Privacy policy

www.vimpay.de - as of February 6th, 2024

Table of Contents

  1. Data protection at a glance
  2. General notes and mandatory informations
  3. Data Protection Officer (DPO)
  4. Data processing on the website
  5. Order processing
  6. Cookies and analysis tools
  7. We Say Hello
  8. Data collection when contact is made
  9. Audio and video conferences
  10. Social Media
  11. Special informations for parents
  12. Changes to the Privacy policy

 

  1. Data protection at a glance

General note

The following informations provide a simple overview of what happens to your personal data when you use our website. Personal data are any data that can be used to identify you personally. Detailed informations on the subject of data protection can be found in our Data protection declaration listed below this text.

Who is responsible for data collection on the website?

The Responsible is the legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g. names, e-mail addresses, etc.). Data processing on the website is carried out by the website operator:

PayCenter GmbH
Clemensänger Ring 24
85356 Freising
Telephone: 08161 4060-300
eMail: info@PayCenter.de

How do we collect your data?

On the one hand, your data are collected when you provide them to us. This may be data that you enter during the registration process. Other data are collected automatically by our IT systems when you visit the website. This are primarily technical data (e.g. the website version, the operating system or the time the page was accessed). These data are collected automatically as soon as you start the website.

For what purpose do we use your data?

We process your personal data in accordance with the provisions of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) for the following purposes:

  1. For the fulfilment of contractual obligations (Article 6(1)(b) GDPR)
    Personal data is processed for the provision of financial services as part of the fulfilment of our contracts with our customers or for the implementation of pre-contractual measures taken at your request.
    This also includes communication with you. We use your personal information to communicate with you via various channels (e.g. by telephone, e-mail, chat) regarding your concerns.
  2. As part of the balancing of interests (Article 6(1)(f) GDPR)
    Where necessary, we process your data beyond the actual fulfilment of the contract to protect our legitimate interests or those of third parties. Examples in this regard are:
    • Error-free provision of the website
    • Advertising, provided you have previously consented to the use of your data
    • Assertion of legal claims and defence within legal disputes
    • Ensuring IT security and IT operations
    • Prevention of criminal offences
  3. On the basis of your consent (Article 6(1)(a) GDPR)
    If you have given us your consent to process personal data for specific purposes (e.g. transfer of data within the association/group), the lawfulness of this processing is based on your consent. Any consent given can be revoked at any time. This also applies to the revocation of declarations of consent given to us before the EU General Data Protection Regulation came into force, i.e. before 25 May 2018. Please note that the revocation is only effective for the future. Processing that took place before the revocation is not affected.
  4. Due to legal requirements (Article 6(1)(c) GDPR) or in the public interest (Article 6(1)(e) GDPR)
    As an electronic money Institution, we are also subject to various legal obligations, i.e. statutory requirements (e.g. German Banking Act, Anti-Money Laundering Act, tax Laws) and banking supervisory requirements (e.g. German Federal Financial Supervisory Authority). The purposes of processing include identity and age verification, fraud and money laundering prevention, the fulfilment of control and reporting obligations under tax Law and the assessment and management of risks within the company.

Who receives your data?

Within the company, those departments that need your data to fulfil our contractual and legal obligations will have access to it. Service providers and vicarious agents employed by us may also receive data for these purposes if they comply with banking secrecy and our written instructions under data protection law. These are essentially companies from the categories listed below. 

With regard to the transfer of data to recipients outside the e-money Institution, it should first be noted that, as an e-money Institution, we are obliged to maintain confidentiality about all customer-related facts and assessments of which we become aware.  

