PRIVACY POLICY

Section 1: General information

Your personal data (e.g. form of address, name, address, email address, telephone number) are processed by us strictly in accordance with the provisions of German data protection law and the data protection laws of the European Union (EU). In addition to the information on the purpose of data processing, legal basis, recipients and period of storage, the following provisions also provide information on your rights and on the controllers processing your data. This data privacy statement applies only to our website. If you follow the links on our web pages to access other sites, then please find out from those sites their policy regarding processing of your data.

Section 2: Contact

(1) Purpose of data processing

We process the personal data you provide us by email, contact form, etc. to respond to your queries and resolve your issues. You are not obligated to provide us with your personal data. However, we will also not be in a position to reply by email if no email address is given to us

(2) Legal basis

Art. 6(1)(a) of the GDPR forms the legal basis for the processing of your data if you grant us your express consent.
If we process your data for taking steps prior to entering into a contract, then Art. 6(1)(b) of the GDPR serves as the legal basis.
In all other cases (particularly in the case of establishing contact using a contact form) the legal basis is Art. 6(1)(f) of the GDPR.

(3) Legitimate interest

Our legitimate interest in processing the data is to communicate with you in the fastest possible way and to address your queries cost-effectively. In case you share your postal address with us, we reserve the right to use it for direct postal marketing. You may protect your interest in data protection by sharing minimal information (e.g. by using pseudonyms).

(4) Recipient categories

Hosting service providers, delivery service providers in the case of direct marketing

(5) Period of storage

Your data are deleted when it can be inferred from the circumstances that your query or the relevant facts have been conclusively clarified.
However, if a contract is concluded, the data required according to commercial and tax laws will be stored by us for the legally stipulated time period – usually ten years (cf. Section 257 of the German commercial code, Section 147 of the German tax code).

(6) Right to withdraw and to object

In any case where consent has been granted by you, you may withdraw that consent at any time with effect to the future.

You also have the right to object at any point in time to the data processing based on Art. 6(1)(f) of the GDPR and which is not for direct marketing purposes on grounds relevant to your specific situation. In the case of direct marketing, you may object to the data processing at any time without stating reasons.

Section 3: Comments

(1) Purpose of data processing

You have the option of writing a comment. In that case, your data (e.g. name/pseudonym, email address, website) are processed only for the purpose of publishing your comment.

(2) Legal basis

The legal basis for this processing is Art. 6 (1)(f) of the GDPR.

(3) Legitimate interest

The legitimate interest pursued by us is the public exchange of user opinions on specific topics and products. Publishing the comments helps to achieve transparency and allows shaping of public opinion. Your interest in protecting your data is preserved as you can publish your comment using a pseudonym.

(4) Period of storage

There is no provision for a specific period of storage. You may request to have your comment erased at any time.

(5) RIGHT TO OBJECT

You have the right to object at any point in time to the data processing based on Art. 6(1)(f) of the GDPR and which is not for direct marketing purposes on grounds relevant to your specific situation. In the case of direct marketing, you may object to the data processing at any time without stating reasons.

Section 4: Information on cookies

(1) Purpose of data processing

In addition to the aforementioned data, different types of cookies are used and stored on your computer whenever you use our website. Cookies are small text files that are stored on your web browser or mobile devices when you visit a website. By collecting cookies, we are able to gather different kinds of information. We use the following types of cookies:

Cookies may be necessary for the proper functioning of our website. By setting cookies we can determine that we have had visitors to our website.
We can also provide you with more user-friendly services that would be impossible to provide without the use of cookies..
With the help of cookies, information and services on our website can be optimised to meet the specific requirements of the user. As mentioned earlier, cookies allow us to recognise you on our website. The purpose of this recognition is to make it simpler for you to use our website.
Cookies may, however, also be used for analysing website use. These analyses determine, for instance, how many users visited the website and where the website could be improved. These analyses, however, do not make a connection between you and the statistics created on the basis of the data collected. If cookies are being used by us for the purpose of website analytics, you are informed.

(2) Cookie Consent using Cookiebot CMP

(3) Legal basis

Art. 6(1)(a) of the GDPR forms the legal basis if you have granted us your consent. In all other cases, Art. 6 (1)(1)(f) of the GDPR serves as the legal basis as it constitutes a legitimate interest on our part.

(4) Legitimate interest

The proper functionality of our website constitutes a legitimate interest on our part. User data collected by means of technically necessary cookies is not used to create user profiles, preserving your interest in data protection. Other types of cookies help us to continually improve our website and to make our website as convenient to use as possible.

