OCTOBER FIT DAYS · SAVE 5% WITH CODE OKTOBER5 OCTOBER FIT DAYS
5% OFF WITH CODE OKTOBER5

--

D

--

H

--

Min

--

Sec

Choose country/region

Sportstech Live Privacy Policy

Introduction

Controller

Sportstech Brands Holding GmbH
Karl-Liebknecht-Straße 7
10785 Berlin
Germany

Authorized representatives:

Managing Director Ali Ahmad

Email address:

[email protected]

Contact for the Data Protection Officer

c/o TÜV SÜD Akademie GmbH 

Westendstraße 160 

80339 Munich 

Email: [email protected]



Overview of Processing Activities

The following overview summarizes the types of data processed and the purposes of their processing, and refers to the data subjects.

Types of data processed

  • Account data.
  • Payment data.
  • Location data.
  • Contact data.
  • Content data.
  • Contract data.
  • Usage data.
  • Training and fitness data
  • Meta- and communication data.
  • Location history and movement profiles.

Categories of data subjects

  • Customers.
  • Prospective customers.
  • Communication partners.
  • Users.
  • Prize draw and competition participants.
  • Business and contract partners.
  • Participants.

Purposes of processing

  • Provision of contractual services and customer service.
  • Contact requests and communication.
  • Security measures.
  • Direct marketing.
  • Reach measurement.
  • Office and organizational procedures.
  • Management and response to requests.
  • Organization of prize draws and competitions.
  • Feedback.
  • Marketing.
  • Provision of our online offer and user-friendliness.
  • Information technology infrastructure.

Applicable Legal Bases

Below is an overview of the legal bases under the GDPR on which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection requirements may apply in your country of residence or domicile or in ours. Furthermore, if more specific legal bases are relevant in individual cases, we will inform you of these in the privacy notice.

  • Consent (Art. 6(1)(a) GDPR) - The data subject has given their consent to the processing of personal data relating to them for a specific purpose or several specified purposes.
  • Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR) - Processing is necessary for the performance of a contract to which the data subject is party or for the implementation of pre-contractual measures taken at the request of the data subject.
  • Legitimate interests (Art. 6(1)(f) GDPR) - Processing is necessary for the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data override those interests.

In addition to the data protection rules of the GDPR, national data protection rules apply in Germany. These include, in particular, the Act on the Protection Against the Misuse of Personal Data during Data Processing (Federal Data Protection Act – BDSG). The BDSG contains special provisions in particular regarding the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and transmission, as well as automated decision-making in individual cases, including profiling. Furthermore, it regulates data processing for purposes related to the employment relationship (§ 26 BDSG), in particular with regard to the establishment, performance, or termination of employment relationships, as well as employee consent. Furthermore, state data protection laws of the individual federal states may apply.

Security Measures

Subject to statutory requirements and taking into account the state of the art, implementation costs, and the nature, scope, circumstances, and purposes of processing, as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of protection appropriate to the risk.

These measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to data, as well as access to, input, transmission, and security of availability, and their separation. We have also established procedures to ensure the exercise of data subjects' rights, the erasure of data, and responses to threats to the data. Furthermore, we take personal data protection into account already during the development or selection of hardware, software, and procedures in accordance with the principle of data protection, through data protection by design and through privacy-friendly default settings.

SSL encryption (https): To protect the data you submit via our online offer, we use SSL encryption. You can recognize such encrypted connections by the https:// prefix in the address bar of your browser.

Transmission of Personal Data

As part of our processing of personal data, data may be transmitted to or disclosed to other entities, companies, legally independent organizational units, or individuals. Recipients of this data may include, for example, service providers tasked with IT tasks or providers of services and content that are embedded in a website. In such cases, we comply with statutory requirements and conclude appropriate contracts or agreements with the recipients of your data to protect your data.

Data transmission within the organization: We may transmit personal data to other entities within our organization or grant them access to this data. If this disclosure is for administrative purposes, it is based on our legitimate business and operational interests, or is necessary to fulfill our contractual obligations, or if the data subject has given consent or if there is a statutory authorization.

Data Processing in Third Countries

If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or if processing takes place as part of the use of third-party services or the disclosure or transmission of data to other individuals, entities, or companies, this is done only in compliance with statutory requirements.

