1. Preface and Selected Terms

On the one hand, this privacy policy informs visitors and users of our website about the data processing operations that take place online and involve the processing of personal data. On the other hand, you will receive information about our processing operations that do not primarily take place online.

• GDPR is the abbreviation for the European Data Protection Regulation.
• BDSG is the abbreviation for the Federal Data Protection Act in its current version.
• Personal data are all individual details that allow conclusions to be drawn about a natural person (for definition see Art. 4 (1) GDPR). This includes, for example, names, e-mail addresses, telephone numbers, but also data such as IP addresses or customer numbers.
• The processing of personal data includes all operations, for example the collection, storage, transmission, archiving or deletion of personal data (definition Art. 4 (2) GDPR).
• The data subject within the meaning of data protection law is any natural person from whom personal data are processed.
• Further definitions of terms can be taken from the General Data Protection Regulation, which can be found in Art. 4 of the GDPR (Definitions).

2. Responsible Party and Data Protection Officer

Responsible Party for data processing

COLUMBUS Verlag GmbH & Co. KG
Am Bahnhof 2
72505 Krauchenwies
Germany
Telefon: +49 (0) 7576 96 03 0
E-Mail: info@columbus-verlag.de
Web: https://www.columbus-verlag.de

Data protection officer required by law

DPO External Data Protection Officer Stuttgart
Fabian Henkel

Graduate business economist (FH)

Certified data protection officer

Phone: +49(0)176 32744172

E-mail:
info@externer-datenschutzbeauftragter-stuttgart.deWeb: https://www.externer-datenschutzbeauftragter-stuttgart.de

3. A brief Overview

The following contents provide you with a brief overview of the processing of personal data; more detailed information can be found in the respective passages presented in detail.

Security on our website (SSL Secure Socket Layer)
Our website is equipped with an SSL certificate, with the help of which data transmission processes are encrypted. This happens, for example, when you send us a message via a form. However, as a precaution, we would like to point out that one hundred percent security in electronic data processing is not possible and that there is always a residual risk.

Data that you transmit to us

On the one hand, we process data on this site that you enter yourself, for example in a form. In this case, the purpose of the processing results from the type of form and, on the other hand, from this data protection declaration. Also, if you send us a message by e-mail, for example, or contact us in any other way, we will process your data in accordance with the purpose of the contact.

Automatic server log files
On the other hand, our server automatically records all accesses and thus also IP addresses (log files), this serves the defense against attacks, the analysis of access figures and the smooth operation.

Use of cookies

Cookies help us to provide various services. Cookies are small text files that are stored in your browser and can be read. We use both our own cookies and third-party cookies, you can find more information in this privacy policy.

Plugins and content delivery networks

We sometimes use plugins and content delivery networks, well-known examples of such services being the video service Youtube or the map service Google Maps. If such services are integrated via a website, access data is transmitted to the services. This is usually your IP address and other metadata, such as time and date of access. As a rule, the provision is carried out by setting cookies.

Analysis Tools

In addition to the pure server log files, which also provide us with information about page views, we use analysis tools or tracking tools. These tools give us detailed insights into the content visited on our site, the flow of behaviour and, for example, the country from which access took place. In order for such services to function, cookies must be set for the site visitor.

Newsletter / Direct Marketing

Direct marketing to existing customers in our legitimate interest

We reserve the right to send our customer e-mail newsletter on the basis of §7 (3) UWG in conjunction with Art. 6 (1) lit. f GDPR. We also reserve the right to send postal advertising to existing customers in our legitimate interest. You can of course object to receiving direct marketing information from us at any time.

Direct marketing based on your consent
If you give us your consent (Art. 6 para. 1lit. a GDPR), we will send you newsletters until you revoke it. You can revoke your consent at any time with effect for the future.

