Data protection guidelines in accordance with the GDPR
This Privacy Policy explains the type, scope, and purpose of the processing of personal data (“data”) within the online offering of You Tango, Info Portal for Argentine Tango, and the associated websites, functions, and content, as well as external online presences, such as our social media profiles (hereinafter collectively referred to as the “online offering”). With regard to the terms used, such as “processing” or “controller,” we refer to the definitions in Article 4 of the General Data Protection Regulation (GDPR).
Controller: You Tango / Karin Lüders
Bauerstraße 37, 80796 Munich, Germany
Owner: Karin Lüders
Phone number: +49 170 5850409
Email address: info@you-tango.com
Data Protection Officer:
Email address: info@you-tango.com
Categories of personal data processed:
– Account data (e.g., names, addresses).
– Contact details (e.g., email addresses, telephone numbers).
– Content data (e.g., text entries, photographs, videos).
– Contract data (e.g., subject matter of the contract, term, customer category).
– Payment data (e.g., bank details, payment history).
– Usage data (e.g., visited websites, interest in content, access times).
– Meta-/communication data (e.g., device information, IP addresses)
Processing of special categories of data (Article 9(1) GDPR):
No special categories of data are processed.
Categories of data subjects affected by processing:
Customers, prospects, visitors, and users of the online offering, business partners.
Hereinafter, we refer to the affected persons collectively as “users.”
Purpose of processing:
– To provide the online offering, its content, and shop functions.
– To provide contractual services, service, and customer care.
– To answer contact requests and communicate with users.
– Marketing, advertising, and market research.
– Security measures.
As of: February 2019
1. Terms used
1.1. “Personal data” means all information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier (e.g., a cookie) or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
1.2. “Processing” means any operation or set of operations performed upon personal data, whether by automated means or not. The term is broad and covers virtually any handling of data.
1.3. “Controller” means the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of processing personal data.
2. Relevant legal bases
Pursuant to Article 13 of the GDPR, we inform you of the legal bases for our data processing. Where the legal basis is not stated in this Privacy Policy, the following applies: The legal basis for obtaining consent is Article 6(1)(a) and Article 7 of the GDPR; the legal basis for processing for the performance of our services and for carrying out contractual measures, as well as for responding to inquiries, is Article 6(1)(b) of the GDPR; the legal basis for processing for the fulfilment of our legal obligations is Article 6(1)(c) of the GDPR; and the legal basis for processing to safeguard our legitimate interests is Article 6(1)(f) of the GDPR. In the event that vital interests of the data subject or another natural person require processing of personal data, Article 6(1)(d) of the GDPR shall serve as the legal basis.
3. Changes and updates to this Privacy Policy
We ask you to check the content of our Privacy Policy regularly. We will update the Privacy Policy as soon as the changes to the data processing activities carried out by us make this necessary. We will inform you as soon as, due to the changes, an act on your part is required (e.g., consent) or other individual notification becomes necessary.
4. Security measures
4.1. Pursuant to Article 32 of the GDPR, taking into account the state of the art, implementation costs, the type, scope, circumstances, and purposes of processing, as well as the different likelihood of occurrence and severity of the risk for the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk; these measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical access to the data and to the access relating to it, including input, disclosure, safeguarding availability, and its separation. Furthermore, we have established procedures to ensure that data subject rights can be exercised, that data can be deleted, and that data is protected in the event of a threat. In addition, we take account of the protection of personal data already in the development and/or selection of hardware, software, and procedures, in accordance with the principle of data protection by design and by default, by considering it through privacy-friendly design and privacy-friendly default settings (Article 25 of the GDPR).
4.2. Security measures include, in particular, the encrypted transfer of data between your browser and our server.
5. Disclosure and transfer of data
5.1. Where, as part of our processing, we disclose data to other persons and companies (processors or third parties), transmit it to them, or otherwise provide them with access to the data, this occurs only on the basis of a legal permission (e.g., if the transfer of data to third parties, such as payment service providers, is required for contract performance in accordance with Article 6(1)(b) of the GDPR), if you have consented, if a legal obligation provides for this, or on the basis of our legitimate interests (e.g., when using appointed representatives, hosting providers, tax, business, and legal advisors, customer care, accounting, billing, and similar services that enable us to perform our contractual obligations, administrative tasks, and duties efficiently and effectively).
