Data Protection

Privacy policy website www.goki.eu

1. Introduction and terms
2. GENERAL

By operating our website with the URL www.goki.eu (hereinafter referred to as "website"), we process personal data. These are treated confidentially by us and processed in accordance with the applicable laws - in particular the German Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). With these data protection provisions, we want to inform you about what personal data we collect from you, for what purposes and on what legal basis we use it and, if applicable, to whom we disclose it. In addition, we will explain to you what rights you have to protect and enforce your data protection.

2. NOTES

Our privacy policy contains technical terms that are in the GDPR and the BDSG. For your better understanding, we would like to explain these terms in simple terms in advance:

• Personal data
  "Personal data" is any information relating to an identified or identifiable person (Art. 4 No. 1 GDPR). Information of an identified person can be, for example, the name or the e-mail address. However, personal data is also data for which the identity is not immediately apparent, but can be determined by combining one's own information or that of others and thus finding out who it is. A person can be identified, for example, by providing your address or bank details, date of birth or user name, IP addresses and/or location data. Relevant here is all information that in any way allows a conclusion to be drawn about a person.
• Processing
  "Processing" is understood by Art. 4 No. 2 GDPR to mean any operation in connection with personal data. This relates in particular to the collection, recording, organization, arrangement, storage, adaptation or alteration, retrieval, consultation, use, disclosure, transmission, dissemination or other form of making available, alignment or combination, restriction, erasure or destruction of personal data.

1. Controller and data protection officer

3. CONTROLLER

Responsible for data processing is:

Company: Gollnest & Kiesel GmbH & Co KG ("we")
Legal representative: Gerhard Gollnest (GmbH Managing Director)
Address: Hauptstraße 13-16, 21514 Güster

Phone: 04158 8822-0

Fax: 04158 8822-55

E-mail: info@goki.eu

4. DATA PROTECTION OFFICER

We have appointed an external data protection officer for our company. You can reach him under:

Name: Reinher Karl

Address: HABEWI GmbH & Co KG, Palmaille 96, 22767 Hamburg

Phone: 040/ 46008966
Fax: 040/ 46008977
E-mail: datenschutz@habewi.de

III.   Processing frame

5. PROCESSING FRAMEWORK: WEBSITE

Within the framework of the website, we process the personal data of you listed in detail below in section IV. We only process data from you that you actively provide on the website (e.g. by filling out forms) or that you automatically provide when using our offer.

Your data will be processed exclusively by us and will not be sold, lent or passed on to third parties. If we use the help of external service providers for the processing of your personal data, this is done within the framework of a so-called order processing, in which we as the client are authorized to issue instructions to our contractors. For the operation of our website, we use external service providers for hosting, as well as for maintenance, further development and care. We host our website with the external provider DSISoft GmbH, Münzstraße 9, 38100 Braunschweig in the data centre location Germany. If further external service providers are used for individual processing operations listed in section IV, they will be named there.

As a matter of principle, we do not transfer data to third countries and do not plan to do so. We will provide information about exceptions to this principle in the processing operations described below. Any data transfer to third countries will then take place on the basis of the so-called EU standard contractual clauses.

1. The processing in detail
2. PROVISION OF THE WEBSITE AND SERVER LOGFILES
   • Description of processing
     Every time you visit the website, we automatically collect information that your browser transmits to our server. This is the following data:

• IP address
• browser software used, as well as its version and language
• Operating system
• the website from which visitors came to the website (so-called referrer)
• the subpages accessed on the website
• the date and time the website was accessed
• Internet Service Provider

These are also stored in the so-called log files of our system. The temporary storage of your IP address by the system is necessary in order to be able to deliver our website to the end device of a user. For this purpose, the user's IP address must remain stored for the duration of the session.  Your IP address is also recorded in the log files for security reasons to defend against attacks on our website (especially so-called DDos attacks) and for fraud prevention.

• Purpose
  The processing is carried out to enable the website to be called up and to ensure its stability and security. Furthermore, the processing serves the statistical evaluation and improvement of our online offer.
• Legal basis
  The processing is necessary to protect the overriding legitimate interests of the controller (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in the purpose stated in section 2.
• Storage period
  The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended. The log files are erased after 16 days.

7. REGISTRATION AND PROFILE
   • Description of the processing
     Some functions and offers of our website are only available to you as a registered user. By registering, you enter into a free user agreement with us. By registering, you will receive your own user account on our website. Registration takes place by filling in the registration form on our website and sending it to us electronically. To register, you must provide your address, e-mail address, first name, last name and telephone number. By clicking the "Register" button, you submit the form to us. You will then receive an automatic welcome e-mail. This contains a link to confirm your e-mail address. Only after successful verification of your e-mail address by clicking on the confirmation link will your account be activated on our website.

