Data protection

A. Privacy policy

I. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is

Palazzina Sports & Building GmbH

Marc-Chagall-Str. 2

D-40477 Düsseldorf

Germany

Phone: +49 211-94250820

Fax: +49 211-94250829

E-Mail: post@palazzina-sports.com

Internet: www.palazzina-building.com

II. Name and address of the data protection officer

The data protection officer of the controller is

Dip.-Ing. Bernhard van Hal

Wackerbeckstr. 30

45329 Essen

Germany

E-mail: data-protection@mediadefine.com

III Preamble

In the event of discrepancies between the German and English versions of the privacy policy, the German version shall prevail.

IV. General Information on Data Processing

1. Scope of Processing Personal Data

We generally process the personal data of our users only to the extent necessary to provide a functional website as well as our content and services. The processing of personal data typically occurs only with the user’s consent. An exception applies in cases where obtaining prior consent is not possible for practical reasons, and the processing of the data is permitted by legal regulations.

2. Legal Basis for the Processing of Personal Data

Where we obtain the consent of the data subject for processing operations involving personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.

For the processing of personal data required for the performance of a contract to which the data subject is a party, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary to take steps prior to entering into a contract.

If processing personal data is necessary to fulfill a legal obligation to which our company is subject, Article 6(1)(c) GDPR serves as the legal basis.

In the event that vital interests of the data subject or another natural person require the processing of personal data, Article 6(1)(d) GDPR serves as the legal basis.

If processing is necessary for the purposes of the legitimate interests pursued by our company or a third party, and if such interests are not overridden by the interests or fundamental rights and freedoms of the data subject, Article 6(1)(f) GDPR serves as the legal basis.

3. Data Deletion and Storage Duration

Personal data of the data subject will be deleted or blocked as soon as the purpose for storing it no longer applies. Storage may also take place if provided for by European or national legislation in EU regulations, laws, or other legal provisions to which the controller is subject. Data will also be blocked or deleted when a storage period prescribed by these regulations expires, unless continued storage is required for the conclusion or performance of a contract.

V. Provision of the Website and Creation of Log Files

1. Description and Scope of Data Processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device.

The following data are collected:

a. Information about the browser type and version used
b. The user's operating system
c. The user's Internet service provider
d. The user's IP address
e. Date and time of access
f. Websites from which the user’s system reaches our website
g. Websites that are accessed by the user’s system via our website

The log files contain IP addresses or other data that may allow attribution to a specific user. This may be the case, for example, if the website from which the user accesses our site or the one they navigate to contains personal data.

These data are also stored in our system’s log files. Storage of this data together with other personal data of the user does not take place.

2. Legal Basis for Data Processing

The legal basis for the temporary storage of data and log files is Article 6(1)(f) GDPR.

3. Purpose of Data Processing

The temporary storage of the IP address by the system is necessary to deliver the website to the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session.

The data is stored in log files to ensure the functionality of the website. Additionally, the data helps us optimize the website and ensure the security of our IT systems. No evaluation of the data for marketing purposes takes place in this context.

These purposes also constitute our legitimate interest in data processing under Article 6(1)(f) GDPR.

4. Duration of Storage

The data is deleted as soon as it is no longer needed to achieve the purpose for which it was collected. When data is collected to provide the website, this is the case once the session ends.

If the data is stored in log files, this happens no later than 365 days after collection. Longer storage is possible. In such cases, users’ IP addresses are deleted or anonymized so that they can no longer be associated with the accessing client.

5. Right to Object and Removal Option

The collection of data for the provision of the website and the storage of data in log files is essential for the operation of the website. Consequently, the user has no right to object.

VI. Use of Cookies

a) Description and Scope of Data Processing

Our website uses cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the user's computer system. When a user visits a website, a cookie may be stored on the user’s operating system. This cookie contains a unique string that allows the browser to be recognized when the website is revisited.

