AI-translated for information from the existing German text. The German source remains the reference version. This translation does not update or legally review the original content. German original
Introduction
This privacy policy explains the types of personal data (also referred to below as “data”) we process, the purposes of processing and its scope. It applies to all processing of personal data carried out by us, both when providing our services and, in particular, on our websites, in mobile applications and on external online presences such as our social media profiles (collectively referred to below as our “online services”).
The terms used are not gender-specific.
Last updated: 21 February 2022
Contents
Data processing in third countries
Provision of online services and web hosting
Contact and enquiry management
Plugins, embedded functions and content
Changes and updates to this privacy policy
Controller
HANS Apartments
Am Eichberg 7
88416 Erlenmoos
Email address:
info@hansapartments.com
Overview of processing
The following overview summarises the types of data processed and the purposes of processing, and identifies the data subjects concerned.
Types of data processed
Master data.
Payment data.
Contact data.
Content data.
Contract data.
Usage data.
Metadata / communication data.
Categories of data subjects
Prospective customers.
Communication partners.
Users.
Business and contractual partners.
Purposes of processing
Provision of contractual services and customer service.
Contact enquiries and communication.
Office and organisational procedures.
Managing and responding to enquiries.
Provision of our online services and user-friendliness.
Relevant legal bases
The following provides an overview of the legal bases under the GDPR on which we process personal data. Please note that national data protection requirements in your or our country of residence or establishment may apply in addition to the GDPR. Where more specific legal bases are relevant in individual cases, we will explain them in this privacy policy.
Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the data subject's request before entering into a contract.
Legal obligation (Article 6(1), first sentence, point (c) GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
Legitimate interests (Article 6(1), first sentence, point (f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject that require protection of personal data.
In addition to the data protection provisions of the GDPR, national data protection rules apply in Germany. These include, in particular, the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). The BDSG contains specific provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transmission, and automated individual decision-making including profiling. It also governs data processing for employment purposes (Section 26 BDSG), particularly the establishment, implementation and termination of employment relationships and employee consent. Data protection laws of individual German federal states may also apply.
Security measures
In accordance with statutory requirements, and taking into account the state of the art, implementation costs, the nature, scope, circumstances and purposes of processing, and the varying likelihood and severity of risks to the rights and freedoms of individuals, we implement suitable technical and organisational measures to ensure a level of security appropriate to the risk.
These measures include safeguarding the confidentiality, integrity and availability of data through controls on physical and electronic access, data access, input, disclosure, availability and separation. We have also established procedures to enable the exercise of data subject rights, deletion of data and responses to threats to data security. We further consider the protection of personal data when developing or selecting hardware, software and procedures, in line with the principles of data protection by design and by default.
IP address truncation: Where we or our service providers and technologies process IP addresses and processing the full address is unnecessary, the IP address is shortened (also known as “IP masking”). The last two digits or the last portion after a dot are removed or replaced with placeholders. Truncation is intended to prevent or substantially hinder identification of a person from their IP address.
SSL encryption (HTTPS): We use SSL encryption to protect data transmitted through our online services. You can identify an encrypted connection by the prefix https:// in your browser's address bar.
Data processing in third countries
Where we process data in a third country (outside the European Union (EU) or the European Economic Area (EEA)), or processing takes place when using third-party services or disclosing or transferring data to other persons, bodies or companies, this is done only in accordance with statutory requirements.
Subject to express consent or transfers required by contract or law, we process data, or have it processed, in third countries only where there is a recognised level of data protection, contractual obligations under the EU Commission's standard contractual clauses, certifications or binding internal data protection rules (Articles 44 to 49 GDPR; European Commission information page: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).
Deletion of data
We delete the data we process in accordance with statutory requirements as soon as consent permitting processing is withdrawn or other permissions cease to apply (for example, when the processing purpose no longer applies or the data is no longer required for that purpose).
If data is not deleted because it is required for other legally permissible purposes, its processing is restricted to those purposes. This means the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons, or that must be stored to establish, exercise or defend legal claims or protect the rights of another natural or legal person.
Our privacy information may contain additional details on data retention and deletion that take precedence for the respective processing activities.
Use of cookies
Cookies are small text files or other storage records that store information on devices and read information from them. They may, for example, store the login status of a user account, the contents of an online shopping cart, accessed content or functions used in online services. Cookies may also serve other purposes, such as functionality, security and convenience, or analysis of visitor traffic.
Information on consent: We use cookies in accordance with statutory requirements. We therefore obtain prior consent from users unless this is not legally required. In particular, consent is not required where storing or accessing information, including cookies, is strictly necessary to provide a telemedia service expressly requested by the user (our online services). Revocable consent is clearly communicated to users and includes information about the relevant cookie use.
Information on data protection legal bases: The legal basis on which we process users' personal data using cookies depends on whether we request consent. Where users consent, their declared consent is the legal basis. Otherwise, data processed using cookies is processed on the basis of our legitimate interests (for example, operating our online services economically and improving usability) or, where necessary to meet contractual obligations, for the performance of those obligations. We explain the purposes of cookie processing in this privacy policy or as part of our consent and processing procedures.