As a registered user, you can shop faster and more conveniently on our website by storing your billing and delivery addresses in your user profile. This means that you do not have to re-enter your personal data for subsequent (further) purchases.

• Purpose
  The processing is carried out in order to provide you with the functions of our website for registered users.
• Legal basis
  The processing is necessary for the conclusion and fulfilment of the free user contract (Art. 6 para. 1 lit. b GDPR). Without providing your personal data in the course of registration, we cannot provide our contractually owed services.
• Storage period
  The data will be automatically erased by us upon termination of your user contract. You can terminate the user contract yourself by selecting the "Delete profile" function in the settings of your user account. Alternatively, you can also inform us by post to Gollnest & Kiesel GmbH & Co KG, Hauptstraße 13-16, 21514 Güster by fax to 04158 8822-55 or by e-mail to info@goki.eu that you no longer wish to be a registered user of our website. We will then delete your user account immediately. Furthermore, as a logged-in user, you can edit and remove your own details and information at any time.

8. SHOPPING
   • Description of processing
     You can shop on our website as a guest or as a registered user (see point ). As part of your ordering process, we process personal data from you. The mandatory fields marked with an asterisk "*" in our online shop must be filled in by you. Otherwise it is not possible for us to conclude a purchase contract with you and to send you the desired goods. All other information is voluntary. When shopping on our website, you can also select one of the payment methods offered (PayPal, credit card and purchase on account) to settle the purchase price. When you complete your order, the data required for payment will be passed on to the respective payment service provider. If you shop on our website as a registered user, you can store your billing and delivery addresses, as well as your preferred method of payment for a faster and more convenient order with us in your user profile. In addition, your first name, last name and address will be transmitted to our shipping service provider to
     process the delivery.
     If you have given your consent by ticking the appropriate box during the ordering process, we will also pass on your e-mail address to DHL so that you are informed directly by the shipping service provider by e-mail about the current status of your order shipment.
   • Purpose
     The processing is carried out for the conclusion and processing of sales contracts and to inform you by e-mail about the current status of your order shipment.
   • Legal basis
     The processing is necessary for the conclusion and fulfilment of the purchase contracts (Art. 6 para. 1 lit. b GDPR). This also concerns the transfer of the data required for the processing of payments to the respective payment service providers and the transfer of the data required for the delivery of goods shipments to the shipping service provider DHL. The transmission of your e-mail address for sending DHL shipment notification e-mail is based on consent (Art. 6 para. 1 lit. b GDPR).
   • Storage period and withdrawl of consent
     We are obliged by commercial and tax law to store your address, payment and order data for a period of ten years. However, we restrict processing after two years. I.e. your data will then only be stored separately for compliance with the statutory retention periods and will be erased immediately after their expiry.
     The consent to the transmission of your e-mail address for the sending of shipment notification e-mails is voluntary and can be revoked by you at any time by simple declaration (by e-mail to: info@goki.eu, by post to: Gollnest & Kiesel GmbH & Co KG, Hauptstraße 13-16, 21514 Güster or by fax to 04158 8822-55) with effect for the future.
   • Recipients
     In order to process your payment, personal data will be passed on to one of the external payment service providers listed below and selected by you as part of your purchase:

• PayPal (also in case of credit card payment - PayPal Plus): PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal reserves the right to transmit personal data to credit agencies under certain circumstances for the purpose of checking identity and creditworthiness.
• For further information on data protection, including information on the credit agencies used, please refer to PayPal's privacy policy: https://www.paypal.com/de/ webapps/mpp/ua/privacy-fullYou
  can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for the contractual processing of payments. In order to carry out and process the delivery of goods, we will pass on the data required for this purpose to the shipping service provider. In the case of a corresponding consent, we will also transmit your e-mail address for the sending of shipment notification e-mail.