5.2. Where we commission third parties to process data on the basis of a so-called “data processing agreement,” this is done on the basis of Article 28 of the GDPR.
6. Transfers to third countries
Where we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or where, as part of using third-party services, disclosure and/or transfer of data to third parties takes place, this occurs only if it is necessary to fulfil our (pre-)contractual obligations, on the basis of your consent, because of a legal obligation, or on the basis of our legitimate interests. Subject to statutory or contractual permissions, we process or allow processing of data in a third country only where the special conditions of Articles 44 et seq. of the GDPR are met. This means that processing takes place, for example, on the basis of special guarantees, such as the officially recognised finding of a data protection level equivalent to that of the EU (e.g., for the USA through the “Privacy Shield”), or by complying with officially recognised specific contractual obligations (so-called “standard contractual clauses”).
7. Rights of data subjects
7.1. You have the right to request confirmation as to whether data concerning you is processed and to obtain access to that data, as well as further information and a copy of the data in accordance with Article 15 of the GDPR.
7.2. In accordance with Article 16 of the GDPR, you have the right to require the completion of data concerning you or the rectification of inaccurate data concerning you.
7.3. In accordance with Article 17 of the GDPR, you have the right to request that data concerning you be deleted without undue delay, or alternatively in accordance with Article 18 of the GDPR to request restriction of the processing of data.
7.4. You have the right to request that data concerning you that you have provided to us be received in accordance with Article 20 of the GDPR and to request its transfer to other controllers.
7.5. You also have, pursuant to Article 77 of the GDPR, the right to lodge a complaint with the competent supervisory authority.
8. Right of revocation
You have the right to revoke consents you have given in accordance with Article 7(3) of the GDPR with effect for the future.
9. Right to object
You may object at any time to the future processing of data concerning you in accordance with Article 21 of the GDPR. In particular, the objection may be made against processing for purposes of direct advertising.
10. Cookies and right to object in direct advertising
10.1. “Cookies” are small files that are stored on users’ computers. Different information can be stored within cookies. A cookie primarily serves to store information about a user (and/or the device on which the cookie is stored) during or even after their visit to an online offering. Temporary cookies, or “session cookies” or “transient cookies,” are cookies that are deleted after a user leaves an online offering and closes their browser. For example, in such a cookie, the contents of a shopping cart in an online shop or a login status can be stored. “Permanent” or “persistent” cookies are cookies that remain stored even after the browser is closed. This allows, for example, the login status to be stored if the users visit after several days. Similarly, the users’ interests can be stored in such a cookie and used for reach measurement or marketing purposes. “Third-party cookies” are cookies placed by providers other than the controller operating the online offering (otherwise, when they are only that controller’s cookies, they are referred to as “first-party cookies”).
10.2. We use temporary and permanent cookies and explain this within the scope of our Privacy Policy.
If users do not want cookies to be stored on their computer, they are asked to disable the corresponding option in the system settings of their browser. Stored cookies can be deleted in the system settings of the browser. Excluding cookies may lead to limitations in the functions of this online offering.
10.3. A general objection to the use of cookies used for the purposes of online marketing may be declared, in many services—especially in the case of tracking—via the US website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/. In addition, cookie storage can be prevented by deactivating them in the browser settings. Please note that then, possibly, not all functions of this online offering can be used.
11. Deletion of data
11.1. The data processed by us is deleted or its processing is restricted in accordance with Articles 17 and 18 of the GDPR. Unless expressly stated otherwise in the context of this Privacy Policy, the data stored by us is deleted as soon as it is no longer required for its original purpose and there are no legal retention obligations to prevent deletion. If the data is not deleted because it is required for other legally permissible purposes, its processing is restricted. In other words, the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.
