Data protection information
(Information obligations according to Art. 13 GDPR)
We believe that data protection should be transparent, easy to understand and, above all, fair for all parties. For this reason, we would like to inform you in this privacy policy about what personal data we collect and use from you, whether and if so, to which third parties it may be passed on, how long we store the data and what rights you have if you do not agree with our responsible handling. If you still have any questions after reading this detailed data protection information, please do not hesitate to contact us using the contact details below.
Definitions
To ensure that we start from the same premises, we would like to clarify a few definitions at this point. This will ensure that everyone involved knows what we are talking about and assuming in the following information.
Personal data: This is any information relating to an identified or identifiable natural person (hereinafter “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Processing: Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Restriction of processing: This refers to the marking of stored personal data with the aim of restricting its future processing.
Profiling: Any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements is called profiling.
Pseudonymization: Pseudonymization is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
Controller: This is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
Recipient: Any natural or legal person, public authority, agency or other body to whom personal data are disclosed, whether or not that person is a third party. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.
Third party: This is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.
Consent: This is any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
1. name and contact details of the person responsible
The controller responsible for data processing is
Rhein Group (Deutschland) GmbH
Außer der Schleifmühle 29
28203 Bremen
You can reach us by post, by email at info@rhein-group.de or by telephone on 0421- 3307488.
2. collection of personal data for informational use
If you use the website for informational purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security (legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR):
Browser type and browser version
Operating system used
Referrer URL
Host name of the accessing computer
Time of the server request
IP address
3. use of cookies
We do not use cookies on our website.
4. use of functions on our website
(1) In addition to the purely informational use of our website, we offer various services that you can use if you are interested. To do so, you must generally provide additional personal data that we use to provide the respective service. If additional voluntary information is possible, it is marked accordingly.
(2) When you contact us by e-mail, we will store your e-mail address and, if you specify this, your name and telephone number in order to answer your questions. (The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR)
5. recipients or categories of recipients
If we pass on your personal data to third parties, you will be explicitly informed of this in the description of the respective data processing (e.g. when using our contact form). Of course, we also use external service providers for technical and organizational processing, with whom we have concluded corresponding order processing contracts within the meaning of Art. 28 GDPR. These are, for example, service providers for web hosting, sending emails and letters, maintenance and care of our IT systems, etc.
6. storage period
Your data will be stored for as long as it is absolutely necessary to achieve the respective purpose, but at the longest for as long as any legal regulations require us to do so (e.g. under commercial law we are obliged to keep business letters, which may also include emails, for 10 years).
As soon as the storage purpose no longer applies or a storage period prescribed by the aforementioned regulations expires, the personal data is routinely blocked or deleted.
7. your rights
In this section we would like to inform you comprehensively about the rights to which you are entitled.
7.1. Recht auf Auskunft
You have the right to request information from us at any time as to whether personal data concerning you is being processed by us. If this is the case, you are entitled to information regarding the information specified in Art. 15 para. 1 2nd HS GDPR.
You have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.
7.2. Recht auf Berichtigung
Furthermore, in accordance with Art. 16 GDPR, you have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to request the completion of incomplete personal data, including by means of a supplementary declaration.
7.3. Recht auf Löschung („Recht auf Vergessenwerden“)
You also have the right to demand that we delete personal data concerning you immediately. We are obliged to comply with this request and delete personal data unless we are legally obliged or entitled to continue processing your data. For details, please refer to Art. 17 GDPR.
7.4. Recht auf Einschränkung der Verarbeitung
You have the right to demand that we restrict processing if the legal requirements under Section 18 GDPR are met.
7.5. Recht auf Unterrichtung
If you have exercised your right to rectification, erasure or restriction of processing in accordance with Art. 19 GDPR, we are obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.
You have the right to be informed about these recipients.
7.6. Recht auf Datenübertragbarkeit
If your data is processed by us with your consent or on the basis of a contract, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format. You also have the right to transfer this data to another controller, provided that the legal requirements of Art. 20 GDPR are met.
7.7. Recht auf Widerspruch
Individual right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions.
We will no longer process the personal data concerning you unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.
Right to object to the processing of data for direct marketing purposes
If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.
If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes.
Notwithstanding Directive 2002/58/EC, you have the option of exercising your right to object in connection with the use of information society services by means of automated procedures using technical specifications.
7.8. Recht auf Widerruf der datenschutzrechtlichen Einwilligungserklärung
You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
7.9. Automatisierte Entscheidung im Einzelfall einschließlich Profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision
a) is necessary for entering into, or performance of, a contract between you and the controller,
b) is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or
c) is based on your explicit consent.
However, these decisions may not be based on special categories of personal data pursuant to Art. 9 para. 1 GDPR, unless Art. 9 para. 2 lit. a or g applies and appropriate measures have been taken to protect the rights and freedoms and your legitimate interests.
With regard to the cases referred to in a. and c., the controller shall take reasonable measures to safeguard the rights and freedoms and your legitimate interests, including at least the right to obtain the intervention of a person by the controller, to express his or her point of view and to challenge the decision.
7.10. Beschwerderecht
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.
The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
The supervisory authority responsible for us is
The State Commissioner for Data Protection and Freedom of Information
Arndtstraße 1
27570 Bremerhaven
Tel.: +49 421 3612010 or +49 471 5962010
Fax: +49 421 49618495
E-mail: office@datenschutz.bremen.de
8. legal bases of the processing
Unless already mentioned in the individual processing operations in the previous sections, we set out below the legal bases on which we process data.
Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 para. 1 lit. a EU General Data Protection Regulation (GDPR) as the legal basis.
When processing personal data necessary for the performance of a contract to which the data subject is party, Art. 6 para. 1 lit. b GDPR as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.
Insofar as the processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 para. 1 lit. c GDPR as the legal basis.
In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 lit. d GDPR as the legal basis.
If the processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 para. 1 lit. f GDPR as the legal basis for processing.