Version: January 07, 2019

We, INTERSEROH Dienstleistung GmbH, take the protection and security of your data very seriously, and we take account of this issue in all our business processes. In this Data Protection Notice we would like to give you an overview of those aspects of our online services which are relevant to data protection law. In the following sections we shall explain:

Which data we collect when you use our online services
For what purposes these data are processed by INTERSEROH Dienstleistung GmbH
What rights and options you have with regard to the processing of your data
How you can contact us on the subject of data protection.

When does this Data Protection Notice come into effect?

This Data Protection Notice applies to the online services supplied by INTERSEROH Dienstleistung GmbH at the domain interseroh.de and the social media accounts operated by Interseroh on Youtube (hereinafter called “social media account”).

Online services of Interseroh companies other than the foregoing are subject to each of their own data protection notices, which you can view on the websites in question.

1. Control and personal contact

The controller under the terms of the European General Data Protection Regulation (GDPR) is

INTERSEROH Dienstleistungs GmbH

Stollwerckstr. 9a
51149 Cologne

When the words “we” or “us” are used in this Data Protection Notice, this shall mean solely INTERSEROH Dienstleistung GmbH.

You can reach Interseroh’s Data Protection Officer at [email protected] or by post, to be marked “FAO Data Protection Officer.”.

2. Data processing when visiting our website

2.1. Automatic collection of access data

You can visit our website without providing any personal data. Only the access data which are transmitted automatically by your browser will then be collected. This will comprise, for example, your online identification (e.g. IP address, session IDs, device IDs), information about the web browser and operating system used, the website from which you are visiting our website (i.e. if you have visited one of our websites via a link), the names of the files requested (i.e. which texts, videos, pictures etc. you have viewed on our websites), your browser’s language settings, any error reports, and the times of access.

These access data must be processed to enable you to visit our website and to use it conveniently, and to ensure its permanent functional capability and security.

These access data will also be stored for 14 days in internal logfiles, in order to produce statistical information on the use of our websites. This enables us to optimise our website constantly, taking our visitors’ usage patterns and technical resources into account, and to rectify breakdowns and security risks.

The legal basis for this data processing is Article 6 (1) (f) of the GDPR (balance of interests, grounded on our foregoing legitimate interests).

2.2. Cookies

We use our own cookies and cookies from third parties on our websites. A cookie is a standardised text file which is stored by your browser for a set time. Cookies make possible the local storage of information, such as language settings and temporary identifiers which can be retrieved on subsequent website visits by the server which has set the cookie. In your browser’s security settings you can view and erase the cookies in use. You can adjust your browser settings as you wish and in this way, for instance, refuse to accept cookies from third parties or all cookies. Please note that in this case you may not be able to use all our websites’ functions.

Our own cookies serve to make your visit to our websites more user-friendly and secure. The legal basis for the data processing associated therewith is Article 6 (1) (f) of the GDPR.

For purposes of web analysis and marketing we use cookies from third parties. You will find more detailed information on this subject under Sections 2.5 of this Data Protection Notice.

2.3. Your messages and communications

We collect all information and all data which you communicate to us via our websites. For example, you are able at various points on our websites, via functions such as the Contact Form or Contact function, to send us messages and, in some cases, files (e.g. PDF documents). Any information which is compulsory for these functions is marked as such. The information which you provide will be used by us solely in order to process your application.

We shall erase the data accrued thereby once their storage is no longer required, or we shall restrict their processing should statutory data retention obligations exist.

Disclosure of your message to another Interseroh company or to an external third party will only be made insofar as this is necessary in order to process your application (for example, we disclose your message to another Interseroh Group company if the latter is responsible for dealing with your request). If you do not wish your message to be disclosed to another company, you can say this – also as a precautionary measure, of course – directly in your message. We shall then pass on your message to the other company without such information as could identify you (e.g. your name, customer number or contact details).

The legal basis for the foregoing data processing is Article 6 (1) (b) of the GDPR. Insofar as you have consented to the disclosure or processing elsewhere of the data which you have communicated to us, the legal basis will be Article 6 (1) (a) of the GDPR.

2.4. Use of YouTube videos

We use YouTube videos on parts of our websites. YouTube is a video platform operated by the Google company YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (“YouTube”). The YouTube videos can be played directly on our websites. They are embedded in “extended data-protection mode”, i.e. no data about you as a user will be transmitted to YouTube if you do not play the videos. Only if you play the videos will data be transmitted to YouTube. We have no influence on this data transmission. Should personal data be transmitted to the USA, Google and YouTube have acceded to the EU-US Privacy Shield .