If technically necessary cookies are used:

We use cookies to make our website more user-friendly. Some elements of our website require that the calling browser be recognized even after a page change.

The following data may be stored and transmitted in cookies:

• Language settings
• Login information
• Possibly items in a shopping cart

If technically unnecessary cookies are also used:

We also use cookies on our website to analyze users’ browsing behavior.

This allows the following data to be transmitted:

• Entered search terms
• Frequency of page views
• Use of website features

The data collected in this way is pseudonymized using technical measures. Therefore, the data can no longer be associated with the accessing user. This data is not stored together with other personal user data.

When visiting our website, users are informed by a banner about the use of cookies for analytical purposes and referred to this privacy policy. In this context, they are also informed how the use of cookies can be disabled in their browser settings.

Users are asked to provide consent for the use of cookies for analytical purposes when visiting our website. This includes a reference to this privacy policy.

b) Legal Basis for Data Processing

If only technically necessary cookies are used, or if both necessary and non-essential cookies are used without prior consent:

The legal basis for the processing of personal data using cookies is Article 6(1)(f) GDPR.

The legal basis for processing personal data with technically necessary cookies is Article 6(1)(f) GDPR.

The legal basis for processing personal data using cookies for analytical purposes—if the user has given consent—is Article 6(1)(a) GDPR.

c) Purpose of Data Processing

The use of technically necessary cookies is intended to make websites easier to use. Some functions of our website cannot be offered without cookies. For these functions, it is necessary that the browser is recognized even after a page change.

We use cookies for the following purposes, for example:

• Login processes
• Displaying personalized website content
• Shopping cart functions
• Retention of language settings
• Remembering search terms

User data collected by technically necessary cookies is not used to create user profiles.

These purposes also constitute our legitimate interest in processing personal data in accordance with Article 6(1)(f) GDPR.

e) Storage Duration, Right to Object and Removal Option

Cookies are stored on the user’s device and transmitted to our website. As a user, you therefore have full control over the use of cookies. You can disable or restrict the transmission of cookies by changing your browser settings. Already stored cookies can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, some website features may no longer function properly.

Flash cookies cannot be managed via browser settings, but you can prevent their use by changing settings in the Flash Player.

VII. Newsletter

1. Description and Scope of Data Processing

The newsletter is sent based on the user’s registration on the website:

On our website, users have the option to subscribe to a free newsletter. When registering for the newsletter, the data entered into the input form is transmitted to us. The following data may be collected if provided:

• Company
• Department
• First name
• Last name
• Street
• Postal code
• City
• Country
• Phone
• Fax
• Email
• Website
• Comments

Additionally, the following data is collected during registration:

• IP address of the accessing computer
• Date and time of registration

As part of the registration process, your consent to data processing is obtained and reference is made to this privacy policy.

If you purchase goods or services on our website and provide your email address, we may subsequently use it to send a newsletter. In such a case, the newsletter will only contain direct advertising for similar goods or services of our own.

There is no disclosure of the data to third parties in connection with the data processing for newsletter distribution. The data is used exclusively for sending the newsletter.

2. Legal Basis for Data Processing

The legal bases for sending newsletters are:

• User registration on the website: If the user has given consent, the legal basis for processing data after newsletter registration is Article 6(1)(a) GDPR.
• Sale of goods or services: If the newsletter is sent as a result of selling goods or services, the legal basis is § 7(3) of the German Unfair Competition Act (UWG).

3. Purpose of Data Processing

The user's email address is collected to send the newsletter.

The collection of other personal data during the registration process serves to prevent misuse of the services or the email address used.

4. Duration of Storage

The data is deleted as soon as it is no longer needed to achieve the purpose for which it was collected. The user's email address is therefore stored as long as the newsletter subscription is active.

Other personal data collected during the registration process is typically deleted after 90 days.

5. Right to Object and Removal Option

The user can cancel the newsletter subscription at any time. For this purpose, a corresponding link is provided in each newsletter or in the newsletter registration section on the website.