Storage duration: The following types of cookies are distinguished by their storage duration:
Temporary cookies (also known as session cookies): Temporary cookies are deleted at the latest after a user leaves an online service and closes their device or application, such as their browser or mobile app.
Persistent cookies: Persistent cookies remain stored after the device or application is closed. They can, for example, retain login status or display preferred content directly when a user returns to a website. Data collected through cookies may also be used to measure reach. Unless users receive explicit information about cookie types and retention periods, for example when consent is obtained, they should assume that cookies are persistent and may be stored for up to two years.
General information on withdrawal and objection (opt-out): Users may withdraw their consent at any time and object to processing in accordance with Article 21 GDPR (further information on objections is provided in this privacy policy). Users may also express their objection through their browser settings.
Further information on processing activities, procedures and services:
Processing cookie data on the basis of consent: We use a cookie consent management procedure through which users' consent to cookies and the processing activities and providers specified in that procedure can be obtained, managed and withdrawn. The declaration of consent is stored so that it need not be requested repeatedly and can be demonstrated as required by law. It may be stored on the server and/or in a cookie (an opt-in cookie or comparable technology) to associate consent with a user or device. Unless individual information about cookie management providers specifies otherwise, the following applies: Consent may be stored for up to two years. A pseudonymous user identifier is created and stored together with the time of consent, its scope (such as cookie categories and/or service providers), and the browser, system and device used.
Business services
We process data relating to our contractual and business partners, such as customers and prospective customers (collectively “contractual partners”), in the context of contractual and comparable legal relationships, associated measures and communications with contractual partners, including pre-contractual communications such as responding to enquiries.
We process this data to fulfil our contractual obligations, particularly to provide agreed services, meet any update obligations and remedy warranty claims and other performance issues. We also process data to safeguard our rights and perform related administrative and organisational tasks. In addition, we process data on the basis of our legitimate interests in proper and economically sound business management and in security measures protecting our contractual partners and business operations from misuse and risks to their data, secrets, information and rights. This may involve telecommunications, transport and other support services, subcontractors, banks, tax and legal advisers, payment service providers or tax authorities. Within the limits of applicable law, we disclose contractual partners' data to third parties only as necessary for these purposes or to meet legal obligations. Contractual partners are informed of other processing, such as marketing, in this privacy policy.
Before or during data collection, we inform contractual partners which data is required for these purposes, for example through specific markings such as colours or symbols such as asterisks in online forms, or in person.
We delete data after statutory warranty and comparable obligations expire, generally after four years, unless it is stored in a customer account, for example for as long as statutory archiving requirements apply (usually ten years for tax purposes). Data disclosed by a contractual partner in the context of an assignment is deleted according to the assignment's requirements, generally when the assignment ends.
Where we use third-party providers or platforms to deliver our services, the respective providers' or platforms' terms and privacy information apply to the relationship between users and those providers.
Agency services
We process our customers' data as part of our contractual services, which may include conceptual and strategic consulting, campaign planning, software and design development, consulting or maintenance, implementation of campaigns and processes, handling, server administration, data analysis, advisory services and training.
Types of data processed: Master data (e.g. names and addresses); payment data (e.g. bank details, invoices, payment history); contact data (e.g. email addresses, telephone numbers); contract data (e.g. subject matter, term and customer category).
Data subjects: Prospective customers; business and contractual partners.
Purposes of processing: Provision of contractual services and customer service; contact enquiries and communication; office and organisational procedures; managing and responding to enquiries.
Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) GDPR); legal obligation (point (c)); legitimate interests (point (f)).
Provision of online services and web hosting
To provide our online services securely and efficiently, we use one or more web hosting providers whose servers, or servers managed by them, host our online services. For these purposes, we may use infrastructure and platform services, computing capacity, storage and database services, as well as security and technical maintenance services.
Data processed in connection with hosting may include all information concerning users of our online services arising during use and communication. This regularly includes the IP address needed to deliver online content to browsers and all entries made within our online services or on websites.
Types of data processed: Content data (e.g. entries in online forms); usage data (e.g. visited websites, interests in content, access times); metadata / communication data (e.g. device information, IP addresses).
Data subjects: Users (e.g. website visitors and users of online services).
Purposes of processing: Provision of our online services and user-friendliness.
Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) GDPR).
Further information on processing activities, procedures and services:
Email sending and hosting: The web hosting services we use also include sending, receiving and storing emails. For these purposes, recipient and sender addresses, other email-related information such as participating providers, and email contents are processed. This data may also be processed to detect spam. Please note that emails are generally not sent in encrypted form throughout the internet. Emails are usually encrypted in transit, but not on the servers from which they are sent and received, unless end-to-end encryption is used. We therefore cannot accept responsibility for the transmission route between the sender and receipt on our server.
