Privacy Policy

Privacy Policy

Thank you for your interest in our company. Data protection is particularly important to the management of M&D Florida Services Inc. In general, our website can be used without providing personal data. However, processing personal data may become necessary when a data subject wishes to use particular services of our company through our website. If processing is necessary and there is no statutory basis for it, we generally obtain the consent of the data subject.

Personal data, such as a data subject’s name, address, email address or telephone number, are always processed in accordance with the General Data Protection Regulation and the country-specific data protection provisions applicable to M&D Florida Services Inc. This privacy policy informs the public about the nature, scope and purpose of the personal data we collect, use and process. It also explains the rights available to data subjects.

As the controller, M&D Florida Services Inc. has implemented numerous technical and organisational measures to ensure the most comprehensive protection possible for personal data processed through this website. Nevertheless, internet-based data transfers may have security vulnerabilities, so absolute protection cannot be guaranteed. Data subjects are therefore free to provide personal data to us by alternative means, such as telephone.

1. Definitions

The privacy policy of M&D Florida Services Inc. is based on the terminology used by the European legislator when adopting the General Data Protection Regulation (GDPR). Our policy should be easy to read and understand for the public, our customers and business partners. We therefore first explain the terminology used. This privacy policy uses the following terms, among others:

  • a) Personal data: Personal data means any information relating to an identified or identifiable natural person (the “data subject”). A natural person is identifiable if they can be identified, directly or indirectly, particularly by reference to an identifier such as a name, identification number, location data, online identifier or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
  • b) Data subject: A data subject is any identified or identifiable natural person whose personal data are processed by the controller.
  • c) Processing: Processing means any operation or set of operations performed on personal data, with or without automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
  • d) Restriction of processing: Restriction of processing means marking stored personal data with the aim of limiting their processing in the future.
  • e) Profiling: Profiling means any form of automated processing of personal data that uses those data to evaluate personal aspects relating to a natural person, particularly to analyse or predict aspects concerning performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
  • f) Pseudonymisation: Pseudonymisation means processing personal data so that they can no longer be attributed to a specific data subject without additional information, provided that the additional information is kept separately and subject to technical and organisational measures ensuring that the data are not attributed to an identified or identifiable natural person.
  • g) Controller: The controller is the natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of processing personal data. Where these purposes and means are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by that law.
  • h) Processor: A processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.
  • i) Recipient: A recipient is a natural or legal person, public authority, agency or other body to which personal data are disclosed, whether or not it is a third party. Public authorities that may receive personal data in the framework of a particular inquiry under Union or Member State law are not regarded as recipients.
  • j) Third party: A third party is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
  • k) Consent: Consent means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they signify agreement to processing their personal data, through a statement or clear affirmative action.

2. Name and address of the controller

The controller within the meaning of the GDPR, other data protection laws applicable in European Union Member States and other provisions relating to data protection is:

M&D Florida Services Inc.

1014 Buttercup Gln

Bradenton, FL 34212

USA

Phone: +1(239)677-7538

Email: info@md-florida.com

Website: www.md-florida.com

3. Cookies

The websites of M&D Florida Services Inc. use cookies. Cookies are text files placed and stored on a computer system through an internet browser.

Many websites and servers use cookies. Many cookies contain a cookie ID, a unique identifier consisting of a string of characters that enables websites and servers to identify the particular browser in which the cookie was stored. This allows visited websites and servers to distinguish the data subject’s browser from other browsers containing different cookies. A particular browser can be recognised and identified through its unique cookie ID.

Cookies allow M&D Florida Services Inc. to provide more user-friendly services that would not be possible without cookies.

Cookies can optimise the information and services on our website for the user. As mentioned above, they allow us to recognise users and make the website easier to use. For example, users of a website that uses cookies do not have to enter their login details on every visit, because the website and the cookie stored on their computer handle this. Another example is an online shop’s shopping-cart cookie, which remembers the items a customer has placed in the virtual cart.