VIII. Registration

1. Description and Scope of Data Processing

Our website offers users the option to register by providing personal data. This data is entered into an input form, transmitted to us, and stored. The data is not passed on to third parties. The following data is collected during the registration process:

• Username
• Password
• Company
• Department
• First name
• Last name
• Street
• Postal code
• City
• Country
• Phone
• Fax
• Email
• Website
• Comments

At the time of registration, the following data is also stored:

• The IP address of the user
• Date and time of registration

As part of the registration process, the user's consent to the processing of this data is obtained.

VIII. Registration (continued)

2. Legal Basis for Data Processing

The legal basis for processing the data is Article 6(1)(a) GDPR, provided the user has given consent.

If registration serves the purpose of fulfilling a contract to which the user is a party or for carrying out pre-contractual measures, the additional legal basis for data processing is Article 6(1)(b) GDPR.

3. Purpose of Data Processing

User registration can be used for entering into a contract with the user. It is required either to fulfill a contract with the user or to take pre-contractual steps.

The content and services provided as part of the contract include:

• Use of an extranet

4. Duration of Storage

Data is deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. For data collected during the registration process for the purpose of fulfilling a contract or performing pre-contractual measures, this is the case when the data is no longer required to execute the contract. Even after the contract has ended, it may be necessary to store personal data in order to comply with contractual or legal obligations.

5. Right to Object and Erasure Options

Users can cancel their registration at any time. They can also request changes to the stored data at any time.

Users may revoke their consent to data processing and request the deletion of their personal data, provided there are no legal obligations that require the retention of data. Revocations and deletion requests can be submitted by email to: data-protection@mediadefine.com or by post to:

Palazzina Sports & Building GmbH
Marc-Chagall-Str. 2
D-40477 Düsseldorf
Germany

If the data is required for fulfilling a contract or performing pre-contractual measures, early deletion is only possible if no contractual or legal obligations prevent it.

IX. Forms and Email Contact

1. Description and Scope of Data Processing

Our website includes several forms (e.g., contact forms) that can be used for electronic communication. If a user uses one of these forms, the data entered into the form is transmitted to and stored by us.

Available forms include:

• Short and long contact forms
• Quote request
• Job application
• Feedback
• Callback request

The following data may be collected through these forms:

• Username
• Password
• Company
• Department
• First name
• Last name
• Street
• Postal code
• City
• Country
• Phone
• Fax
• Email
• Website
• How you found us
• Message content

In addition, the following data is collected when the form is submitted:

• IP address of the user
• Date and time of submission

Consent is obtained before processing, and users are referred to this privacy policy.

Alternatively, contact can be made via the email address provided. In this case, the personal data transmitted with the email is stored.

There is no transfer of this data to third parties. It is used exclusively to process the communication.

2. Legal Basis for Data Processing

If the user has given consent, the legal basis is Article 6(1)(a) GDPR.

For data transmitted via email, the legal basis is Article 6(1)(f) GDPR. If the email contact is aimed at concluding a contract, the legal basis is also Article 6(1)(b) GDPR.

3. Purpose of Data Processing

The processing of personal data from the input forms serves solely to handle the contact request. In the case of email contact, this also constitutes the necessary legitimate interest.

Additional data collected during form submission is used to prevent misuse and ensure the security of our IT systems.

Form purposes include:

• Short/long contact forms – for inquiries from prospective customers
• Quote request – for inquiries from prospective and existing customers
• Job application – for applicant submissions including documents
• Feedback – customer service feedback
• Callback – customer service callback requests

4. Duration of Storage

Data is deleted once it is no longer necessary for its intended purpose. For contact form or email interactions, this is the case when the conversation with the user has clearly ended.

Data collected during form submission is deleted after 90 days unless there are overriding legitimate interests in accordance with Article 6(1)(f) GDPR, a contract is in place, or consent has been given. For job applications, a legitimate interest may include the duty to preserve evidence under the General Equal Treatment Act (AGG).