If you visit a website with embedded YouTube videos, YouTube and Google obtain the access data accrued thereby and the information that you have visited the page on our website in question. This will happen irrespective of whether or not you are logged into YouTube or Google. If you are logged into Google, you data will be associated directly with your Google account. If you do not wish them to be associated with your profile at YouTube, you must log out before playing a video. YouTube and Google may use your access data to produce user profiles for purposes of marketing, marketing research and needs-based design of their own websites. You have a right to object to the formation of these user profiles, in which case the objection must be sent directly to YouTube. You will find further information in Google’s Privacy Policy, which also applies to YouTube.

The legal basis for the foregoing data processing, insofar as we are the controlling body, is Article 6 (1) (f) of the GDPR (balance of interests grounded on our legitimate interest in incorporating video contents)..

2.5. Analysis tools

2.5.1. Google Analytics

Our websites use Google Analytics, a web analysis service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google Analytics uses cookies to collect your access data when you visit our websites. These access data will be combined into pseudonymised user profiles on our behalf and transmitted to a Google server in the USA. Prior to this your IP address will be anonymised. Therefore we cannot know which user profiles belong to a particular user. We cannot identify you on the basis of the data collected by Google, nor can we tell how you use our websites. In the exceptional case that personal data is transmitted to the USA, Google has acceded to the EU-US Privacy Shield.

In this way the data processing carried out by Google Analytics is subject to an adequacy decision by the EU Commission, i.e. the level of data protection is recognised as adequate, even if the processing takes place as an exception in the USA.

Google will use the information gained through the cookies in order to evaluate the use of our websites, to compile reports on this website activity, and to supply further services for us associated with website and internet use. You will find further information on this subject in the Google Analytics Privacy Policy.

You can object at any time to the foregoing production and evaluation of pseudonymised user profiles by Google. For this purpose you have various options:: Sie können Ihren Browser so einstellen, dass Cookies von Google Analytics blockiert werden.

You can set your browser to block cookies from Google Analytics.
You can adjust your Google ad settings.
You can set an “opt-out” cookie by clicking here: Disable Google Analytics
You can install the opt-out plug-in provided by Google at https://tools.google.com/dlpage/gaoptout?hl=en on your Firefox, Internet Explorer or Chrome browser (this option does not work on mobile devices).

2.5.2. Google Adwords Conversion Tracking

We also use Google Conversion Tracking to statistically record the use of our website and to evaluate it for the purpose of optimising our website.

Google Adwords will place a cookie (see section 2.2) on your computer if you have accessed our website via a Google advertisement. These cookies lose their validity after 30 days and are not used for personal identification. If the user visits certain pages on the AdWords customer’s website and the cookie has not expired, Google and the customer will be able to see that the user clicked on the ad and was directed to that page. Each Adwords customer receives a different cookie. Therefore it is not possible to trace cookies via the websites of Adwords customers. The information collected with the aid of the conversion cookie is used to generate conversion statistics for Adwords customers who have opted for conversion tracking.

Adwords customers learn the total number of users who clicked on their ad and were directed to a page tagged with a conversion tracking tag. However, they do not receive information enabling them to personally identify users. Should you not wish to participate in the tracking procedure, you may also refuse to set a cookie as required for this purpose – for example, by setting your browser to deactivate the automatic setting of cookies in general.

You may also deactivate cookies for conversion tracking by setting your browser to block cookies from the domain “www.googleadservices.com”. Google’s privacy instruction on conversion tracking can be found here (https://services.google.com/sitestats/de.html).

2.5.3. Google Tag Manager

Our website uses Google Tag Manager, a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Tag Manager serves to manage website tags more efficiently. A website tag is a placeholder which is stored in our website’s source code, in order for example to capture the embedding of frequently used website elements (e.g. the code for the web analysis service). Google Tag Manager operates without the use of cookies. The data will be processed partly on a Google server in the USA. Should personal data be transmitted to the USA, Google has acceded to the EU-US Privacy Shield.

The legal basis is Article 6 (1) (f) of the GDPR, grounded on our legitimate interest in a commercial operation of our website. You will find further information in Google’s Information on Tag Manager.

4. Orders in the Lizenzero shop

FA customer account and participation in the Interseroh dual system are required if you wish to place an order in the Lizenzero shop. The conditions of participation can be found at https://www.lizenzero.de/en/general-terms-and-conditions. We require the following information to set up a customer account:

First name
Surname
Email address
Password
Company
VAT ID number
Tax number
Billing address

To process orders, we also require the following information:

Registration number from the national packaging authority (“Zentrale Stelle Verpackungsregister”)
Payment method and payment information
Volume of packaging

You may also provide data, e.g. your telephone number, on a voluntary basis following registration.