Further data recipients

a) Use of processors
We use processors in accordance with the requirements of Art. 28 GDPR, for example in the area of IT services, web hosting, email hosting or printing services. These process personal data for us in accordance with instructions.

b) Use of external services
If it is necessary (for example, for the execution of contracts), we pass on your data, for example, to banks, other payment service providers, shipping service providers, our tax advisor or lawyer.

c) Legal obligations
In addition, in certain cases we are obliged to make a report to the relevant authorities on the basis of the Money Laundering Act. In addition, we are subject to further legal obligations, such as trade laws or tax law, in this context we must pass on certain data to tax authorities, for example.

d) Investigation of criminal offences
In so far as  it should be necessary for the investigation of a criminal offence, we pass on data to the criminal prosecution authorities.

General information on deletion periods for personal data
We process data as long as this is necessary for the respective purpose. As far as necessary, we process your personal data for the duration of our business relationship, which also includes the initiation and execution of a contract.In addition, we are obliged to comply with statutory retention obligations. If the data processing is based on your consent, we will delete your data after your revocation.

Transfer of personal data to a third country
We try to have all service providers and services provided by providers within the European Union. A transfer to a third country is possible if you have given us your consent and/or we have concluded a contract for commissioned processing pursuant to Art. 28 GDPR, taking into account appropriate guarantees. In individual cases, we may use plugins or tools that are hosted in third countries, but we use them on the basis of our legitimate interests. In these cases, we point out the circumstance where appropriate.

Obligation to provide personal data
The provision of personal data is regularly required for the initiation, conclusion, processing and reversal of a contract. In the event that you do not provide the necessary personal data, it will not be possible for us to conclude and fulfil a contract with you.

5. Your Rights under the European Data Protection Regulation

Every natural person is entitled to certain rights, these are defined in particular in Articles 15 to 21 and 77 of the GDPR. In principle, you have the following rights, which you can claim from us.

Right to revoke consent given (cf. Art. 7 GDPR)
You can revoke consent given to us at any time without giving reasons with effect for the future.

Right to information (cf. Art. 15 GDPR)
You have the right to request information about the data processed about you and the purposes of the processing at any time.

Right to rectification (cf. Art. 16 GDPR)

If you discover that we are processing incorrect or incomplete data about you, you have the right to rectification.

Right to erasure (cf. Art. 17 GDPR)
You have the right to request the erasure of your personal data that we process about you at any time. Insofar as complete deletion is not possible, for example because we have to comply with statutory retention obligations or we can assert legitimate interests for another reason, we will restrict your data until these reasons cease to apply.

Right to restriction of processing / blocking (cf. Art. 18 GDPR)
You have the right to request the restriction of the processing of your personal data. To do so, you can contact us at any time at the address given in the imprint. The right to restriction of processing exists in the following cases:

• If you dispute the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the review, you have the right to request the restriction of the processing of your personal data.
• If the processing of your personal data happened / happens unlawfully, you can demand the restriction of the data processing instead of the deletion.
• If we no longer need your personal data, but you need it to exercise, defend or enforce legal claims, you have the right to request restriction of the processing of your personal data instead of deletion.
• If you have lodged an objection pursuant to Art. 21 (1) GDPR, a balancing of your and our interests must be carried out. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.
• If you have restricted the processing of your personal data, such data may only be processed - apart from being stored - with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or a Member State.

Right to data portability (cf. Art. 20 GDPR)
You have the right to have us transfer your data to another company in a machine-readable format, insofar as this is possible with reasonable effort.

Right to object to certain processing operations and direct marketing (cf. Art. 21 GDPR).
Art. 21(1) - You may exercise your right to object at any time, this is particularly relevant if the processing is based on Art. 6(1)(e) or (f) GDPR. This also includes processing for profiling purposes. If we can demonstrate compelling reasons for the processing that outweigh your interests or the processing serves the enforcement of legal claims, their exercise or defence, we may reject your objection in individual cases.
Art. 21(2) - You may also object at any time to processing for direct marketing purposes, this includes profiling related to direct marketing. We will follow up your objection at any time and no longer process your data for these purposes.