5. Right to Object and Erasure Options

Users can revoke their consent to the processing of their personal data at any time. If contact was initiated via email, users may object to the storage of their data at any time. In such cases, the conversation cannot be continued.

Users may object to processing or request deletion by emailing: dataprotection@domain.de or by writing to:

Palazzina Sports & Building GmbH
Marc-Chagall-Str. 2
D-40477 Düsseldorf
Germany

All personal data stored in the course of contact will then be deleted, unless legal regulations require continued storage.

XI. Services Used – Google Analytics (with anonymization function)

Scope and Purpose of Processing Personal Data

We have integrated components of Google Analytics (with anonymization function) into our website. Google Analytics is a web analytics service used to collect and analyze data about website usage. It helps analyze the behavior of website visitors. We use Google Analytics to optimize our website and possibly for optimizing online advertising.

Google Analytics is operated by:

Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043-1351, USA

Further information on data protection and the terms of use can be found at:

• https://www.google.de/intl/de/policies/privacy/
• http://www.google.com/analytics/terms/de.html
• https://www.google.com/intl/de_de/analytics/

The “_gat._anonymize Ip” feature ensures that IP addresses from EU or EEA countries are shortened and anonymized before processing.

Google Analytics uses cookies that allow analysis of website usage. Each page visit can trigger data transfers to Google Analytics, including:

• IP address
• Clicks
• Time of access
• Location
• Visit frequency
• Referring URLs
• Exit URLs
• Time spent on the page

This data is stored in the U.S. and may be shared with third parties.

The information is processed to protect our legitimate interest in optimizing the marketing of our services per Article 6(1)(f) GDPR.

Legal Basis for Processing

The legal basis for processing personal data is Article 6(1)(f) GDPR.

Duration of Storage

The data is deleted as soon as it is no longer needed for recordkeeping purposes.

Right to Object and Removal Option

Users can prevent the use of cookies through browser settings or opt-out plugins (e.g., Google Analytics opt-out browser add-on).

Cookies

Cookies are stored on the user's device and transmitted from there to our website. Therefore, you as a user have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Already stored cookies can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may no longer be possible to use all functions of the website to their full extent.

If the transmission of personal data is not desired, it can be prevented by logging out of the account, thereby blocking the transfer of personal data.

Users of our website can prevent the setting of cookies through their browser settings and thereby permanently object to the setting of cookies. This prevents Google from setting a cookie. An already set cookie can be deleted at any time via the internet browser or another software application.

Affected individuals also have the option to object to the collection of their data by Google Analytics and prevent it. To do this, users must download and install a browser add-on available at the following link: https://tools.google.com/dlpage/gaoptout. This is considered an objection. This browser add-on tells Google Analytics not to transmit any data about website visits.

Service: Google AdWords

Scope and Purpose of Personal Data Processing

We have integrated Google AdWords on our website. Google AdWords is a service that allows internet advertising – i.e., placing ads in Google search results and across the Google Display Network – to be shown to users. Through Google AdWords, our company can create user-related advertising based on entered search terms and display this to visitors, linking them to our website. This is the purpose of using Google AdWords. The display of ads is determined by a Google-defined algorithm.

Operator and Data Controller
• Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

For more information on privacy policy, data processing, and the service, visit:
• https://www.google.de/intl/de/policies/privacy/

Google AdWords sets cookies and can use them to recognize visitors when they access another site that is part of the Google Ad Network. Visited pages may automatically send data to Google. If a user arrives at our site via a Google ad, a conversion cookie (usually valid for 30 days) may be stored. This cookie allows us to see which pages were visited and whether the user completed actions like submitting a contact form, signing up for a newsletter, or completing a purchase. Google receives personal data such as the user’s IP address, clicks, access time, location, visit frequency, referring links, follow-up links, dwell time, and ad performance (KPIs). These data are stored in the USA and may be shared with third parties.