We will process the data you provide for the purpose of setting up and providing access to your customer account, and for performance of contract. The purposes for which we process data are primarily determined by the services you order and may include the following:

Provision of licensing service
Payment handling
Customer service

The legal basis for this data processing is Article 6(1)(b) of the GDPR.

5. Payment handling

Payments made by credit card, PayPal, invoice, and SEPA direct debit mandate are handled by our payment service provider BS PAYONE GmbH, Lyoner Straße 9, 60528 Frankfurt, Germany. Your payment information will be collected by this company; it is not stored by us.

6. Data processing for social media accounts

Youtube
Lizenzero is represented in the social network YouTube with its own social media presence and can be reached by you.

On these sites we tell you the latest news from Interseroh and everything we have been doing, and we are glad to use the facilities provided by the social networks to communicate directly with their members.

Please note, however, that we have no influence of the data processing carried out by the social networks. Therefore please check carefully what personal information and what messages you send us via the social networks and, in case of doubt, use other ways of contacting us which we provide. We therefore cannot undertake any liability for the conduct of the operators of these social networks and of their other members.

If you communicate with us via our social media accounts, we shall process the information supplied to us for this purpose by the social network in question (e.g. your name, your profile page and the contents of the messages which you have sent to us) in accordance with the purpose for which you have sent it (e.g. service requests, suggestions and criticism). We shall erase the data thus accrued after their storage is no longer necessary, or we shall restrict their processing should statutory data retention obligations exist. In the case of public posts on our social media accounts, we shall decide in the individual case, weighing your interests and ours, whether and when we may delete these.

Facebook
We operate our fan page on Facebook in joint responsibility with Facebook to communicate with followers (such as our customers and interested parties) and to provide information about our products and services.

We may receive statistics from Facebook regarding the use of our fan page (e.g. number, names, interactions such as “likes” and comments, as well as aggregate demographic and other information or statistics). Further information about the type and scope of these statistics can be found on the Facebook Page Insights. Further information about the respective responsibilities can be found in the Facebook Page Insights Controller Addendum. The legal basis for this data processing is Article 6(1)(f) of the General Data Protection Regulation (GDPR) based on our aforementioned legitimate interest.

We have no influence on data that Facebook processes on its own responsibility in accordance with Facebook’s terms of use. However, we would like to point out that when you visit the fan page, data on your usage behaviour is transferred from Facebook and the fan page to Facebook. Facebook itself processes the aforementioned information in order to compile more detailed statistics and for its own market research and advertising purposes over which we have no control. Further information on this can be found in the Facebook data policy. In the event that personal data is transferred to the USA, Facebook has acceded to the EU-US Privacy Shield.

Should we receive your personal data while operating the fan page, you shall be entitled to the rights stated in this privacy policy. Furthermore, should you wish to assert your rights against Facebook, the easiest way to do so is to contact Facebook directly. Facebook knows the details of both the technical operation of the platform and the associated data processing as well as the specific purposes of the data processing and can, on request, implement appropriate measures if you exercise your rights. We are happy to support you in asserting your rights, insofar as it is possible for us, and will forward your requests to Facebook.

The legal basis for the foregoing data processing will depend on the purpose of your message. Should the purpose be that of using our customer service or of requesting provision by Interseroh, the legal basis will be Article 6 (1) (b) of the GDPR. Otherwise the legal basis will be Article 6 (1) (f) of the GDPR (balance of interests grounded on our legitimate interest in processing your message). Insofar as you have consented to the processing of the foregoing data, the legal basis is Article 6 (1) (a) of the GDPR.

7. Online advertising

We use the access data generated when you visit our websites to display advertising on websites operated by third parties (retargeting). This allows us to show you personalised advertising, i.e. advertising that is based on your interests and thus more relevant to you. We participate in Google’s ad network for this purpose, which allows us to display personalised advertisements on third-party websites who also participate in the Google ad network. More information on Google’s ad network and the Google Privacy Policy can be found at http://www.google.com/privacy/ads/.

The legal basis for the data processing set out below is Article 6(1)(f) of the GDPR (balancing of interests on the basiThe legal basis for the data processing set out below is Article 6(1)(f) of the GDPR (balancing of interests on the basis of the legitimate interest of INTERSEROH Dienstleistungs GmbH to use personalised online advertising).