Subject to express consent or transmission required by contract or law, we only process data in third countries with an adequate level of data protection, contractual obligations under the European Commission's so-called Standard Contractual Clauses, or where certifications or binding internal data protection rules are in place (Art. 44 to 49 GDPR, European Commission information page: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de ).

Data Erasure

The data we process will be deleted in accordance with statutory requirements as soon as the consents allowing its processing are withdrawn or other authorizations expire (e.g. if the purpose for processing this data no longer exists or the data is no longer required for that purpose). If the data is not deleted because it is required for other legally permissible purposes, its processing will be restricted to those purposes. This means that the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax reasons, or whose retention is required for the establishment, exercise, or defense of legal claims, or to protect the rights of another natural or legal person.

As part of our privacy notices, we may provide users with further information about the erasure and retention of data that applies specifically to the respective processing activities.

Providers and Services Used in the Course of Business

As part of our business activities, we use additional services, platforms, interfaces, or plug-ins from third-party providers (hereinafter "Services") in compliance with statutory requirements. Their use is based on our interests in the proper, lawful, and economical management of our business operations and internal organization.

  • Types of data processed: Account data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contact data (e.g. email, phone numbers); content data (e.g. inputs in online forms); contract data (e.g. subject matter of the contract, duration, customer category).
  • Data subjects: Customers; prospective customers; users (e.g. website visitors, users of online services); business and contract partners.
  • Purposes of processing: Provision of contractual services and customer service; office and organizational procedures.

Provision of the Offer

We process user data to make our online services available to them. For this purpose, we process the user's IP address, which is necessary to transmit the content and features of our online services to the user's browser or end device.

  • Types of data processed: Usage data (e.g. visited websites, interest in content, access times); meta- and communication data (e.g. device information, IP addresses); content data (e.g. inputs in online forms).
  • Data subjects: Users (e.g. website visitors, users of online services); business and contract partners.
  • Purposes of processing: Provision of our online offer and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)); security measures.
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing activities, procedures, and services:

  • Provision of the online offer on rented storage space: To provide our online offer, we use storage space, computing capacity, and software that we rent or otherwise obtain from a corresponding server provider (also called a "web host"); Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).
  • Collection of access data and log files: Access to our online offer is logged in the form of so-called "server log files". Server log files may include the address and name of the retrieved websites and files, the date and time of retrieval, transmitted data volumes, a report of successful retrieval, the browser type and version, the user's operating system, the referrer URL (the previously visited page), and generally IP addresses and the requesting provider. The server log files may be used, on the one hand, for security purposes, e.g. to prevent server overload (especially in the case of malicious attacks, so-called DDoS attacks), and on the other hand, to ensure server utilization and stability; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); Data erasure: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further retention is required for evidentiary purposes is exempt from erasure until the respective incident is finally resolved.
  • Amazon Web Services (AWS): Services in the field of provision of information technology infrastructure and related services (e.g. storage space and/or computing capacity); Service provider: Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855, Luxembourg; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://aws.amazon.com/de/ ; Privacy notice: https://aws.amazon.com/de/privacy/ ; Data processing agreement: https://aws.amazon.com/de/compliance/gdpr-center/ ; Standard contractual clauses (ensuring the level of data protection during processing in third countries): Included in the data processing agreement.

Special information on applications (apps)

We process the data of our app users to the extent necessary to make the app and its features available to users, monitor their security, and further develop them. We may also contact users in compliance with statutory requirements if communication is necessary for the purpose of administering or using the app. Otherwise, with regard to the processing of user data, we refer to the privacy notices in this privacy notice.

Legal bases: The processing of data necessary for the provision of the app's features serves to fulfill contractual obligations. This also applies if the provision of the features requires user authorization (e.g. granting permissions for device features). If the processing of data is not necessary for the provision of the app's features, but serves the security of the app or our business interests (e.g. collection of data for the purpose of optimizing the app or for security purposes), it is based on our legitimate interests. If users are expressly asked for their consent to the processing of their data, the processing of the data covered by the consent is based on that consent.