The data is used to protect our legitimate interests in optimal marketing of our offering, in accordance with Art. 6(1)(f) GDPR.

Legal Basis
Art. 6(1)(f) GDPR.

Storage Duration
Data is deleted as soon as it is no longer needed for our recording purposes.

Objection and Removal Option
As previously described under Cookies.

Service: Google Remarketing

Scope and Purpose of Personal Data Processing

We have integrated Google Remarketing on our website. This service enables ads to be shown to people who have previously visited the site. It allows for user-related, interest-based advertising across the Google Ad Network.

Operator and Data Controller
• Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

For more information, visit:
• https://www.google.de/intl/de/policies/privacy/

Google Remarketing sets cookies and can recognize visitors when they access other network-affiliated websites. Pages visited by the user can automatically send data to Google. Through this process, Google obtains personal data such as the user's IP address and browsing behavior. These data are stored in the USA and may be shared with third parties.

The data is used to protect our legitimate interests in optimal marketing of our offering, in accordance with Art. 6(1)(f) GDPR.

Legal Basis
Art. 6(1)(f) GDPR.

Storage Duration
Data is deleted as soon as it is no longer needed for our recording purposes.

Objection and Removal Option
As previously described under Cookies.

Service: Google AdSense

Scope and Purpose of Personal Data Processing

We have integrated Google AdSense on our website. AdSense allows third-party ads to be displayed based on relevant content on our pages, using a Google algorithm. The purpose is to show ads on our website.

Operator and Data Controller
• Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

For more information, visit:
• https://www.google.de/intl/de/policies/privacy/
• https://www.google.de/intl/de/adsense/start/

Google AdSense uses cookies and count pixels to recognize visitors. Data such as IP address, clicks, access time and location, visit frequency, referring and follow-up links, and time spent on the website are automatically transmitted to Google. These are stored and processed in the USA and may be shared with third parties. Google uses these data for behavioral analysis and commission accounting.

The data is used to protect our legitimate interests in optimal marketing of our offering, in accordance with Art. 6(1)(f) GDPR.

Legal Basis
Art. 6(1)(f) GDPR.

Storage Duration
Data is deleted as soon as it is no longer needed for our recording purposes.

Objection and Removal Option
As previously described under Cookies.

Service: Google+

Scope and Purpose of Personal Data Processing

We have integrated the Google+ service on our website. Google+ is a social network for profile creation, communication, linking, and content sharing between users and with the public. We use it to share our content.

Operator and Data Controller
• Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

For more information, visit:
• https://www.google.de/intl/de/policies/privacy/
• https://developers.google.com/+/
• https://developers.google.com/+/web/buttons-policy

When Google+ buttons are embedded on our site, it can automatically download IT content. Pages accessed by users may automatically send data to Google. Google receives personal data (IP address, surfing behavior) and stores it in the USA. If the user is logged into Google+, all actions are linked to their profile, including page views, clicks, visit time and location, and time spent. These may be shared with the user’s network and contacts.

The data is used to protect our legitimate interests in optimal marketing of our offering, in accordance with Art. 6(1)(f) GDPR.

Legal Basis
Art. 6(1)(f) GDPR.

Storage Duration
Data is deleted as soon as it is no longer needed for our recording purposes.

Objection and Removal Option
As previously described under Cookies and by logging out of the account.

Service: Google reCAPTCHA

Scope of processing of personal data & purpose of processing

We use the Google service reCAPTCHA to determine whether a human or a computer is making a specific input in our contact or newsletter form.
The operator and controller responsible for the processing of personal data is:

• Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

Further information about the privacy policy, data processing, and the service can be found at:

• https://www.google.com/policies/privacy/

Google checks the following data to determine if you are a human or a computer: IP address of the device used, the website you visit with us where the captcha is embedded, the date and duration of the visit, identification data of the browser and operating system type used, Google account if you are logged in to Google, mouse movements on the reCAPTCHA areas, and tasks where you must identify images. We have a legitimate interest in this data processing to ensure the security of our website and protect us against automated inputs (attacks).

