Privacy

Data protection declaration

This data protection declaration explains the type, scope and purpose for processing of personal data (hereinafter referred to as "data") as per our online service offerings and associated websites, functions and content, as well as external online presences, such as our social media profile (hereinafter collectively referred to as "online service"). Terms used, such as "processing" or "person responsible", are as per the definitions found in Article 4 of the General Data Protection Regulations (GDPR).

Responsible person

Bernhard Nießen
BAM-Service UG (haftungsbeschränkt)
Zerkaller Str. 6
52385 Nideggen
Germany

T: +49 (0) 2427 4349 5050
F: +49 (0) 2427 4349 5059

E: info@BAM-Service.com
W: www.BAM-Service.com

Authorised representative
Mr Bernhard Nießen

https://www.bam-service.com/kontakt/impressum/

Types of data processed

– Inventory data (e.g., names, addresses)
– Contact details (e.g., email, phone numbers)
– Content data (e.g., text input, photographs, videos)
– Usage data (e.g., websites visited, interest in content, access times)
– Meta / communication data (e.g., device information, IP addresses)

Categories of data subjects

Visitors and users of the online service (in the following sections, we refer to these persons concerned collectively as "users")

Purposes of data processing

– Provision of the online offer, its functions and content
– Answering contact inquiries and communicating with users
– Online safety precautions
– Reach measurement / marketing

Terms used

“Personal data” refers to information that relates to an identified or identifiable natural person (hereinafter called “data subject”). Furthermore, a data subject is regarded as identifiable when they can be identified directly or indirectly, in particular, by means of assignment to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie) or one or more special features, which express the physical, physiological, genetic, psychological, economic, cultural or social identity of this data subject.

“Processing” is any process carried out with or without the aid of automated processes, or any such series of processes in connection with personal data. The term is far-reaching and for practical purposes, it includes all data handling.

"Pseudonymization" refers to the processing of personal data in such a way that the personal data can no longer be assigned to a specific data subject without the use of additional information, provided that this additional information is stored separately and is subject to technical and organizational measures that ensure that the personal data cannot be assigned to an identified or identifiable data subject.

"Profiling" means any type of automated processing of personal data that consists of using this personal data to evaluate certain personal aspects relating to a data subject, in particular aspects relating to work performance, economic situation, health, or personal details used to analyze or predict the preferences, interests, reliability, behavior, whereabouts or relocation of this data subject.

“Responsible” is the natural or legal person, authority, institution or other body that alone, or jointly with others, decides on the purposes and means of processing personal data.

"Processor" means a natural or legal person, authority, institution or other body that processes personal data on behalf of the person responsible.

Relevant legal bases

In accordance with Article 13 of the GDPR, we will inform you of the legal basis for our data processing. If the legal basis is not mentioned in the data protection declaration, the following bases apply. The legal basis for obtaining consent is Article 6, paragraph 1, lit. a, and Article 7 of the GDPR is the legal basis for processing for the performance of our services, and the implementation of contractual measures. Answering inquiries is based on Article 6, paragraph 1, lit. b of the GDPR. The legal basis for processing to fulfill our legal obligations is Article 6, paragraph 1, lit. c of the GDPR, and the legal basis for processing to safeguard our legitimate interests is Article 6, paragraph 1, lit. f of the GDPR. In the case,

Safety measures

In accordance with Article 32 of the GDPR, taking into account the state of the art, the implementation costs and the type, scope, circumstances and purposes of processing, as well as the different probability of occurrences and severities of the risks to the rights and freedoms of data subjects, we take suitable technical and organizational measures to ensure a level of protection appropriate to the risk.

The measures include, in particular, securing the confidentiality, integrity and availability of data by controlling physical access to the data, as well as the access, input and transfer of data. At the same time, we ensure data availability to the client, and data separation. Furthermore, we have set up procedures that ensure the exercise of data subject rights, deletion of data and reaction to data threats. Furthermore, we consider the protection of personal data during the development or selection of hardware, software and procedures, in accordance with the principles of data protection through technology design and data protection-friendly default settings (Article 25 of the GDPR).