We may only provide information about you if this is required by law, if you have given your consent, if we are authorised to provide bank information and/or if the processors commissioned by us guarantee compliance with banking secrecy and the provisions of the EU General Data Protection Regulation/German Federal Data Protection Act. Under these conditions, recipients of personal data may be for example the following:

  • Public Bodies and Institutions (e.g. Deutsche Bundesbank, German Federal Financial Supervisory Authority, European Banking Authority, European Central Bank, tax Authorities, German Federal Central Tax Office) if there is a legal or official obligation.
  • Other credit and financial services Institutions, comparable Institutions and Processors (see point 5. Order processing) to whom we transfer personal data in order to conduct the business relationship with you. In detail: Processing of bank informations, support/maintenance of EDP/IT applications, archiving, document processing, compliance services, controlling, data screening for anti-money laundering purposes, data destruction, recovery, payment card processing, customer administration, telephony, video legitimisation, website management, payment transactions.
    Other data recipients may be those entities for which you have given your consent to the transfer of data or for which you have released us from banking secrecy in accordance with an agreement or consent.

Are data transferred to a third Country or an international Organisation?

Data are only transferred to Countries outside the EU or the EEA (so-called third Countries) if this is necessary for the execution of your orders (e.g. payment orders), if it is required by law (e.g. reporting obligations under tax law), if you have given us your consent or as part of commissioned data processing. If service providers in a third Country are used, they are obliged to provide suitable guarantees in accordance with Art. 46 GDPR.

This also includes the automatic exchange of data as part of the Mastercard Automatic Billing Updater (ABU) database to minimise the rejection of card payments when credit card data expires or changes. The data are transmitted to:

  • Mastercard Inc., 2000 Purchase Street, Purchase, NY 10577, USA.

 

Note regarding the transfer of data to third Countries that are not secure under the data protection law and the transfer to US companies that are not DPF-certified

Among the others, we use tools from companies based in third Countries that are not secure under the data protection law, as well as US-tools whose providers are not certified under the EU-US Data Privacy Framework (DPF). If these tools are active, your personal data may be transferred to these Countries and processed there. We would like to point out that a level of data protection comparable to that in the EU cannot be guaranteed in third Countries that are not secure under the data protection law.

We would like to remark that the USA, as a safe third Country, generally does provide a level of data protection comparable to that of the EU. Data transfer to the USA is therefore permitted if the recipient is certified under the "EU-US Data Privacy Framework" (DPF) or has suitable additional guarantees. Informations on transfers to third Countries, including the data recipients, can be found within this Privacy policy.

 

What rights do you have regarding your data?

You have the right to receive information about the origin, recipient and the purpose of your stored personal data free of charge at any time. You also have the right to request the correction, restriction or deletion of these data. You can contact us at any time at the address given in the legal notice if you have any further questions on the subject of data protection. You also have the right to lodge a complaint with the competent supervisory Authority.

 

Analysis tools and tools from third-party providers

When you visit our app, your usage behaviour may be statistically evaluated. This is done primarily with so-called analysis programmes. The analysis of your usage behaviour is anonymous; the usage behaviour cannot be traced back to you. You can object to this analysis or prevent it by not using certain tools. Details in regard to this theme can be found in our Privacy policy under the heading "Analysis tools".

 

  1. General notes and mandatory informations

Data protection

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection Regulations and this Privacy policy. When you use this website, various personal data are collected. Personal data are data that can be used to identify you personally. This Privacy policy explains what data we collect and what we use them for. It also explains how and for what purpose this is done. We would like to point out that data transmission over the Internet (e.g. when communicating by eMail) may be subject to security vulnerabilities. Complete protection of data against access by third parties is not possible.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You can withdraw your consent at any time. All you need to do is send us an informal eMail. The legality of the data processing carried out until the withdrawal remains unaffected.

Right to lodge a complaint with the competent supervisory Authority

In the event of breaches of data protection law, the data subject has the right to lodge a complaint with the competent supervisory Authority. The competent supervisory Authority for data protection issues is:

Bavarian State Office for Data Protection
Post Office Box 1349
91504 Ansbach
Tel.: 0981/180093-0
Fax: 0981/180093-800
poststelle@lda.bayern.de
https://www.lda.bayern.de

TLS-Encryption

This website uses TLS encryption for security reasons and to protect the transmission of confidential contents, such as orders or enquiries that you send to us as website operators.