Right to complain to a supervisory authority (cf. Art. 77 DGVO)
You have the right to complain about the processing of your personal data to the supervisory authority for data protection at any time.

6. External Hosting

This website is hosted by an external service provider (hoster). The personal data collected on this website is stored on the hoster's servers. This may include IP addresses, contact requests, meta and communication data, contractual data, contact data, names, website accesses and other data generated via a website.

The hoster is used for the purpose of fulfilling the contract with our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of a secure, fast and efficient provision of our online offer by a professional provider (Art. 6 para. 1 lit. f GDPR). Our hoster will only process your data insofar as this is necessary for the fulfilment of its service obligations and follow our instructions with regard to this data.

We have contracted the following hoster for hosting:
IONOS SE
Elgendorfer Str. 57
56410 Montabaur

Conclusion of a contract on order processingTo ensure
data protection-compliant processing, we have concluded a contract on order processing with our hoster.

7. Server Log Data

Our web server automatically logs all accesses and thus also IP addresses of visitors. This serves the defense against attacks, the analysis of access figures and the smooth operation. We have a legitimate interest in this (Art. 6 lit. f GDPR).

The server log usually records not only the IP address but also other metadata about the session, this data can be found below.

• Date and time of retrieval
• Information about the type of browser and the version used Browser
• Information on the operating system used
• Device (Client)
• Refferer URL (via which page you have landed with us)
• Invoked hyperlinks

We process this data only for the purposes mentioned above. We delete server log files after six months at the latest.

8. Use of Cookies

Our website uses cookies for the provision of services and to ensure full functionality. Cookies and similar technologies are very small text documents or pieces of code that often contain a unique identification code. When you visit a website or use a mobile application, a computer asks your computer or mobile device for permission to store this file on your computer or mobile device and access information. Information collected through cookies and similar technologies may include the date and time of your visit and how you use a particular website or mobile application.

Cookies ensure that you remain logged in during your visit to our online shop, that all items in your shopping cart remain saved, that you can shop safely and that the website continues to function smoothly. The cookies also ensure that we can see how our website is used and how we can improve it. In addition, depending on your preferences, our own cookies may be used to present you with targeted advertising that matches your personal interests.

Cookies are stored on your terminal device and transmitted from it to our site. As a user, you have full control over the use of cookies. You can define whether and which cookies you generally allow in your browser settings. We recommend that you set your browser so that you are informed when a website wants to set cookies on you. This gives you control over which cookies you want to accept. However, if you do not allow cookies, the functionality of websites may be limited.

Cookies are basically divided into non-persistent and persistent cookies. A further distinction is made between first party cookies (which come directly from our web server) and third party cookies (which are set by third-party providers).

Cookie types by runtime

Session cookies: Session cookies are deleted at the latest when you leave our website and close your browser.

Persistent cookies: These cookies remain stored even after you leave our website and close your browser of the browser. Persistent cookies can have different durations, from one day to several years. These cookies can perform various functions, for example, your login details may be stored so that you are automatically logged in when you return to our website. Other persistent cookies are used for analysis, tracking and marketing purposes.

Cookie types by origin

We use both first-party cookies and third-party cookies. First-party cookies are cookies that come directly from us. Third-party cookies are cookies that are placed via a third-party provider. We use various third-party cookies for analysis, tracking and marketing purposes.

Cookie types by function

Necessary cookies

These cookies are necessary for the website to function properly. Some of the following actions can be performed with these cookies. - Save items in a shopping cart for online purchases - Save your cookie settings for this website - Save language settings - Log in to our portal. We need to verify that you are logged in.

Performance Cookies
These cookies are used to collect statistical information about the use of our website, also called analytics cookies. We use this data to improve performance and optimize the website.