Data subjects can prevent our website from setting cookies at any time by adjusting their browser settings, thereby permanently objecting to cookies. Cookies already set can also be deleted at any time through a browser or other software. This is possible in all commonly used browsers. If cookies are disabled, some functions of our website may not be fully available.

4. Collection of general data and information

Whenever a data subject or automated system accesses the website of M&D Florida Services Inc., it collects general data and information stored in the server log files. These may include (1) browser types and versions, (2) the accessing system’s operating system, (3) the website from which the system reaches our website (the referrer), (4) the subpages accessed on our website, (5) the date and time of access, (6) an Internet Protocol (IP) address, (7) the accessing system’s internet service provider and (8) other similar data and information used to defend against attacks on our information technology systems.

M&D Florida Services Inc. does not use these general data and information to draw conclusions about the data subject. They are needed to (1) deliver our website’s content correctly, (2) optimise the website’s content and advertising, (3) ensure the continued operation of our information technology systems and website technology and (4) provide law enforcement authorities with the information necessary for prosecution in the event of a cyberattack. We therefore analyse these anonymously collected data statistically and to improve data protection and security within our company, with the aim of ensuring an optimal level of protection for the personal data we process. Anonymous server-log data are stored separately from personal data supplied by a data subject.

5. Registration on our website

Data subjects can register on the controller’s website by providing personal data. The registration form shows which data are transmitted to the controller. Personal data entered by the data subject are collected and stored exclusively for the controller’s internal use and own purposes. The controller may arrange for data to be passed to one or more processors, such as a parcel delivery service, which also uses the data exclusively for internal purposes attributable to the controller.

Registration also records the IP address assigned by the data subject’s internet service provider (ISP), and the date and time of registration. This information is stored because it is necessary to prevent misuse of our services and, if needed, to investigate offences. Storage is therefore necessary to safeguard the controller. In general, these data are not disclosed to third parties unless disclosure is required by law or serves law enforcement.

Registration involving the voluntary provision of personal data allows the controller to offer content or services that, by their nature, can only be offered to registered users. Registered persons may change the personal data provided during registration at any time or have them completely deleted from the controller’s records.

On request, the controller will inform any data subject at any time of the personal data stored about them. The controller will also correct or erase personal data at the data subject’s request or instruction, unless statutory retention obligations prevent this. All of the controller’s employees are available as contacts for this purpose.

6. Subscription to our newsletter

Users of the M&D Florida Services Inc. website can subscribe to our company’s newsletter. The subscription form shows which personal data are transmitted to the controller.

M&D Florida Services Inc. regularly informs customers and business partners about company offers by newsletter. A data subject can generally receive the newsletter only if (1) they have a valid email address and (2) they register for the newsletter. For legal reasons, a confirmation email using the double opt-in procedure is sent to an email address entered for the first time. This verifies that the owner of the email address has authorised receipt of the newsletter.

When a person subscribes to the newsletter, we also store the IP address assigned by the ISP to the computer used at the time of registration, and the registration date and time. These data are necessary to trace any possible misuse of an email address at a later stage and therefore provide legal protection for the controller.

Personal data collected when subscribing are used exclusively to send our newsletter. Subscribers may also be informed by email where necessary for the operation of the newsletter service or registration, for example if the newsletter offering or technical circumstances change. Personal data collected as part of the newsletter service are not passed to third parties. Data subjects may cancel their subscription at any time and withdraw their consent to storage of the data provided for newsletter delivery. Each newsletter contains a link for withdrawing consent. Users can also unsubscribe directly on the controller’s website or inform the controller by another means.

7. Newsletter tracking

The newsletters of M&D Florida Services Inc. contain tracking pixels. A tracking pixel is a miniature graphic embedded in HTML emails to enable log-file recording and analysis, allowing statistical evaluation of the success or failure of online marketing campaigns. The embedded pixel allows M&D Florida Services Inc. to determine whether and when a data subject opened an email and which links in the email they followed.