(5) Period of storage

We use the data gathered by means of cookies until such time as they are necessary for the specific purpose mentioned above.

(6) Right to withdraw and to object

In the case that consent has been granted by you, you may withdraw it at any time with effect to the future, provided the consent is not regarding the use of necessary cookies.

You also have the right to object at any point in time to the data processing based on Art. 6(1)(f) of the GDPR and which is not for direct marketing purposes on grounds relevant to your specific situation. In the case of direct marketing, you may object to the processing of your data at any time without stating reasons.

You also have the option of using opt-outs to withdraw your consent or to object to the processing of data. You may also decide to delete cookies from your computer at any time. By adjusting the appropriate settings in your browser, you can specify whether the transfer of cookies from your computer to us should be enabled or restricted, or whether the cookies should be deleted completely. If you disable all cookies for our website, then it is likely that you may no longer be able to make full use of all features of the website. The following list provides more information on disabling or managing the cookie settings in your browser:

Safari: help.apple.com/safari/mac/8.0/
iPhone, iPad or iPod: support.apple.com/en-gb/HT201265
Google Chrome: support.google.com/chrome/answer/95647
Internet Explorer/Edge: windows.microsoft.com/en-GB/windows-vista/Block-or-allow-cookies
Firefox: support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences
Firefox Android: support.mozilla.org/en-US/kb/enable-or-disable-cookies-firefox-android

§ 5 Web analysis with Google Analytics

(1) Purpose of data processing

This website uses Google Analytics, a web analytics service provided by Google, Inc. (‘Google’). Google Analytics uses ‘cookies’, which are text files that are stored on your computer and allow your use of the website to be analysed. The information generated by the cookie regarding your use of this website is usually transferred to Google’s server in the United States and stored there. In the event that IP-anonymisation is activated on this website, your IP address will first be truncated by Google within member states of the European Union or in any other contracting states of the Agreement on the European Economic Area. This website uses Google Analytics with the extension “anonymizeIP()”, which means that the IP addresses are processed only in abbreviated form in order to exclude direct identification of persons. Only in exceptional cases is your full IP address transmitted to a Google server in the US and truncated there. Google uses this information on behalf of the operator of this website to evaluate your use of the website, to compile reports about website activity and to provide the website operator with further services associated with website usage and Internet usage. Google will not link the IP address transmitted by your browser as part of Google Analytics with any other data held by Google. In exceptional cases, where personal data are transmitted to the US, Google adheres to the requirements of the EU-US Privacy Shield,
www.privacyshield.gov/EU-US-Framework

(2) Legal basis

Art. 6(1) Cl. 1 of (a) of the GDPR forms the legal justification for using Google Analytics, provided a consent has been obtained from you beforehand. Otherwise, the legal basis for this processing is Art. 6(1)(f) of the GDPR.

(3) Legitimate interest

The legitimate interest pursued by us in this case is to be able to analyse the use of our website and to appropriately adjust user behaviour to increase the efficiency of our website. We use Google Analytics so that we can analyse the usage of our website and regularly improve it. We will process your data only as long as it is necessary for the purpose of data collection (in this case, for creating statistics and evaluating them).

(4) Period of storage

The data sent by us as well as the data linked with cookies, user identifications (user ID) or web IDs are deleted automatically after 14 months. The data that have reached the end of their retention period are deleted automatically once a month. More information on terms of service and privacy are available at: https://www.google.de/analytics/terms/gb.html

(5) Right to object and to withdraw

You may withdraw your consent at any time with effect for the future.

You can prevent cookies from being stored on your computer by adjusting the appropriate settings on your browser; however, please note that if you do this, you may not be able to make full use of all features of this website. Furthermore, you can prevent Google from collecting the data generated by cookies related to the usage of the website (including your IP address) and from processing such data by downloading and installing the browser plugin which is available at: Opt-out
Details of Google’s privacy policy are available here:
https://policies.google.com/privacy

Section 6: AddThis

(1) Purpose of data processing

We have integrated tools offered by the AddThis company on this website. AddThis is operated by AddThis, Inc. 1595 Spring Hill Road, Suite 300, Vienna, VA 22182, USA (‘AddThis’). AddThis is what is a social bookmarking service provider. The service allows easy bookmarking of websites using buttons. A list of bookmarking and sharing services is displayed when you roll the mouse cursor over the AddThis component or click on them.