9. COOKIES AND OTHER TRACKING TECHNOLOGIES
   • Description of processing
     Our website uses cookies. Cookies are small text files that are stored on the user's terminal device when visiting a website. Cookies contain information that enables the recognition of a terminal device and possibly certain functions of a website. We distinguish between our own cookies and external, so-called third-party cookies. So-called "session cookies" and "persistent cookies" are used on our site. "Session cookies" are automatically erased when you end your Internet session and close the browser. Persistent cookies remain stored on your terminal device for a longer period of time. In addition to cookies, we also use other tracking technologies, such as pixels. If cookies are technically necessary for the operation of our site, your consent is not required for this. All other cookies and tracking technologies that are not technically necessary are only set after you have actively consented to the use of cookies/tracking technologies via our Consent Tool. We use our own Consent Tool to obtain and document consent. The Consent Tool itself stores your selection in a cookie on your terminal device. This means that you do not need to make a decision about cookies again on a subsequent visit to our website.
     You can find out which cookies are used on our website for which purpose, how long they are stored on your end device and which consents you may have already declared in the settings of the Consent Tool.
   • Purpose
     We use cookies to make our website more user friendly and to provide the functions described in clause 1.
     
     
   • Legal basis
     The processing is necessary with regard to technically required cookies, as well as the use of the Consent Tool to protect the overriding legitimate interests of the controller (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in the purpose named
     in clause 2. For processing with regard to all other - i.e. non-technically necessary cookies/tracking technologies - the legal basis is consent (Art. 6 (1) lit. a GDPR). Such consent is voluntary.
   • Storage period, withdrawl of consent
     Cookies are automatically erased at the end of a session or at the end of the specified storage period. Since cookies are stored on your terminal device, you as a user have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transfer of cookies. Cookies that have already been stored can be erased. This can also be done automatically. If cookies are deactivated, erased or restricted for our website, it may be that individual functions of our website cannot be used or can only be used to a limited extent. You can revoke any consent you may have given for the use of cookies at any time in the settings of the Consent Tool Privacy Policy with effect for the future.
   • Recipients
     When third-party cookies are used, data may be transmitted to the corresponding providers of these third-party services. Under certain circumstances, data may also be transferred to third countries outside the European Union or the European Economic Area. We provide information about the recipients of data, as well as a third country transmission in the settings of the Consent Tool or in the corresponding passage for the third-party service in this privacy policy.
10. CONTACT FORM AND CONTACT BY E-MAIL
    • Description of the processing
      For contacting us, we have provided a contact form on our website. In this form, you are asked to enter your e-mail address, your name and a message to us. When you click the "Send" button, the data is transmitted to us
      using SSL encryption (see section ). The contact form can only be transmitted if you accept our privacy policy by clicking the corresponding checkbox. You can also contact us via the e-mail addresses provided on the website. To contact us, you can write to us using the e-mail address provided on the website. In this case, the personal data transmitted with the e-mail will be processed by us.
    • Purpose
      By providing a contact form on our website, we want to offer you a convenient way to contact us. The data transmitted with and in the contact form or your e-mail will be used exclusively for the purpose of processing and responding to your request.
    • Legal basis
      The processing is necessary to protect the overriding legitimate interests of the controller (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in the purpose named in section 2. If the e-mail contact is aimed at the conclusion or fulfilment of a contract, the data processing is carried out for the fulfilment of the contract (Art. 6 para. 1 lit. b GDPR).
    • Storage period
      The data is erased by us as soon as it is no longer required to achieve the purpose for which it was collected. This is usually the case when the respective communication with you has ended. The communication is terminated when it can be inferred from the circumstances that your concern has been conclusively clarified. If legal retention periods prevent deletion, the data will be erased immediately after expiry of the legal retention period.
11. SOCIAL NETWORKS
    • Description of processing
      Our website does not use so-called social media plugins. The Facebook, Pinterest, Instagram and YouTube logos displayed on our website are merely linked to the corresponding profiles of our company on the social networks. A data transfer to the social networks does not take place with the integration of the logos. If you click on one of the logos, you will only be redirected to the external website of the respective social network.

However, our profiles within the social networks represent data processing. If you are logged in to the respective social network when you visit such a profile, this information will be assigned to your user account there. If you interact with our profile, e.g. comment, "share", "like" or "retweet" a post, this information will also be stored in your user account. As a rule, your interactions with our profile can also be viewed by us.

On the social network Facebook, we have the possibility to obtain statistical data about the use of our Facebook page via the so-called "Insights" function. These statistics are provided by Facebook. The "Insights" function cannot be disabled. We cannot decide to turn this feature on or off. It is available to all Facebook Fan Page operators, whether or not you use Facebook's Insights feature. Facebook Insights provides us with the following data for a selectable period of time regarding fans, subscribers, people reached, and people interacting: Total page views, "likes" including origin, page activity, post interactions, reach, post reach (broken down into organic, viral, and paid interactions), comments, shared content, replies, and demographics, i.e. country of origin, gender, and age. Insights statistics do not allow us to identify subscribers and fans of our site and view their profiles.