The controller stores and analyses personal data collected through newsletter tracking pixels to optimise delivery and better adapt future newsletters to subscribers’ interests. These data are not disclosed to third parties. Data subjects may withdraw the separate consent given through the double opt-in procedure at any time. Following withdrawal, the controller deletes these personal data. M&D Florida Services Inc. automatically treats unsubscribing from the newsletter as withdrawal of consent.

8. Contact through the website

Under statutory provisions, the M&D Florida Services Inc. website contains information enabling rapid electronic contact and direct communication with our company, including a general email address. If a data subject contacts the controller by email or through a contact form, the personal data transmitted are automatically stored. Data voluntarily transmitted in this way are stored to handle the inquiry or contact the data subject. These personal data are not disclosed to third parties.

9. Comments in the website blog

M&D Florida Services Inc. allows users to leave individual comments on blog posts on the controller’s website. A blog is a generally publicly accessible website portal where one or more people, known as bloggers or web bloggers, post articles or record thoughts in blog posts. Third parties can generally comment on these posts.

If a data subject leaves a comment on this website’s blog, the comment, the time it was submitted and the chosen username (pseudonym) are stored and published. The IP address assigned by the ISP is also logged. The IP address is stored for security reasons and in case a comment infringes third-party rights or contains unlawful content. Storage is therefore in the controller’s own interest, enabling it to establish that it was not responsible if a legal violation occurs. These data are not disclosed to third parties unless required by law or necessary for the controller’s legal defence.

10. Subscription to blog comments

Third parties can generally subscribe to comments made in the M&D Florida Services Inc. blog. In particular, a commenter may subscribe to subsequent comments on a particular blog post.

If a data subject subscribes to comments, the controller sends an automatic confirmation email using the double opt-in procedure to verify that the owner of the supplied email address selected this option. The subscription can be ended at any time.

11. Routine erasure and blocking of personal data

The controller processes and stores personal data only for the period necessary to achieve the purpose of storage, or for a period provided for by the European legislator or another legislator in laws or regulations to which the controller is subject.

If the purpose of storage ceases to apply or a retention period prescribed by the European legislator or another competent legislator expires, personal data are routinely blocked or erased in accordance with statutory provisions.

12. Rights of the data subject

  • a) Right to confirmation: Every data subject has the right granted by the European legislator to obtain confirmation from the controller as to whether personal data concerning them are being processed. To exercise this right, a data subject may contact an employee of the controller at any time.
  • b) Right of access: Every data subject whose personal data are processed has the right granted by the European legislator to obtain, free of charge and at any time, information from the controller about personal data stored concerning them and a copy of those data. The European legislator also grants access to the following information:
    • the purposes of processing
    • the categories of personal data being processed
    • the recipients or categories of recipients to whom personal data have been or will be disclosed, particularly recipients in third countries or international organisations
    • where possible, the planned period of storage, or, if this is not possible, the criteria used to determine that period
    • the existence of the right to request rectification or erasure of personal data or restriction of processing by the controller, or to object to processing
    • the existence of the right to lodge a complaint with a supervisory authority
    • where personal data are not collected from the data subject, any available information about their source
    • the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved and the significance and envisaged consequences of such processing for the data subject

    The data subject also has the right to information about whether personal data have been transferred to a third country or international organisation. If so, they have the right to information about appropriate safeguards relating to the transfer. To exercise this right of access, a data subject may contact an employee of the controller at any time.

  • c) Right to rectification: Every data subject whose personal data are processed has the right granted by the European legislator to obtain rectification of inaccurate personal data concerning them without undue delay. Taking account of the purposes of processing, they also have the right to have incomplete personal data completed, including by providing a supplementary statement. To exercise this right, a data subject may contact an employee of the controller at any time.
  • d) Right to erasure (right to be forgotten): Every data subject whose personal data are processed has the right granted by the European legislator to obtain erasure from the controller without undue delay where one of the following grounds applies and processing is not necessary:
    • The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
    • The data subject withdraws consent on which processing was based under Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal ground for processing.
    • The data subject objects to processing under Article 21(1) GDPR and there are no overriding legitimate grounds for processing, or objects under Article 21(2) GDPR.
    • The personal data have been unlawfully processed.
    • The personal data must be erased to comply with a legal obligation under Union or Member State law to which the controller is subject.
    • The personal data were collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

