Version: July 17, 2019

Version: July 27, 2019

We, INTERSEROH Dienstleistung GmbH, take the protection and security of your data very seriously, and we take account of this issue in all our business processes. In this Data Protection Notice we would like to give you an overview of those aspects of our online services which are relevant to data protection law. In the following sections we shall explain:

• Which data we collect when you use our online services
• For what purposes these data are processed by INTERSEROH Dienstleistung GmbH
• What rights and options you have with regard to the processing of your data
• How you can contact us on the subject of data protection.

When does this Data Protection Notice come into effect?

This Data Protection Notice applies to the online services supplied by INTERSEROH Dienstleistung GmbH at the domain lizenzero.de/en and the social media accounts operated by Lizenzero on Youtube and Facebook (hereinafter called “social media account”).

Online services of Interseroh companies other than the foregoing are subject to each of their own data protection notices, which you can view on the websites in question.

1. Control and personal contact

The controller under the terms of the European General Data Protection Regulation (GDPR) is

INTERSEROH Dienstleistungs GmbH
Stollwerckstr. 9a
51149 Cologne

When the words “we” or “us” are used in this Data Protection Notice, this shall mean solely INTERSEROH Dienstleistung GmbH.
For all questions regarding data protection in connection with our products and services or the use of our website, you can also contact our data protection officer at any time. This can be reached at the above postal address (to be marked “FAO Data Protection Officer.”) and at [email protected].

2. Data processing when visiting our website

2.1.    Automatic collection of access data

You can visit our website without providing any personal data. Only the access data which are transmitted automatically by your browser will then be collected. This will comprise, for example, your online identification (e.g. IP address, session IDs, device IDs), information about the web browser and operating system used, the website from which you are visiting our website (i.e. if you have visited one of our websites via a link), the names of the files requested (i.e. which texts, videos, pictures etc. you have viewed on our websites), your browser’s language settings, any error reports, and the times of access.
These access data must be processed to enable you to visit our website and to use it conveniently, and to ensure its permanent functional capability and security.
These access data will also be stored for 14 days in internal logfiles, in order to produce statistical information on the use of our websites. This enables us to optimise our website constantly, taking our visitors’ usage patterns and technical resources into account, and to rectify breakdowns and security risks.
The legal basis for this data processing is Article 6 (1) (f) of the GDPR (balance of interests, grounded on our foregoing legitimate interests).

2.2. Cookies

We use our own cookies and cookies from third parties on our websites. A cookie is a standardised text file which is stored by your browser for a set time. Cookies make possible the local storage of information, such as language settings and temporary identifiers which can be retrieved on subsequent website visits by the server which has set the cookie. In your browser’s security settings you can view and erase the cookies in use. You can adjust your browser settings as you wish and in this way, for instance, refuse to accept cookies from third parties or all cookies. Please note that in this case you may not be able to use all our websites’ functions.

Our own cookies serve to make your visit to our websites more user-friendly and secure. The legal basis for the data processing associated therewith is Article 6 (1) (f) of the GDP (balancing of interests based on our above-mentioned legitimate interests).

For purposes of web analysis and marketing we use cookies from third parties. You will find more detailed information on this subject under Sections 2.5 of this Data Protection Notice.

2.3.    Your messages and communications

We collect all information and all data which you communicate to us via our websites. For example, you are able at various points on our websites, via functions such as the Contact Form or Contact function, to send us messages. Any information which is compulsory for these functions is marked as such. The information which you provide will be used by us solely in order to process your application.
We shall erase the data accrued thereby once their storage is no longer required, or we shall restrict their processing should statutory data retention obligations exist.
Disclosure of your message to another Interseroh company or to an external third party will only be made insofar as this is necessary in order to process your application (for example, we disclose your message to another Interseroh Group company if the latter is responsible for dealing with your request). If you do not wish your message to be disclosed to another company, you can say this – also as a precautionary measure, of course – directly in your message. We shall then pass on your message to the other company without such information as could identify you (e.g. your name, customer number or contact details).
The legal basis for the foregoing data processing is Article 6 (1) (b) of the GDPR.