On the social networks Facebook and Instagram, we have the possibility to obtain statistical data about the use of our Facebook page or our Instagram profile via the so-called "Insights" function. These statistics are provided by Facebook and Instagram respectively. The "Insights" feature is not opt-out. We cannot decide to turn this feature on or off. It is available to all Facebook Fan Page operators and all Instagram business account operators, whether or not you use the Insights feature.

We are provided with the following data via Facebook Insights for a selectable period of time in anonymized form with regard to fans, subscribers, people reached and people interacting: Total page views, "likes" including origin, page activity, post interactions, reach, post reach (broken down into organic, viral, and paid interactions), comments, shared content, replies, and demographic analysis, i.e. country of origin, gender, and age. Insights statistics do not allow us to identify subscribers and fans of our site and view their profiles.

Furthermore, we receive anonymous data about the development and reach of our Instagram profile, as well as the posts, stories and videos we post there. We also receive statistical information about the place of origin, gender and age of the subscribers of our Instagram profile in the Instagram insights.

The social networks with which you communicate store your data using pseudonyms as usage profiles and use them for advertising purposes and market research. For example, you may be shown advertisements within the social network and on other third-party websites that match your presumed interests. For this purpose, cookies are usually used, which the social network stores on your terminal device. You have the right to object to the creation of these user profiles, for the exercise of which you must contact the social networks directly.

• Purpose
  We maintain profiles on the aforementioned social networks for the purpose of public relations and corporate communication with customers and interested parties. We use the "Insights" function of Facebook and Instagram to evaluate the reach of our posts on the social network and to make them more appealing to our visitors in the future.
• Legal basis
  The legal basis for data processing in the context of our profiles on social networks is the protection of our overriding legitimate interests (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in the purpose named
  in section 2. If you are asked for consent by the respective operator of a social network, the legal basis is Article 6 (1) a GDPR. The data processing with regard to our Facebook page and our Instagram page is also carried out on the basis of joint responsibility in accordance with Art. 26 GDPR.
• Recipients and transfer to third countries
  The respective social networks are operated by the companies listed below. Further information on data protection with regard to our profile on the social networks can be found in the linked data protection provisions.

• Facebook: Facebook Inc, 1601 S California Ave, Palo Alto, California 94304, USA. Privacy policy: http://www.facebook.com/policy.php; http://www.facebook.com/help/186325668085084, http://www.facebook.com/about/privacy/your-info-on-other#applications as well as http://www.facebook.com/about/privacy/your-info#everyoneinfo.
• Instagram: Instagram LLC, 1601 Willow Rd, Menlo Park, California 94025, USA; Privacy Policy: https://help.instagram.com/155833707900388/.
• YouTube: YouTube LLC, 901 Cherry Avenue, San Bruno, CA 94066, USA. YouTube is represented by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy of Youtube/Google: https://www.google.com/policies/privacy/partners/?hl=de.
• Pinterest: Pinterest Europe Ltd, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. Data may be passed on to the group company Pinterest Inc., 808 Brannan Street, San Francisco, California, 94103, USA and processed there. Further information on data protection at Pinterest can be found at https://policy.pinterest.com/de/privacy-policy.

The social networks also process your personal data in the USA.

12. GOOGLE ANALYTICS
    • Description of processing
      Our website uses "Google Analytics", a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as "Google"). Google Analytics uses cookies (see clause ), which enable an analysis of your use of our offer. We use Google Analytics in the offered version "Universal Analytics", which allows this analysis across devices by assigning the data to a pseudonymous user ID. The information generated by the cookies is usually transferred to a Google server in the USA and stored there. However, we use Google Analytics exclusively with IP anonymization. This means that your IP address is shortened beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. The statistics generated by Google Analytics record in particular how many users visit our website, from which country or location the access takes place, which sub-pages are called up and via which links or search terms visitors reach our website. The user conditions of Google Analytics can be found at http://www.google.com/analytics/terms/de.html. An overview of data protection at Google Analytics is available at http://www.google.com/intl/de/analytics/learn/privacy.html. Google's privacy policy can be viewed at http://www.google.de/intl/de/policies/privacy.
    • Purpose
      The processing takes place in order to be able to evaluate the use of our website. The information thus obtained is used to improve our online presence and to design it in line with requirements.
    • Legal basis
      The processing is based on consent pursuant to Art. 6 (1) lit. a GDPR. Your consent is obtained by us via the Consent Tool (see section 1). Such consent is voluntary.
    • Storage period and right of objection, withdrawl of consent
      We have explained the storage period, as well as your control and setting options for cookies in section 4. You can revoke the consent you have given with regard to Google Analytics at any time in the settings of the consent tool with effect for the future. Alternatively, you can object to data processing by Google Analytics at any time by downloading and installing the browser add-on offered by Google at https://tools.google.com/dlpage/gaoptout?hl=de. The analysis data processed and stored with Google Analytics will be automatically erased by us after 14 months.
    • Recipients and transfer to third countries
      Google Analytics is involved in joint responsibility for data processing on our behalf according to the German data protection supervisory authorities (Data Protection Conference). Against this background, we have also concluded the "Google Measurement Controller-Controller Data Protection Terms" with Google. Google also processes your personal data in the USA.
13. FONT SUBSTITUTION