Legal basis for the processing of personal data
The legal basis for the described data processing is Art. 6(1)(f) of the General Data Protection Regulation (GDPR).

Duration of storage
The data will be deleted as soon as it is no longer needed for our recording purposes.

Right to object and deletion options
Cookies are stored on the user’s device and transmitted by the user to our site. Therefore, you as a user have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Cookies already stored can be deleted at any time, including automatically. If cookies are disabled for our website, some functions may no longer be fully usable.

Service: Facebook

Scope of processing of personal data & purpose of processing

We have integrated the Facebook service on our website. Facebook is a social network. The social network serves the purpose of profiling, communication, linking, creation, and sharing of content between users and between users and the public. The purpose of embedding it on our site is to spread our content via the service.

When you visit a page with a Facebook plugin, a cookie is set, and your web browser on the device automatically downloads the selected Facebook plugin from Facebook. The following Facebook plugins can be used: https://developers.facebook.com/docs/plugins/?locale=de_DE. Facebook receives technical information about which subpage of our website was visited by the user. If the user is logged into Facebook at the same time, Facebook recognizes with every visit of this website which page the user visited and during the entire stay on the website. The data are stored by the Facebook plugin and assigned to the respective Facebook account of the user. Clicks on buttons integrated on our page like “Like” or “Share” or posted comments are saved by Facebook as personal data and assigned to the user account.

The following data may be stored and transmitted to Facebook after logging into the account:

• Visit of the corresponding website
• Time of the website visit

The operator and controller for the processing of personal data is:

• For people living in the USA & Canada: Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA.
• For people living outside the USA or Canada: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Further information about the privacy policy, data processing, and the service can be found at:

• https://de-de.facebook.com/about/privacy/

The information is also published on the social network and shown to your contacts there. This serves to safeguard our overriding legitimate interests in optimal marketing of our offer pursuant to Art. 6(1)(f) GDPR.

Legal basis for the processing of personal data
The legal basis for the processing of personal data of users is Art. 6(1)(f) GDPR.

Duration of storage
The data will be deleted as soon as it is no longer needed for our recording purposes.

Right to object and deletion options
Cookies are stored on the user’s device and transmitted to our site by the user. Therefore, you have full control over the use of cookies. You can disable or restrict cookies in your browser settings. Stored cookies can be deleted anytime. Disabling cookies for our website might reduce full functionality.

If you do not want your personal data to be transmitted, logging out of your Facebook account prevents transmission.

Service: Twitter

Scope of processing of personal data & purpose of processing

We have integrated the Twitter service on our website. Twitter is a social network and blogging service. It serves for profiling, communication, linking, creating, and sharing content between users and with the public. Tweets—short messages—can be created and sent. Tweets are shown to followers, Twitter users, and the public. The purpose of embedding Twitter on our site is to spread our content via the service.

The operator and controller responsible for processing personal data is:

• Twitter, Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA.

Further information about privacy policy, data processing, and the service can be found at:

• https://twitter.com/privacy?lang=de
• https://about.twitter.com/de/resources/buttons

Twitter can automatically download information technology content if buttons and plugins are integrated on our website. The individual pages visited by the user can automatically transmit data to Twitter. This allows Twitter to receive personal data like the IP address and browsing behavior. These data are stored in the USA and can be shared with third parties. If the user is logged into Twitter, Twitter recognizes the user on every activity. Personal data such as IP address, clicks, access time, location, visit frequency, referral links, follow links, and time spent on the website are transmitted. Twitter can assign, store, and process all activities by the logged-in user on our site.

Information is also published on Twitter and shown to your contacts to protect our legitimate interests in optimal marketing according to Art. 6(1)(f) GDPR.

Legal basis for the processing of personal data
The legal basis is Art. 6(1)(f) GDPR.

Duration of storage
Data are deleted as soon as no longer needed for recording purposes.

