Data Protection Notice for the Website www.becksche.de According to the GDPR
I. Name and address of the controller
The controller, in terms of the GDPR and other national data protection laws of Member States as well as other data privacy laws, is:
Druckerei C.H.Beck
Bergerstraße 3
86720 Nördlingen
Germany
Tel.: +49 9081 85-0
E-Mail: info@becksche.de
Website: www.becksche.de
II. Name and address of the authorised data protection officer
The legally appointed data protection officer is:
Herting Oberbeck Datenschutz GmbH
Hallerstraße 76
20146 Hamburg
Germany
E-Mail: dsb_druckereibeck@datenschutzkanzlei.de
Website: https://www.datenschutzkanzlei.de/
III. General Information on Data Processing
1. Extent of personal data processing
We collect and use the personal data of our users only where strictly essential for website functionality, as well as when required by our content and services. The collection and usage of our users’ personal data is done on a regular basis only after consent has been given by users. Exceptions are applicable in cases where it is not possible to obtain prior consent for factual reasons and the processing of data is legally permitted.
2. Legal basis for the processing of personal data
Insofar as we obtain the consent of the data subject for processing operations relating to personal data, Article 6 (1) (a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data.
Article 6 (1) (b) of the GDPR serves as the legal basis for processing personal data that is required for the fulfilment of a contract to which the data subject is party. This also applies to processing operations that are required for the implementation of pre-contractual measures.
When processing personal data as a necessity for complying with legal obligations to which our company is subject, Article 6 (1) (c) of the GDPR serves as the legal basis on which to do so.
In the event that the vital interests of the data subject or another natural person necessitate the processing of personal data, Article 6 (1) (d) of the GDPR provides legal grounds on which to do so.
Article 6 (1) (f) of the GDPR provides the legal grounds for processing data as essential for the protection of a legitimate interest of our company or a third party, so long as it is not overridden by the interests and fundamental rights and freedoms of the data subject.
3. Deleting data and duration of retention
Personal data will be deleted or blocked as soon as the purpose of storing it no longer applies. In some cases, storing data can occur if permitted by the European or national legislator under Union regulations, laws or other decrees that the controller is subject to. The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless a prolonged retention of data is required to perform or complete a contract.
IV. Providing the website and creating log files
1. Details and extent of data processing
With every visit to our website, our system automatically collects data and information from the incoming computer system, where the following data is collected:
- Information about the browser type and what version is being utilised
- The user’s operating system
- The user’s internet service provider
- The user’s IP address
- The time and date of access
- Websites from which the user’s system reached our website
- Websites that the user’s system accesses via our website
This data is also saved in our system’s log files, but not together with other personal data of users.
2. Legal basis for data processing
The legal basis for the temporary storage of the data and log files is Article 6 (1) (f) of the GDPR.
3. Purpose of processing data
The system’s temporary retention of an IP address is necessary to enable the website to reach the user’s device. The user’s IP address must therefore be stored for the duration of the session.
Log files are stored to ensure website functionality. Additionally, the data helps to optimise the website and to ensure the security of our IT systems. An analysis of the data for marketing purposes does not take place in this context.
According to Article 6 (1) (f) of the GDPR, data processing for these purposes also falls under our legitimate interests.
4. Duration of Retention
The data is deleted as soon as it is no longer serves the purpose for which it was collected. In cases where data is collected to provide users with the website, this expires once the session ends.
Data collected as log files are kept for a maximum period of seven days. It is however possible for retention to exceed this period, in which case users’ IP addresses will be deleted or anonymised so that an association with visiting clients is no longer possible.
5. Options concerning objection and removal
Collecting data for the provision of the website and storing data in log files are absolutely necessary for the running of the website. Consequently, the user cannot make any objections in this regard.
V. Use of Cookies
a) Details and extent of data processing
Our website uses cookies. Cookies deal with text files that the internet browser stores on the user’s computer system. When visiting a website, a cookie may be stored on the user’s system. This cookie contains a distinctive character string that allows the browser to be uniquely identified whenever the website is visited again.