Information, erasure and rectification

Within the framework of the applicable legal provisions, you have the right to receive information about your stored personal data free of charge at any time, its origin and recipient and the purpose of the data processing and, if necessary, the right to rectification or erasure of these data. You can contact us at any time at the address given in the legal notice if you have any further questions on the subject of personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. To do so, you can contact us at any time at the address given in the legal notice. The right to restriction of processing exists in the following cases:

    • If you dispute the accuracy of your personal data stored by us, we generally need time to check this. For the duration of the review, you have the right to request that the processing of your personal data be restricted.
    • If the processing of your personal data was/is unlawful, you can request the restriction of data processing instead of the erasure.
    • If we no longer need your personal data, but you need them for the assertion, exercise or defence of legal claims, you have the right to request the restriction of the processing of your personal data instead of their erasure.
    • If you have lodged an objection in accordance with Art. 21 (1) GDPR, a balance between your interests and ours must be performed. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, these data - apart from their storage - may only be processed with your consent or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State.

Right to data portability

You have the right to receive data that we process automatically on the basis of your consent or in fulfilment of a contract in a commonly used, machine-readable format. If you request the direct transfer of the data to another controller, this will only take place if it is technically feasible.

 

  1. Data Protection Officer (DPO)

Data protection officer required by the law

We have appointed a Data protection officer (DPO) for our company. If you have any questions on the subject of data protection, please use the following contact options:

PayCenter GmbH
Clemensänger Ring 24
85356 Freising
Telephone: 08161 4060-300
eMail: datenschutz@paycenter.de 

 

  1. Data processing on the website

Data processing during registration and subsequent card use

Users can register and create a user account. The data entered during the registration will be used for the purposes of using the service.

We collect, process and use personal data only insofar as it is necessary for the establishment, content or amendment of the legal relationship (inventory data). This is done on the basis of Art. 6 para. 1 lit. b GDPR, which permits the processing of data for the fulfilment of a contract or pre-contractual measures, as well as on the basis of Art. 6 para. 1 lit. c GDPR, which makes the processing necessary for the fulfilment of a legal obligation to which the controller is subject. We collect, process and use personal data concerning the usage of our website (usage data) only insofar as this is necessary to enable or charge the user for the usage of the service.

The customer data collected will be deleted after completion of the order or termination of the business relationship. It is the responsibility of users to back up their data before the end of the contract in the event of cancellation. We are authorised to irretrievably delete all user data, stored during the term of the contract, if this does not conflict with the statutory retention periods.;
Statutory retention periods remain unaffected. These include the retention obligations under commercial and tax law: German Commercial Code (HGB), German Banking Act (KWG) and the German Anti-Money Laundering Act (GwG). The periods specified therein are two to ten years. If data is retained as evidence, it is subject to the limitation periods of the German Civil Code (BGB) §§195ff. and can be up to 30 years, whereby the standard limitation period is three years. IP addresses are deleted after 90 days at the latest.

These data will not be submitted to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so pursuant to Art. 6 para. 1 lit. c GDPR.

If a due diligence procedure (legitimisation) is required for the registration in accordance with the Section 11 of the German Anti-Money Laundering Act (GwG), the personal data collected during the identification will only be stored by the identifying company (Deutschen Post AG or IDnow GmbH) to the extent that this is necessary for the proper determination, billing and evaluation as well as for proof of the correctness of service charges (charge data). Furthermore, we use the data provided as part of the Postident procedure to compare the personal master data stored by us in our database for the purposes of the legitimisation required by the law.

In order to be able to use the service, we may collect from you the following data

  • Company name
  • First name and surname
  • Address
  • Date of Birth
  • Identification data
  • eMail-Address
  • Account details
  • Mobile phone number
  • Politically exposed person (PEP) Status
  • Direct debit mandates
  • IP address at the time of registration
  • IP address of the login
  • Recipients' account numbers
  • Account transactions
  • Tax-ID

 

Server-Log-Files

petaFuel GmbH automatically collects and stores informations in so-called server log files. The following informations are transmitted to us by the website:

  • Operating system used
  • Browser used
  • Accessed URL
  • Date and time of the server request
  • IP-Address

These data are not merged with other data sources.