    If one of these grounds applies and a data subject wishes to have personal data stored by M&D Florida Services Inc. erased, they may contact an employee of the controller at any time. The employee will arrange for the request to be fulfilled without undue delay. If M&D Florida Services Inc. has made personal data public and is obliged as controller to erase them under Article 17(1) GDPR, it will take reasonable steps, including technical measures, taking account of available technology and implementation costs, to inform other controllers processing the published data that the data subject has requested erasure of all links to, or copies or replications of, those data, insofar as processing is not necessary. The employee will arrange the necessary measures in each individual case.

  • e) Right to restriction of processing: Every data subject whose personal data are processed has the right granted by the European legislator to obtain restriction of processing from the controller where one of the following conditions applies:
    • The data subject contests the accuracy of the personal data, for a period enabling the controller to verify their accuracy.
    • Processing is unlawful and the data subject opposes erasure, requesting restriction of use instead.
    • The controller no longer needs the personal data for processing purposes, but the data subject needs them to establish, exercise or defend legal claims.
    • The data subject has objected to processing under Article 21(1) GDPR, pending verification of whether the controller’s legitimate grounds override those of the data subject.

    If one of these conditions applies and a data subject wishes to request restriction of personal data stored by M&D Florida Services Inc., they may contact an employee of the controller at any time. The employee will arrange restriction of processing.

  • f) Right to data portability: Every data subject whose personal data are processed has the right granted by the European legislator to receive personal data concerning them that they provided to a controller in a structured, commonly used and machine-readable format. They also have the right to transmit those data to another controller without hindrance from the controller to which they were provided, where processing is based on consent under Article 6(1)(a) or Article 9(2)(a) GDPR or a contract under Article 6(1)(b) GDPR, and is carried out by automated means, unless processing is necessary for a task performed in the public interest or in the exercise of official authority vested in the controller. When exercising this right under Article 20(1) GDPR, the data subject also has the right to have data transmitted directly between controllers where technically feasible, provided this does not adversely affect the rights and freedoms of others. To exercise the right to portability, a data subject may contact an employee of M&D Florida Services Inc. at any time.
  • g) Right to object: Every data subject whose personal data are processed has the right granted by the European legislator to object at any time, on grounds relating to their particular situation, to processing under Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. M&D Florida Services Inc. will no longer process the data following an objection unless it demonstrates compelling legitimate grounds that override the data subject’s interests, rights and freedoms, or processing serves the establishment, exercise or defence of legal claims. Where M&D Florida Services Inc. processes data for direct marketing, the data subject may object at any time to such processing, including profiling related to direct marketing. Following an objection, M&D Florida Services Inc. will no longer process the data for those purposes. The data subject also has the right, on grounds relating to their particular situation, to object to processing by M&D Florida Services Inc. for scientific or historical research or statistical purposes under Article 89(1) GDPR, unless necessary for a task carried out for reasons of public interest. To exercise this right, the data subject may contact any employee of M&D Florida Services Inc. or another employee directly. In connection with the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may also exercise the right to object by automated means using technical specifications.
  • h) Automated individual decision-making, including profiling: Every data subject whose personal data are processed has the right granted by the European legislator not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision (1) is necessary for entering into or performing a contract between the data subject and the controller, (2) is authorised by Union or Member State law to which the controller is subject and which provides suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests, or (3) is based on explicit consent. Where a decision (1) is necessary for entering into or performing a contract or (2) is based on explicit consent, M&D Florida Services Inc. will implement suitable safeguards, including at least the right to obtain human intervention by the controller, express their point of view and contest the decision. To exercise rights relating to automated decisions, the data subject may contact an employee of the controller at any time.
  • i) Right to withdraw consent: Every data subject whose personal data are processed has the right granted by the European legislator to withdraw consent to processing at any time. To exercise this right, the data subject may contact an employee of the controller at any time.

