I. Name of the person responsible
The person responsible within the meaning of the GDPR and other national data protection laws of the member states as well as other data protection regulations is the
Sendlinger Straße 7
Email: [email protected] | Website: www.usercentrics.com
II. Data Protection Officer
You can contact our data protection officer under:
SECUWING GmbH & Co. KG
E-mail: [email protected] | Phone: +49 821 90786450 | Fax: +49 821 90786459
III. General information about the collection and processing of your data
1. Scope of processing
In principle, we process personal data only insofar as this is necessary to provide a functioning website and our content and services. The processing of personal data of our users takes place regularly only with the consent of the user. An exception applies to cases in which prior consent can not be obtained for reasons of fact and the processing of the data is permitted by law.
2. Legal basis
Insofar as we obtain the consent of the data subject for processing of personal data, Art. 6 para.1 s. 1 lit. a GDPR serves as a legal basis.
If the processing of personal data is necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 s. 1 lit. b GDPR is a legal basis. This also applies to processing operations required to carry out pre-contractual actions.
Insofar as processing of personal data is required to fulfill a legal obligation that is subject to our company, Art. 6 para. 1 s. 1 lit. c GDPR serves as the legal basis.
If processing is necessary to safeguard the legitimate interests of our company or a third party, and if the interests, fundamental rights and freedoms of the data subject do not prevail over the first interest, Art. 6 para. 1 s. 1 lit. f GDPR serves as the legal basis for processing.
3. Storage and deletion of your data
In principle, we only store personal data for as long as is necessary to fulfill contractual or legal obligations for which we collected the data. After that, we delete the data immediately, unless we still need the data until the expiry of the statutory limitation period for evidence purposes for claims under civil law or due to statutory retention obligations.
For evidentiary purposes, we must retain contractual data for six years from the end of the year in which the business relationship with you ends. Any claims become statute-barred at this point at the earliest according to the statutory limitation period.
Even after this, we still have to store some of your data for accounting reasons. We are obliged to do so because of legal documentation obligations that may arise from the German Commercial Code, the German Fiscal Code, the German Banking Act, the German Money Laundering Act and the German Securities Trading Act. The periods specified there for the retention of documents are two to ten years.
We delete or block the personal data of the data subject as soon as the purpose of the storage is fulfilled. It may also be stored if provided for by the European or national legislator in EU regulations, laws or regulations to which our company is subject. Blocking or deletion of the data also takes place when a storage period prescribed by the standards mentioned expires, unless there is a need for further storage of the data for conclusion of a contract or fulfillment of the contract.
4. Please note
Your consent data will be processed for the use of this website and the use of the implemented Consent Management Platform. We use the Google Cloud Platform, provided by Google Cloud EMEA Ltd. The servers are located in Germany and Belgium. Due to the judgment of the Court of Justice of July 16th, 2020 (Case C311/18), the transfer of personal data to the US on the basis of the Privacy Shield was declared invalid. We would like to inform you that we cannot exclude the fact that data may be transferred to the US and may be subject to access by the US security authorities in accordance with 50 U.S.C. §1881(b)(4), 50 U.S.C. §1881a (= FISA 702). In the event that personal data is transferred to the USA or other third countries, we have concluded standard contractual clauses with Google in accordance with Art. 46 Para. 2 lit. c GDPR. More information can be found in the Data Protection references of Google. Additionally we have taken further safety measures to ensure the security of the data.
IV. Provision of the website and creation of log files
1. Scope of processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the calling computer. This is e.g. information like
- Information about the type and version of your internet browser,
- The operating system of your computer or smartphone,
- Your internet service provider,
- Your IP address,
- Date and time of your access,
- Geographic location,
- Websites from which you came to us,
- Websites that you visit from our site.
- When applicable – Referrer URL from Partner Website.
We collect such technical information in so-called “log files”, so that you can display our website correctly and we can identify the causes of any technical problems, for the technical optimization of our websites and for the purpose of the security of our computer systems and networks. For these purposes, we have a legitimate interest in the processing of data according to Art. 6 para. 1 s. 1 lit. f GDPR.
The data will be deleted as soon as it is no longer necessary for the purpose of its collection. Typically, this technical information will be erased or rendered unrecognizable at the latest after seven days.