The basis for data processing is the Art. 6 para. 1 lit. f GDPR, which permits the processing of data to protect legitimate interests. We use these data both to operate and improve the website and to prevent frauds.

The data will be deleted automatically after 90 days at the latest.

 

Friendly Captcha

We use Friendly Captcha (hereinafter referred to as "Friendly Captcha") on this website. The provider is Friendly Captcha GmbH, Am Anger 3-5, 82237 Woerthsee, Germany.

Friendly Captcha is used to check whether the data input on this website (e.g. in a contact form) is made by a human or by an automated programme. To do this, Friendly Captcha analyses the behaviour of the website visitor based on various characteristics. Friendly Captcha evaluates various informations for the analysis (e.g. anonymised IP address, referrer, visit time, etc.). Further information on this can be found at: https://friendlycaptcha.com/legal/privacy-end-users/.

The data is stored and analysed on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in protecting its website from abusive automated spying and Spam. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of the Art. 6 para. 1 lit. a GDPR and the § 25 para. 1 TTDSG (German Telecommunications Telemedia Data Protection Act), insofar as the consent includes the storage of cookies or access to informations in the user's terminal device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.

Order processing

We have concluded a Data Processing Agreement (DPA) for the use of the above-mentioned service. This is a contract prescribed by the data protection law, which guarantees that it processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

 

  1. Order processing

We occasionally engage other companies to provide limited services on our behalf and within the scope of the business purpose. These companies may only process the personal data that are necessary for the provision of the respective services. These companies undertake to treat the data confidentially. The companies are expressly prohibited from using the informations for other purposes. We have concluded an order processing contract with the following companies and we therefore disclose them personal data to the extent necessary:

  • petaFuel GmbH (MasterCard Processor, Technical Service Provider): petaFuel GmbH, Clemensänger Ring 24, 85356 Freising
  • Deutsche Post AG (PostIdent, VideoIdent): Deutsche Post AG, Charles-de-Gaules-Str. 20, 53113 Bonn
  • Deutsche Post Direkt GmbH (Address verification): Deutsche Post Direkt GmbH, Junkersring 57, 53844 Troisdorf
  • Melissa Data GmbH (Address verification): Melissa Data GmbH, Cäcilienstr. 42-44, 50667 Köln
  • Infoscore Consumer Data GmbH (Address verification): Infoscore Consumer Data GmbH, Rheinstr. 99, 76532 Baden-Baden
  • IDnow (Videoident): IDnow GmbH, Auenstr. 100, 80469 München
  • Authada GmbH (Authentication via eID): Authada GmbH, Julius-Reiber-Str. 15a, 64293 Darmstadt
  • Google Inc., Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland
  • Burak Esen & Simon Pröbstl GbR (Advertisements), Schloßstr. 3, 85354 Freising

 

  1. Cookies and analysis tools

Use of cookies

In addition to the aforementioned data, cookies or similar technologies such as pixels (hereinafter generally referred to as "cookies") are used on your computer when you visit and use our website. Cookies are small text files that are stored by your browser on your end device to store certain information, or image files such as pixels. The next time you visit our website with the same end device, the information stored in cookies is subsequently sent back either to our website ("first party cookie") or to another website to which the cookie belongs ("third party cookie").

The stored and returned information enables the respective website to recognise that you have already accessed and visited it with the browser on your end device. We use this information to optimise the design and display of the website according to your preferences. Only the cookie itself is identified on your end device. Any further storage of personal data will only take place with your express consent or if this is absolutely necessary in order to be able to use the service offered and accessed by you accordingly.

You have the option of accepting or rejecting cookies. The majority of web browsers automatically accept cookies. However, you can usually set your browser preferences to refuse cookies. If cookies are rejected, you may not be able to log in to the website or services that depend on cookies or use other interactive features of this website or services.

