Date: 05/2018

We process users' personal data (hereinafter referred to as “data”) only if this is necessary for the provision of a functional and user-friendly website and of our content and services.

“Processing” refers to collection, use, forwarding and/or storage. Under the General Data Protection Regulation (hereinafter referred to as the “GDPR”), “personal data” refers to all data by means of which a natural person can be identified. The precise definitions of the terms are set out in Article 4 GDPR.

The statements below inform you in particular of the nature, scope, purpose, duration and legal basis of the processing of personal data; we, alone or in conjunction with others, decide on the purposes and means of processing of said data, and on the components of third parties that may be used by us for optimisation and quality of use and process data under their own responsibility:

A) Information on the controller
B) Rights of the user
C) Information on data processing

A) Information on the controller

The controller (hereinafter referred to as the “provider”) as defined by the GDPR and other national data protection legislation of the member states as well as other data protection regulations is:

Volmary Digital GmbH
Kaldenhofer Weg 70
D-48155 Münster

Tel.: +49 (0)251-270 70-100
Fax: +49 (0)251-270 70-270
E-Mail: info@volmary.com

The data protection officer of the controller is:

Christian Westkemper
Kaldenhofer Weg 70
D-48155 Münster

Tel.: +49 (251) 27070 312
Fax.: +49 (251) 27070 112
E-Mail: datenschutz@volmary.com

B) Rights of the user

With regard to the processing of their personal data carried out by the provider and described below, the user has the right,

1. to request confirmation of whether the data relating to them will be processed and to request precise information on these data as well as further information and copies of the data as per Article 15 GDPR;

2. to request immediate rectification of incorrect data concerning them or completion of said data as per Article 16 GDPR;

3. to request that the data relating to them are erased immediately as per Article 17 GDPR, or alternatively, for example if further processing as per Article 17(3) GDPR is required, to request restriction of processing of the data in accordance with Article 18 GDPR;

4. to receive the personal data concerning them which they have provided in accordance with Article 20 DSGVO, and to request that said data be transmitted to other controllers;

5. to lodge a complaint with the supervisory authority as per Article 77 GDPR if the user considers that processing of their data by the provider infringes the GDPR.

6. In accordance with Article 21 GDPR, the user can object at any time to future processing of data concerning them that is performed by a controller on the basis of Article 6(1)(f) GDPR. In particular, the objection can be raised on account of processing for the purpose of direct marketing.

7. The provider is additionally obliged to communicate any rectification or erasure of personal data or restriction of processing carried out on the basis of Article 16 GDPR, Article 17(1) GDPR and Article 18 GDPR to all data recipients to whom the provider has disclosed the data. This obligation does not apply in the event that this notification proves impossible or would involve a disproportionate effort. The user has the right to receive information on these recipients.

C) Information on data processing

If no detailed information is subsequently provided regarding the individual data processing operations, the user's data processed by the provider shall be deleted or blocked as soon as the storage purpose ceases to apply and no statutory storage obligations stand in the way of erasure.

Server data

For communication and security reasons, data such as those listed below are collected during the visit to the website and are sent by the user's web browser to the provider or the provider's web space provider (server log files):

- Browser type and version;
- Operating system used;
- Website from which the user switched to the provider's website (referrer URL);
- Website visited by the user;
- Date and time of access;
- The user's internet protocol (IP) address.

In addition, the data are stored temporarily. These data are not stored together with other personal data of user. The legal basis for temporary storage is Article 6(1)(f) GDPR on the basis of the legitimate interest in improving the stability, functioning and security of the website.

The data are deleted after no more than seven days. Data that has to be stored for longer for verification purposes are exempt from erasure until the respective matter is finally resolved.

Cookies

a) Session cookies/persistent cookies

The provider uses cookies on its website. Cookies are small text files or other storage technologies that the user's web browser deposits and stores on the terminal. These cookies process specific information of the user, such as browser and location data and IP address values, to an individual extent. 

Processing allows the provider to make its website more user-friendly, effective and secure. For instance, if applicable, processing of session cookies enables reproduction of the content in different languages or use of a shopping-basket function.

Persistent cookies allow the website to recognise the user via their browser on a regular visit to the website.

If personal data is processed by these cookies for the purpose of contract initiation or contract execution, the legal basis for processing is Article 6(1)(b) GDPR.

If processing is not intended for contract initiation or contract execution, processing serves the provider's legitimate interest in improving the functioning of the website and is based on the legal basis of Article 6(1)(f) GDPR.

The session cookies are erased when the user closes their browser. The persistent cookies are automatically erased after a period stipulated by the provider. This period differs depending on the cookie, but shall not exceed one year.

b) Cookies from third-party providers

If applicable, cookies from third-party providers are also used on the website. These third-party providers are partner companies with which the provider collaborates for the purpose of marketing, analysis or the functions of the website. If this is the case, the purposes and legal bases of the corresponding processing operations are listed in the subsequent statements.

c) Possibility of rectification

The user can prevent or restrict installation of the cookies by configuring their browser accordingly. Cookies that have already been stored can also be erased at any time. The settings for this depend on the respective browser. In the case of Flash cookies, processing cannot be prevented via the browser settings, but by corresponding configuration of Flash Player.  If the user prevents or restricts installation of cookies, this may mean that some functions of the website are no longer fully usable.

Contract execution

a) Processing

The personal data submitted by the user for the purpose of purchasing goods or services shall be processed by the provider for the purpose of contract execution. The data content is essential to conclusion of a contract; no contract can be concluded without provision of data. The legal basis for processing is Article 6(1)(b) of the General Data Protection Regulation (GDPR). After full execution of the contract, the user's data shall be erased with due consideration of storage periods specified by tax and commercial legislation.

b) Forwarding

In the context of order execution, the user's personal data shall be forwarded to a service provider used for handling of the purchase of the goods or services, to the transportation company commissioned with delivery or to the financial service provider insofar as this is essential for handling or delivery of or payment for the goods.