We use cookies to make our website more user-friendly. Some elements of our website
require the browser accessing it to be identified, even after changing pages.
Cookies store and transmit the following data:
- Currently-used resolution for the optimisation of images
- Anonymous identification of the session
b) Legal basis for the processing of data
Article 6 (1) (f) acts as the legal basis for the processing of personal data through the use of cookies.
c) Purpose of data processing
The purpose of using technically essential cookies is to simplify the user experience of
websites. Some of our website functions cannot be offered without the use of cookies; for
these it is necessary to recognise the browser even after pages have been changed.
The following applications require us to use cookies:
- Optimisation of images
- Memorising data entered into forms
User data that is collected through technically essential cookies is not used to create user profiles.
According to Article 6 (1) (f) of the GDPR, processing personal data for these purposes also falls under our legitimate interest.
e) Duration of retention and options concerning objection and removal
Cookies are stored on the user's device and transmitted from the user to our site. As the user, you therefore have full control over the use of cookies. By changing the settings in your internet browser, you can prohibit or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. Deactivating cookies for our website could result in some of its functions not being fully usable anymore.
VI. Analysis of user behaviour
Google reCAPTCHA
We use ‘Google reCAPTCHA’ (referred to hereafter as ‘reCAPTCHA’) on our website, which is provided by Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (‘Google’).
reCAPTCHA checks whether data entered into pages on our website (e.g., into a contact form) is done by a person or an automated programme. For this, it analyses the behaviour of website users based on various characteristics. This analysis begins automatically, as soon as the user accesses the website. reCAPTCHA evaluates a variety of information about users for its analysis (e.g., IP addresses, amount of time spent on the website, or mouse movements made). The data collected during this analysis is passed on to Google.
This analysis by reCAPTCHA runs entirely in the background and users of the website are not notified that it is taking place.
The processing of data is done in accordance with Article 6 (1) (f) of the GDPR. The website operator has a legitimate interest in protecting its website content from misuse through automated data spying or spam.
More information on Google reCAPTCHA and Google’s privacy policy can be found via the following links: https://www.google.com/intl/de/policies/privacy/ and https://www.google.com/recaptcha/intro/android.html.
VII. Newsletter
1. Details and extent of data processing
On our website it is possible to subscribe to a free newsletter. When registering for the subscription, the data you put into the entry form is sent to us.
- Title
- First Name
- Last Name
- Email adress
- Newsletter format (text or HTML)
The following data is also collected during the registration process:
- IP address of the device accessing the site
- Time and date of registration
To process this data, your consent is obtained during the registration process with reference to this data protection notice.
If you acquire goods or services from us and disclose your email address in the process, we may then use it to send you newsletters. In such a case, only direct advertisements for our own goods and services similar to those you purchased will be sent via the newsletter.
Data in connection with data processing for the sending of newsletters is not passed onto third parties; this data is used solely for the purpose of sending out the newsletter.
2. Legal basis for the processing of data
The legal basis for the processing of data after registration for the newsletter is Article 6 (1) (a) of the GDPR, if the user has given their consent.
Article 7 (3) of the UWG (Act against Unfair Competition) provides the legal basis for sending newsletters following the sale of goods and services.
3. Purpose of data processing
Collecting email addresses and the names of users is essential for sending the newsletter.
The collection of other personal data during the registration process is done to prevent the misuse of services or e-mail addresses
4. Duration of retention
The data is deleted as soon as it no longer serves the purpose for which it was collected. Email addresses are therefore only stored so long as the user’s subscription to the newsletter is still active.
Other personal data collected during the registration process is generally deleted after a period of seven days.
5. Options concerning objection and removal
Users can cancel their subscription to the newsletter at any time, a link for which can be found in every newsletter.
This action will also revoke the consent that was given to store personal data that was collected during the registration process.
VIII. Contact form and email contact
1. Details and extent of data processing
Our website contains contact forms that can be used to get in touch electronically. If the user does this, the data entered into the input mask will be transmitted to us and stored. This data is:
- First Name
- Last Name
- Phone number
- Email adress
- Written message text
- The user’s IP address
- The time and date of access
Alternatively, it is possible to contact us via the email address that is provided. In such a case, the user’s personal data that is transmitted with the email will be stored.