This website may use the following types of cookies, the scope and function of which are explained below:

- Strictly necessary cookies (type a)
- Functional and performance cookies (type b) 
(Currently not in use in our company)
- Cookies requiring consent (type c)
(Currently not in use in our company)

We will inform you which cookie types are set and used for the tools we use.

Strictly necessary cookies (type a)

Strictly necessary cookies guarantee functions without which you could not use our websites as intended. These cookies are used exclusively by us and are therefore first party cookies. This means that all information stored within the cookies is sent back to our website.

Strictly necessary cookies are used, for example, to ensure that you, as a registered user, always remain logged in when accessing various subpages of our website and therefore do not have to re-enter your login details each time you access a new page.

The use of strictly necessary cookies on our website is possible without your consent. For this reason, strictly necessary cookies cannot be deactivated or activated individually. However, you have the option of generally deactivating cookies in your browser at any time (see below).

Legal basis: Art. 6 para. 1 lit. b GDPR

Functional and performance cookies (type b)

Functional cookies enable our website to save informations you have already entered (such as your registered name or language selection) and to offer you improved and more personalised functions based on them. These cookies only collect and store anonymised information, if at all, so that they cannot track your movements on other websites.

Performance cookies collect informations about how our websites are used in order to improve their attractiveness, content and functionality. These cookies help us, for example, to determine whether and which subpages of our website are visited and what content users are particularly interested in. In particular, we record the number of visits to a page or the number of sub-pages accessed. As a result, we can tailor the content of our website more specifically to the needs of our users and optimise our offering.

You can object to the use of functional and performance cookies at any time by adjusting your cookie settings accordingly.

Legal basis: Art. 6 para. 1 lit. f GDPR

Cookies requiring consent (type c)

Cookies that are neither strictly necessary (type a) nor functional or performance cookies (type b) are only used after you have given your consent.

We also reserve the right to use information that we have obtained by means of cookies from an anonymised analysis of the usage behaviour of visitors to our websites to show you specific advertising for certain of our products on our own websites. We believe that you as a user benefit from this because we display advertising or content that we assume, based on your surfing behaviour, matches your interests and you are therefore shown less random advertising or certain content that may be of less interest to you.

Marketing cookies originate from external advertising companies (third party cookies) and are used to collect information about the websites visited by the user in order to create targeted advertising for the user.

You have both the options of accepting or rejecting cookies. The majority of web browsers automatically accept cookies. However, you can usually set your browser preferences to refuse cookies. If cookies are rejected, you may not be able to log in to the website or services that depend on cookies, or use other interactive features of this website or services.

Legal basis: Art. 6 para. 1 lit. a GDPR

 

Cookies of PayCenter GmbH

MATOMO_SESSID

Necessary for the Matomo iFrame Opt-Out Methode.

Used Cookies: Type b

Lifetime of cookies: cookies are deleted again when you leave the page (close the browser)

Legal basis: Art. 6 para. 1 lit. f GDPR

 

Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that allows us to integrate tracking or statistical tools and other technologies on our website. The Google Tag Manager itself does not create any user profiles, does not store any cookie and does not carry out any independent analyses. It is only used to manage and display the tools integrated via it. However, Google Tag Manager records your IP address, which may also be transmitted to Google's parent company in the United States.

The Google Tag Manager is used on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the fast and uncomplicated integration and management of various tools on its website. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of the Art. 6 para. 1 lit. a GDPR and the § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.

The company is certified in accordance with the "EU-US Data Privacy Framework" (DPF). The Data Privacy Framework (DPF) is an agreement between the European Union and the USA that aims to ensure that data processing in the USA complies with European data protection Standards. Every company certified under the DPF undertakes to comply with these data protection standards. Further informations on this can be obtained from the provider at the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt000000001L5AAI&status=Active

 

Matomo

This website uses the open source web analysis service Matomo. Matomo uses technologies that enable the cross-site recognition of the user to analyse user behaviour (e.g. cookies or device fingerprinting). The information collected by Matomo about the use of this website is stored on our server. The IP address is anonymised before storage.