2.4. Use of YouTube videos

We use YouTube videos on parts of our websites. YouTube is a video platform operated by the Google company YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (“YouTube”). The YouTube videos can be played directly on our websites. They are embedded in “extended data-protection mode”, i.e. no data about you as a user will be transmitted to YouTube if you do not play the videos. Only if you play the videos will data be transmitted to YouTube. We have no influence on this data transmission.

If you visit a website with embedded YouTube videos, YouTube and Google obtain the access data accrued thereby and the information that you have visited the page on our website in question. This will happen irrespective of whether or not you are logged into YouTube or Google. If you are logged into Google, you data will be associated directly with your Google account. If you do not wish them to be associated with your profile at YouTube, you must log out before playing a video. YouTube and Google may use your access data to produce user profiles for purposes of marketing, marketing research and needs-based design of their own websites. You have a right to object to the formation of these user profiles, in which case the objection must be sent directly to YouTube. You will find further information in Google’s Privacy Policy, which also applies to YouTube.

The legal basis for the foregoing data processing, insofar as we are the controlling body, is Article 6 (1) (f) of the GDPR (balance of interests grounded on our legitimate interest in incorporating video contents).

2.5. Analysis tools

2.5.1. Google Analytics

Our websites use Google Analytics, a web analysis service provided by  Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google Analytics uses cookies to collect your access data when you visit our websites. These access data will be combined into pseudonymised user profiles on our behalf and transmitted to a Google server in the USA. Prior to this your IP address will be anonymised. Therefore we cannot know which user profiles belong to a particular user. We cannot identify you on the basis of the data collected by Google, nor can we tell how you use our websites.
Google will use the information gained through the cookies in order to evaluate the use of our websites, to compile reports on this website activity, and to supply further services for us associated with website and internet use. You will find further information on this subject in the Google Analytics Privacy Policy.

You can object at any time to the foregoing production and evaluation of pseudonymised user profiles by Google. For this purpose you have various options:
1.    You can set your browser to block cookies from Google Analytics.
2.    You can adjust your Google ad settings.
3.    You can set an “opt-out” cookie by clicking here: Disable Google Analytics
4.    You can install the opt-out plug-in provided by Google at https://tools.google.com/dlpage/gaoptout?hl=en on your Firefox, Internet Explorer or Chrome browser (this option does not work on mobile devices).

2.5.2. Google Adwords Conversion Tracking

We also use Google Conversion Tracking to statistically record the use of our website and to evaluate it for the purpose of optimising our website.

Google Adwords will place a cookie (see section 2.2) on your computer if you have accessed our website via a Google advertisement. These cookies lose their validity after 30 days and are not used for personal identification. If the user visits certain pages on the AdWords customer’s website and the cookie has not expired, Google and the customer will be able to see that the user clicked on the ad and was directed to that page. Each Adwords customer receives a different cookie. Therefore it is not possible to trace cookies via the websites of Adwords customers. The information collected with the aid of the conversion cookie is used to generate conversion statistics for Adwords customers who have opted for conversion tracking.

Adwords customers learn the total number of users who clicked on their ad and were directed to a page tagged with a conversion tracking tag. However, they do not receive information enabling them to personally identify users. Should you not wish to participate in the tracking procedure, you may also refuse to set a cookie as required for this purpose – for example, by setting your browser to deactivate the automatic setting of cookies in general.

You may also deactivate cookies for conversion tracking by setting your browser to block cookies from the domain “www.googleadservices.com”. Google’s privacy instruction on conversion tracking can be found here  (https://services.google.com/sitestats/de.html).