Functional cookies
These cookies enable more functionality for our website visitors. These cookies can be set by our external service providers or our own website. The following functionalities may or may not be enabled if you accept this category. - Live chat services - Watch online videos - Social media sharing buttons - Sign in with social media on our website.

Advertising / Tracking Cookies
These cookies are set by external advertising partners and are used to profile and track data across multiple websites. If you accept these cookies, we may display our advertisements on other websites based on your user profile and preferences. These cookies also store data about how many visitors have seen or clicked on our ads in order to optimize advertising campaigns.

9. Cookie Preferences and Legal Bases

We use technically necessary cookies in the interest of a functional and stable website (Art. 6 para. 1 lit. f GDPR), we use other cookies only with your consent (Art. 6 para. 1lit. a GDPR). You can make your preferences regarding the selection of non-essential cookies at the beginning of your visit, furthermore you have the possibility to adjust your preferences at any time.

The individual legal bases for the use of various tools that use cookies can be found in the respective passages in our privacy policy.

You can adjust your preferences at any time by opening the cookie window again.

Change your preferences here: Cookie Settings

Alternatively, you will find a link to access the settings in the footer of our website.

10. Contact and Communication

Message via contact form

You have the possibility to send us messages via contact form. We process the data that you have entered in the data entry mask. Mandatory fields are marked and must be specified.

The purpose of data processing is to process your request and, if necessary, to contact you afterwards. The legal basis for processing the data entered in the contact form is always based on your consent (Art. 6 para. 1 lit. a GDPR). You can revoke your consent at any time without giving reasons. In addition, we process your data for the initiation or execution of purchase contracts, insofar as you ask us product-related questions, for example (Art. 6 para. 1 lit. b GDPR).

We store the transmitted data until you revoke your consent, in which case we delete your data insofar as no legitimate interests speak against deletion. As a legitimate interest, we can refer to compliance with statutory retention periods. The legal retention periods are generally derived from §257 of the German Commercial Code (HGB) with a retention period of 6 years for commercial letters, beginning with the following year after the time of the communication. For this period, we restrict the processing of your data after revocation of your consent and process it exclusively for the purpose of compliance with retention periods. Insofar as you do not revoke your consent, we restrict the processing of your data after the purpose has been achieved and retain it until the expiry of the aforementioned retention periods.

Communication by E-mail

Insofar as you write us an email, we process your data according to the content and purpose of the message. As a rule, processing is carried out on the basis of pre-contractual measures or in the context of the implementation of a contractual relationship on the basis of Art. 6 para. 1 lit. b GDPR and Art. 6 para. 1 lit. f. GDPR. It is a legitimate interest to process your request quickly and efficiently.

Insofar as it is a product or service-related message, we generally process your data on the basis of our legitimate interests pursuant to Art. 6 (1) lit. f GDPR.

Please note that we archive all incoming e-mails in accordance with the principles of proper accounting (GoBD for short) for a period of 10 years, starting with the first day of the following year in which the message was received. Therefore, insofar as you request us to delete the data, we will henceforth restrict your data for processing and only store it for the purpose of complying with retention periods in our legitimate interest.

Communication by phone or fax

Even if you contact us by telephone or fax, we process your data either for the initiation and implementation of contractual relationships (if the content is product- or service-related) and/or in our legitimate interest, analogous to contacting you by e-mail.

We do not record the content of conversations, but may make notes for the processing of your request. We store these until the purpose of the data processing has been achieved and we no longer have any legitimate interests in the processing. If necessary, contents of the conversation are stored anonymously for statistical purposes. Of course, you can request deletion at any time.

11. Direct Marketing

Direct marketing to existing customers based on legitimate interests

We reserve the right to use the data collected on the occasion of a purchase contract or service contract, if necessary, for direct advertising by e-mail or post in accordance with the German competition law § 7 para. 3 UWG, if the customer does not object or has not objected to this use.

