General notices and mandatory information
1. Controller’s name and contact details
Paul-Utzschneider Strasse 1
06895 Zahna-Elster, Germany Telephone: +49 (0)34924 707 0 Fax: +49 (0)34924 707 39 Email: firstname.lastname@example.org
Controller: Ivette Winkler
Data protection officer contact details:
The enterprise’s data protection officer can be contacted at
Mr Frank Vierling
Franz-Mehring Str. 3
06846 Dessau-Rosslau, Germany
2. Scope and purpose of the processing of personal data
2.1 Accessing the website
When the website http://www.zahna-fliesen.de is accessed, data are automatically sent to the website’s server by the visitor’s internet browser and is temporarily stored in a protocol file (logfile). The data listed below are stored without any input being required from the visitor, until they are automatically deleted:
- the IP address of the visitor’s end device
- the date and time when the visitor accessed the site
- the name and URL of the page accessed by the visitor
- the website that linked the visitor to the enterprise’s website (the referrer URL)
- the browser and operating system of the visitor’s end device, together with the name of the visitor’s access provider.
The processing of this personal data is justified in accordance with the first sentence of Article 6(1)(f) GDPR. The enterprise has a legitimate interest in processing this data for the purposes of:
- quickly establishing a connection to the enterprise’s website
- facilitating user-friendly usage of the website
- determining and guaranteeing the security and stability of the systems, and
- simplifying and improving the administration of the website.
The processing expressly does not have the aim of gaining insight into the identity of the visitor to the website.
3. Disclosure of data
Personal data will be transmitted to third parties if
- the data subject has given express consent to this, in accordance with the first sentence of Article 6(1)(a) GDPR
- in accordance with the first sentence of Article 6(1)(f) GDPR, the disclosure is necessary for the establishment, exercise or defence of legal claims and there are no grounds to assume that the data subject has an overriding legitimate interest in their data not being disclosed
- it is necessary to transmit the data in order to comply with a legal obligation in accordance with the first sentence of Article 6(1)(c) GDPR, and/or
- this is necessary in order to fulfil a contractual relationship with the data subject in accordance with the first sentence of Article 6(1)(b) GDPR.
In any other case, personal data will not be transmitted to third parties.
Depending on the browser’s basic settings, cookies are generally accepted. Browser settings can be configured so that either cookies are rejected on the devices used, or a special notification is given in each case before a new cookie is created. It should however be noted that deactivating cookies may mean that some website functions cannot be used optimally.
Cookies are used in order to make the enterprise’s web content more convenient to use. For example, session cookies can be used to track whether the visitor has previously visited individual pages of the website. These session cookies are automatically deleted upon leaving the website.
Temporary cookies are used in order to make the website more user-friendly. They are temporarily saved on the user’s device. When re-visiting the website, they are then used to automatically detect whether the visitor has accessed the page previously, as well as what inputs and settings were entered, in order to avoid having to enter them again.
Cookies are also used to analyse instances of access to the website for statistical purposes and in order to improve the content. When re-visiting the website, these cookies make it possible to automatically detect that the visitor has previously visited the website. The cookies are automatically deleted after a predetermined time.
The data processed using cookies are justified for the purposes of protecting the legitimate interests of the enterprise in accordance with the first sentence of Article 6(1)(f) GDPR.
5. Use of Google Maps
Google Maps (API) of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”) is used on the enterprise’s website. Google Maps is a web service that displays interactive (geographical) maps in order to visually depict geographical information. As soon as the subpage into which Google Maps is integrated is accessed, information about the use of the enterprise’s website (e.g. the user’s IP address) is transferred to Google’s servers in the USA and stored there.
Google will also send this information to third parties if necessary, where this is required by law or in so far as third parties process this data on behalf of Google. Google will never link the user’s IP address to other data being stored by Google. Nevertheless, it would be technically feasible for Google to use the user data arising from the use of Google Maps to identify the user, to create personality profiles of users or for other purposes of processing or use. The enterprise does not and cannot have any influence over such processing.
You can view Google’s Terms of Service here: https://policies.google.com/terms?hl=en .
You can view the Additional Terms of Service for Google Maps here: https://www.google.com/intl/en_US/help/terms_maps/.