The legal basis for forwarding of the data is Article 6(1)(b) GDPR.

Notice regarding PayPal:

If the customer selects the payment service provider PayPal, the latter may ask credit rating-related questions in the event of certain payment types also selected by the customer. Further details regarding processing of the customer's personal data by PayPal can be found at https://www.paypal.com/uk/webapps/mpp/ua/privacy-full.

Customer account

If the user registers for a customer account with the provider, the data entered in the course of this registration (e.g. name, address, e-mail address) shall be collected and stored solely for fulfilment of a contract or the implementation of pre-contractual measures as well as for general customer relationship management (e.g. retrieval of previous orders or notepad function). On registration, the IP address and the date and time of registration shall also be stored. There shall be no forwarding to third parties.

In the event of consent from the user, the legal basis is Article 6(1)(a) GDPR. During the registration process, if applicable, the user's express consent to the aforementioned processing shall be obtained and this privacy policy shall be referred to. The data thus collected shall be used solely for the aforementioned purpose. There shall be no forwarding to third parties.

If the customer account is opened for fulfilment of a contract or for implementation of precontractual measures, an additional legal basis is Article 6(1)(b) GDPR.

The user can withdraw granted consent for the customer account at any time under Article 7(3) GDPR by notifying the provider. The data processed in connection with this shall be erased as soon as processing thereof is no longer required. Should the data be essential to fulfilment of a contract or implementation of precontractual measures, the user's data shall be erased upon expiry of the storage periods specified by tax and commercial legislation.

Contact requests

If the user makes contact with the provider via contact form or e-mail, the user's personal data entered in this instance shall be used for processing of the request. The data content is essential to a response to the request; only a partial response or no response at all is possible without provision of the data.

If the contact request serves the purpose of fulfilling a contract or implementing precontractual measures, the legal basis is Article 6(1)(b) GDPR.

The user's data shall be erased if the user's request has been definitively answered and no statutory storage obligations stand in the way of this, e.g. in the event of subsequent contract execution.

Consent from the user can also be a legal basis as per Article 6(1)(a) GDPR. In the context of the contact form, if applicable, the user's consent to the aforementioned processing shall be obtained and this privacy policy shall be referred to.

The user can withdraw granted consent for the contact request at any time under Article 7(3) GDPR by notifying the provider. The data processed in connection with this shall be erased as soon as processing thereof is no longer required.

Credit-rating check/scoring

If invoice-based payment is offered to the user by the provider in an offer for goods or services, the provider reserves the right to forward the data relevant to the contract (in particular forename and surname, street, house number, postcode, town/city) to a credit agency (e.g. Bürgel, Schufa, Creditreform, infoscore etc.) for the purpose of a credit check on the basis of mathematical and statistical methods. The provider shall use the resultant information on the statistical probability of default in order to decide whether invoice-payment for contract execution shall be offered.

The credit check may contain probability figures (score values) that are calculated on the basis of scientifically recognised mathematical and statistical methods.

The legal basis for this processing is the legitimate interest of the provider in the reliability of the receivable as per Article 6(1)(f) GDPR.

Google Analytics

This website uses Google Analytics, a web analysis service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, hereinafter referred to as “Google”.

Google is certified under the EU-US Privacy Shield, thus ensuring that data processing in the USA complies with EU data processing requirements.

https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active

Google Analytics enables the provider to analyse use of the website. The legal basis here is Article 6(1)(f) GDPR. The legitimate interest of the provider consists of analysis, optimisation and commercial operation of the website.

Information such as the time, location and frequency of the user's visits to the web pages, including the user's IP address, is transmitted to a Google server in the USA and stored there.

The provider uses Google Analytics with an anonymisation function here. By means of this additional feature, in this case, the IP address is abbreviated by Google within European Union member states or in other contracting states of the Agreement on the European Economic Area.

Google shall use the data gathered in this way to evaluate the user's visit to the website and to compile reports on website activities for the provider. In addition, the data shall be used in order to perform further services associated with website use and internet use. Google may also transmit this information to third parties if this is legally prescribed or if third parties process these data on Google's behalf.

Google itself has stated that it shall never connect the user's IP address with other Google data. Further information, particularly regarding the opportunities for preventing data use, is available from Google via the following link:

https://policies.google.com/technologies/partner-sites?hl=en

In addition, Google offers a deactivation add-on for the most common browsers, giving the user greater control over what data Google gathers regarding the website accessed by the user. The add-on notifies the JavaScript (ga.js) of Google Analytics that no information on the website visit is to be transmitted to Google Analytics. However, the deactivation add-on for browsers from Google Analytics does not prevent information from being sent to the provider or to other web analysis services that may be used by the provider and are listed in this privacy policy. Further information on installation of the browser add-on can be accessed via the following link:

Browser add-on for deactivation of Google Analytics

Google Fonts:

To display the text on the website, the provider uses external fonts in the form of “Google Fonts”, a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, hereinafter referred to as “Google”.

Google is certified under the EU-US Privacy Shield, thus ensuring that data processing in the USA complies with EU data processing requirements.

https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active

When the provider's website is accessed, a connection with the Google server in the USA is established in order to enable and update the display of the text.

The legal basis here is Article 6(1)(f) GDPR. The legitimate interest of the provider consists of optimisation and commercial operation of the website.

The connection allows Google to identify the website from which a request is sent and the IP address to which display of the text is sent.

Further information, particularly regarding the opportunities for preventing data use, is available from Google via the following links:

https://policies.google.com/privacy
https://adssettings.google.com/authenticated.