Imprint
Kolle Rebbe GmbH
Dienerreihe 2
20457 Hamburg
Fon: 040/32 54 23-0
Fax: 040/32 54 23-23
e-mail: [email protected]
Managing directors:
Andreas Winter-Buerke, Ralph Poser, Fabian Frese, Lennart Wittgen, Matthias Schrader, Thomas Heinz, Thomas Knüwer, Liane Siebenhaar
Commercial register: Hamburg District Court HRB 59344
VAT Reg. No.: DE 176663348
Legal notice:
Any partial or commercial use requires the prior written consent of Kolle Rebbe GmbH
Creation and Production
KOREFE | Kolle Rebbe Form und Entwicklung
PRIVACY POLICY
Protecting personal data is important to us. That’s why we process personal data in accordance with valid European and national legal regulations.
You may of course revoke your declaration(s) of consent at any time with effect for the future. To do so, please contact the controller pursuant to Section 1.
The following declaration provides an overview of the kinds of data that we collect, how the data are used and passed on to others, what security measures we take to protect your data and the way in which we communicate to you about the information given to us.
Legal basis for processing personal data
Insofar as we obtain a declaration of consent of the data subject regarding the processing of personal data, sentence 1 point (a) Article 6(1) of the EU General Data Protection Regulation (GDPR) serves as a legal basis.
In processing personal data that are necessary to perform a contract to which the data subject is a party, sentence ? point (b) Article 6(1) of the GDPR serves as a legal basis. This also holds true for processing personal data that are necessary for taking steps prior to entering into a contract.
Insofar as it is necessary to process personal data to fulfill a legal obligation to which we are subject, sentence 1 point (c) Article 6(1) of the GDPR serves as a legal basis.
Where it is necessary to process personal data to protect a legitimate interest of our company or a third party and where those interests are not overridden by the interests or rights and freedoms of the data subject, then sentence 1 point (f) Article 6(1) of the GDPR serves as the legal basis for the data processing.
Erasure of data and storage period
The personal data of the data subject will be deleted or made unavailable as soon as the purpose for which they were stored no longer exists. Furthermore, the data may be stored if this was provided for by European or national lawmakers in Union legal directives, laws, or other regulations to which we are subject. The data will also be made unavailable or deleted if a period for which the personal data are stored that is prescribed by the standards named above is reached, unless it is further necessary to store the data in order to complete or perform a contract.
§ 1 The controller and the data protection officer
(1) Name and address of the controller
The controller as defined in the General Data Protection Regulation and other national data protection laws of the Member States, and in other provisions for data protection is
Kolle Rebbe GmbH
Dienerreihe 2
20457 Hamburg
Germany
Telephone: +49 40 32 54 23 0
Email: [email protected]
Website: www.kolle-rebbe.de
(2) Name and address of the data protection officer
The data protection officer for the controller is
Dieter Grohmann / akwiso Datenschutz & Audit
Beethovenstrasse 23
87435 Kempten
Germany
Telephone: +49 (0) 831 / 5124-7030
Fax: +49 (0) 831 / 5124-7031
Email: [email protected]
§ 2 Definitions
This data protection declaration is based in terminology used by European regulators in issuing the EU General Data Protection Regulation (called “GDPR” in the following). The privacy policy should be easy to read and understand. In order to ensure this is the case, the most important terms are explained below:
a) Personal data means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
b) Data subject means any identified or identifiable natural person whose personal data are processed by the controller.
c) Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
d) Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
e) Pseudonymization means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
f) Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
g) Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
h) Recipient means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.
i) Third party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.
j) Consent means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
§ 3 Making the website available and creation of logfiles
(1) In the case of purely informational use of the website, meaning if you do not register or otherwise transmit information to us, we automatically collect the following data and information regarding the computer system of the connecting computer upon every access of the website:
a) IP address of the user
b) information about type of browser and version used
c) the operating system of the user
d) the internet service provider of the user
e) date and time of the access
f) websites from which the system of the user came to our internet website
g) websites accessed by the user’s system via our internet website
h) content of the access (specific pages)
i) respectively transmitted quantity of data
j) language and version of the browser software
k) search machine used
l) names of the files downloaded
This data is also stored in our system’s log files. This does not apply to the user’s IP address or other data that make it possible to attribute the data to a user. This data is not stored together with any other personal data about the user.