The direct advertising exclusively includes offers for similar products or services, such as the products or services already purchased by the user from us. We have a legitimate, economic interest (Art. 6 para. 1 lit. f GDPR) in informing our customers about new products and improving our services.

We use your data for up to three years after the last legal transaction for direct marketing purposes in the legitimate interest.

Of course, you can object to receiving direct advertising by e-mail at any time. Address your objection to the above-mentioned responsible office.

Direct Marketing based on your consent (newsletter)

You have the option to give us your consent to receive direct marketing content. If you give your consent (Art. 6 para. 1 lit. a GDPR), for example, to receive our email newsletter, we will process your data for direct marketing measures by email for a specific purpose.

Since we are obliged to verify the correctness of your e-mail address provided as part of the newsletter registration and want to ensure the correctness, we use procedures that allow the verification of the ownership of the e-mail address. As a rule, this verification is carried out by the double opt-in procedure, you will receive an e-mail with a link after registration, which you must click to confirm. If, due to temporary technical causes, the double opt-in procedure is not available, we will send you an email to which you can reply without text to confirm your identity.

You can revoke your consent at any time with effect for the future, for this purpose you will find an "unsubscribe" link in every newsletter. Alternatively, you can send us an email with the subject "Unsubscribe from newsletter". We will process your data until you revoke your consent. Legal retention periods remain unaffected.

After you have unsubscribed from the newsletter distribution list, your e-mail address will be stored by us or the newsletter service provider in a blacklist, if necessary, in order to prevent future mailings. The data from the blacklist will only be used for this purpose and will not be merged with other data. This serves both your interest and our interest in complying with legal requirements when sending newsletters (legitimate interest within the meaning of Art. 6 (1) f GDPR). The storage in the blacklist is not limited in time. You can object to the storage if your interests outweigh our legitimate interest.

12. Privacy Policy for Applicants

If you apply to us, whether for an advertised position or on your own initiative, we process your data to carry out the selection process. It is irrelevant to us whether you apply by post, by e-mail or, if available for the respective position, by online form.

As a matter of principle, we only process the data that you yourself have provided to us within the scope of an application procedure. The use of other sources may only be considered after information and consultation with you. For example, whether we may contact a former employer.

The legal basis for the implementation of an application procedure is §26 BDSG in conjunction with Art. 6 para. 1 lit. b GDPR (initiation of employment contract). If you give us your consent to store your data for a longer period of time, this is done on the legal basis of Art. 6 para. 1 lit. a GDPR.

Deletion deadlines for applicant data
We delete applicant data a maximum of 4 months after the end of the application process (when a candidate has been selected and all applicants have been informed of the outcome). In principle, the purpose of data processing ceases to exist at the end of the selection procedure, but we have a legitimate interest (Art. 6(1)(f) GDPR) in being able to defend ourselves against any claims by rejected applicants. If you have the impression that your interests in immediate deletion outweigh this, you have the option of requesting us to do so. We will then examine your request and provide you with feedback.

After the expiry of the above-mentioned period, your data will be deleted, unless we need to defend ourselves, for example, in ongoing proceedings, for example, due to a lawsuit under the General Equal Treatment Act. In this case, we delete your data after the conclusion of the proceedings, subject to there being no statutory retention periods.

If we are allowed to store your data for a longer period on the basis of your consent, we will delete your data if you request us to do so and revoke your consent. If necessary, we will also delete your data before revoking your consent if it is foreseeable that no position will be available.

Inclusion in our applicant pool
If we are unable to offer you a position at the current time, we may ask you for your consent to continue storing your data. This serves the purpose of offering you a suitable position at a later date. The legal basis for processing your data in our applicant pool is your consent (Art. 6 Aba. 1 lit. a GDPR). Of course, you can revoke your consent at any time with effect for the future. If you do not revoke your consent yourself within a period of two years, we will delete your data from our applicant pool by then at the latest.