  • Types of data processed:

When you sign up for our app for the first time, we process the data you provide to create your user profile. Your name (nickname), email address, and password are necessary for this. In addition we process data from you if you voluntarily provide it to us, in order to keep your training and fitness goals up to date. This information includes, among other things, height, gender, and weight, and for training, telematics data such as your heart rate, calorie consumption, and training history. We need this information to make the core feature of our app available to you, which consists of allowing you to participate in live workouts, motivating you to work out, and, if applicable, providing you with training and nutrition recommendations. Furthermore, we also process location data so that our trainers can personally address you in shoutouts, if applicable, to increase your motivation.

Further data that we process: meta- and communication data (e.g. device information, IP addresses); location data (information about the geographic location of a device or person); location history and movement profiles (collection of location data and changes in position over a certain period).

Purposes of processing: Provision of contractual services and customer service. Where location data is accessed, this is based on your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time in your profile settings. Furthermore, you can also delete other information, such as height and weight, in your settings. Please note, however, that if you delete this data, we may no longer be able to make the features of this website available to you, or may only be able to make them available in part.

Legal bases: Consent (Art. 6(1)(a) GDPR); performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Deletion of data: You can delete your user profile at any time. Unless your account is deleted, we store the data in accordance with legal requirements.

Further information on processing activities, procedures and services:

  • Storage of a universal and unique identifier (UUID): For the purposes of analysing the use and functionality of the application and storing user settings, the application stores a so-called universal and unique identifier (in English "Universally Unique Identifier", UUID). This identifier is generated when this application is installed (but is not linked to the device, so it is not a device identifier in this sense), remains stored between the launch of the application and its updates, and is deleted when the user removes the application from their device.
  • Device permissions for access to features and data: The use of our application or its features may require user permissions to access certain features of the devices used or data stored on the devices or accessible with the help of the devices. By default, these permissions must be granted by the users and can be revoked at any time in the settings of the respective devices. The exact procedure for controlling the app permissions may depend on the device and the software used by the users. If clarification is required, users can contact us. We point out that the denial or revocation of the respective permissions may affect the functionality of our application.
  • Location history and movement profiles: Based on the location data collected during the use of our application, a location history is created, which shows the geographical movements of the devices used over a period of time (and may allow inferences to be drawn about the users' movement profiles). The location history is used solely to provide the respective functionality of our application, in accordance with its description to the users or its typical and expected operation.

Obtaining applications via app stores

Our application is obtained via special online platforms operated by other service providers (so-called "app stores"). In this context, in addition to our privacy notices, the privacy notices of the respective app stores apply. This applies in particular with regard to the methods used on the platforms for measuring reach and interest-based marketing, as well as any associated costs.

  • Types of data processed: Record data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contact details (e.g. email, telephone numbers); contract data (e.g. subject matter of the contract, duration, customer category); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses); content data (e.g. entries in online forms).
  • Data subjects: Customers; users (e.g. website visitors, users of online services).
  • Purposes of processing: Provision of contractual services and customer service; marketing.
  • Legal bases: Legitimate interests (Art. 6(1) lit. f) GDPR).

Further information on processing activities, procedures and services:

Registration, login and user account

Users can create a user account. During registration, users are informed of the required mandatory information, which is processed for the purpose of providing the user account on the basis of contractual obligations. The processed data includes, in particular, login information (username, password and an email address).

When you use our registration and login features and your user account, we store the IP address and the time of the respective user action. This is done on the basis of our legitimate interests and those of the users in protecting against misuse and other unauthorised use. This data is disclosed solely for the purpose of authentication. Generally, no further disclosure to third parties takes place unless it is necessary to pursue our claims or there is a legal obligation to do so.

Users can be informed by email about developments relevant to their user account, such as technical changes.

  • Types of data processed: Record data (e.g. names, addresses); contact details (e.g. email, telephone numbers); content data (e.g. entries in online forms); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Provision of contractual services and customer service; security measures; management and answering of enquiries; provision of our online offer and user-friendliness.
  • Legal bases: Performance of a contract and pre-contractual measures (Art. 6(1) lit. b) GDPR); legitimate interests (Art. 6(1) lit. f) GDPR).