Cooperation with contract processors and third parties

If we disclose data to other persons and / or companies (contract processors or third parties) as part of our processing, transmit them to others, or otherwise grant other persons or companies access to the data, this is only done on the basis of legal permission (e.g., if the data are transmitted to third parties, as is required for payment service providers and in accordance with Article 6, paragraph 1, lit. b of the GDPR). Where you have consented, a legal obligation provides for this transfer on the basis of our legitimate interests (e.g., when using agents, web hosts, etc.).

If we commission third parties to process data on the basis of a so-called "order processing contract", this is done on the basis of Article 28 of the GDPR.

Transfers to third countries

If we process data in a third country (i.e., outside the European Union [EU] or the European Economic Area [EEA]), or if this happens in the context of the use of third-party services or disclosure or transmission of data to third parties, this will only take place if the action fulfils our (pre) contractual obligations, and on the basis of your consent, a legal obligation or our legitimate interests. Subject to legal or contractual permissions, we process or have the data processed in a third country only if the special requirements of Article 44 ff. of the GDPR are met. This means that processing takes place, for example, on the basis of special guarantees, such as the officially recognized determination of a data protection level corresponding to the EU

General rights of data subjects

You have the right to request confirmation as to whether the data in question is being processed and to request information about these data, as well as further information and a copy of the data in accordance with Article 15 of the GDPR.

According to Article 16 of the GDPR, you have the right to request completion of the data concerning you, or the correction of incorrect data concerning you.

In accordance with Article 17 of the GDPR, you have the right to demand that the relevant data be deleted immediately, or alternatively, in accordance with Article 18 of the GDPR, to request a restriction on the processing of the data.

You have the right to request that you receive the data concerning you that you have provided to us in accordance with Article 20 of the GDPR, and to request that the data be transmitted to other responsible parties.

In accordance with Article 77 of the GDPR, you also have the right to lodge a complaint with the competent supervisory authority.

Right of withdrawal

You have the right to revoke your consent in accordance with Article 7, paragraph 3 of the GDPR, with effect for the future.

Right to object

You can object to the future processing of your data in accordance with Article 21 of the GDPR at any time. The objection can, in particular, be made against processing for direct marketing purposes.

Cookies and the right to object to direct mail

"Cookies" are small files that are stored on users' computers. Various information can be stored within cookies. A cookie is primarily used to store information about a user (or the device on which the cookie is stored) during. or after. their visit to an online platform or website. Temporary cookies, aka "session cookies" or "transient cookies", are cookies that are deleted after a user leaves an online offer and closes his browser. Such a cookie can, for example, store the contents of a shopping cart in an online shop, or a login status. Some cookies are referred to as "permanent" or "persistent" and remain stored even after the browser is closed. For example, the login status can be saved for reuse when users visit the same site, even after several days have elapsed. The interests of the users can also be stored in permanent cookies, which are used for range of marketing metrics and purposes. "Third-party cookies" are cookies used by providers other than the person responsible for operating the online platform (otherwise, they are referred to as "first-party cookies").

At BAM-Service UG, we use temporary and permanent cookies and clarify our use in the context of our data protection declaration.

If users do not want cookies to be stored on their computer, they are asked to deactivate the corresponding option in the system settings of their browser. Saved cookies can be deleted in the system settings of the browser. The exclusion of cookies can lead to functional restrictions of our online services.

A general objection to the use of cookies used for online marketing purposes can be made for a large number of services, especially in the case of tracking, via the US site http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/ explained. Furthermore, cookies can be saved by deactivating them in the browser settings. Please note that if you do so, you may not be able to use all the functions available through our online services.

Deletion of data

The data processed by us are deleted or restricted in accordance with Articles 17 and 18 of the GDPR. Unless expressly stated in this data protection declaration, the data stored by us will be deleted as soon as they are no longer required for their intended purpose, and the deletion does not conflict with any statutory retention requirements. If the data are not deleted because they are required for other and legally permissible purposes, data processing will be restricted. This means, in effect, that data are blocked and not processed for other purposes. This applies, for example, to data that must be kept for commercial or tax reasons.

According to the legal requirements in Germany, data storage is required by the state for 10 years according to §§147 abs. 1 AO 257 Abs. 1 nos. 1 and 4 abs. 4 HGB (books, records, management reports, accounting documents, trading books, taxation documents, etc.) and 6 years according to § 257, paragraph 1, nos. 2 and 3, paragraph 4 HGB (commercial letters).