13. Online Marketing and Analysis

Google Analytics

This website uses functions of the web analysis service Google Analytics. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyse the behaviour of website visitors. In doing so, the website operator receives various usage data, such as page views, length of stay, operating systems used and the origin of the user. This data is summarized in a user ID and assigned to the respective end device of the website visitor. Furthermore, Google Analytics allows us to record your mouse and scroll movements and clicks, among other things. Furthermore, Google Analytics uses various modelling approaches to supplement the collected data records and uses machine learning technologies in the data analysis.

Google Analytics uses technologies that enable the recognition of the user for the purpose of analysing user behaviour (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is usually transferred to a Google server in the USA and stored there.

The use of this service is based on your consent according to Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG. The consent can be revoked at any time.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://privacy.google.com/businesses/controllerterms/mccs/.

IP anonymization
We have activated the IP anonymization function on this website. This means that your IP address is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before being transmitted to the USA. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

Browser Plugin
You can prevent the collection and processing of your data by Google by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

For more information on how Google Analytics handles user data, please see Google's privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.

Order processing
We have concluded an order processing contract with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

14. Other Tools

YouTube

This website embeds videos from the website YouTube. The operator of the website is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit one of our websites on which YouTube is integrated, a connection to the YouTube servers is established. This tells the YouTube server which of our pages you have visited.

Furthermore, YouTube may store various cookies on your terminal device or use comparable technologies for recognition (e.g. device fingerprinting). In this way, YouTube can obtain information about visitors to this website. This information is used, among other things, to collect video statistics, improve the user experience, and prevent fraud attempts.

If you are logged into your YouTube account, you enable YouTube to assign your surfing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account.

YouTube is used in the interest of an appealing presentation of our online offers. This represents a legitimate interest within the meaning of Art. 6 (1) lit. f GDPR. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 Para. 1 lit. a GDPR and § 25 Para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TTDSG. The consent can be revoked at any time.

For more information on how we handle user data, please see YouTube's privacy policy at: https://policies.google.com/privacy?hl=de.

15. Raffles

When you enter one of our competitions, we process the data you provide as part of the competition, which is usually the following categories of data:

• Name
• First name
• E-mail address
• Street and house number, if applicable
• Postcode and city, if applicable
• Telephone number if applicable (if this should be necessary for the competition)
• Date of birth, if applicable (if required for age verification or voluntary)
• if applicable, solution or answer to the competition

We process the personal data of the raffle participants to carry out the raffle. This includes checking whether a participant is entitled to participate, determining and notifying the winners and delivering the prize.

The winner will be notified by the method specified within the competition. Generally, winners will be contacted by email, but this may vary depending on the nature and design of the competition.

Legal basis for data processing

(a) Implementation of the competition

By accepting the terms and conditions of participation and your participation in the competition, a relationship of a contractual nature is established, accordingly we process your data on the basis of Art. 6 para. 1 lit. b GDPR. This includes in particular the transfer of your data to a shipping service provider for the delivery of the prize.

(b) Other purposes

If you have given your consent for further processing purposes in the context of the competition, we will process your personal data for these purposes on the basis of your consent (Art. 6 para. 1 lit. a GDPR).

Some of our competitions require your consent to the processing of your data for promotional purposes, this is clearly highlighted and transparently communicated on the respective competition form. The types of promotional measures that are part of the consent will also be indicated on the competition form. The processing for promotional purposes is based on your consent (Art. 6 para. 1 lit. a GDPR).

You can revoke your consent at any time; please address your revocation to the responsible body (the competition organiser). The legality of the data processing operations already carried out remains unaffected by the revocation, as the revocation is only future-oriented.

Other recipients of your data

We will never pass on your data to unauthorised third parties. Your data will only be passed on if this is necessary for the processing of the competition or if you have explicitly consented to the passing on of your data.

1. a) ProcessorsIn
   some cases, other processors support us in the implementation of the competition on an ad
   hoc basis and process personal data according to our instructions.
2. b) Shipping service provider
   For the delivery of a prize, we pass on your data, insofar as necessary, to a shipping service provider.
   