Here, data is not passed on to third parties; it is used exclusively for processing the conversation.
2. Legal basis for data processing
The legal basis for processing data that has been obtained through sending an email is provided by Article 6 (1) (f) of the GDPR. If the email contact intendeds to conclude a contract, the additional legal basis for the processing is Article 6 (1) (b) of the GDPR.
3. Purpose of data processing
The processing of personal data from the input mask serves solely to handle the initiated contact. Contacting via email also constitutes a necessary legitimate interest in the processing of data.
Other personal data that is processed during the sending process serves to prevent potential misuse of the contact form and to ensure the security of our IT systems.
4. Duration of retention
The data is deleted as soon as it no longer serves the purpose for which it was collected. This applies to the personal data from the input mask of the contact form and to those who sent via email, when the conversation has come to an end. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.
Additional personal data that was collected during the sending process is deleted after a maximum period of seven days.
5. Options concerning objection and removal
Users may withdraw their consent for data processing at any time. Users can always contact us via email to object to the retention of their personal data. In such cases, any active conversations must then be discontinued
To withdraw consent, an informal email to datenschutz@becksche.de is sufficient.
This will result in the deletion of all personal data that has been stored over the course of the contact that has been had.
XI. Data subject rights
If your personal data is processed, you are a data subject according to the GDPR and you have the following rights over the controller:
1. Right of access
You may request confirmation from the controller as to whether personal data relating to you is being processed by us.
If such processing is occurring, you can request the following information from the controller:
- The purposes for which the personal data is being processed
- The categories of personal data that are being processed
- The recipients, or categories thereof, to whom your personal data has been or will be disclosed
- The planned duration of which your personal data is stored or, if precise information is not available here, the criteria for determining the retention period
- A right to rectify or delete your personal data, a right to obtain the restriction of processing by the controller or a right to object to such processing
- The right to appeal to a supervisory authority
- All available information regarding the origins of the data, if the personal data has not been collected from the data subject
- The automated decision-making, including profiling in accordance with Article 22 (1) and (4) of the GDPR and (at least in these cases) significant information about the logic involved as well as the extent of such processing and its anticipated effects for the data subject
You have the right to request information on whether your personal data is passed on to any third countries or international organisations. Further to this, you may request to be instructed on suitable safeguards in accordance with Article 46 of the GDPR, with regards to the sharing of data.
2. Right to rectification
You have the right to rectify and/or complete your personal data being that is processed so long as it is inaccurate or incomplete, to which the controller must oblige and promptly perform the rectification.
3. Right to the restriction of processing
You may request that the processing of your personal data be restricted under the following conditions:
- If you contest the accuracy of your personal data for a length of time that ensures the controller revises the accuracy of the personal data
- The processing is unlawful and you decline the deletion of the personal data, requesting that its usage be restricted instead.
- The controller no longer needs the personal data for the purpose of processing, but you require it for the establishment, exercise or defence of legal claims
- If you have lodged an objection to processing as per Article 21 (1) of the GDPR and it has not yet been determined whether the legitimate grounds of the controller override your reasons.
Should the processing of your personal data be restricted, it may be processed – with the exception of retention – only with your consent or for the establishment, exercise or defence of legal claims, or to protect the rights of another natural or legal person on the grounds of an important public interest of the Union or a Member State.
If processing has been restricted according to the above-mentioned conditions, you will be informed by the controller before the restriction is lifted.
4. Right to deletion
a) Obligation to delete
You may request the controller to delete your personal data immediately, whereby the controller is obliged to do so provided one of the following reasons applies:
- Your personal data is no longer serves the purposes for which it was collected or otherwise processed
- You withdraw your consent on which the processing was based according to Article 6 (1) (a) or Article 9 (2) (a) of the GDPR and no other legal basis for processing is present
- You object to processing pursuant to Article 21 (1) of the GDPR and there are no overriding grounds in favour of the processing, or you object to processing pursuant to Article 21 (2) of the GDPR
- Your personal data has been unlawfully processed
- The deletion of your personal data is in compliance with a legal obligation under Union or Member State law to which the controller is subject.