According to the legal requirements in Austria, data storage is required for: 7 years by the state in accordance with § 132, paragraph 1 BAO (accounting documents, receipts / invoices, accounts, receipts, business papers, lists of income and expenses, etc.), 22 years in connection with real estate, and, 10 years for documents in connection with electronically provided services, telecommunications, radio and television services that are provided to non-entrepreneurs in EU member states and for which the mini-one-stop-shop (MOSS) is used.

Agency services

We process our customers' data as part of our contractual services, which include conceptual and strategic advice, campaign planning, software and design development / advice or maintenance, implementation of campaigns and processes / handling, server administration, data analysis / consulting services and training services.

We process: inventory data (e.g., customer master data, such as names or addresses), contact data (e.g., e-mail, telephone numbers), content data (e.g., text entries, photographs, videos), contract data (e.g., subject of the contract, term), payment data (e.g., bank details, payment history) and usage and metadata (e.g., in the context of evaluating and measuring the success of marketing measures). In principle, we do not process special categories of personal data, unless these are part of a commissioned processing. Those affected include our customers, interested parties and their customers, users, website visitors or employees, as well as third parties. The purpose of processing is to provide contractual services, billing and our customer service. The legal basis for processing results from Article 6, paragraph 1, lit. b of the GDPR (contractual services), and Article 6, paragraph 1, lit. f of the GDPR (analysis, statistics, optimization, security measures). We process data that are necessary for the establishment and fulfillment of the contractual services, and we highlight the necessity of their disclosure. Disclosure to external parties only takes place if it is necessary in the context of a service order. When processing the data provided to us within the framework of a service order, we act in accordance with the instructions of the client and the legal requirements for order processing in accordance with Article 28 of the GDPR, and we do not process the data for any other purposes than those strictly necessary for the establishment and fulfillment of the contractual services.

We delete data held after the expiry of statutory warranties and comparable obligations. The necessity of storing data is reviewed every 3 years; in the case of the statutory archiving obligations, the deletion takes place after the expiry of archiving obligations (6 years, according to §257, paragraph 1 HGB; and 10 years according to §14.7, paragraph 1 AO). In the case of data that were disclosed to us in the context of a service order by the client, we delete the data in accordance with the specifications of the order, generally after the end of the order.

Contractual services

We process the data of our contractual partners and interested parties, as well as other clients, customers and clients, clients or contractual partners (uniformly referred to as "contractual partners") in accordance with Article 6, paragraph 1, lit. b. of the GDPR in order to provide you with our contractual or pre-contractual services. The data processed, and the type, scope, purpose and the necessity of their processing, are determined by the underlying contractual relationship.

The processed data includes the master data of our contractual partners (e.g., names and addresses), contact details (e.g., email addresses and telephone numbers), as well as contract data (e.g., services used, contract content, contractual communication, names of contact persons) and payment data (e.g., bank details, payment history).

As a matter of principle, we do not process special categories of personal data, unless these are part of a commissioned or contractual processing.

We process data that are required for the establishment and fulfillment of the contractual services, and our duty is to point out the necessity of their disclosure, if this is not evident for the contractual partner. Disclosure to external persons or companies As a matter of principle, we do not process special categories of personal data, unless these are part of a commissioned or contractual processing.

Only takes place if it is required within the framework of a contract. When processing the data provided to us as part of a service order, we act in accordance with the instructions of the client and the relevant legal requirements.

We save the IP address and the time of the respective user action when you use our online services. Data storage takes place on the basis of our legitimate interests, as well as the interests of the users, as a method of protecting against misuse and other unauthorized use. These data are generally not passed on to third parties, unless it is necessary to pursue our claims in accordance with Article 6, paragraph 1, lit. of the GDPR. The data are deleted when they are no longer required to fulfill contractual or statutory duties of care, or to deal with any warranty or comparable obligations, whereby the need to store the data is checked every 3 years. Otherwise, statutory retention requirements apply.