11.2. Germany: In accordance with statutory requirements, retention takes place in particular for 6 years pursuant to § 257(1) HGB (commercial books, inventories, opening balance sheets, annual financial statements, commercial letters, booking documents, etc.) and for 10 years pursuant to § 147(1) AO (books, records, management reports, booking documents, commercial and business letters, documents relevant for taxation, etc
12. Order processing in the online shop and customer account
12.1. We process our customers’ data as part of the ordering processes in our online shop in order to enable them to select and place the chosen products and services, as well as to pay for and receive them (delivery) or have them performed.
12.2. The data processed includes account data, communication data, contract data, payment data, and for the affected persons our customers, prospects, and other business partners. Processing is carried out for the purpose of providing contractual services in the operation of an online shop, billing, delivery, and customer services. For this purpose, we use session cookies to store the contents of the shopping cart and permanent cookies to store the login status.
12.3. Processing is based on Article 6(1)(b) (performance of order processes) and (c) (legally required archiving) of the GDPR. The information marked as required is necessary for the justification and fulfilment of the contract. We disclose the data to third parties only within the scope of delivery, payment, or within the scope of the legal permissions and obligations vis-à-vis legal advisors and authorities. Data is processed in third countries only when this is required for contract performance (e.g., at the customer’s request for delivery or payment).
12.4. Users may optionally create a user account, in particular to view their orders. During registration, the required mandatory information is provided to users. User accounts are not public and cannot be indexed by search engines. If users cancel their user account, their data with regard to the user account is deleted, subject to retention; retention for commercial or tax law reasons is necessary in accordance with Article 6(1)(c) of the GDPR. Information in the customer account remains until it is deleted, with subsequent archiving in the event of a legal obligation. It is the users’ responsibility to secure their data upon termination of the contract before the end of the contract.
12.5. As part of registration and renewed logins, as well as when using our online services, we store the IP address and the time of each user action. Storage is based on our legitimate interests, as well as the users’ interest in protection against misuse and other unauthorised use. As a rule, this data is not passed on to third parties unless it is necessary to assert our claims or there is a legal obligation to do so pursuant to Article 6(1)(c) of the GDPR.
12.6. Deletion occurs after the expiry of statutory warranty and comparable obligations; the necessity of retaining the data is reviewed every three years. In the case of statutory archiving obligations, deletion occurs after their expiry (end of the retention obligation under commercial law (6 years) and under tax law (10 years)); information in the customer account remains until it is deleted.
13. Business analyses and market research
13.1. In order to run our business economically, and to recognise market trends and customer and user preferences, we analyse the data available to us relating to business transactions, contracts, inquiries, etc. In doing so, we process account data, communication data, contract data, payment data, usage data, and metadata on the basis of Article 6(1)(f) of the GDPR, whereby customers, prospects, business partners, visitors, and users of the online offering are among the affected persons. The analyses are carried out for the purpose of business evaluation, marketing, and market research. In this context, we may take into account the profiles of registered users with information, e.g., about their purchase transactions. The analyses are used by us to increase user-friendliness, optimise our offering, and improve business efficiency. The analyses are for our sole use and are not disclosed externally unless they are anonymous analyses with aggregated values.
13.2. If these analyses or profiles are personal data, they are deleted upon termination of the users’ accounts or anonymised; otherwise, after two years from the date the contract was concluded. In addition, overall business analyses and general trend assessments are created anonymously where possible.
2. A customer’s creditworthiness assessment is permissible only if otherwise there is a risk of non-payment, i.e., if the goods are delivered without payment having been received (i.e., when the customer chooses to purchase on account). No risk of non-payment exists, for example, if the customer chooses an advance payment option or processes payment via a third-party provider such as PayPal.
It should also be noted that obtaining an automated credit report constitutes “Automated decisions in individual cases” in accordance with Article 22 of the GDPR, meaning a legal decision without human involvement. This is permissible if the customer has consented or if this decision is necessary for the conclusion of the contract. Whether the decision is necessary has not yet been conclusively clarified, but it is often considered to be the case, including by the author of this template. If, however, you want to exclude any risk, you should obtain consent.