When displaying our website, the standard fonts of your terminal device are replaced by fonts. This is done to make the text on our customer portal easier to read and more aesthetically pleasing to display. When replacing fonts, we have opted for a privacy-friendly solution. We do not integrate external services such as Google Fonts or Adobe Fonts. Instead, we store the fonts to be replaced locally on our server. This has the advantage that when you call up our site, no request is made by your browser to external font replacement services and thus no data, in particular not your IP address in connection with the address of our website, is transmitted to third parties.

14. YOUTUBE
    • Description of processing
      Our website uses services from "YouTube" a video platform operated by YouTube LLC, 901 Cherry Avenue, San Bruno, CA 94066, USA (hereinafter referred to as "YouTube"). YouTube is represented by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. We use YouTube by embedding individual videos from the platform on our website as a so-called iFrame, so that they can be played directly on our website. The videos are embedded in the "extended data protection mode" offered on YouTube, i.e. no personal data will be transmitted from you to Google as long as you do not play the videos. Only when you play a video will data be transmitted to Google, over which we have no control. If you play a video embedded on a subpage of our website, Google will be informed which subpage you have visited and which video you have watched. Your IP address may also be transmitted to Google. If you are logged in as a YouTube or Google user, Google will associate this information with your user account. Google stores your data as user profiles and uses them for advertising purposes, for market research and/or for the needs-based design of Google websites. You have the right to object to the creation of these user profiles. To exercise this right, you must contact Google directly. Further information on data protection at Google can be found at google.com/intl/de-DE/policies/privacy/.
    • Purpose
      The processing is done in order to show you videos in our website.
    • Legal basis
      The processing is necessary to protect the overriding legitimate interests of the controller (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in the purpose named
      in section 2.
    • Recipients and transmission to third countries
      Through the integration of YouTube, personal data may be transmitted to YouTube LLC or Google. Google also processes your personal data in the USA.
15. VIMEO
    • Description of processing
      Our website uses services from "Vimeo" a video platform operated by Vimeo LCC, 555 West 18th Street, New York, New York 10011, USA (hereinafter referred to as "Vimeo"). We use Vimeo by embedding individual videos from the platform on our website as a so-called iFrame, so that they can be played directly on our website. When you visit a subpage of our website on which a video is embedded, a connection is established to the Vimeo servers and the video is displayed within the website. This transmits to Vimeo which website you have visited. Your IP address may also be transmitted to Vimeo. If you play an embedded video, this information is also passed on to Vimeo. If you are logged in as a Vimeo user, Vimeo assigns this data to your user account. For more information about Vimeo's privacy policy, please visit http://vimeo.com/privacy.
    • Purpose
      The processing is done in order to show you videos on our website.
    • Legal basis
      The processing is necessary to protect the overriding legitimate interests of the controller (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in the purpose stated in the paragraph.
    • Recipients and transmission to third countries
      Through the integration of Vimeo videos, personal data may be transmitted to Vimeo LCC. Vimeo also processes data in the USA.
16. FACEBOOK PIXEL
    • Description of processing
      Our website uses the remarketing service "Facebook Pixel", which is operated by Facebook Inc, 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook"). Via the "Facebook Pixel", it is possible for us to display advertisements on the social network that are targeted to those Facebook users who have shown interest in our offer - e.g. through a previous visit to our website. With the help of the "Facebook Pixel", we can also track and evaluate the effectiveness and reach of our advertising on Facebook by recording whether Facebook users interact with our ads on the social network by clicking on the ads are redirected to our website. Therefore, when you visit our website, a connection to the Facebook servers is established and the "Facebook pixel" is embedded in our website. In addition, Facebook may store a cookie on your terminal device (see point above). If you are logged in to Facebook or log in to Facebook later, your visit to our website will be assigned to your user account. The data collected about you by means of the "Facebook Pixel" are anonymous for us. They do not provide us with any conclusions about your person. However, a connection to your user profile is possible on the part of Facebook. The data processing by Facebook is carried out in accordance with the company's data policy, which can be accessed at https://www.facebook.com/policy.php.
    • Purpose
      The processing takes place in order to carry out targeted online advertising for our own offers and to be able to evaluate its effectiveness and reach.
    • Legal basis
      The processing is based on consent pursuant to Art. 6 (1) lit. a GDPR. Your consent is obtained by us via the Consent Tool "Other" (see clause 1). Such consent is voluntary.
    • Storage period and right of objection, withdrawl of consent
      We have explained the storage period, as well as your control and setting options for cookies/tracking pixels in section You can revoke the consent you have given with regard to the data collection by the "Facebook Pixel" and the use of your data for the display of Facebook ads at any time in the settings of the Consent Tool with effect for the future. https://www.facebook.com/settings?tab=ads You can also object to the data collection by the "Facebook Pixel" and the use of your data for the display of Facebook ads to Facebook at any time. Thus, you can decide within the settings of your Facebook account at https://www.facebook.com/settings?tab=ads which types of advertisements are displayed to you on Facebook. This setting is applied across all devices.
    • Recipients and transmission to third countries
      Via integration of the "Facebook Pixel", personal data may be transmitted to Facebook. Facebook also processes your personal data in the USA.