By calling up a page on this website, the browser on the IT system of the data subject is automatically prompted by the respective AddThis component to download data from www.addthis.com. As part of this technical process, AddThis learns more about your visit and the specific pages of this website used by you. Furthermore, AddThis receives information on your IP address, browser type, browser language, websites accessed before our website, and date and time of visiting our website. AddThis uses these data to create anonymous user profiles. The data and information transferred to AddThis in this way helps the AddThis company, as well as its associate and partner companies, to attract visitors to our website in a targeted manner through personalised and interest-based advertising. AddThis displays personalised and interest-based advertising on the basis of a cookie set by the company. This cookie analyses individual surfing behaviour of the computer used by the data subject. The cookie stores the visits made to websites from that computer.

(2) Legal basis

The legal basis for the processing is Art. 6(1) Cl. 1 of (a) of the GDPR, provided you have granted consent beforehand. In all other cases, the legal basis for the processing is Art. 6(1) Cl. 1 of (f) of the GDPR.

(3) Legitimate interest

The legitimate interest pursued by us in this case is to be able to analyse the use of our website and to appropriately adjust user behaviour to increase the efficiency of our website.

(4) Period of storage

We store your data as long as it is required for the purpose of collection.

(5) Right to object and to withdraw

You may withdraw your consent at any time with effect to the future.

You may at any time prevent the setting of cookies by our website, as described above, by adjusting the appropriate settings in your browser and thus permanently object to the setting of cookies. Such a setting in your Internet browser would also prevent AddThis from storing a cookie on your device. Moreover, cookies already set by AddThis can also be deleted at any time in your browser settings or by using other software programmes. You also have the option to permanently object to the processing of personal data by AddThis. For this, you must click on the opt-out button on the link http://www.addthis.com/privacy/opt-out, which sets an opt-out cookie. The opt-out cookie with the objection is placed on your device. If after setting the objection the cookies on your device are deleted, you will have to click the link again and set a new opt-out cookie. By setting the opt-out cookie, however, there is a possibility that you may not be able to make full use of all features of this website.

The privacy policy of AddThis is available at http://www.addthis.com/privacy/privacy-policy.

Section 7: Jetpack for WordPress

(1) Intended purpose

We have integrated Jetpack into our website. The Jetpack plugins for WordPress are operated by Automattic Inc., 132 Hawthorne Street, San Francisco, CA 94107, USA (‘Automattic’). Automattic uses the tracking technology of Quantcast Inc., 201 Third Street, San Francisco, CA 94103, USA.

Jetpack is a WordPress plugin that offers additional features to the operator of a website built using WordPress. Among other things, Jetpack provides the website operator with an overview of website traffic. Furthermore, the traffic can be increased by displaying related posts and publications or through the option of sharing web page content. In addition, Jetpack also comes with integrated safety features to ensure that a website using Jetpack is secured against brute force attacks. Jetpack also optimises and speeds up the loading of images integrated into the website. Jetpack sets a cookie on your browser or device. Every time a page of this website where a Jetpack component is integrated is called up, the browser on your device is automatically prompted by the respective Jetpack component to transmit data to Automattic for analytics purposes. As part of this technical process, Automattic obtains knowledge of the data that are subsequently used to create an overview of the website traffic. The data obtained in this manner helps to analyse your behaviour and are evaluated with the objective of optimising the website.

(2) Legal basis

The legal basis for the processing is Art. 6(1) Cl. 1 of (a) of the GDPR, provided you have granted us consent beforehand. In all other cases, Art. 6 Para 1 Cl. 1 of (f) of the GDPR serves as the legal basis as it constitutes a legitimate interest on our part to perform website analytics.

(3) Legitimate interest

The legitimate interest pursued by us in this case is the analysis of the use of our website and the appropriate adjustments for user behaviour for increasing the efficiency of our website.

(4) Period of storage

We store your data as long as it is required for the purpose of collection.

(5) Right to object and to withdraw

You may withdraw your consent at any time with effect to the future.

You also have the right to object at any point to data processing based on Art. 6(1)(f) of the GDPR that is not for direct marketing purposes on grounds relevant to your specific situation. In the case of direct marketing, you may object to the processing of your data at any time without stating reasons.

You may at any time prevent the setting of cookies by our website, as described above, by adjusting the appropriate settings in your browser and thus permanently object to the setting of cookies. Such a setting in your browser would also prevent Automattic/Quantcast from storing a cookie on your device. Moreover, cookies already set by Automattic can be deleted at any time in the browser or with the use of other software programmes. Apart from that, you also have the option to object to and prevent the collection of data generated by the Jetpack cookie regarding the usage of this website as well as the processing of this data by Automattic/Quantcast. For this, you must click on the opt-out button on the link https://www.quantcast.com/opt-out/, which sets an opt-out cookie. The opt-out cookie with the objection is placed on your device. If, after objecting, the cookies on the data subject’s system are deleted, the data subject will have to click the link again and set a new opt-out cookie. By setting the opt-out cookie, however, there is a possibility that the data subject may not be able to make full use of all features of the website.
The privacy policy of Automattic is available at https://automattic.com/privacy/. The privacy policy of Quantcast is available at https://www.quantcast.com/privacy/.