- Your personal data has been collected in relation to services offered by an information society, referred to in Article 8 (1) of the GDPR
b) Information to third parties
If the controller has made your personal data public and is obliged to delete it as per Article 17 (1) of the GDPR, it will take appropriate steps – including technical ones – with consideration of the available technology and implementation costs, in order to inform controllers processing your personal data that you, as the data subject, are requesting that they delete all links to, or copies or replications of this personal data
c) Exceptions
The right to deletion is not upheld if the processing is essential
- To exercise the right to freedom of expression and information
- In compliance with a legal obligation that requires processing under Union law or that of Member States, to which the controller is subject; or for the performance of a task that is for public interest, or in the exercise of official authority vested in the controller
- For reasons of public interest in the domain of public health, in accordance with Article 9 (2) (h) and (i) as well as Article 9 (3) of the GDPR
- For purposes of archiving, statistics, or scientific or historical research in the interests of the public, pursuant to Article 89 (1) of the GDPR, insofar as the right referred to in section (a) is likely to impair or render impossible the fulfilment of the aims of the processing
- For the establishment, exercise or defence of legal claims
5. Right to information
If you have exercised the right to rectification, deletion or restriction of processing against the controller, they are obliged to inform all recipients to whom your personal data was disclosed of this rectification or deletion of the data or the restriction of the processing of it, unless such action proves to be impossible or entails a disproportionate effort.
You have the right to be informed of these recipients by the controller.
6. Right to data portability
You have the right to be informed of these recipients by the controller.
-
You have the right to be informed of these recipients by the controller.
You have the right to receive your personal data that you provided to the controller, in a
structured, commonly used and machine-readable format. You also have the right to
transmit this data to another controller without hinderance from the controller to whom
the personal data was provided, as long as:
In exercising this right, you also have the right to have your personal data transferred from one controller directly to another, where it is technically feasible to do so. This cannot infringe on the rights and freedoms of others.
7. Right to object
The right to data portability does not apply when processing personal data is required to perform a task carried out on the grounds of public interest or in the exercise of official authority vested in the controller.
You have the right to object at any time to the processing of your personal data that is carried out based on Article 6 (1) (e) or (f), for reasons to do with your particular situation. This also applies to profiling that is carried out based on these clauses.
If your personal data is being processed for direct marketing purposes, you have the right to object at any time to such processing, which includes profiling insofar as it is related to such marketing.
Should you object to processing for direct marketing purposes, your personal data will cease to be processed for such purposes.
In connection with the use of information society services and notwithstanding Directive 2002/58/EC, you have the possibility to exercise your right by automated procedures using technical specifications.
8. Right to withdraw consent under data protection law
You have the right to withdraw your declaration of consent at any time under data protection law. The withdrawal of consent does not affect the lawfulness of processing that was carried out with consent prior to its withdrawal.
9. Automated decision-making in individual cases, including profiling
You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision:
- Is necessary for the completion or performance of a contract between you and the controller
- Is permitted by Union or Member State law to which the controller is subject and this legislation entails suitable measures to safeguard your rights and freedoms as well as your legitimate interests
- Is carried out with your explicit consent
However, these decisions cannot be based on special categories of personal data as defined in Article 9 (1) of the GDPR unless Article 9 (2) (a) or (g) applies and suitable measures have been taken to protect your rights, freedoms and legitimate interests.
Regarding the cases referred to in points 1 and 3, the controller will take suitable measures to safeguard your rights, freedoms and legitimate interests, which includes at least the right to obtain the intervention of a person on the part of the controller, to express their point of view and to contest the decision.
10. Right to complain to a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your fixed residence, place of work or the place of the alleged infringement, if you consider the processing of your personal data to be in violation of the GDPR.
The supervisory authority to which the complaint has been filed will keep the complainant informed on the status and outcome of their complaint, including the possibility of a legal remedy in accordance with Article 78 of the GDPR.