13. Data protection provisions concerning Facebook

The controller has integrated components of Facebook on this website. Facebook is a social network.

A social network is an online meeting place and community that generally enables users to communicate and interact virtually. It can serve as a platform for sharing opinions and experiences or allow users to provide personal or business information. Facebook enables users, among other things, to create personal profiles, upload photos and connect through friend requests.

Facebook is operated by Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. If a data subject lives outside the USA or Canada, the controller responsible for processing personal data is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Each visit to a page of this website operated by the controller that contains a Facebook component (Facebook plug-in) automatically causes the data subject’s browser to download a display of the relevant component from Facebook. An overview of all Facebook plug-ins is available at https://developers.facebook.com/docs/plugins/?locale=de_DE. During this technical process, Facebook learns which specific subpage of our website the data subject visits.

If the data subject is logged into Facebook at the same time, Facebook recognises which subpage they visit each time they access our website and throughout their visit. The Facebook component collects this information and associates it with their Facebook account. If the data subject clicks a Facebook button integrated into our website, such as “Like”, or submits a comment, Facebook assigns this information to their personal account and stores these personal data.

Facebook receives information through the component that the data subject has visited our website whenever they are logged into Facebook at the time of access, whether or not they click the component. To prevent this transfer, the data subject can log out of Facebook before visiting our website.

Facebook’s data policy, available at https://de-de.facebook.com/about/privacy/, explains its collection, processing and use of personal data and the privacy settings it offers. Various applications are also available to prevent data transmission to Facebook; data subjects can use these to suppress such transfers.

14. Data protection provisions concerning Google AdSense

The controller has integrated Google AdSense on this website. Google AdSense is an online service that places advertising on third-party websites. It uses an algorithm to select adverts matching the content of those websites. Google AdSense enables interest-based targeting through the creation of individual user profiles.

The Google AdSense component is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland.

The purpose of Google AdSense is to display adverts on our website. AdSense places a cookie on the data subject’s computer system, enabling Alphabet Inc. to analyse use of our website. Cookies are explained above. Each visit to a page operated by the controller that contains an AdSense component automatically causes the browser to transmit data to Alphabet Inc. for online advertising and commission accounting. During this process, Alphabet Inc. receives personal data, such as the data subject’s IP address, which it uses, among other things, to trace the origin of visitors and clicks and calculate commissions.

As explained above, the data subject may prevent cookies through browser settings and thereby permanently object to their use. This would also prevent Alphabet Inc. from setting a cookie on their computer. Cookies already set by Alphabet Inc. can be deleted at any time through the browser or other software.

Google AdSense also uses tracking pixels: miniature graphics embedded in websites to enable log-file recording and analysis and statistical evaluation. They allow Alphabet Inc. to identify whether and when a data subject opened a website and which links they clicked. Tracking pixels are used, among other things, to evaluate visitor flows.

Google AdSense transmits personal data and information, including the IP address, necessary to record and account for displayed adverts to Alphabet Inc. in the United States. These data are stored and processed there. Alphabet Inc. may disclose data collected through this technical process to third parties.

Google AdSense is explained in more detail at https://www.google.de/intl/de/adsense/start/.

15. Data protection provisions concerning Google Analytics (with anonymisation)

The controller has integrated Google Analytics with an anonymisation function on this website. Google Analytics is a web analytics service. Web analytics involves collecting and evaluating data about website visitors’ behaviour, including the website from which a data subject arrived (the referrer), the subpages accessed, how often they were viewed and for how long. Web analytics is primarily used to optimise websites and assess the costs and benefits of online advertising.

The Google Analytics component is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland.

The controller uses the “_gat._anonymizeIp” extension for Google Analytics web analytics. This causes Google to shorten and anonymise the IP address of the data subject’s internet connection when access to our website originates from a European Union Member State or another state party to the Agreement on the European Economic Area.