2.5.3. Google Tag Manager

Our website uses Google Tag Manager, a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Tag Manager serves to manage website tags more efficiently. A website tag is a placeholder which is stored in our website’s source code, in order for example to capture the embedding of frequently used website elements (e.g. the code for the web analysis service). Google Tag Manager operates without the use of cookies. The data will be processed partly on a Google server in the USA. Should personal data be transmitted to the USA, Google has acceded to the EU-US Privacy Shield.
The legal basis is Article 6 (1) (f) of the GDPR, grounded on our legitimate interest in a commercial operation of our website. You will find further information in Google’s Information on Tag Manager.

2.6 Data transfer to the USA

In the event that personal data is transferred to the USA, Google and YouTube have subjected themselves to the EU-US Privacy Shield.
This means that data processing within the framework of Google and YouTube is subject to an adequacy finding by the EU Commission, i.e. the level of data protection is recognised as adequate, even if the processing is exceptionally carried out in the USA.

3. Orders in the Lizenzero shop

FA customer account and participation in the Interseroh dual system are required if you wish to place an order in the Lizenzero shop. The conditions of participation can be found at https://www.lizenzero.de/en/general-terms-and-conditions. We require the following information to set up a customer account:

• First name
• Surname
• Email address
• Password
• Company
• VAT ID number
• Tax number
• Billing address

To process orders, we also require the following information:

• Registration number from the national packaging authority (“Zentrale Stelle Verpackungsregister”)
• Payment method and payment information
• Volume of packaging

You may also provide data, e.g. your telephone number, on a voluntary basis following registration.

We will process the data you provide for the purpose of setting up and providing access to your customer account, and for performance of contract. The purposes for which we process data are primarily determined by the services you order and may include the following:

• Provision of licensing service
• Payment handling
• Customer service

The legal basis for this data processing is Article 6(1)(b) of the GDPR.

4. Payment processing via BS Payone

We have commissioned BS PAYONE GmbH, Fraunhoferstraße 2-4, 24118 Kiel, Germany, to process the payments (PayPal, SEPA direct debit, bank transfer). For this purpose, BS PAYONE GmbH requires among other things your name and address, account number and bank code or credit card number (including validity period), invoice amount and currency as well as the transaction number. BS PAYONE GmbH may use this information for the purpose of payment processing and pass it on to us. BS PAYONE is obliged to treat the information according to the data protection laws. The privacy policy of the PAYONE GmbH can be viewed at https://www.payone.de/datenschutz/.

5. Data processing for social media accounts

5.1 Youtube

Lizenzero is represented in the social network YouTube with its own social media presence and can be reached by you.
On these sites we tell you the latest news from Interseroh and everything we have been doing, and we are glad to use the facilities provided by the social networks to communicate directly with their members.
Please note, however, that we have no influence of the data processing carried out by the social networks. Therefore please check carefully what personal information and what messages you send us via the social networks and, in case of doubt, use other ways of contacting us which we provide. We therefore cannot undertake any liability for the conduct of the operators of these social networks and of their other members.
If you communicate with us via our social media accounts, we shall process the information supplied to us for this purpose by the social network in question (e.g. your name, your profile page and the contents of the messages which you have sent to us) in accordance with the purpose for which you have sent it (e.g. service requests, suggestions and criticism).
We shall erase the data thus accrued after their storage is no longer necessary, or we shall restrict their processing should statutory data retention obligations exist. In the case of public posts on our social media accounts, we shall decide in the individual case, weighing your interests and ours, whether and when we may delete these.   
The legal basis for the data processing described above is Article 6 paragraph 1 letter f DSGVO (balancing of interests based on our legitimate interest in the storage of public mail).
In the event that personal data is transferred to the USA, YouTube has submitted to the EU-US Privacy Shield.
As a result, data processing within the framework of Google and YouTube is subject to an adequacy finding by the EU Commission, i.e. the level of data protection is recognised as adequate, even if, exceptionally, the processing is carried out in the USA.