   

Provision of personal data
Please note that participation in the competition - in particular for the delivery of the prize - is generally only possible if you provide us with the aforementioned data.

Transfer to a third country
We generally process your personal data within Germany and the European Union.


Storage period
We delete the data collected in the competition no later than four weeks after the conclusion (prize determination) of the competition, unless explicitly stated otherwise in the respective competition.

We have to store the data of winners for 10 years due to legal retention periods according to §257 HGB and §147 AO. The period begins on the first day of the year following the competition.

If you have given us your consent for further purposes, we will process your personal data until you withdraw your consent.

16. Raffles in Social Media

On our social media sites, we occasionally run sweepstakes that require commenting on a post, or otherwise interacting with one of our social media presences, to enter.

When we run a competition on a social network, we generally process the following data (unless explicitly stated otherwise in the competition):

• Public profile information incl. username
• Submitted comment (text & image) or other type of interaction

The purpose of the data processing is the implementation of the competition, this includes the verification of eligibility and the determination of the winner or winners.

The winner(s) will be notified by means of a personal message on the relevant social network and/or, where applicable, announced publicly in connection with the competition (in accordance with the information provided about the competition).

We also usually ask winners for the following information:

• Name, first name
• Address
• E-mail address

The purpose of the processing is the delivery or issuance of the prize. For this purpose, it may be necessary that we pass on the data of winners to a shipping service provider (such as the German Post) so that the prize can be delivered.

In some cases, the transfer of winnings can be handled by e-mail or direct message on the respective social network, for example, if vouchers are involved.

Other purposes

If no other purpose is directly and transparently stated in the sweepstake information, we will process your data solely for the purpose of conducting the sweepstakes.

Insofar as explicitly and transparently stated in the competition, we process your data for further purposes in compliance with the legal framework conditions. We state these purposes accordingly in the context of a competition and, where necessary, obtain your consent to processing for the stated purpose, for example consent to receive our newsletter.

Other recipients of your data
We will never pass on your data to unauthorised third parties. Your data will only be passed on if this is necessary for the processing of the competition or if you have explicitly consented to the passing on of your data.

1. a) ProcessorsIn
   some cases, other processors support us in the implementation of the competition on an ad
   hoc basis and process personal data according to our instructions.
2. b) Shipping service provider
   For the delivery of a prize, we pass on your data, insofar as necessary, to a shipping service provider.
   
   

Legal basis for data processing

a) Implementation of the competition
By accepting the conditions of participation and your participation in the sweepstake, a relationship of a contractual nature is established, accordingly we process your data on the basis of Art. 6 (1) lit. b GDPR. This includes in particular the transfer of your data to a shipping service provider for the delivery of the prize.

1. b) Further purposes
   If you have consented to further processing purposes in the context of the competition, we will process your personal data for these purposes on the basis of your consent (Art. 6 para. 1 lit. a GDPR).

You can revoke your consent at any time without giving reasons, please send your revocation in writing (by post or e-mail) to the responsible body (the competition organiser).

Provision of personal data
Please note that participation in the competition - in particular for the delivery of the prize - is generally only possible if you provide us with the aforementioned data.

Transfer to a third country
We generally process your personal data within Germany and the European Union.

Storage period
We delete the data collected in the competition no later than four weeks after the conclusion (determination of the prize) of the competition, unless explicitly stated otherwise in the respective competition. This does not apply to comments or posts that you yourself have published in social media as part of the competition.

We have to store the data of winners for 10 years due to legal retention periods according to §257 HGB and §147 AO. The period begins on the first day of the year following the competition.

If you have given us your consent for further purposes, we will process your personal data until you withdraw your consent.