Collection of access data and log files: We or our hosting provider collect data about every server access in server log files. These may include the address and name of requested pages and files, access date and time, data volumes transferred, successful retrieval notifications, browser type and version, operating system, referrer URL (the previously visited page) and usually IP addresses and the requesting provider. Log files may be used for security, for example to prevent server overload, particularly from abusive DDoS attacks, and to monitor server capacity and stability. Deletion: Log file information is retained for a maximum of 30 days and then deleted or anonymised. Data required for evidentiary purposes is exempt from deletion until the incident has been conclusively resolved.
ALL-INKL: Provision of information technology infrastructure and associated services (e.g. storage and/or computing capacity); provider: ALL-INKL.COM - Neue Medien Münnich, proprietor: René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany; website: https://all-inkl.com/; privacy policy: https://all-inkl.com/datenschutzinformationen/; data processing agreement: concluded with the provider.
Contact and enquiry management
When you contact us (for example by contact form, email, telephone or social media), and within existing user and business relationships, we process the information supplied by the enquiring person insofar as this is necessary to respond to enquiries and any requested actions.
We respond to enquiries and manage contact and enquiry data within contractual or pre-contractual relationships to fulfil our contractual obligations or respond to pre-contractual enquiries. Otherwise, processing is based on our legitimate interests in responding to enquiries and maintaining user or business relationships.
Types of data processed: Master data (e.g. names and addresses); contact data (e.g. email addresses and telephone numbers); content data (e.g. entries in online forms).
Data subjects: Communication partners.
Purposes of processing: Contact enquiries and communication; provision of contractual services and customer service.
Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) GDPR); legitimate interests (point (f)); legal obligation (point (c)).
Further information on processing activities, procedures and services:
Contact form: When users contact us through our contact form, email or other communication channels, we process the data provided to handle their request. For this purpose, we process personal data within pre-contractual and contractual relationships where necessary for their performance, and otherwise on the basis of our legitimate interests, the communication partners' interests in a response, and our statutory retention obligations.
Plugins, embedded functions and content
We integrate functions and content obtained from the servers of their respective providers (“third-party providers”) into our online services. These may include graphics, videos or maps (collectively “content”).
Integration always requires the third-party providers to process users' IP addresses, since otherwise they cannot send the content to users' browsers. The IP address is therefore necessary to display such content or functions. We endeavour to use only content whose providers use the IP address solely to deliver the content. Third-party providers may also use pixel tags (invisible graphics or “web beacons”) for statistical or marketing purposes. Pixel tags can evaluate information such as visitor traffic. Pseudonymous information may also be stored in cookies on users' devices and may include technical information about browsers and operating systems, referring websites, visit times and other usage details, and may be combined with similar information from other sources.
Information on legal bases: Where we request users' consent to third-party providers, consent is the legal basis for processing. Otherwise, users' data is processed on the basis of our legitimate interests in efficient, economical and user-friendly services. Please also refer to the information about cookies in this privacy policy.
Types of data processed: Usage data (e.g. visited websites, interests in content, access times); metadata / communication data (e.g. device information and IP addresses).
Data subjects: Users (e.g. website visitors and users of online services).
Purposes of processing: Provision of our online services and user-friendliness; provision of contractual services and customer service.
Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) GDPR).
Further information on processing activities, procedures and services:
Font Awesome: Display of fonts and icons; provider: Fonticons, Inc., 6 Porter Road Apartment 3R, Cambridge, MA 02140, USA; website: https://fontawesome.com/; privacy policy: https://fontawesome.com/privacy.
Google Fonts: We integrate fonts provided by Google (“Google Fonts”), using users' data solely to display the fonts in their browsers. Integration is based on our legitimate interests in the technically secure, maintenance-free and efficient use of fonts, their consistent display and compliance with possible licensing restrictions. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://fonts.google.com/; privacy policy: https://policies.google.com/privacy.
Google Maps: We integrate maps from Google's “Google Maps” service. Data processed may include users' IP addresses and location data, which is not collected without their consent, usually given through mobile device settings. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://cloud.google.com/maps-platform; privacy policy: https://policies.google.com/privacy; objection option (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for advertising displays: https://adssettings.google.com/authenticated.
Changes and updates to this privacy policy
Please check the contents of our privacy policy regularly. We update it whenever changes to our data processing make this necessary. We will inform you if changes require action on your part, such as consent, or another individual notification.
Where this privacy policy includes addresses and contact details of companies and organisations, please note that these may change over time and check the details before making contact.
Definitions
This section provides an overview of the terminology used in this privacy policy. Many terms are taken from legislation, in particular Article 4 GDPR. The statutory definitions are binding; the explanations below are primarily intended to aid understanding. The terms are listed in the order of the German source.
Personal data: “Personal data” means any information relating to an identified or identifiable natural person (“data subject”). An identifiable person is someone who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, an identification number, location data, an online identifier such as a cookie, or one or more factors specific to that person's physical, physiological, genetic, mental, economic, cultural or social identity.
Controller: A “controller” is the natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of processing personal data.
Processing: “Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data, including collection, analysis, storage, disclosure or deletion.