The collection of data for the provision of the website and the storage of the data in log files is essential for the operation of the website.
V. Contact requests for product information, a demo or other concerns
1. Description and scope of data processing
On our website you can contact us via various options: e.g. contact form, book a demo, request a quote, request product information, request guides. If you make use of these options, the data entered in the input mask will be transmitted to us and saved. In addition to the specific input macro data, the IP address and the date and time of the request are collected and stored.
Alternatively, a contact via e-mail address is possible. In this case, your personal data transmitted by e-mail will be stored.
In this context, there will be no disclosure of the data to third parties, unless this is necessary for the processing of the query (for example, demo booking tool). In any case, the data will be used exclusively for processing the conversation, unless agreed upon otherwise.
2. Legal basis for processing
Legal basis for the processing of the data is in general consent of the user, art. 6 para. 1 s. 1 lit. a GDPR.
3. Purpose of the data processing
The processing of personal data from the input mask is solely for the processing of your request. In the case of contact via e-mail, this also includes the required legitimate interest in the processing of the data.
The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.
4. Duration of storage
If you have booked a demo, requested product information or an offer, we reserve the right to store the data for two years to measure the profitability of our sales and marketing. Otherwise, we will delete the data as soon as it is no longer necessary to achieve the purpose of its collection. For the personal data entered in the contact form and those sent by e-mail, this is the case when the respective conversation with you has ended. The conversation is ended when it can be inferred from the circumstances that the relevant facts have been finally clarified.
5. Revoking consent and removal possibility
You have the possibility at any time to revoke your consent to the processing of the personal data. If you contact us by e-mail, you may object to the storage of his personal data at any time. In such a case, the conversation can not continue. All personal data stored in the course of contacting will be deleted in this case.
VI. NEWSLETTER, PRODUCT RECOMMENDATIONS AND CUSTOMER SURVEYS
When signing up for the Newsletter, data entered into the input mask will also be stored, in order to provide the Newsletter. The legal basis for this processing is art. 6 para. 1 s. 1 lit. a GDPR. Your e-mail address, time of subscription and the IP address used for subscribing will be retained as long as you subscribe to our Newsletter. This service is provided by means of a double opt-in. Thus, you will receive an e-mail containing a link by which you can confirm that you are the owner of the e-mail address and wish to be notified via our e-mail service. You can unsubscribe from this service by opting out via the link provided in each Newsletter any time.
2. Product Recommendations
You will be informed by Usercentrics about relevant changes concerning the Services, such as the implementation of additional functions, by e-mail, if you purchase the Usercentrics product.. The legal basis for this is Art. 6 Para. 1 lit. f GDPR in conjunction with § 7 Para. 3 UWG, justified by our interest in sending you individual offers.
3. Customer Surveys
If you place an order with us, we will also use your e-mail address to send you customer and satisfaction surveys. We will use the results of the surveys to improve our products and services. The legal basis for this is Art. 6 para. 1 lit. a GDPR, if you have given your consent. In some cases Art. 6 para. 1 lit. f GDPR might apply, justified by our legitimate interest in constantly improving our service.
VII. YOU BECOME A CUSTOMER OR PARTNER OF USERCENTRICS
1. Description and scope of data processing
You can become a customer or partner of Usercentrics. The following data is collected during the registration process:
- Your e-mail address,
- First name and last name,
- if necessary company affiliation,
- Payment information (possibly the company),
- other data that we request from you and
- possibly data that we receive in the course of the business relationship.
2. Legal basis for processing
Legal basis for the processing of the data is in the presence of the consent of the user art. 6 para 1 s. 1 lit. a GDPR and art. 6 para. 1 s. 1 lit. b GDPR, since the registration of the fulfillment of a contract or the implementation of pre-contractual measures.
3. Purpose of the data processing
Registration is required to fulfill the customer or partner contract or to carry out pre-contractual measures.
4. Opposition and removal possibility
As a customer you always have the option to cancel your account. You can change the data stored about you at any time. If the data is required to fulfill a contract or to carry out pre-contractual measures, premature deletion of the data is only possible, unless contractual or legal obligations preclude deletion.