17. Social Media Appearances

Data processing by social networks

We maintain publicly accessible profiles on social networks. The social networks used by us in detail can be found below. Social networks such as Facebook, Twitter, etc. can generally analyse your user behaviour comprehensively when you visit their website or a website with integrated social media content (e.g. like buttons or advertising banners). By visiting our social media presences, numerous data protection-relevant processing operations are triggered.

Specifically:

If you are logged into your social media account and visit our social media presence, the operator of the social media portal can assign this visit to your user account. However, your personal data may also be collected under certain circumstances if you are not logged in or do not have an account with the respective social media portal. In this case, this data collection takes place, for example, via cookies that are stored on your terminal device or by recording your IP address.

With the help of the data collected in this way, the operators of the social media portals can create user profiles in which your preferences and interests are stored. In this way, you can be shown interest-based advertising inside and outside the respective social media presence. If you have an account with the respective social network, the interest-based advertising can be displayed on all devices on which you are or were logged in.

Please also note that we cannot track all processing operations on the social media portals. Depending on the provider, further processing operations may therefore be carried out by the operators of the social media portals. For details, please refer to the terms of use and data protection provisions of the respective social media portals.

Legal basis

Our social media presences are intended to ensure the most comprehensive presence possible on the Internet and to enable effective user information and communication with users. This is a legitimate interest within the meaning of Art. 6 (1) lit. f GDPR. The analysis processes initiated by the social networks may be based on deviating legal bases, which are to be stated by the operators of the social networks (e.g. consent within the meaning of Art. 6 (1) lit. a GDPR).

Person responsible and assertion of rights

If you visit one of our social media sites (e.g. Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered during this visit. In principle, you can assert your rights (information, correction, deletion, restriction of processing, data portability and complaint) both vis-à-vis us and vis-à-vis the operator of the respective social media portal (e.g. vis-à-vis Facebook).

Please note that despite the joint responsibility with the social media portal operators, we do not have full influence on the data processing operations of the social media portals. Our options are largely determined by the corporate policy of the respective provider.

Storage period

The data collected directly by us via the social media presence will be deleted from our systems as soon as the purpose for storing it no longer applies, you request us to delete it, revoke your consent to store it or the purpose for storing the data no longer applies. Stored cookies remain on your terminal device until you delete them. Mandatory legal provisions - in particular retention periods - remain unaffected. We have no influence on the storage period of your data, which is stored by the operators of social networks for their own purposes. For details, please contact the operators of the social networks directly (e.g. in their privacy policy, see below).

Social networks in detail

We maintain profiles on the following social networks.

Facebook

We have a profile on Facebook. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. According to Facebook, the data collected is also transferred to the USA and other third countries.

We have entered into a Joint Processing Agreement (Controller Addendum) with Facebook. This agreement specifies which data processing operations we or Facebook are responsible for when you visit our Facebook page. You can view this agreement at the following link: https://www.facebook.com/legal/terms/page_controller_addendum.

You can adjust your advertising settings independently in your user account. To do so, click on the following link and log in: https://www.facebook.com/settings?tab=ads.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

For details, see Facebook's privacy policy: https://www.facebook.com/about/privacy/.

Twitter

We use the short message service Twitter. The provider is Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland.

You can adjust your Twitter privacy settings independently in your user account. To do so, click on the following link and log in: https://twitter.com/personalization.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://gdpr.twitter.com/en/controller-to-controller-transfers.html.

For details, see Twitter's privacy policy: https://twitter.com/de/privacy.

Instagram

We have a profile on Instagram. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum, https://help.instagram.com/519522125107875 and https://de-de.facebook.com/help/566994660333381.

For details on how they handle your personal data, please see Instagram's privacy policy: https://help.instagram.com/519522125107875.

XING

We have a profile on XING. The provider is New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany. For details on how they handle your personal data, please refer to XING's privacy policy: https://privacy.xing.com/de/datenschutzerklaerung.

YouTube

We have a profile on YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For details on how they handle your personal data, please refer to YouTube's privacy policy: https://policies.google.com/privacy?hl=de.