With the help of Matomo, we are able to collect and analyse data about the use of our website by website visitors. This allows us to find out, among other informations, when which pages were accessed and from which region. We also record various log files (e.g. IP address, referrer, browser and operating system used) and can measure whether our website visitors perform certain actions (e.g. clicks, purchases, etc.).

This analysis tool is used on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the anonymised analysis of user behaviour in order to optimise both its website and its advertising. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of the Art. 6 para. 1 lit. a GDPR and the § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.

We use IP anonymisation for the analysis with Matomo. Your IP address is truncated before the analysis so that it can no longer be clearly assigned to you.

We host Matomo exclusively on our own servers so that all analysis data remains with us and is not transmitted to third parties.

Matomo processes the following data for this purpose:

  • Anonymised IP addresses by removing the last 2 bytes (i.e. 192.68.0.0 instead of 192.68.100.54)
  • Pseudo-anonymised location (based on the anonymised IP address)
  • Date and time
  • Title of the page accessed
  • URL of the requested page
  • URL of the previous page (if this is permitted)
  • Screen resolution
  • Local time
  • Files that were clicked and downloaded
  • External links
  • Duration of the page setup
  • Country, region, city (with low accuracy due to IP address)
  • Main language of the browser
  • Browser user agent

You can object to the storage and analysis of these data by Matomo at any time by unchecking the "Matomo" box on the following page.

Matomo-Auswertung widersprechen

In this case, a so-called Opt-Out cookie is permanently stored in your browser, which causes Matomo not to collect any data for storage and analysis. However, if you delete this cookie intentionally or unintentionally, the objection to data storage and analysis will also be cancelled and can be renewed via the link above.

Alternatively, most browsers have a so-called "Do Not Track" option, with which they inform websites not to track your user activities. Matomo complies with this option.

 

  1. We Say Hello

To be reminded by us of all your future "We Say Hello" appointments, you have the option of giving us your mobile phone number. We will then send you a notification by SMS before each appointment.

The legal basis for the storage and processing of your data is Art. 6 para. 1 lit. a GDPR (consent of the data subject). Your personal data will remain with us until you ask us to delete them, revoke your consent to storage, or the purpose for data storage no longer applies (e.g. if there are no further "We Say Hello" appointments). You have the right to receive information about the origin, recipient and purpose of your stored personal data free of charge at any time. You also have the right to object, the right to data portability and the right to lodge a complaint with the competent supervisory Authority. Furthermore, you can request the rectification, erasure and, under certain circumstances, the restriction of the processing of your personal data.

We use Jitsi Meet for the We-Say-Hello-Meeting. You can find more information at the following Audio and video conferences

 

  1. Data collection when contact is made

When contacting us (e.g. via contact form, eMail, telephone or via social media), the user's details are processed to process the contact request and its handling in accordance with Art. 6 para. 1 lit. a GDPR (consent of the data subject) and Art. 6 para. 1 lit. b GDPR (for the fulfilment of a contract or pre-contractual measures). User data may be stored in a ticket system or comparable enquiry organisation.
Your personal data will remain with us until you ask us to delete it, revoke your consent to storage or the purpose for data storage no longer applies (e.g. after your request has been processed). Mandatory statutory provisions - in particular retention periods under tax and commercial Law - remain unaffected.

Basic automatic cancellation periods:

  • Tickets from non-customers: 6 months
  • Tickets from customers: 1 year
  • Tickets with data protection reference: 3 years

You have the right to receive information about the origin, recipient and purpose of your stored personal data free of charge at any time. You also have the right to object, the right to data portability and the right to lodge a complaint with the competent supervisory authority. Furthermore, you can request the rectification, erasure and, under certain circumstances, the restriction of the processing of your personal data.

 

  1. Audio and video conferences

Data processing

We use online conferencing tools, among others, to communicate with our customers. The individual tools we use are listed below. If you communicate with us by video or audio conference via the Internet, your personal data will be collected and processed by us and, if applicable, by the provider of the respective conference tool.