1. Security measures

17. Security measures

 To protect your personal data from unauthorized access, we have provided our website with an SSL or TLS certificate. SSL stands for "Secure Sockets Layer" and TLS for "Transport Layer Security" and encrypts the communication of data between a website and the end device of the user. You can recognize the active SSL or TLS encryption by a small lock logo that is displayed on the far left in the address bar of the browser.

1. Rights of the data subject
2. Data subject rights

With regard to the data processing by our company described above, you are entitled to the following data subject rights:

• Right of access by the data subject (Art. 15 GDPR)
  You have the right to request confirmation from us as to whether we are processing personal data relating to you. If this is the case, you have a right to information about this personal data and to the information listed in detail in Art. 15 GDPR under the conditions specified in Art. 15 GDPR.
• Right to rectification (Art. 16 GDPR)
  You have the right to demand that we immediately correct any inaccurate personal data concerning you and, if necessary, complete any incomplete personal data.
• Right to easure (Art. 17 GDPR)
  You have the right to demand that we delete personal data relating to you without delay, provided that one of the reasons listed in detail in Art. 17 GDPR applies, e.g. if your data is no longer required for the purposes pursued by us.
• Right to restriction of processing (Art. 18 GDPR)
  You have the right to request that we restrict processing if one of the conditions listed in Art. 18 GDPR applies, e.g. if you dispute the accuracy of your personal data, data processing will be restricted for the period of time that allows us to verify the accuracy of your data.
• Right to data portability (Art. 20 GDPR)
  You have the right, under the conditions set out in Art. 20 GDPR, to request that the data concerning you be handed over in a structured, common and machine-readable format.
• Withdrawal of consent (Art. 7 (3) GDPR)
  You have the right to withdraw your consent at any time in the case of processing based on consent. The withdrawl applies from the time it is asserted. In other words, it has effect for the future. The processing therefore does not become unlawful retroactively as a result of the withdrawal of consent.
• Complaint (Art. 77 GDPR)
  If you consider that the processing of personal data concerning you infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. You can assert this right with a supervisory authority in the EU member state of your place of residence, your place of work or the place of the alleged infringement.
• Automated decision-making/profiling (Art. 22 GDPR)
  Decisions which have legal effects concerning you or which significantly affect you must not be based solely on automated processing of personal data, including profiling. We inform you that we do not use automated decision-making including profiling with regard to your personal data.
• Right of objection (Art. 21 GDPR)
  If we process personal data from you on the basis of Art. 6 (1) (f) GDPR (to protect overriding legitimate interests), you have the right to object to this under the conditions listed in Art. 21 GDPR. However, this only applies insofar as there are reasons arising from your particular situation. After an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms. We also do not have to stop processing if it serves the assertion, exercise or defence of legal claims. In any case - also regardless of a specific situation - you have the right to object at any time to the processing of your personal data for direct marketing.

October 2021