Consent is also necessary even if the credit report is already used in order to decide whether the option “on account” should be displayed at all. This is because it could have been that the customer would have chosen advance payment or PayPal anyway and a credit assessment would not have been necessary.
Such consent could be worded, for example, as follows:
I agree that a creditworthiness check will be carried out in order to decide, in an automated process (Article 22 of the GDPR), whether the purchase on account option is offered. Further information about the creditworthiness check, the credit agencies used, and the procedure, as well as about the options to object, can be found in our [Link]Privacy Policy[/Link].
14. Credit report
14.1. If we provide services in advance (e.g., when purchasing on account), we reserve the right, to safeguard our legitimate interests, to obtain an identity and creditworthiness report for the purpose of assessing credit risk on the basis of mathematically and statistically based procedures from specialised service providers (credit agencies).
14.2. As part of the creditworthiness report, we transmit the following personal data of the customer (name, postal address, date of birth, information about the type of contract, bank details [Please provide any additional data if applicable]) to the following credit agencies:
[Please insert the credit agencies here, e.g.:] SCHUFA Gesellschaft (SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden), Privacy information: https://www.schufa.de/en/about-us/data-scoring/.
14.3. We process the information received by the credit agencies about the statistical likelihood of non-payment as part of an appropriate discretionary decision regarding the justification, implementation, and termination of the contractual relationship. We reserve the right, in the event of a negative result from the creditworthiness check, to refuse payment on account or another form of advance payment.
14.4. The decision as to whether we provide services in advance is made in accordance with Article 22 of the GDPR solely on the basis of an automated decision in an individual case, which our software makes using the credit agency’s information.
14.5. If we obtain your express consent, the legal basis for the creditworthiness report and the transmission of the customer’s data to the agencies is consent pursuant to Article 6(1)(a) and Article 7 of the GDPR. If no consent is obtained, our legitimate interests in the reliability of your payment claim are the legal basis pursuant to Article 6(1)(f) of the GDPR.
15. Contact and customer service
15.1. When you contact us (via contact form or email), the user’s information is processed for the purpose of handling the contact request and for its processing in accordance with Article 6(1)(b) of the GDPR.
15.2. The information provided by users may be stored in our Customer Relationship Management system (“CRM system”) or in a comparable request management organisation.
15.3. We delete inquiries if they are no longer necessary. We check the necessity every two years; we permanently store inquiries from customers who have a customer account and refer to the customer account information for deletion. In addition, statutory archiving obligations apply.
16. Collection of access data and log files
16.1. Based on our legitimate interests within the meaning of Article 6(1)(f) of the GDPR, we collect data about every access to the server on which this service is hosted (so-called server log files). Access data includes the name of the requested website, file, date and time of access, amount of data transferred, a report about successful retrieval, browser type and version, the user’s operating system, referrer URL (the previously visited page), IP address, and the requesting provider.
16.2. For security reasons (e.g., to clarify misuse or fraud), logfile information is stored for a maximum of seven days and then deleted. Data for which further retention is necessary for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.
17. Online presences in social media
17.1. Based on our legitimate interests within the meaning of Article 6(1)(f) of the GDPR, we maintain online presences within social networks and platforms in order to communicate with customers, prospects, and users active there and to inform them there about our services. When accessing the respective networks and platforms, the terms of service and data processing guidelines of their respective operators apply.
17.2 To the extent that this is not otherwise specified in our Privacy Policy, we process users’ data if they communicate with us within the social networks and platforms, e.g., by writing posts on our online presences or sending us messages.
18. Google Analytics
18.1. Based on our legitimate interests (i.e., interest in analysing, optimising, and operating our online offering economically within the meaning of Article 6(1)(f) of the GDPR), we use Google Analytics, a web analytics service provided by Google LLC (“Google”). Google uses cookies. The information generated by the cookie about users’ use of the online offering is generally transmitted to a Google server in the USA and stored there.
18.2. Google is certified under the Privacy Shield agreement and thereby offers a guarantee that it will comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
18.3. Google will use this information on our behalf to evaluate the users’ use of our online offering, to compile reports on the activities within this online offering, and to provide us with further services related to the use of this online offering and internet usage. In this process, pseudonymous usage profiles of the users may be created from the processed data.