Further information on processing activities, procedures and services:

  • Registration with pseudonyms: Users may use pseudonyms instead of their real names as usernames; Legal bases: Performance of a contract and pre-contractual measures (Art. 6(1) lit. b) GDPR).
  • User profiles are public: User profiles are publicly visible and accessible; Legal bases: Performance of a contract and pre-contractual measures (Art. 6(1) lit. b) GDPR).
  • Deletion of data after termination: When users terminate their user account, their data relating to the user account will be deleted, subject to any legal permission, obligation or user consent; Legal bases: Performance of a contract and pre-contractual measures (Art. 6(1) lit. b) GDPR).
  • No obligation to retain data: Users are responsible for backing up their data before the end of the contract after termination. We are entitled to permanently delete all user data stored during the contract period; Legal bases: Performance of a contract and pre-contractual measures (Art. 6(1) lit. b) GDPR).

 

 

Single sign-on function

We provide a single sign-on function for authentication. Single sign-on (SSO) is a login process that allows users to verify their identity through a third-party provider. This login feature can establish a direct connection between your browser and the provider's servers even if you do not have an account with the provider or are not logged in to one. The provider therefore receives information that you have visited our website. The information collected in this context (possibly including your IP address) is transmitted directly by your browser to a server operated by the provider and stored there. However, this information is not used to identify you personally and is not disclosed to third parties. If you click the login button to register on our website using the data from your account with the provider, the provider will transmit to us, solely on the basis of your explicit consent pursuant to Art. 6(1) lit. a GDPR, the general and publicly available information stored in your account (user ID, name, address, email address, age and gender). We store and use the data transmitted by the provider to create a user account with the necessary data, provided you have authorised the provider to do so. Conversely, with your consent, we may transfer data (e.g. information about your browsing or purchasing behaviour) to your account with the provider.

The consent given can be revoked at any time with effect for the future.

  • Types of data processed: Login data (e.g. title, first name, surname, address details, country, email address, date of birth, IP address, user ID, address, email address, age and gender)
  • Data subjects: Users (e.g. users of online services).
  • Purposes of processing: User-friendly and interactive design of the login process Legal bases: Legitimate interests in a user-friendly and interactive design of our online presence (Art. 6(1) lit. f) GDPR). If you click the login button to register on our website using the data from your account with the provider, the provider will transmit to us, solely on the basis of your explicit consent pursuant to Art. 6(1) lit. a GDPR, the general and publicly available information stored in your account

Further information on processing activities, procedures and services:

  • Google Sign-On Single sign-on function (SSO); Service provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland; In addition to transmitting data to the above-mentioned provider location, data may also be transmitted to: Google LLC, USA Legal bases: Legitimate interests (Art. 6(1) lit. f) GDPR), consent (for login) (Art. 6(1) lit. f) GDPR),; Website: https://support.google.com/ ; Privacy policy: https://business.safety.google/intl/de/privacy/
  • Facebook Connect Single sign-on function (SSO); Service provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; In addition to transmitting data to the above-mentioned provider location, data may also be transmitted to: Meta Platforms Inc., USA Legal bases: Legitimate interests (Art. 6(1) lit. f) GDPR), consent (for login) (Art. 6(1) lit. f) GDPR),; Website: https://www.facebook.com/ Privacy policy: https://de-de.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0
  • Apple Sign-On Single sign-on function (SSO); Service provider: Apple Inc., Infinite Loop, Cupertino, CA 95014, USA Legal bases: Legitimate interests (Art. 6(1) lit. f) GDPR), consent (for login) (Art. 6 (1) lit. f) GDPR),; Website: https://www.apple.com/de/; Privacy policy: https://www.apple.com/legal/privacy/de-ww/ .

Community features

The community features we provide allow users to engage in conversations or otherwise communicate with each other. In doing so, please note that the use of the community features is only permitted in accordance with applicable law, our terms and policies, and the rights of other users and third parties.

  • Types of data processed: Usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Provision of contractual services and customer service; security measures.
  • Legal bases: Performance of a contract and pre-contractual measures (Art. 6(1) lit. b) GDPR).

 

Further information on processing activities, procedures and services:

  • User posts are public: Posts and content created by users are publicly visible and accessible; Legal bases: Performance of a contract and pre-contractual measures (Art. 6(1) lit. b) GDPR).
  • Protection of your own data: Users decide which data they disclose about themselves within our online offer. For example, when users provide personal details or participate in conversations. We ask users to protect their data and to publish personal data only with due care and only to the extent necessary. In particular, we ask users to note that they must protect their login details especially carefully and use secure passwords (i.e. preferably long and random combinations of characters); Legal bases: Performance of a contract and pre-contractual measures (Art. 6(1) lit. b) GDPR).