VIII. COOKIES AND TRACKING TECHNOLOGIES
1. What are Cookies?
Web Browser Cookies: A web browser cookie is a small text file sent from a website to your computer or mobile device where it is stored by your web browser. Web browser cookies may store information such as your IP address or other identifier, your browser type, and information about the content you display and interact with on the digital services. By storing such information, web browser cookies can store your preferences and settings for online services and analyze how you use online services.
Tracking Technologies: Web Beacons, Pixels, Tags, Scripts.
E-mails and mobile applications can contain small, transparent image files or lines of code to record how you interact with them. This information is used to help website and app publishers better analyze and improve their services.
2. Use, legal basis and purpose
The legal basis for the processing of personal data using cookies for analytics purposes is the consent of the user Art. 6 para. 1 lit. a GDPR. The use of the analytics cookies is for the purpose of improving the quality of our website and its contents. Through the analytics cookies, we learn how the website is used and so we can constantly optimize our offer.
3. Duration of storage, objection and disposal options
4. Recipients of data
We only pass on the data we have collected if this is necessary for the fulfillment of the contract or for the provision of the technical functionality of the website, or if there is another legal basis for passing on the data.
In addition, disclosure may take place in connection with official enquiries, court orders and legal proceedings if it is necessary for legal prosecution or enforcement. When governments make a lawful demand for customer data from Usercentrics, Usercentrics strives to limit the disclosure. Usercentrics will only release specific data mandated by the relevant legal demand.
If compelled to disclose your data, Usercentrics will promptly notify you and provide a copy of the demand unless legally prohibited from doing so.
If Usercentrics commissions third parties with the collection, processing and use of data within the scope of commissioned processing in accordance with Art. 28 GDPR, this will also take place exclusively in compliance with the statutory provisions on data protection.
IX. IMPLEMENTED TECHNOLOGIES
We use the Google Sign-in Service to enable the registration or log-in to the Usercentrics Consent Management Platform. This service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
To log in or register, you will be redirected to the Google site, where you can log in with your account data. This will link your Google profile or your Google email address and our service. When using this service Google might collect the following data from you:
- email address
- Google ID.
We obtain from the service only your userID in a hashed format which is essential for our services to be able to identify your privacy settings. We solely use this data to complete your user profile. We do not receive your login information.
Please note that the use may involve a transfer of data to a third country, that does not offer appropriate safeguards, especially to the holding company Alphabet Inc., USA.
We use the Apple Sign-in Service to enable the registration or log-in to the Usercentrics Consent Management Platform. This service is provided by Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.
To log in or register, you will be redirected to Apple, where you can log in with your account data. This will link your Apple profile and our service. When using this service Apple might collect the following data from you:
- e-mail address/Apple ID.
Please note that the use may involve a transfer of data to a third country, that does not offer appropriate safeguards, especially to the holding company Apple Inc., USA.
X. California Consumer Privacy Act Compliance
We at Usercentrics value your privacy, that is why we have taken the necessary precautions to be in compliance with the California Consumer Privacy Act (CCPA). For visitors coming from California the California Consumer Privacy Act applies. You can opt-out of the processing of your data any time with effect for the future. Additionally you can make use of your rights under the CCPA by contacting us at [email protected].
Our services are not aimed at children under 13 years. We do not knowingly collect information from children under the age of 13. If you have not reached the age limit, do not use the services and do not provide us with your personal information. If you are a parent of a child below the age limit and you learn that your child has provided Usercentrics personal information, please contact us at [email protected] and insist on exercising your rights of access, correction, cancellation and / or opposition. If you are resident in California and are under 18 years of age and wish to erase publicly available content, please contact us at [email protected].
XII. ONLINE PRESENCE IN SOCIAL NETWORKS
We maintain online presences in social networks in order to communicate there with customers and interested parties, among others, and to provide information about our products and services.
The users’ data is usually processed by the social networks concerned for market research and advertising purposes. In this way, usage profiles can be created based on the interests of the users. For this purpose, cookies and other identifiers are stored on the users’ computers. On the basis of these usage profiles, advertisements, for example, are then placed within the social networks but also on third-party websites.