18.4. We use Google Analytics only with IP anonymisation activated. This means that users’ IP addresses are shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there.
18.5. The IP address sent by the users’ browser is not combined with other Google data. Users can prevent cookies from being stored by adjusting the corresponding setting in their browser software; in addition, users can prevent the collection of the data generated by the cookie and related to their use of the online offering by Google, as well as the processing of that data by Google, by downloading and installing the browser plugin available via the following link: https://tools.google.com/dlpage/gaoptout?hl=de.
18.6. Further information about data usage by Google, as well as options for settings and objection, can be found on Google’s websites: https://www.google.com/intl/de/policies/privacy/partners (“Data usage by Google when you use websites or apps of our partners”), https://policies.google.com/technologies/ads (“Data usage for advertising purposes“), https://adssettings.google.com/authenticated (“Manage information that Google uses to show you ads”).
19. Facebook social plugins
19.1. Based on our legitimate interests (i.e., interest in analysing, optimising, and operating our online offering economically within the meaning of Article 6(1)(f) of the GDPR), we use social plugins (“plugins”) from the social network facebook.com, operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”). The plugins may display interactive elements or content (e.g., videos, graphics, or text posts) and are recognisable by one of the Facebook logos (white “f” on a blue tile, the terms “Like”, “Gefällt mir” or a “thumbs up” sign) or are labelled with the addition “Facebook Social Plugin”. The list and appearance of the Facebook social plugins can be viewed here: https://developers.facebook.com/docs/plugins/.
19.2. Facebook is certified under the Privacy Shield agreement and thereby offers a guarantee that it will comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active).
19.3. If a user calls up a feature of this online offering that contains such a plugin, the user’s device establishes a direct connection to the Facebook servers. The plugin’s content is transmitted by Facebook directly to the user’s device and integrated into the online offering. In this process, usage profiles of the users may be created from the processed data. We therefore have no influence on the scope of the data that Facebook collects with the help of this plugin and therefore inform users accordingly based on our knowledge.
19.4. By integrating the plugins, Facebook receives information that a user has accessed the corresponding page of the online offering. If the user is logged into Facebook, Facebook can associate the visit with the user’s Facebook account. If users interact with the plugins—for example by clicking the Like button or leaving a comment—the corresponding information is transmitted from your device directly to Facebook and stored there. If a user is not a member of Facebook, there is still the possibility that Facebook will learn and store their IP address. According to Facebook, in Germany only an anonymised IP address is stored.
19.5. The purpose and scope of the collection of data, as well as further processing and use of the data by Facebook, and the related rights and settings options for protecting users’ privacy, can be found in Facebook’s privacy information: https://www.facebook.com/about/privacy/.
19.6. If a user is a Facebook member and does not want Facebook to collect data about them through this online offering and link it to their stored Facebook member data, they must log out of Facebook before using our online offering and delete their cookies. Further settings and objections regarding the use of data for advertising purposes are possible within the Facebook profile settings: https://www.facebook.com/settings?tab=ads or via the US page http://www.aboutads.info/choices/ or the EU page http://www.youronlinechoices.com/. The settings are made independently of the platform, meaning they are applied to all devices such as desktop computers or mobile devices.
20. Amazon Partner Program
20.1. Based on our legitimate interests (i.e., interest in the economic operation of our online offering within the meaning of Article 6(1)(f) of the GDPR), we participate in the Amazon EU Partner Program, which was designed to provide a medium for websites through which advertising placements and links to Amazon.de can earn advertising cost reimbursement. Amazon uses cookies to track the origin of orders. Among other things, Amazon can recognise that you clicked the partner link on this website.
20.2. Further information about data usage by Amazon is available in the company’s Privacy Policy: http://www.amazon.de/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&nodeId=3312401.
21. Communication by post, email, fax, or telephone
21.1 We use remote communication methods for business processing and for marketing purposes, such as post, telephone, or email. In doing so, we process account data, address and contact details, and contract data of customers, participants, prospects, and communication partners.