(2) The legal basis for the temporary storage of the logfiles is sentence 1 point (f) Article 6(1) of the
GDPR.
(3) The temporary storage of the IP address by the system is necessary
a) in order to enable the delivery of the website to the user’s computer. For this purpose, the user’s IP address must be stored for the duration of the session.
b) to optimize the contents of our website or advertising for the website.
c) to maintain the functionality of our information technology systems and the technology of our website.
d) to provide law-enforcement authorities with information necessary for law enforcement in the event of a cyber attack.
This information is stored in log files to guarantee the website’s functionality.
In addition, we use the data to optimize our website and to ensure the
security of our information technology systems. An analysis of the data for
marketing purposes does not occur in this context.
For these purposes, we also have a legitimate interest in processing the data according to sentence 1 point (f) Article 6(1) of the GDPR.
(4) The data are deleted as soon as they are longer necessary to achieve the purpose for which they were collected – in this case, upon conclusion of the session.
In the case of logfile data that have been stored, this is the case after no longer than seven days. It is possible to store the data for a longer period. In this case, the IP addresses are deleted or anonymized so that they cannot be attributed to the client accessing the website.
(5) Collecting data to make the website available and storing data in logfiles is absolutely necessary for the operation of the internet website, which is why there is no possibility for you to object.
§ 4 Use of Cookies
(1) This website uses so-called cookies. Cookies are small text files that are sent by an internet server to your browser when you visit a website and stored locally on your end device (PC, notebook, tablet, smartphone, etc.), and which are stored on your computer and provide the user (meaning us) with certain information. Cookies serve to make the website more customer friendly and secure, and especially to collect information related to the use of the website, such as frequency of use and number of users of the pages as well as the ways in which the pages are used. Cookies cause no damage to your computer and do not contain viruses.
This cookie contains a characteristic string (the so-called cookie ID) that makes it possible to clearly identify the browser when the website is accessed again.
(2) We use cookies to make our website more user friendly. Several features of our internet website require that the connecting browser can be identified even after changing pages. In this process, the cookies store and transmit the following data:
- user recognition
(3) The purpose for using technically required cookies is to simplify the use of the website for you. Several features of our internet website cannot be offered without the use of cookies. These features require that the browser be recognized even after changing pages.
We require cookies for the following applications:
- user recognition
(4) Cookies remain stored even if the browser session is closed and can be accessed again upon a new visit to the page. However, cookies are stored on your computer, which transmits them to our page. As a result, you also have full control over the use of cookies. If you do not want data to be collected by cookies, you can adjust your browser via the “settings” menu to notify you if cookies are placed on your computer or to generally prevent or individually delete cookies. We would nevertheless like to advise you that the deactivation of cookies may limit the functionality of this website. Insofar as these are session cookies, the cookies will in any case be automatically deleted after you leave the website.
§ 5 Disclosure of personal data to third parties
1. Integration of YouTube videos
(1) We have integrated YouTube videos into our online offerings, which are stored at http://www.YouTube.com and can be played directly from our website. These have all been integrated in “enhanced privacy mode,” meaning that no data about you as a user are transmitted to YouTube if you do not play the videos. The data named in paragraph 2 are transmitted only if you play the videos. We have no influence over this data transfer. When you visit the website, YouTube is notified that you have accessed the corresponding subpage of our website.
In the process, the following data are transmitted:
- Device-specific information, for example, the hardware used; version of operation system; unique device ID and information about the mobile telephone network including your telephone number.
- Log data in the form of server logs. These include, among other things, details of the way in which the services were used, for example, search requests; IP address; hardware settings; browser type; browser language; date and time of your request; original page; cookies that allow your browser or Google account to be uniquely identified.
- Location-based information. It is possible that information about your actual location may be captured by Google. This includes, for example, your IP address, your WLAN access point or mobile telephone tower.
- You will find further information about the data collected by Google, Inc. at
the following link: https://policies.google.com/privacy?hl=de&gl=de
This occurs regardless of whether YouTube provides a user account to which you are logged in or you have no user account. If you are logged in to Google, your data are attributed directly to your account.
(2) The legal basis for the processing of personal data of the user is sentence 1 point (f) Article 6(1) of the GDPR.