Contact and enquiry management

When you contact us (e.g. via a contact form, email, telephone or social media) and within the context of existing user and business relationships, the details provided by the enquiring persons will be processed to the extent necessary to answer the contact enquiries and any requested measures.

Contact enquiries are answered and contact and enquiry data are managed within the context of contractual or pre-contractual relationships to fulfil our contractual obligations or to answer (pre)contractual enquiries and otherwise on the basis of legitimate interests in answering the enquiries and maintaining user or business relationships.

For the organisation and processing of enquiries, personal data will be collected to the extent provided, but at least name, first name and email address, transmitted to the provider, stored there and accessed.

When you contact us (e.g. via a contact form or email), personal data will be processed solely for the purpose of processing and answering your request and only to the extent necessary for that purpose.

Your data will be deleted when it can be inferred from the circumstances that the matter in question has been conclusively resolved and provided that there are no statutory retention obligations.

  • Types of data processed: Contact details (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Communication partners.
  • Purposes of processing: Provision of contractual services and customer service; contact enquiries and communication; management and answering of enquiries; feedback (e.g. collecting feedback via an online form); provision of our online offer and user-friendliness.
  • Legal bases: Performance of a contract and pre-contractual measures (Art. 6(1) lit. b) GDPR); legitimate interests in the efficient design of our customer service, in answering your request as quickly as possible and in optimising our service offer (Art. 6(1) lit. f) GDPR).

 

Further information on processing activities, procedures and services:

Push Notifications

With the users' consent, we can send users so-called "push notifications". These are messages that are displayed on users' screens, devices or browsers, even when our online service is not currently in use.

To sign up for push notifications, users must confirm their browser or device prompt to receive push notifications. This consent process is documented and stored. Storage is necessary to identify whether users have consented to receive push notifications and to be able to demonstrate consent. For these purposes, a pseudonymous browser identifier (so-called "push token") or the device ID of a device is stored.

Push notifications may be necessary, on the one hand, to fulfill contractual obligations (e.g. technical and organizational information relevant to the use of our online offer) and are otherwise sent based on the users' consent, unless specifically stated below. Users can change their receipt of push notifications at any time using the notification settings of their respective browser or device.

  • Types of data processed: Usage data (e.g. visited websites, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Communication partners.
  • Purposes of processing: Provision of our online offer and user-friendliness.
  • Legal basis: Consent (Art. 6(1)(a) GDPR); performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).

 

Profiling, Business and Marketing Analytics

We process your personal data for business and marketing analytics purposes to improve the product, analyze whether and how the membership content is used, and to improve and ensure the services, so that the membership continues to meet the needs of members over an extended period.

· Types of data processed: Account data (e.g. names, addresses); contact details (e.g. email, phone numbers); meta/communication data (e.g. device information, IP addresses); usage data (e.g. visited websites, interest in content, access times).

· Data subjects: Participants, customers.

· Purposes of processing : Profiling, business and marketing analytics.

· Legal basis : Legitimate interests (Art. 6(1)(f) GDPR).

· Right to object: You can object to the use of your data for profiling, business and marketing analytics at any time.

Further information on processing activities, procedures and services:

Amplitude Inc: Market analysis service; service provider: Amplitude Inc., 201 3rd Street Suite 200, San Francisco, California 94103; legal basis: legitimate interests (Art. 6(1)(f) GDPR); Website: https://amplitude.com/ . Privacy Notice: https://amplitude.com/amplitude-security-and-privacy ; Data Processing Agreement: Provided by the service provider, https://amplitude.com/dpa .

Newsletters and Electronic Notifications

We only send newsletters, emails and other electronic notifications (hereinafter "newsletters") with the consent of the recipients or with legal permission. If the contents of a newsletter signup are specifically described, they shall determine the scope of the users' consent. Otherwise, our newsletters contain information about our services and ourselves.

To sign up for our newsletters, it is generally sufficient to provide your email address. However, we may ask you to provide a name for personal address in the newsletter, or other information, provided that this is necessary for the purposes of the newsletter.