The conference tools collect all data that you provide/enter to use the tools (eMail address and/or your telephone number). The conference tools also process the duration of the conference, the start and end (time) of the participation in the conference, the number of participants and other "context informations" in connection with the communication process (metadata).

Furthermore, the provider of the tool processes all technical data that are required to process the online communication. This includes, in particular, IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or loudspeaker and the type of connection.

If content is exchanged, uploaded or provided in any other way within the tool, it is also stored on our servers or those of the tool provider. Such content includes, in particular, cloud recordings, chat/instant messages, voicemails, uploaded photos and videos, files, whiteboards and other information shared while using the service.

Please note that we do not have the full control over the data processing operations of the tools used. Our options depend to a large extent on the company policy of the respective provider. Further informations on data processing by the conference tools can be found in the privacy policies of the tools used, which we have listed below this text.

Purpose and legal basis

The conference tools are used to communicate with prospective or existing contractual partners or to offer certain services to our customers (Article 6 (1)(b) GDPR). Furthermore, the use of the tools serves the general simplification and acceleration of communication with us or our company (legitimate interest within the meaning of Article 6 para. 1 lit. f GDPR). If consent has been requested, the tools in question are used on the basis of this consent; consent can be withdrawn at any time with effect for the future.

Storage period

The data collected directly by us via the video and conference tools will be deleted from our systems as soon as you request us to delete it, withdraw your consent to storage or the purpose for data storage no longer applies. Stored cookies remain on your end device until you delete them. Mandatory statutory retention periods remain unaffected.

We have no influence on the storage period of data of yours stored by the operators of the conference tools for their own purposes. For details, please contact the operators of the conference tools directly.

Conference tools currently used

We use the following conference tools:

Microsoft Teams

We use Microsoft Teams. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Details on data processing can be found within the Microsoft Teams privacy policy: https://privacy.microsoft.com/en-us/privacystatement.

The company is certified in accordance with the "EU-US Data Privacy Framework" (DPF). The Data Privacy Framework (DPF) is an agreement between the European Union and the USA that aims to ensure that data processing in the USA complies with European data protection Standards. Every company certified under the DPF undertakes to comply with these data protection standards. Further informations on this can be obtained from the provider at the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000KzNaAAK&status=Active

Order processing

We have concluded a Data Processing Agreement (DPA) for the use of the above-mentioned service. This is a contract prescribed by the data protection law, which guarantees that it processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Jitsi Meet

We use Jitsi Meet. When you communicate with us via Jitsi Meet, all data associated with this communication process are processed exclusively on our servers (On Premise).

 

  1. Social Media

We maintain publicly accessible profiles on social networks. The individual social networks we use are listed below.

Social networks such as Facebook, X (formerly Twitter) etc. can generally analyse your user behaviour comprehensively when you visit their website or a website with integrated social media content (e.g. through like-buttons or advertising banners). Visiting our social media presences triggers numerous data protection-relevant processing operations. In detail:

If you are logged into your social media account and visit our social media presence, the operator of the social media portal can assign this visit to your user account. However, your personal data may also be collected if you are not logged in or do not have an account with the respective social media portal. In this case this data collection takes place, for example, via cookies that are stored on your end device or by recording your IP address.

With the help of the data collected in this way, the operators of the social media portals can create user profiles in which your preferences and interests are stored. In this way, interest-based advertising can be displayed to you inside and outside the respective social media presence. If you have an account with the respective social network, the interest-based advertising can be displayed on all devices on which you are logged in or were logged in.

Please also note that we cannot track all processing operations on the social media portals. Depending on the provider, further processing operations may therefore be carried out by the operators of the social media portals. For details, please refer to the terms of use and data protection provisions of the respective social media portals.

Legal basis

Our social media presence is intended to ensure the widest possible presence on the Internet. This is a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. The analysis processes initiated by the social networks may be based on different legal bases, which must be specified by the operators of the social networks (e.g. consent within the meaning of Art. 6 para. 1 lit. a GDPR).