External payment service providers

We use external payment service providers, through whose platforms the user and we can carry out payment transactions. Links to third-party privacy policies are provided below: PayPal (https://www.paypal.com/de/webapps/mpp/ua/privacy-full), Klarna (https://www.klarna.com/de/datenschutz/), Skrill (https://www.skrill.com/de/fusszeile/datenschutzpolitik/), Giropay (https://www.giropay.de/ legal / datenschutz-agb /), Visa (https://www.visa.de/datenschutz), Mastercard (https://www.mastercard.de/de-de/datenschutz.html), American Express (https: / /www.americanexpress.com/de/content/privacy-policy-statement.html)

As part of the fulfillment of contracts, we use these payment service providers on the basis of Article 6 (1), lit. b. of the GDPR. In addition, we use external payment service providers on the basis of our legitimate interests in accordance with Article 6 (1), lit. of the GDPR, to offer our users a range of effective and secure payment options.

The data processed by the payment service providers include: inventory data such as name and address, bank data such as account numbers or credit card numbers, passwords, TANs, checksums, contracts, sums and recipient-related information. The information is required to carry out the transactions. However, the data entered is processed and stored by the payment service providers only. This means that we do not receive any account or credit card-related information, but only information about the confirmation or declination of the payment. However, the data may be transmitted to credit agencies by the payment service provider. The purpose of this transmission is to check your identity and creditworthiness.

For payment transactions, the terms and conditions and the data protection information of the respective payment service provider apply, which can be accessed on the respective websites or transaction applications. We also refer to these for the purpose of accessing further information and our assertion of rights of revocation, information and other data subjects.

Administration, financial accounting, office organization, contract management

We process data in the context of administrative tasks as well as the organization of our operations, financial accounting and compliance with legal obligations, such as archiving. In doing so, we process the same data that we process in the context of providing our contractual services. The processing bases are Article 6, paragraph 1, lit. of the DSGVO and Article 6, paragraph 1, lit. f. of the DSGVO. Customers, interested parties, business partners and website visitors are affected by the processing. The purpose and our interest in processing lies in: administration, financial accounting, office organization and archiving of data (e.g., tasks that serve to maintain our business activities, and help us perform our tasks and provide our services).

We disclose or transmit data to financial administrators, consultants (such as tax consultants or auditors), other fee offices and payment service providers.

Furthermore, on the basis of our business interests, we store information about suppliers, organizers and other business partners, e.g., for the purposes of further contact. We generally store these data permanently, and most of the data are company related.

Business analysis and market research

In order to operate our business economically, recognize market trends and fulfill the wishes of contractual partners and users, we analyze the data available to us on business transactions, contracts, inquiries, etc. We process inventory data, communication data, contract data, payment data, usage data and metadata on the basis of Article 6, paragraph 1, lit. f. of the GDPR, whereby the persons concerned include contractual partners, interested parties, customers, visitors and users of our online services.

Data analyses are carried out for the purposes of business evaluations, marketing and market research. In doing so, we take into account the profiles of the registered users with regards to information, e.g., on the services they have used. The analyses serve to increase the user-friendliness of our service offerings, thus optimising economic efficiency and customer experience. Our data analyses serve us alone and are not disclosed externally, unless they are anonymized and contain only summarized values.

If these analyses or profiles are personal, they will be deleted or anonymized upon contract termination by the user, or after 2 years from the conclusion of the contract. In addition, overall business analysis and general tendency determinations are created anonymously if possible.

Hosting and email

The hosting services we use serve to provide the following: Infrastructure and platform services, computing capacity, storage space and database services, email dispatch, security services and technical maintenance services that we use for the purpose of operating our online services.

We or our hosting provider process inventory data, contact data, content data, contract data, usage data, meta and communication data from customers, interested parties and visitors based on our legitimate interests in an efficient and secure provision of our services, and in accordance with Article 6, paragraph 1, lit. f of the GDPR, in conjunction with Article 28 of the GDPR (conclusion of an order processing contract).

Collection of access data and log files

We, or our hosting provider, collect data on every access attempt to the server on which this service is located (so-called server log files) on the basis of our legitimate interests within the meaning of Article 6, paragraph 1, lit. The access data include: the name of the accessed website, file, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page), IP address and the requesting provider.

For security reasons (e.g., to investigate acts of abuse or fraud), log file information is stored for a maximum of 7 days and then deleted. Data, the further storage of which is necessary for evidential purposes, are excluded from deletion until the respective incident has been fully investigated.

Created with Datenschutz-Generator.de by RA Dr. Thomas Schwenke