Google Analytics analyses visitor flows on our website. Google uses the data and information obtained to evaluate website use, compile online reports showing activity on our website and provide other services connected with its use.

Google Analytics sets a cookie on the data subject’s computer system. Cookies are explained above. This enables Google to analyse use of our website. Each visit to a page operated by the controller that contains a Google Analytics component automatically causes the browser to transmit data to Google for online analysis. Google receives personal data, such as the data subject’s IP address, used, among other things, to trace the origin of visitors and clicks and subsequently calculate commissions.

The cookie stores personal information such as access time, the location from which access occurred and the frequency of the data subject’s visits. On each visit, these data, including the IP address of the internet connection, are transmitted to Google in the United States and stored there. Google may disclose data collected through this technical process to third parties.

As explained above, the data subject may prevent cookies through browser settings and thereby permanently object to their use. This would also prevent Google from setting a cookie on their computer. Cookies already set by Google Analytics can be deleted at any time through the browser or other software.

Data subjects may also object to and prevent Google Analytics from collecting data generated about their use of this website and Google’s processing of those data. They must download and install the browser add-on at https://tools.google.com/dlpage/gaoptout. Through JavaScript, the add-on tells Google Analytics that data about website visits must not be transmitted. Google treats installation as an objection. If the computer system is later erased, formatted or reinstalled, the add-on must be reinstalled to disable Google Analytics. If the data subject or another person under their control uninstalls or disables it, it can be reinstalled or reactivated.

Further information and Google’s applicable privacy provisions are available at https://www.google.de/intl/de/policies/privacy/ and http://www.google.com/analytics/terms/de.html. Google Analytics is explained at https://www.google.com/intl/de_de/analytics/.

16. Data protection provisions concerning Google AdWords

The controller has integrated Google AdWords on this website. AdWords is an online advertising service allowing advertisers to display adverts in Google search results and its advertising network. Advertisers can define keywords so that an advert appears in Google search results only when a user searches for a relevant term. In Google’s advertising network, adverts are distributed to relevant websites using an automated algorithm and the specified keywords.

Google AdWords services are operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland.

Google AdWords promotes our website through interest-relevant advertising on third-party websites and in Google search results, and displays third-party advertising on our website.

If a data subject reaches our website through a Google advert, Google places a conversion cookie on their computer system. Cookies are explained above. A conversion cookie expires after thirty days and does not identify the data subject. Before expiry, it tracks whether certain subpages, such as an online shop’s shopping cart, were visited. It allows us and Google to determine whether a visitor arriving through an AdWords advert generated sales, completed a purchase or abandoned it.

Google uses data collected through conversion cookies to create visitor statistics for our website. We use these statistics to determine the total number of users referred through AdWords adverts, assess their success or failure and optimise future adverts. Neither our company nor other AdWords advertisers receive information from Google that could identify the data subject.

Conversion cookies store personal information, such as websites visited. On each visit to our website, personal data, including the IP address of the data subject’s internet connection, are transmitted to Google in the United States and stored there. Google may disclose data collected through this technical process to third parties.

As explained above, data subjects may prevent cookies through browser settings and permanently object to their use. This would also prevent Google from setting a conversion cookie on their computer. Cookies already set by AdWords can be deleted at any time through the browser or other software.

Data subjects may also object to Google’s interest-based advertising by visiting www.google.de/settings/ads in each browser they use and adjusting the settings there.

Further information and Google’s applicable privacy provisions are available at https://www.google.de/intl/de/policies/privacy/.

17. Data protection provisions concerning Instagram

The controller has integrated Instagram components on this website. Instagram is an audiovisual platform that allows users to share photos and videos and redistribute these data through other social networks.

Instagram services are operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland.

Each visit to a page operated by the controller that contains an Instagram component (Insta button) automatically causes the data subject’s browser to download a display of the relevant component from Instagram. During this technical process, Instagram learns which specific subpage of our website is visited.