As part of the operation of our online presences, it is possible that we can access information such as statistics on the use of our online presences, which are provided by the social networks. These statistics are aggregated and may include, in particular, demographic information and data on interaction with our online presences and the posts and content distributed via them. Please refer to the list below for details and links to the data of the social networks that we can access as operators of the online presences.
The legal basis for data processing is Art. 6 para. 1 s. 1 lit. a and b, in order to stay in contact with and inform our customers and to carry out pre-contractual measures with future customers and interested parties.
For the legal basis of the data processing carried out by the social networks on their own responsibility, please refer to the data protection information of the respective social network. The links below also provide you with further information on the respective data processing and the options to object.
We would like to point out that data protection requests can be asserted most efficiently with the respective provider of the social network, as only these providers have access to the data and can take appropriate measures directly. Below is a list with information on the social networks on which we operate online presences:
- Facebook (USA and Canada: Facebook Inc., 1601 Willow Road, Menlo Park, California 94025, USA; all other countries: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland).
- Operation of the Facebook Fanpage in joint responsibility on the basis of an agreement on joint processing of personal data (so-called Page Insights Supplement regarding the controller).
- Information on the processed Page Insights data and the contact option in the event of data protection enquiries: https://www.facebook.com/legal/terms/information_about_page_insights_data
- Opt-out: https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com.
- Instagram (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland).
- Google/ YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).
- Opt-out: https://www.google.com/settings/ads.
- Twitter (Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07 Ireland).
- Opt-Out: https://twitter.com/personalization.
- LinkedIn (LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland).
- Operation of the LinkedIn company page in joint responsibility on the basis of an agreement on joint processing of personal data (so-called Page Insights Joint Controller Addendum).
- Information on the Page Insights data processed and the contact option in the event of data protection enquiries: https://legal.linkedin.com/pages-joint-controller-addendum
- Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
- Google my business
- We operate a so-called Google My Business entry. Should you find us in this way, we make use of the information service offered by Google and the services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”).
- We do not know how Google uses the data from the visit for its own purposes, to what extent activities of individual users are assigned, how long Google stores this data and whether data is passed on to third parties. When accessing Google services, the IP address assigned to your terminal device is transmitted to Google. Google also stores information about its users’ end devices; this may enable Google to assign IP addresses to individual users or user accounts.
- We, as the provider of our Google My Business entry, do not collect or process any further data from your use of this Google service. Beyond that, we do not use any Google functions on our website.
XIII. DATA TRANSFER TO THIRD COUNTRIES
If a third country transfer is provided for and no adequacy decision or appropriate safeguards are in place, it is possible and there is a risk that authorities in the respective third country (e.g. intelligence services) may gain access to the transferred data in order to collect and analyze it, and that enforceability of your data subject rights cannot be guaranteed.
XIV. THIRD PARTY LINKS
Occasionally, at our discretion, we may include or offer third-party products or services on our website. These third-party sites have separate independent privacy policies. We therefore have no responsibility or liability for the content and activities of these linked websites. Nonetheless, we seek to protect the integrity of our website and welcome any feedback about these websites.
XV. YOUR RIGHTS
If we process your personal data you have – after successful identification – the following rights towards us:
- Right to information (Article 15 GDPR, § 34 BDSG)
- Right to deletion (Article 17 GDPR, § 35 BDSG)
- Right to rectification (Article 16 GDPR, Section 34 BDSG)
- Right to restriction of processing (Article 18 GDPR)
- Right to data portability (Article 20 GDPR)
- Right to withdraw consent (Article 7(3) GDPR)
- Right to object to certain data processing activities (Article 21 GDPR).
In order to exercise your rights described here, you can contact us at any time using the contact details listed under “Name of the person responsible”.
You also have the right to complain to the data protection supervisory authority responsible for us. You can contact the data protection authority in your place of residence, which will then forward your request to the competent authority.
XVI. SECURITY AND INTEGRITY OF THE DATA
Protecting the information you give us or that we receive about you is our priority. We take appropriate security measures to protect your information from loss, misuse, and unauthorized access, alteration, disclosure, or destruction. Usercentrics has taken measures to ensure the ongoing confidentiality, integrity, availability and resiliency of systems and services that process personal information, and will restore the availability and access to information in the event of a physical or technical incident in a timely manner.