Section 8: Newsletter

(1) Purpose of data processing

If you subscribe to our newsletter, your email address will be used for marketing purposes, which means that we will send you information about products from our range in the newsletter. For statistical purposes, we may analyse the links clicked in the newsletter. We cannot, however, identify the particular person clicking the link. The following consent is expressly granted by you separately or during the ordering process if applicable: newsletter subscription

(2) Legal basis

The legal basis for this processing is Art. 6(1)(a) of the GDPR.

(3) Recipient categories

Newsletter delivery service providers (if any).

(4) Period of storage

Your email address is stored for the purpose of newsletter delivery only for the duration of the subscription or until the time we stop the newsletter.

(5) Right to withdraw

You may withdraw your consent at any time with effect for the future. If you do not wish to receive the newsletter, you may cancel your subscription using one of the following channels: by email, by telephone, by fax.

Section 9: Social media links

We do not use any social media plugins on our website. The symbols used on our website only provide links to our page on the respective social media site. If you click on these links, the relevant terms of service and privacy policies of the social media provider will apply.

Section 10: Rights of the data subject

If your personal data are processed, then you are referred to as the data subject as defined in the GDPR and are entitled to the following rights:

1. Right of access

You have the right to obtain a confirmation from us as to whether personal data concerning you is being processed by us.

If so, you may ask us to provide the following information:

the purpose for which the personal data are being processed;
the categories of the personal data being processed;
the recipients or the categories of recipients to whom the personal data concerning you has been disclosed or will be disclosed;
the period for which the personal data will be stored or, if that is not possible, the criteria used to determine that period;
the existence of a right to rectify or erase the personal data concerning you, a right to restrict the processing by us or a right to object to such processing;
the existence of a right to lodge a complaint with a supervisory authority;
all available information on the source of the data where the personal data are not collected from the data subject;
the existence of an automated decision-making process, including profiling, pursuant to Art. 22(1) and (4) of the GDPR and – at least in these cases – conclusive information on the logic involved, as well as the importance and intended consequences of such processing for the data subject.

You are entitled to request information as to whether the personal data concerning you are transmitted to a third country or an international organisation. In this regard, you may also ask to be informed about the appropriate safeguards according to Art. 46 of the GDPR relating to such transmission.

2. Right to rectification

If the processed personal data concerning you are incorrect or incomplete, you have the right to demand rectification and/or completion of the data from us. We are obligated to make the necessary rectification without delay.

3. Right to restriction of processing

You are entitled to ask for a restriction of processing of your personal data under the following conditions:

if you are contesting the accuracy of your personal data for a period of time that enables us to verify the accuracy of the personal data;
if the processing is unlawful and you refuse the erasure of personal data and instead request restriction of its use;
if we no longer need the personal data for processing, yet you require said data for the establishment, exercising or defence of legal claims; or
if you have objected to the processing of your data pursuant to Art. 21(1) of the GDPR and it is not yet certain whether the legitimate reasons pursued by us override your reasons.

If the processing of your personal data has been restricted, then these data – except for their storage – may be processed only with your consent or for the establishment, exercising or defence of legal claims, to protect the rights of another natural person or legal entity, or for reasons of important public interest of the European Union or of a member state.

If the restriction on processing is affected in accordance with the above-mentioned conditions, we will inform you before this restriction is removed.

4. Right to erasure

a) Obligation to erase

You may ask us to erase your personal data without undue delay; we are obligated to erase such data without undue delay, provided one of the following reasons applies:

your personal data are no longer required for the purposes for which they were collected or otherwise processed;
you withdraw your consent, which formed the basis for the processing according to Art. 6(1)(a) or Art. 9(2)(a) of the GDPR, and there is no other legal basis for the processing;
you object to the processing in accordance with Art. 21(1) of the GDPR and there are no overriding legitimate reasons for the processing, or you object to the processing according to Art. 21(2) of the GDPR;
your personal data have been processed unlawfully;
the personal data must be erased for compliance with a statutory obligation as per the EU law or the law of the member states to which we are subject;
your personal data were collected in connection with the offered services of the information society pursuant to Art. 8(1) of the GDPR.