Right to object and deletion options
Cookies are stored on the user’s device and transmitted to our site. You control cookie use via your browser settings and can delete stored cookies anytime. Disabling cookies may reduce website functionality.

You can prevent data transmission by logging out of your Twitter account.

Use of Twitter social plugins
Our website uses social plugins ("plugins") from social networks. When you visit a page with such a plugin, your browser connects directly to Twitter servers. Content is delivered by Twitter and integrated into the page. This informs the provider that your browser visited the page. This happens even if you do not have a profile or are not logged in. This information, including your IP address, is transmitted directly to Twitter servers (possibly in the USA) and stored. If you are logged in to Twitter, visits to our site are assigned to your Twitter profile. Interactions with plugins like clicking "Like" or "Share" are also transmitted and stored. Information is published on Twitter and shown to your contacts. This supports our legitimate interests in optimal marketing according to Art. 6(1)(f) GDPR.

If you do not want social networks to directly assign data collected on our site to your profile, log out of the respective service before visiting our site. You can also prevent plugin loading using browser add-ons like the script blocker "NoScript" (http://noscript.net/).

Service: Amazon Affiliate Program

Scope of processing of personal data & purpose of processing

We have integrated the Amazon affiliate program on our website. The goal of these plugins is optimized publication of advertisements on various Amazon group websites. Using Amazon elements, we can earn advertising revenue.

The operator and controller responsible is:

• Amazon EU S.à.r.l, 5 Rue Plaetis, L-2338 Luxembourg, Luxembourg.

Amazon can analyze website usage via cookies set on websites. Pages visited by the user can automatically transmit data to Amazon for online analysis. This technical procedure allows Amazon to receive personal data like IP address, clicks, access time, location, visit frequency, referral and follow-up links, and time spent on the website. This data is used for online advertising and commission accounting. Amazon uses the data to track orders and commission settlement.

Further information about privacy, data processing, and the service can be found at:

• https://www.amazon.de/gp/help/customer/display.html?nodeId=3312401

Legal basis for processing personal data
The legal basis is Art. 6(1)(f) GDPR.

Duration of storage
Data will be deleted once no longer needed for recording purposes.

Right to object and deletion options
Cookies are stored on the user’s device and transmitted to our site. You have full control over cookie use and can disable or delete cookies via your browser. Disabling cookies may reduce website functionality.

Users can prevent cookie setting by adjusting their browser settings. This prevents Amazon from setting cookies. Already set cookies can be deleted anytime via the browser or other applications.

XII. Rights of the data subject

If personal data about you is processed, you are a data subject under the GDPR and have the following rights toward the controller:

1. Right of access
   You can request confirmation from the controller whether personal data concerning you is being processed. If such processing exists, you can request information about:

• The purposes of the processing;
• The categories of personal data processed;
• The recipients or categories of recipients to whom your data has been or will be disclosed;
• The planned duration of storage or criteria for determining storage duration;
• The existence of the right to rectification or erasure, restriction of processing, or objection;
• The existence of a right to complain to a supervisory authority;
• The source of the data if it was not collected from you;
• The existence of automated decision-making including profiling under Art. 22(1) and (4) GDPR, with meaningful information on the logic involved and the significance and consequences of such processing.

You also have the right to ask if your data is transferred to a third country or international organization and to be informed about appropriate safeguards pursuant to Art. 46 GDPR.

1. Right to rectification
   You have the right to request correction or completion of inaccurate or incomplete personal data. The controller must rectify without delay.
2. Right to restriction of processing
   You can request restriction of processing if:

• You contest the accuracy of data for a period allowing verification;
• Processing is unlawful but you oppose erasure and request restriction instead;
• The controller no longer needs the data for processing but you need it for legal claims;
• You have objected to processing under Art. 21(1) GDPR and it is not yet decided whether legitimate reasons override your objections.

Restricted data may only be processed with your consent or for exercising legal claims, protecting rights of others, or important public interests. The controller must inform you before lifting the restriction.