6. Your rights as a data subject
In so far as your personal data are processed in the context of visiting our website, you have the following rights under the GDPR as a “data subject”:
You have the right to obtain confirmation as to whether we are processing personal data pertaining to you (“right of access”). No right of access shall exist in so far as the provision of the requested information would breach the duty of confidentiality according to Section 83 of the German Tax Consultancy Act (StBerG, Steuerberatungsgesetz) or in so far as the information must be kept confidential due to some overriding legitimate interest of a third party. In derogation of this, a duty to provide access may exist if, especially with regard to imminent damages, your interests are overriding with respect to the interests of maintaining confidentiality. The right of access is further excluded if the data have only been stored because they could not be deleted due to legal or statutory retention periods, or exclusively serve the purposes of data backup or data protection monitoring, in so far as the provision of access would require a disproportionate effort and processing for other purposes is excluded through suitable technical or organisational measures. In so far as the right of access is not excluded in your particular case and your personal data are being processed by us, you have the right to obtain the following information from us:
- the purposes of the processing
- the categories of personal data pertaining to you being processed
- the recipients or categories of recipients to whom your personal data will be disclosed, in particular recipients in third countries
- where possible, the envisaged period for which your personal data will be stored, or, if not possible, the criteria used to determine that period
- the existence of the right to request rectification, erasure or restriction of processing of personal data pertaining to you or to object to such processing
- the existence of the right to lodge a complaint with a data protection supervisory authority
- where the personal data are not collected from you as the data subject, any available information as to their source
- if applicable, the existence of automated decision-making, including profiling, and meaningful information about the logic involved as well as the significance and the envisaged consequences of such automated decision-making
- if applicable, where personal data are transferred to a third country and in so far as no EU Commission decision regarding the adequacy of the level of protection in the sense of Article 45(3) GDPR has been issued, information as to what appropriate safeguards pursuant to Article 46(2) GDPR have been provided in order to protect the personal data.
6.2 Rectification and completion
If you determine that we are in possession of inaccurate personal data pertaining to you, you have the right to require that we rectify that inaccurate data without undue delay. In the case of incomplete personal data pertaining to you, you have the right to have this data completed.
You have the right to erasure (“right to be forgotten”), in so far as the processing is not necessary for the exercise of the right of freedom of expression, the right to information or the fulfilment of a legal obligation or the performance of a task that is in the public interest and one of the following grounds applies:
- The personal data are no longer necessary for the purposes for which they were processed.
- Your consent to the processing formed the sole justification for the processing and you have withdrawn that consent.
- You have objected to the processing of personal data pertaining to you that we have made public.
- You have objected to the processing of personal data that we have not made public and there are no overriding legitimate grounds for the processing.
- Your personal data have been unlawfully processed.
- The personal data must be erased in order to comply with a legal obligation to which we are subject.
No right to erasure shall exist if, in the case of lawful and non-automated data processing, the erasure would be impossible or possible only with disproportionate effort due to the particular way in which the data are stored, and your interest in having them erased is only slight. In such a case, instead of erasure, a restriction of processing will be applied.
6.4 Restriction of processing
You have the right to request that we restrict the processing of your personal data, when one of the following grounds applies:
- You dispute the accuracy of the personal data. In this case, you may request that the processing be restricted for a period sufficient to allow us to verify the accuracy of the data.
- The processing is unlawful and, instead of erasure, you request that the use of your personal data be restricted.
- We no longer need your personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims.
- You have objected pursuant to Article 21(1) GDPR. Restriction of processing can be requested for as long as it is still not determined whether our legitimate grounds override your grounds.
Restriction of processing means that the personal data may only be processed with your consent or for the establishment, exercise or defence of legal claims, or in order to protect the rights of another natural or legal person or for reasons of significant public interest. Before we lift a restriction of processing, we are obliged to inform you of this.
6.5 Data portability
You have the right to data portability, in so far as the processing is based on your consent (first sentence of Article 6(1)(a) or Article 9(2)(a) GDPR) or on a contract to which you are party and the processing is carried out by automated means. The right to data portability includes in this case the following rights, in so far as the rights and freedoms of other persons are not adversely affected hereby: You have the right to receive from us the personal data that you have provided to us in a structured, commonly used and machine-readable format. You have the right to transfer those data to another controller without any hindrance on our part. You have the right to request that we transfer your personal data directly to another controller, in so far as this is technically feasible.
In so far as the processing is based on the first sentence of Article 6(1)(e) GDPR (performance of a task in the public interest or in the exercise of official authority) or on the first sentence of Article 6(1)(f) GDPR (legitimate interest of the controller or a third party), you have the right to object, on grounds relating to your particular situation, to processing of personal data concerning you at any time. This includes profiling based on the first sentence of Article 6(1)(e) or (f) GDPR. Once you have objected, we shall no longer process your personal data unless we are able to demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.
You have the right to object at any time to the processing of your personal data for direct marketing purposes. This includes profiling, to the extent that it is related to such direct marketing. Once you have exercised this right to object, we will no longer use the personal data in question for the purposes of direct marketing.
6.7 Withdrawal of consent
You have the right to withdraw your consent at any time, with future effect. You can withdraw your consent informally by telephone, fax or email or by contacting us at our postal address. The withdrawal of consent shall not affect the lawfulness of the data processing that took place based on that consent prior to its withdrawal. After you have withdrawn your consent, the processing that was based solely on your consent will be stopped.
If you believe that the processing of your personal data is unlawful, you have the right to lodge a complaint with a data protection supervisory authority that is competent either with regard to your residence or place of work or with regard to the location of the suspected violation.