If the data subject is logged into Instagram at the same time, Instagram recognises which subpage they visit each time they access our website and throughout their visit. The component collects this information and associates it with their Instagram account. If they click an Instagram button on our website, the transmitted data and information are associated with their personal account and stored and processed by Instagram.

Instagram receives information through the component that the data subject has visited our website whenever they are logged in at the time of access, whether or not they click it. To prevent this transfer, the data subject can log out of Instagram before visiting our website.

Further information and Instagram’s applicable privacy provisions are available at https://help.instagram.com/155833707900388 and https://www.instagram.com/about/legal/privacy/.

18. Data protection provisions concerning YouTube

The controller has integrated YouTube components on this website. YouTube is an internet video portal enabling publishers to upload video clips free of charge and other users to watch, rate and comment on them free of charge. YouTube allows all types of videos, including complete films and television programmes, music videos, trailers and user-made videos.

YouTube is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland.

Each visit to a page operated by the controller that contains a YouTube component (video) automatically causes the data subject’s browser to download a display of the component from YouTube. Further information is available at https://www.youtube.com/yt/about/de/. During this technical process, YouTube and Google learn which specific subpage of our website is visited.

If the data subject is logged into YouTube at the same time, YouTube recognises which subpage they visit when accessing a page containing a video. YouTube and Google collect this information and associate it with the relevant YouTube account.

YouTube and Google receive information through the component that the data subject has visited our website whenever they are logged into YouTube at the time of access, whether or not they click a video. To prevent this transfer, the data subject can log out of YouTube before visiting our website.

YouTube’s privacy provisions, available at https://www.google.de/intl/de/policies/privacy/, explain the collection, processing and use of personal data by YouTube and Google.

19. Legal basis for processing

Article 6(1)(a) GDPR is the legal basis for processing where our company obtains consent for a specific purpose. If processing is necessary to perform a contract to which the data subject is a party, such as delivering goods or providing a service or consideration, it is based on Article 6(1)(b) GDPR. This also applies to processing necessary for pre-contractual measures, such as inquiries about our products or services. If our company is subject to a legal obligation requiring processing, such as tax obligations, processing is based on Article 6(1)(c) GDPR. In rare cases, processing may be necessary to protect vital interests of the data subject or another natural person. For example, if a visitor is injured on our premises and their name, age, health insurance details or other vital information must be given to a doctor, hospital or other third party, processing would be based on Article 6(1)(d) GDPR. Finally, processing may be based on Article 6(1)(f) GDPR where none of these grounds apply and processing is necessary for our company’s or a third party’s legitimate interests, unless the data subject’s interests, fundamental rights and freedoms override them. The European legislator expressly mentioned such processing and considered that a legitimate interest may exist where the data subject is a customer of the controller (Recital 47, sentence 2, GDPR).

20. Legitimate interests pursued by the controller or a third party

Where processing is based on Article 6(1)(f) GDPR, our legitimate interest is conducting our business for the well-being of all employees and shareholders.

21. Period for which personal data are stored

The applicable statutory retention period determines how long personal data are stored. Once that period expires, the data are routinely erased unless still required to perform or enter into a contract.

22. Statutory or contractual requirements to provide personal data; necessity for entering into a contract; the data subject’s obligation to provide data; possible consequences of failure to provide them

Providing personal data may be required by law, such as tax provisions, or arise from contractual terms, such as details of a contracting party. Entering into a contract may require a data subject to provide personal data that we must then process. For example, a data subject is obliged to provide personal data if our company enters into a contract with them. Failure to provide those data would mean the contract could not be concluded. Before providing personal data, the data subject must contact one of our employees. The employee will explain, for the individual case, whether providing the data is required by law or contract or necessary to enter into a contract, whether there is an obligation to provide them, and the consequences of failing to do so.

23. Automated decision-making

As a responsible company, we do not use automated decision-making or profiling.

This privacy policy was created using the privacy policy generator of DGD Deutsche Gesellschaft für Datenschutz GmbH, which acts as an external data protection officer in Kempten in cooperation with IT and data protection lawyer Christian Solmecke.