b) Information to third parties

If we have made your personal data public and are obliged to erase it in accordance with Art. 17(1) of the GDPR, then, taking account of the available technology and the cost of implementation, we will take reasonable steps including technical measures, to inform the controllers processing the personal data that you as data subject have requested the erasure by such controllers of all links to, copies, or replications of this personal data.

c) Exceptions

The right to erasure does not exist if the processing is required

to exercise the right to freedom of expression and information;
to comply with a statutory obligation that requires processing according to the EU laws or the laws of the member states to which we are subject, or to perform a task in the public interest, or as part of exercising official authority vested in us;
for reasons of public interest relating to public health pursuant to Art. 9(2)(h) and (2)(i) as well as Art. 9(3) of the GDPR;
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89(1) of the GDPR, provided the right specified in paragraph a) is likely to render the achievement of the objectives of this processing impossible or will seriously impair it; or
to assert, exercise or defend legal claims.

5. Right to notification

If you have asserted the right to rectification, deletion or restriction of processing vis-à-vis us, then we are obliged to inform all recipients to whom your personal data has been disclosed about this rectification or deletion of data or the restriction on processing unless this proves impossible or involves unreasonable effort.

You are entitled to request information about these recipients from us.

6. Right to data portability

You are entitled to receive your personal data, which you have provided to us, in a structured, commonly used and machine-readable format. You also have the right to forward this data to another controller without any hindrance, provided that

the processing is based on consent in accordance with Art. 6(1)(a) or Art. 9(2)(A) of the GDPR, or on a contract in accordance with Art. 6(1)(b) of the GDPR and
the processing is done using automated processes.

In exercising this right you are further entitled to have your personal data transmitted directly from us to another controller, as long as doing so is technically feasible. This may not negatively affect the rights and freedoms of any other person.

The right to data portability does not apply to the processing of personal data required for performing a task in the public interest or as part of exercising public authority vested in us.

7. Right to object

You are entitled to object at any point in time to the processing of your personal data on the basis of Art. 6(1)(e) or (1)(f) of the GDPR on grounds relating to your particular situation; this also applies to profiling based on these provisions.

In this case, we will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for processing, which override your interests, rights and freedoms, or unless the processing is for the establishment, exercising or defence of legal claims.

If your personal data are being processed for direct marketing, then you have the right to object at any point in time to the processing of personal data concerning you for such marketing purposes; this also applies to profiling, provided it is related to such direct marketing.

If you object to the processing for purposes of direct marketing, your personal data will no longer be processed for such purposes.
Regardless of the Directive 2002/58/EC, you have the option, in the context of the use of information society services, of exercising your right to object through automated procedures using technical specifications.

8. Right to withdraw consent declaration under data protection law

You have the right to withdraw your consent declaration under data protection law at any time. The withdrawal of consent does not affect the legality of the processing on the basis of consent until the time of its withdrawal.

9. Automated decision-making on a case-by-case basis, including profiling

You have the right not to be subjected to a decision exclusively based on automated processing – including profiling – that has a legal effect on you or that severely affects you in a similar way. This does not apply if the decision

is necessary for the conclusion or performance of a contract between you and us;
is permissible based on legal provisions of the EU or member states to which we are subject and these legal provisions contain appropriate measures for safeguarding your rights and freedoms, as well as your legitimate interests; or
is taken with your explicit consent.

However, these decisions may not be based on special categories of personal data as per Art. 9(1) of the GDPR, provided Art. 9(2)(a) or (2)(g) does not apply and appropriate measures have been taken to protect the rights and freedoms as well as your legitimate interests.

In the cases referred to in points (1) and (3), we will take appropriate measures to safeguard the rights and freedoms as well as your legitimate interests.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you are entitled to lodge a complaint with a supervisory authority – in particular in the member state of your residence, your place of work or the place of the alleged violation – if you are of the view that the processing of your personal data is in violation of the GDPR.

The supervisory authority, with whom the complaint has been lodged, shall inform the complainant on the progress and the outcome of the complaint, including the possibility of legal remedy pursuant to Art. 78 of the GDPR.

Controller:
Kolibri Online GmbH
Bernstorffstraße 128
22767 Hamburg
Germany
Telephone: +49 40 5247774-0
info@kolibri.online

Contact details of our data protection officer:
Kolibri Online GmbH
Data protection officer
Bernstorffstraße 128
22767 Hamburg
Germany
datenschutz@kolibri.online

This privacy policy document was prepared by janolaw AG, with a few amendments made by us.