(3) The integration of the videos serves to make the website more intuitive for the user and to increase the website’s search engine ranking with Google. YouTube stores your data as a user profile and uses them for purposes of advertising, market research and/or designing the website to be more accessible. Such an analysis occurs in particular (even for users who are not logged in) to provide advertising suited to demand and to inform other uses of the social network about your activities on our website.
(4) If you do not want data to be attributed to your profile with YouTube, you must log out before clicking the button.
(5) You have the right to object to the creation of this user profile, although you must contact YouTube to exercise this right.
(6) You will find further information about the purpose and scope of the data collection and processing by YouTube in the privacy policy. That policy also contains further
information about your rights and settings options to protect your privacy: https://www.google.de/intl/de/policies/privacy.
2. Links to external websites
This website contains links to external pages. We are responsible for our own content. We have no influence over external links and are therefore not responsible for them; we especially do not take ownership of their content. If you are directed to an external page, the privacy policy of that page applies. If you notice illegal activities or contents on this page, you are welcome to notify us. In this case, we will check the content and react accordingly (notice and take-down procedure).
§ 6 Contact form and email contact
(1) An email contact is available on our internet website that you can use to contact us electronically. If you make use of this possibility, the data you enter into the input mask will be transmitted to us, where they will be stored. These data are
Your consent will be obtained to process the data as part of the sending process, and you will be referred to this privacy policy.
Alternately, you may contact us via the email address we have provided. In this case, the personal data transmitted with the email will be stored. If these data pertain to information about communication channels (for example, email address, telephone number), you additionally agree for us to possibly contact you via this communication channel among others in order to respond to your concern.
No data are disclosed to third parties in this context. The data are used exclusively for processing the conversation.
(2) Where consent has been obtained by the use, the legal basis for the processing of the data is sentence 1 point (a) Article 6(1) of the GDPR. The legal basis for the processing of data that are transmitted in the course of sending an email is sentence 1 point (f) Article 6(1) of the GDPR. If the intention of the email contact is to enter into a contract, the additional legal basis for the processing is sentence 1 point (b) Article 6(1) of the GDPR.
(3) The processing of personal data from the input mask serves only for us to process your contact request. We will of course use the data from your email request exclusively for the purpose for which you provided them when you contacted us. In the case of contact via email, there is also a required legitimate interest to process the data in replying to the email. The other personal data processed as part of the sending process serve to prevent misuse of the contact form and to ensure the security of our information systems.
(4) The data are deleted as soon as they are no longer necessary to achieve the purpose for which they were collected. This is the case for personal data from the input mask of the contact form and for the data sent by email when the respective conversation with the user ends. The conversation is ended when the situation indicates that the issue at hand has been finally resolved. The personal data additionally collected in the course of the sending process will be deleted after a period of no longer than seven days.
(5) You may withdraw your consent at any time to the processing of your personal data. If you contact us via email, you may object at any time to the storage of your personal data. In this case, the conversation cannot be continued. We ask you to contact the controller or data protection officer in accordance with Section 1 by email or mail concerning a withdrawal of consent or objection to the storage of your personal data. In this case, all personal data that were stored in the course of establishing contact will be deleted.
§ 7 Rights of the data subject
Where personal data are processed, you are the data subject as defined by the GDPR, and you have the following rights vis-à-vis the controller:
1. Right to information
2. Right to rectification
3. Right to restriction of processing
4. Right to erasure
5. Right to be informed
6. Right to data portability
7. Right to object to the processing of personal data
8. Right to withdraw consent regarding data protection
9. Right to not have automated decision-making applied to your data
10. Right to submit a complaint to a supervisory authority
1. Right to information
(1) You may obtain from the controller confirmation as to whether or not personal data concerning you are being processed. Where such processing may occur, you may request at any time that the controller provide you information free of charge about the personal data concerning you that has been stored, in addition to the following information:
a) the purposes of the processing;
b) the categories of personal data concerned;
c) the recipients or categories of recipient to whom the personal data have been or will be disclosed;
d) the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
e) the existence of the right to request from the controller rectification or erasure of personal data, the right to restriction of processing of personal data concerning the data subject or to object to such processing;
f) the right to lodge a complaint with a supervisory authority;
g) where the personal data are not collected from the data subject, any available information as to their source;
h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
(2) You have the right to obtain information about whether the personal data concerning you are being transferred to a third country or to an international organization. In this context, you have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.