7.1. Google Analytics Audience

The legal basis for the data processing set out below is Article 6(1)(f) of the GDPR (balancing of interests on the basiThe legal basis for the data processing set out below is Article 6(1)(f) of the GDPR (balancing of interests on the basisWe also use the Audiences function provided by Google Analytics on our websites. This allows Google, on our behalf, to show you personalised advertising when you visit websites run by other providers who also participate in Google’s ad network. Google will use cookies and the pseudonymised usage profiles generated by Google Analytics (see section 2.5.1) when you use our website to determine your interests. Based on these pseudonymised usage profiles, Google can show you personalised advertising in advertising spaces connected to Google’s ad network (e.g., Google may show you advertising for a service provided by Interseroh that you previously viewed on one of our websites).

You may prevent your data from being processed by Google’s ad network for personalised online advertising. There are several ways of doing this:

You can change the settings in your browser to block cookies from the www.googleadservices.com domain.
You can change your Google advertising settings by going to https://www.google.de/settings/ads.
You can install Google’s free opt-out plugin in Firefox, Internet Explorer, or Google Chrome by going to http://www.google.com/settings/ads/plugin (this does not work on mobile browsers).
You can also generally opt-out of personalised advertising served by Google and many other providers that have signed up to the “Your Online Choices“ self-regulatory initiative by going to http://www.youronlinechoices.eu.

If you opt out of personalised advertising, please note that Google will only show you general advertisements not selected for you on the basis of your access data.

7.2. Bing Ads

Our website uses Bing Ads, a service provided by the Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (“Microsoft”). Microsoft uses cookies and similar technologies to present advertisements relevant to you. The use of these technologies enables Microsoft and its partner sites to serve ads based on previous visits to our and other websites on the Internet. The access data arising in this context may be transmitted by Microsoft to a server in the USA for evaluation and storage there. In the event that personal data is transferred to the USA, Microsoft has acceded to the EU-US Privacy Shield.

Should you not wish Microsoft to process your access data in this way, you may opt out of the use of third-party cookies required for this purpose. You may also prevent Microsoft from collecting and processing this information by declaring your objection via the link below: http://choice.microsoft.com/de-DE/opt-out. For more information about data protection and the use of cookies by Microsoft and Bing Ads, visit the Microsoft website at https://privacy.microsoft.com/en-us/privacystatement.

7.3. Integration of the Trusted Shop Trustbadge

The Trusted Shops Trustbadge is integrated on this website to display our Trusted Shops Seal of Approval and the possibly collected evaluations as well as to offer Trusted Shops products to buyers after they place an order.

This serves to safeguard our predominantly legitimate interests in optimised marketing within the framework of balancing interests by enabling secure purchasing in accordance with Article 6 (1) (1) (f) GDPR. The Trustbadge and the services promoted there are an offer of Trusted Shops GmbH, Subbelrather Str. 15C, 50823 Cologne, Germany. The Trustbadge is provided by a Content Delivery Network (CDN) provider as part of order processing. Trusted Shops GmbH also uses service providers from the USA. An adequate level of data protection is ensured. You can find further information on data privacy at Trusted Shops GmbH here: https://www.trustedshops.de/impressum/#datenschutz

When the Trustbadge is called up, the web server automatically saves a server log file entry and documents the call. The log file entry also contains your IP address, the date and time of the call, the amount of data transferred and the requesting provider (access data). Individual access data is stored in a security database for analysis of security vulnerabilities. The log files are automatically deleted 90 days after creation at the latest.

Further personal data is transferred to the Trusted Shops GmbH if, after conclusion of an order, you decide to use Trusted Shops products or have already registered to use them. The contractual agreement between you and Trusted Shops shall apply. To this end, automatic collection of personal data from the order data takes place. Whether you as a buyer are already registered for use of a product is automatically checked on the basis of a neutral parameter that uses the e-mail address hashed by a cryptological one-way function. Before it is transmitted, the e-mail address is converted to this hash value, which cannot be decrypted for Trusted Shops. After checking for a match, the system automatically deletes the parameter.

This is necessary for fulfilment of our own and Trusted Shops’ predominantly legitimate interests in always providing buyer protection linked to the specific order and the transactional valuation services in accordance with Article 6 (1) (1) (f) GDPR. Further details, including information in regard to objections, can be found in the Trusted Shops’ privacy policy linked above and in the Trustbadge.

8. Disclosure of data

8.1. Principles

We only disclose your data if:

You have given your express consent thereto, pursuant to Article 6 (1) (a) of the GDPR
Disclosure is necessary under Article 6 (1) (f) of the GDPR in order to bring, exercise or defend the legal claims of an Interseroh company, and no grounds exist to suppose that you have a compelling interest in your data not being disclosed which overrides these considerations,
We have a statutory duty of disclosure under Article 6 (1) (c) of the GDPR
Disclosure is permitted by law and is necessary, under Article 6 (1) (b) of the GDPR, for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract.