Double opt-in procedure: Signups for our newsletter are generally carried out using a so-called double opt-in procedure. This means that after signing up, you will receive an email asking you to confirm your signup. This confirmation is necessary to prevent anyone from signing up using someone else's email address. Newsletter signups are logged so that the signup process can be demonstrated to comply with legal requirements. This includes storing the time of signup and confirmation, as well as the IP address. Changes to your data stored with the service provider are also logged.

Deletion and restriction of processing: We can store submitted email addresses for up to three years based on our legitimate interests before deleting them to demonstrate that consent was previously given. The processing of this data is restricted to the purpose of defending potential claims. An individual deletion request can be made at any time, provided that the former existence of consent is also confirmed. In cases of obligations to permanently respect objections, we reserve the right to store the email address solely for this purpose on a blocklist (so-called "blocklist").

The logging of the signup process is carried out based on our legitimate interests for the purpose of demonstrating its proper operation. Where we commission a service provider to send emails, this is done based on our legitimate interests in an efficient and secure sending system.

Content:

Information about us, our services, promotions and offers.

  • Types of data processed: Account data (e.g. names, addresses); contact details (e.g. email, phone numbers); meta/communication data (e.g. device information, IP addresses); usage data (e.g. visited websites, interest in content, access times).
  • Data subjects: Communication partners.
  • Purposes of processing: Direct marketing (e.g. by email or post); reach measurement (e.g. access statistics, detection of returning visitors).
  • Legal basis: Consent (Art. 6(1)(a) GDPR).
  • Right to object (opt-out): You can unsubscribe from our newsletter at any time, i.e. withdraw your consent or object to further receipt. You can find a link to unsubscribe from the newsletter either at the end of every newsletter or can otherwise use one of the contact options provided above, preferably email.

Further information on processing activities, procedures and services:

  • Klaviyo: Email marketing platform; Service provider: Klaviyo, Inc., 125 Summer St., Ste 600, Boston, MA 02110, USA; Legal basis: Based on our legitimate interest in effective and user-friendly newsletter marketing, we pass on the data you provided when signing up for the newsletter to this provider pursuant to Art. 6(1)(f) GDPR, so that it can handle the newsletter distribution on our behalf. Subject to your express consent pursuant to Art. 6(1)(a) GDPR, the provider also performs a statistical success evaluation of newsletter campaigns using web beacons or tracking pixels in the sent emails that can measure open rates and specific interactions with the newsletter content. Device information (e.g. time of access, IP address, browser type and operating system) is also collected and evaluated, but not combined with other data sets.; Website: https://www.klaviyo.com/; Privacy Notice: https://www.klaviyo.com/legal/data-processing-agreement ; Data Processing Agreement: We have concluded a data processing agreement with the provider. For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection based on an adequacy decision by the European Commission.

Sweepstakes and competitions

We only process personal data of participants in sweepstakes and competitions in compliance with the relevant data protection provisions, insofar as processing is contractually necessary to provide, conduct and administer the sweepstake, the participants have consented to the processing, or the processing serves our legitimate interests (e.g. the security of the sweepstake or the protection of our interests from misuse by potentially collecting IP addresses when sweepstake entries are submitted).

If participants' entries are published as part of the sweepstakes (e.g. as part of a vote or presentation of the sweepstake entries or the winners or reporting on the sweepstake), we point out that the names of the participants may also be published in this context. Participants can object to this at any time.

If the sweepstake takes place on an online platform or social network (e.g. Facebook or Instagram, hereinafter referred to as the "online platform"), the terms of use and privacy provisions of the respective platforms also apply. In these cases, we point out that we are responsible for the information provided by the participants in the context of the sweepstake and that inquiries regarding the sweepstake should be directed to us.

The participants' data will be deleted as soon as the sweepstake or competition has ended and the data is no longer required to inform the winners or because follow-up questions about the sweepstake are expected. In principle, the participants' data will be deleted at the latest 6 months after the end of the sweepstake. Winners' data may be retained longer, for example to answer follow-up questions about the prizes or to fulfill the prize obligations; in this case, the retention period depends on the type of prize and is, for example, up to three years for goods or services, to process warranty claims, for example. Furthermore, the participants' data may be stored longer, for example in the form of reporting on the sweepstake in online and offline media.