21.2 The processing is based on Article 6(1)(a), Article 7 of the GDPR, and Article 6(1)(f) of the GDPR in conjunction with statutory requirements for commercial communications. Contact is made only with consent of the contact partners or within the scope of statutory permissions, and the processed data is deleted as soon as it is no longer necessary; otherwise, with objection/revocation or the termination of the applicable legal basis or statutory archiving obligations.
22. Newsletter
22.1. With the following information, we inform you about the contents of our newsletter, the registration, sending, and statistical evaluation process, as well as your right to object. By subscribing to our newsletter, you consent to receiving it and to the procedures described.
22.2. Content of the newsletter: We send newsletters, emails, and other electronic notifications containing advertising information (hereinafter “newsletter”) only with the consent of the recipients or a statutory permission. Where the content of the newsletter is specifically described as part of the registration, it is decisive for the consent of the users. In addition, our newsletters contain information about our products, offers, promotions, and our company.
22.3 Double opt-in and logging: Registration for our newsletter is done using a so-called double opt-in procedure. That means that after you register, you receive an email asking you to confirm your registration. This confirmation is necessary so that no one can register using someone else’s email address. Registrations for the newsletter are logged in order to prove compliance with the legal requirements for the registration process. This includes storing the time of registration and confirmation, as well as the IP address. Changes to the data stored with the sending service provider are also logged.
22.4 Sending service provider: The newsletter is sent using “MailChimp,” a newsletter sending platform of the US provider Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA. You can view the privacy policies of the sending service provider here: https://mailchimp.com/legal/privacy/. The Rocket Science Group LLC d/b/a MailChimp is certified under the Privacy Shield agreement and thereby offers a guarantee that it will comply with the European data protection standard (https://www.privacyshield.gov/participant?id=a2zt0000000TO6hAAG&status=Active).
22.5. To the extent that we use a sending service provider, the sending service provider may, according to its own information, use this data in pseudonymous form—that is, without linking it to a user—to optimise or improve its own services, e.g., for technical optimisation of the sending process and the display of the newsletters or for statistical purposes, in order to determine from which countries the recipients come. However, the sending service provider does not use the data of our newsletter recipients to contact them themselves or to pass it on to third parties.
22.6. Registration details: To subscribe to the newsletter, it is sufficient for you to provide your email address. Optionally, we ask you to provide a name for personal address in the newsletter.
22.7. Measurement of success – The newsletters include a so-called “web beacon,” i.e., a file the size of a pixel that is retrieved from our server when the newsletter is opened, or—if we use a sending service provider—from its server. As part of this retrieval, first technical information is collected, such as information about the browser and your system, as well as your IP address and the time of retrieval. This information is used to technically improve the services based on the technical data or target groups and their reading behaviour using the retrieval locations (which can be determined with the help of the IP address) or access times. Statistical data collection also includes determining whether the newsletters are opened, when they are opened, and which links are clicked. For technical reasons, this information can be assigned to individual newsletter recipients. However, it is neither our intent nor, if used, that of the sending service provider to monitor individual users. Rather, the evaluations are used to recognise our users’ reading habits and adapt our content to them or send different content according to the interests of our users.
22.8. Germany: The sending of the newsletter and the measurement of success are carried out on the basis of the recipients’ consent in accordance with Article 6(1)(a) and Article 7 of the GDPR in conjunction with § 7(2)(3) of the UWG (German Act Against Unfair Competition), or on the basis of a statutory permission pursuant to § 7(3) of the UWG.
22.9. The logging of the registration process is carried out on the basis of our legitimate interests pursuant to Article 6(1)(f) of the GDPR and serves to provide evidence of consent to receiving the newsletter.
22.10. Newsletter recipients may unsubscribe from our newsletter at any time, i.e., revoke your consents. A link to unsubscribe from the newsletter can be found at the end of each newsletter. As a result, your consents for the measurement of success will expire at the same time. Unfortunately, a separate revocation of the measurement of success is not possible; in this case, the entire newsletter subscription must be cancelled. When unsubscribing from the newsletter, the personal data is deleted unless its retention is legally required or justified, in which case its processing is limited to these exceptional purposes. In particular, we may store the unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them for the purposes of sending newsletters, in order to be able to prove consent that was previously given. The processing of this data is limited to the purpose of possible defence of claims. An individual deletion request is possible at any time, provided that the previous existence of consent is confirmed at the same time.