2. Right to rectification
You have the right to obtain from the controller without undue delay the rectification and/or completion where the personal data concerning that are being processed are incorrect or incomplete.
3. Right to restriction of processing
(1) Under the following conditions, you have the right to obtain from the controller the immediate restriction of processing of personal data concerning you:
a) where you contest the accuracy of the personal data for a period enabling the controller to verify the accuracy of the personal data;
b) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
c) the controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defense of legal claims;
d) when you have objected to processing pursuant to Article 21(1) of the GDPR pending the verification whether the legitimate grounds of the controller override your grounds.
(2) Where processing of personal data concerning you has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. Where the restriction of processing has been restricted according to the conditions referred to above, the controller will inform you before the restriction is lifted.
4. Right to erasure
(1) You may obtain from the controller the erasure of personal data concerning you without undue delay where one of the following grounds applies:
a) the personal data concerning you are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b) you withdraw your consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2) of the GDPR, and where there is no other legal ground for the processing;
c) you object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2);
d) the personal data have been unlawfully processed;
e) the personal data concerning you have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
f) the personal data concerning you have been collected in relation to the offer of information society services referred to in Article 8(1).
(2) Where the controller has made the personal data concerning you public and is obliged pursuant to Article 17(1) of the GDPR to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you as the data subject have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
(3) There is no right to erasure where the processing is necessary:
a) for exercising the right of freedom of expression and information;
b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
c) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3) of the GDPR;
d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the GDPR insofar as the right referred to in point (a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
e) for the establishment, exercise or defense of legal claims.
5. Right to be informed
Where you have exercised the right to rectification, erasure or restriction of processing vis-à-vis the controller, the controller is obligated to communicate
any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed by the controller about those recipients.
6. Right to data portability
(1) You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. Furthermore, you have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
a) the processing is based on consent pursuant to point (a) of Article 6(1) of the GDPR or point (a) of Article 9(2) of the GDPR or on a contract pursuant to point (b) of Article 6(1) of the GDPR and
b) the processing is carried out by automated means.
(2) In exercising this right, you further have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This may not adversely affect the freedoms and rights of others.
(3) That right to data portability shall not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
(4) The data subject can contact the controller at any time to exercise his or her right to data portability.
7. Right to object
(1) You have the right to object, at any time, on grounds relating to your particular situation, to the processing of personal data concerning you, which is based on point (e) or (f) of article 6(1) of the GDPR, including profiling based on those provisions.
(2) If you make such an objection, the controller will no longer process your personal data unless the controller can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms or for the establishment, exercise or defense of legal claims.
(3) Where personal data are processed for direct marketing purposes, you have the right to object, at any time, to the processing of your personal data for the purpose of such marketing; this also applies to profiling insofar as it is conducted in conjunction with such direct marketing. If you object to the processing of your personal data for direct marketing purposes, we will cease to process your personal data for such purposes.
(4) In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.
(5) The data subject may can contact the controller directly to exercise his or her right to object.
8. Right to withdraw consent regarding data protection
You have the right to withdraw your consent to this privacy policy at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. To withdraw your consent, you can contact the controller at any time.
9. Automated individual decision-making, including profiling
(1) You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision
a) is necessary for entering into, or performance of, a contract between you and a data controller;
b) is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or
c) occurs with your explicit consent.
(2) However, these decisions may not be based on special categories of personal data pursuant to Article 9(1) of the GDPR, in so far as point (a) or point (g) Article 9(2) of the GDPR do not apply and
reasonable steps were taken to protect rights and freedoms and your legitimate interests.
(3) Regarding the cases referred to in paragraphs (1) and (3), the data controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
(4) If the data subject wishes to exercise his or her rights regarding automated decision-making, he or she can contact the controller at any time to do so.
10. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 of the GDPR.
§ 8 Changes to the privacy policy
We reserve the right to change our data protection practices and this privacy policy in order to adjust them if necessary for changes in relevant laws or provisions or in order to better meet your needs. We will accordingly publish the changes to our data protection practices at this site. To that end, please note the current date applying to this privacy policy.
OPT-OUT
You may choose not to have a unique web analytics cookie identification number assigned to your computer to avoid the aggregation and analysis of data collected on this website.
To make that choice, please click below to receive an opt-out cookie.