If data was also collected for other purposes as part of the sweepstake, its processing and retention period are governed by the privacy notices for that use (e.g. in the case of signing up for the newsletter as part of a sweepstake).

  • Types of data processed: Account data (e.g. names, addresses); content data (e.g. entries in online forms); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Sweepstake and competition participants.
  • Purposes of processing: Conducting sweepstakes and competitions.
  • Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).

Surveys and questionnaires

We conduct surveys and questionnaires to collect information for the respective communicated survey or questionnaire purpose. The surveys and questionnaires we conduct (hereinafter "questionnaires") are evaluated anonymously. Personal data is only processed to the extent necessary to provide and technically conduct the surveys (e.g. processing the IP address to display the survey in the user's browser or using a cookie to enable the resumption of the survey).

  • Types of data processed: Contact details (e.g. email, phone numbers); content data (e.g. entries in online forms); usage data (e.g. visited websites, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Communication partners; participants.
  • Purposes of processing: Feedback (e.g. collecting feedback via an online form).
  • Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

Changes and updates to the privacy notice

We ask you to regularly inform yourself about the content of our privacy notice. We update the privacy notice as soon as changes to the data processing we conduct make this necessary. We will inform you as soon as changes require an action on your part (e.g. consent) or any other individual notification.

If we provide addresses and contact information of companies and organizations in this privacy notice, please note that addresses may change over time and please check the information before contacting us.

Rights of data subjects

As a data subject, you have various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

  • Right to object: You have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data relating to you that takes place based on Art. 6(1)(e) or (f) GDPR, this also applies to profiling based on these provisions. If your personal data is processed for direct marketing, you have the right at any time to object to the processing of personal data relating to you for such marketing purposes; this also applies to profiling insofar as it is linked to such direct marketing.
  • Right to withdraw consent: You have the right to withdraw consent at any time.
  • Right of access: You have the right to request confirmation as to whether data relating to you is being processed and to access such data as well as further information and a copy of the data in accordance with legal requirements.
  • Right to rectification: You have the right, in accordance with legal requirements, to request the completion of data relating to you or the rectification of incorrect data relating to you.
  • Right to erasure and restriction of processing: You have the right, in accordance with legal requirements, to request that data relating to you be erased without delay or, alternatively, in accordance with legal requirements, to request a restriction of the processing of the data.
  • Right to data portability: You have the right, in accordance with legal requirements, to receive data relating to you that you have provided to us in a structured, commonly used and machine-readable format or to request its transmission to another data controller.
  • Right to lodge a complaint with a supervisory authority: In accordance with legal requirements and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular with a supervisory authority in the Member State in which you habitually reside, the supervisory authority of your place of work or the place where the alleged infringement occurred, if you consider that the processing of personal data relating to you violates the GDPR.

Definitions

This section provides an overview of the terms used in this privacy notice. Many of the terms are taken from the law and are defined primarily in Art. 4 GDPR. The statutory definitions are binding. The following explanations, on the other hand, are intended primarily for understanding. The terms are sorted alphabetically.

  • Personal data: “Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); a natural person is considered identifiable if they can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  • Reach measurement: Reach measurement (also known as web analytics) is used to evaluate visitor traffic to an online offer and may include the behavior or interests of visitors in certain information, such as website content. With the help of reach analysis, website owners can, for example, identify when visitors visit their website and what content they are interested in. This allows them to, for example, better adapt the website content to the needs of their visitors. For reach analysis purposes, pseudonymous cookies and web beacons are often used to identify returning visitors and thus obtain more accurate analyses of the use of an online offer.
  • Location data: Location data are generated when a mobile device (or another device with the technical requirements for location determination) connects to a radio cell, a Wi-Fi network, or similar technical means and functions for location determination. Location data indicate the geographically determinable position on Earth where the respective device is located. Location data can be used, for example, to display map functions or other location-dependent information.
  • Location history and movement profiles: Location history (also referred to as a “movement profile”) refers to the collection of location data over a certain period of time. Location history allows for inferences to be drawn about the geographical movements (i.e. changes in position) of devices or their users.
  • Controller: The “controller” means the natural or legal person, authority, body or other entity that alone or jointly with others determines the purposes and means of processing personal data.
  • Processing: “Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers virtually every type of handling of data, whether it is collection, analysis, storage, transmission or erasure.