23. Integration of third-party services and content
23.1. Within our online offering, we use, on the basis of our legitimate interests (i.e., interest in analysing, optimising, and operating our online offering economically within the meaning of Article 6(1)(f) of the GDPR), content or service offers from third-party providers to embed their content and services, such as videos or fonts (hereinafter collectively referred to as “content”). This always requires that the third-party providers of this content recognise the users’ IP address, because without an IP address they could not send the content to the users’ browsers. The IP address is therefore required for displaying this content. We endeavour to use only such content whose respective providers use the IP address merely to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also referred to as “web beacons”) for statistical or marketing purposes. Using the “pixel tags,” information such as visitor traffic on the pages of this website can be evaluated. The pseudonymous information may also be stored in cookies on the users’ devices and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit, and further information about the use of our online offering; it can also be linked with such information from other sources.
23.2. The following presentation provides an overview of third-party providers and their content, including links to their privacy policies, which contain further information about data processing and, in part, also right to object options already mentioned here (so-called opt-out)
– If our customers use third-party payment services (e.g., PayPal or immediate bank transfer), the terms and conditions and privacy notices of the respective third-party providers apply, which can be accessed within the respective websites or transaction applications.
– External fonts from Google, LLC., https://www.google.com/fonts (“Google Fonts”). The integration of Google Fonts is done by calling a server at Google (generally in the USA). Privacy Policy: https://policies.google.com/privacy, Opt-out: https://adssettings.google.com/authenticated.
– Maps of the “Google Maps” service provided by the third-party provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Policy: https://www.google.com/policies/privacy/, Opt-out: https://www.google.com/settings/ads/.
– Videos from the “YouTube” platform of the third-party provider Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Policy: https://www.google.com/policies/privacy/, Opt-out: https://www.google.com/settings/ads/.
– Within our online offering, functions of the Google+ service are integrated. These functions are provided by the third-party provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. If you are logged into your Google+ account, you can link the content of our pages to your Google+ profile by clicking the Google+ button. This allows Google to associate the visit to our pages with your user account. We would like to point out that, as the provider of the pages, we have no knowledge of the content of the data transmitted and its use by Google+. Privacy Policy: https://policies.google.com/privacy, Opt-out: https://adssettings.google.com/authenticated.
– Within our online offering, functions of the Instagram service are integrated. These functions are provided by Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA. If you are logged into your Instagram account, you can link the content of our pages to your Instagram profile by clicking the Instagram button. This allows Instagram to associate the visit to our pages with your user account. We would like to point out that, as the provider of the pages, we have no knowledge of the content of the data transmitted and its use by Instagram. Privacy Policy: http://instagram.com/about/legal/privacy/.
– We use social plugins from the Pinterest social network, operated by Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA (“Pinterest”). When you access a page that contains such a plugin, your browser establishes a direct connection to Pinterest’s servers. The plugin transmits protocol data to Pinterest’s server in the USA. This protocol data may include your IP address, the address of the websites visited that also contain Pinterest features, the type and settings of the browser, the date and time of the request, your method of using Pinterest, and cookies. Privacy Policy: https://about.pinterest.com/de/privacy-policy.
– Within our online offering, functions of the service or the platform Twitter can be integrated (hereinafter referred to as “Twitter”). Twitter is a service provided by Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. The functions include displaying our posts within Twitter within our online offering, linking to our profile on Twitter, and the possibility to interact with the posts and functions of Twitter, as well as measuring whether users reach our online offering via advertisements that we display on Twitter (so-called conversion measurement). Twitter is certified under the Privacy Shield agreement and thereby offers a guarantee that it will comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000TORzAAO&status=Active). Privacy Policy: https://twitter.com/de/privacy, Opt-out: https://twitter.com/personalization