8.2. Disclosure to external service providers of INTERSEROH Dienstleistungs GmbH

A part of the data processing set out in this Data Protection Notice may be carried out on our behalf by external service providers. Along with the service providers named in this Data Protection Notice, these may include in particular data centres which store our websites and databases, IT service providers which maintain our systems, and corporate consultants.

Should we disclose data to our service providers, these providers may only use the said data to carry out their tasks. These service providers are carefully selected and commissioned by ourselves. They are contractually bound to follow our instructions, have suitable technical and organisational measures in place to protect the rights of data subjects, and are monitored regularly by ourselves.

Should we, over and above this Data Protection Notice, pass on your data to a service provider located in a country outside the European Economic Area (EEA), we shall inform you separately of this fact as it becomes necessary and tell you of the specific guarantees on which this data transfer is based. Should you wish to receive copies of guarantees certifying an adequate level of data protection, please communicate with our Data Protection Officer (see Section 1).

8.3 Weitergabe an Cloudflare

We use Cloudflare, a so-called content delivery network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Content delivery networks such as Cloudflare provide server capacities for website operators so that the services can be optimally used even with high data throughput. Cloudflare therefore accelerates our online service while simultaneously protecting against third-party attacks. Further information can be found in the Cloudflare privacy policy: https://www.cloudflare.com/security-policy/.

9. Period of storage

Unless stated otherwise in this Data Protection Notice, we shall store and use your data only as long as this is necessary to perform our contractual or statutory duties or to satisfy the purpose for which the data were collected. Following expiry of the statutory period of limitation, however, we shall restrict their processing, i.e. from that time your data will only be used to comply with statutory duties.

We shall then erase your data immediately, unless we still need these data until expiry of the statutory period of limitation for purposes of evidence in civil claims or to comply with statutory retention periods. Even thereafter it may be necessary for us to store your data for accounting purposes. We have a duty to do this in order to satisfy statutory rules of documentation which may arise under the German Commercial Code, the German Tax Code, the German Credit and Loans Act, the German Money Laundering Act and the German Securities Trading Act. The periods of storage stipulated in these Acts run from two to ten years.

The legal basis for this data protection for purposes of compliance with statutory duties of documentation and storage is Article 6 (1) (c) of the GDPR.

10. Your rights

To exercise your rights as set out below, you can communicate at any time with our Data Protection Officer (see Section 1):

You have the right at any time to access information on the processing of your personal data by ourselves. In supplying such information we shall explain this data processing to you and provide you with an overview of the data which we have saved relating to your person.
Should data stored with us be incorrect or no longer up-to-date, you have the right to have these data corrected.
You can also require that your data be erased. Should, in exceptional cases, such erasure not be possible due to other legal regulations, the data will be blocked, so that they are only available for this legal purpose.
You can further have the processing of your data restricted, e.g. if you believe that the data which we have stored are not correct.
You have the right of data portability, i.e. should you wish, we must send you a digital copy of the personal data which you have provided.

You also have the right to lodge a complaint with a data protection authority. The data protection authority for INTERSEROH Dienstleistungs GmbH can be found in the imprint.

11. Right of withdrawal and objection

If you wish to exercise your rights of withdrawal and objection as set out below, a notification without prescribed formal requirements to the contact details set out in Section 1 will suffice.

Withdrawal of consent

Under Article 7 (2) of the GDPR, you have the right at any time to withdraw any declaration of consent which you have given us. This will result in our being unable to continue the data processing based on this consent in the future. The withdrawal of your consent will not affect the legality of the processing undertaken pursuant to the said consent up to the time of the withdrawal.

Objection to processing of data

Insofar as we process your data on the grounds of legitimate interests under Article 6 (1) (f) of the GDPR, under Article 21 of the GDPR you have the right to lodge an objection to the processing of your data, should grounds exist arising from your particular situation, or should the objection be directed towards direct marketing. In the latter case you have a general right of objection which we shall realise even if you do not state reasons.

12. Data security

We maintain technical measures adequate to guarantee data security for our online services, particularly for the protection of your data against dangers posed during data transmission and against unauthorised cognizance by third parties. These measures are constantly revised to reflect the latest state of technology. To secure the personal data which you have specified on our website, we use transport layer security (TLS), which encrypts the information which you have entered.

13. Amendments to this Data Protection Notice

We shall update this Data Protection Notice from time to time, for instance when we revise our website or if statutory rules or official regulations should change.