Responsible party and assertion of rights

If you visit one of our social media sites (e.g. Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered during this visit. You can assert your rights (information, rectification, erasure, restriction of processing, data portability and complaint) both against us and against the operator of the respective social media portal (e.g. Facebook).

Please note that, despite our joint responsibility with the social media portal operators, we do not have full control over the data processing operations of the social media portals. Our options are largely determined by the company policy of the respective provider.

Storage period

The data collected directly by us via the social media presence will be deleted from our systems as soon as you request us to delete it, withdraw your consent to storage or the purpose for data storage no longer applies. Stored cookies remain on your end device until you delete them. Mandatory statutory provisions - in particular retention periods - remain unaffected.

We have no influence on the storage period of data of yours stored by the operators of the social networks for their own purposes. For details, please contact the operators of the social networks directly (e.g. in their privacy policy, see below).

Social networks in detail

Facebook

We have a profile on Facebook. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. According to Facebook, the data collected is also transferred to the USA and other third countries.

We have entered into a joint processing Agreement (Controller Addendum) with Facebook. This Meta Platforms Ireland Limited agreement specifies which data processing operations we or Facebook are responsible for when you visit our Facebook page. You can view this agreement at the following link: https://www.facebook.com/legal/terms/page_controller_addendum.
You can find an addendum to the contract at https://www.facebook.com/legal/EU_data_transfer_addendum/update

You can customise your advertising settings yourself in your user account. To do this, click on the following link and log in: https://www.facebook.com/settings?tab=ads.

Data transfer to the USA is based on the Standard Contractual Clauses (SCC) of the EU Commission. You can find details here: https://www.facebook.com/legal/EU_data_transfer_addendum und https://de-de.facebook.com/help/566994660333381.

Details can be found within the Facebook's Privacy policy: https://www.facebook.com/about/privacy/.

X (formerly Twitter)

We use the social media and social networking service X (formerly Twitter). X functions are offered by the parent company Twitter Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. The Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland, is responsible for the data processing of persons living outside the USA.

You can customise your X (formerly Twitter) privacy settings yourself in your user account. To do this, click on the following link and log in: https://twitter.com/personalization.

Data transfer to the USA is based on the Standard Contractual Clauses (SCC) of the EU Commission. You can find details here https://gdpr.twitter.com/en/controller-to-controller-transfers.html.

Details can be found within the X's Privacy policy: https://twitter.com/de/privacy.

Instagram

We have a profile on Instagram. The provider is Instagram Inc, 1601 Willow Road, Menlo Park, CA, 94025, USA.

Data transfer to the USA is based on the Standard Contractual Clauses (SCC) of the EU Commission. You can find details here: https://www.facebook.com/legal/EU_data_transfer_addendum, https://help.instagram.com/519522125107875 and https://de-de.facebook.com/help/566994660333381.

Details on how Instagram handles your personal data can be found within Instagram's Privacy policy: https://help.instagram.com/519522125107875.

YouTube

We have a profile on YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Details on how YouTube handles your personal data can be found within YouTube's Privacy policy: https://policies.google.com/privacy?hl=de.

TikTok

We have a profile on TikTok. The provider is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. Details on how TikTok handles your personal data can be found within TikTok's Privacy policy: https://www.tiktok.com/legal/privacy-policy?lang=de.

Data transfer to non-secure third Countries is based on the Standard Contractual Clauses (SCC) of the EU Commission. You can find details here https://www.tiktok.com/legal/privacy-policy?lang=de.

 

  1. Special informations for parents

While our website is not generally directed to children under the age of 16, we strictly adhere to applicable laws regarding obtaining parental or guardian consent before collecting, using or disclosing information from children. We strongly recommend that parents take an active role in monitoring their children's online activities. If you believe that we have collected personal information from a person under the age of 16, please let us know through the following datenschutz@petafuel.de.

 

  1. Changes to the Privacy policy

We reserve the right to amend this Privacy policy at any time to the extent permitted by the law. The current version can be found on the website under the link "Privacy Policy".