5.2 Facebook

We operate our fan page on Facebook in joint responsibility with Facebook to communicate with followers (such as our customers and interested parties) and to provide information about our products and services.
We may receive statistics from Facebook regarding the use of our fan page (e.g. number, names, interactions such as “likes” and comments, as well as aggregate demographic and other information or statistics). Further information about the type and scope of these statistics can be found on the Facebook Page Insights. Further information about the respective responsibilities can be found in the Facebook Page Insights Controller Addendum. The legal basis for this data processing is Article 6(1)(f) of the General Data Protection Regulation (GDPR) based on our aforementioned legitimate interest.
We have no influence on data that Facebook processes on its own responsibility in accordance with Facebook’s terms of use. However, we would like to point out that when you visit the fan page, data on your usage behaviour is transferred from Facebook and the fan page to Facebook. Facebook itself processes the aforementioned information in order to compile more detailed statistics and for its own market research and advertising purposes over which we have no control. Further information on this can be found in the Facebook data policy. In the event that personal data is transferred to the USA, Facebook has acceded to the EU-US Privacy Shield. This means that data processing within Google is subject to an adequacy finding by the EU Commission, i.e. the level of data protection is recognised as adequate, even if, exceptionally, the processing is carried out in the USA.

Should we receive your personal data while operating the fan page, you shall be entitled to the rights stated in this privacy policy. Furthermore, should you wish to assert your rights against Facebook, the easiest way to do so is to contact Facebook directly. Facebook knows the details of both the technical operation of the platform and the associated data processing as well as the specific purposes of the data processing and can, on request, implement appropriate measures if you exercise your rights. We are happy to support you in asserting your rights, insofar as it is possible for us, and will forward your requests to Facebook.
The legal basis for the foregoing data processing will depend on the purpose of your message. Should the purpose be that of using our customer service or of requesting provision by Interseroh, the legal basis will be Article 6 (1) (b) of the GDPR. Otherwise the legal basis will be Article 6 (1) (f) of the GDPR (balance of interests grounded on our legitimate interest in processing your message).

6. Online advertising

We use the access data generated when you visit our websites to display advertising on websites operated by third parties (retargeting). This allows us to show you personalised advertising, i.e. advertising that is based on your interests and thus more relevant to you. For this purpose, we also participate in the advertising networks of Google (Google advertising network) and Microsoft Bing Ads ("Bing advertising network"). This enables us to display personalized ads in the online offerings of other providers who participate in these advertising networks (as so-called publishers). For further information, please contact the operators of the respective advertising networks:

• Google Privacy Policy
• Microsoft Privacy Policy

The legal basis for the data processing set out below is Article 6(1)(f) of the GDPR (balancing of interests on the basis of the legitimate interest of INTERSEROH Dienstleistungs GmbH to use personalised online advertising).

6.1. Google Analytics Audience

We also use the Audiences function provided by Google Analytics on our websites. This allows Google, on our behalf, to show you personalised advertising when you visit websites run by other providers who also participate in Google’s ad network. Google will use cookies and the pseudonymised usage profiles generated by Google Analytics (see section 2.5.1) when you use our website to determine your interests. Based on these pseudonymised usage profiles, Google can show you personalised advertising in advertising spaces connected to Google’s ad network (e.g., Google may show you advertising for a service provided by Interseroh that you previously viewed on one of our websites).

You may prevent your data from being processed by Google’s ad network for personalised online advertising. There are several ways of doing this:
1.    You can change the settings in your browser to block cookies from the www.googleadservices.com domain.
2.    You can change your Google advertising settings by going to https://www.google.de/settings/ads.
3.    You can install Google’s free opt-out plugin in Firefox, Internet Explorer, or Google Chrome by going to http://www.google.com/settings/ads/plugin (this does not work on mobile browsers).
4.    You can also generally opt-out of personalised advertising served by Google and many other providers that have signed up to the “Your Online Choices“ self-regulatory initiative by going to http://www.youronlinechoices.eu.

If you opt out of personalised advertising, please note that Google will only show you general advertisements not selected for you on the basis of your access data.
In the event that personal data is transferred to the USA, Google is subject to the EU-US Privacy Shield. This means that data processing within Google is subject to an adequacy finding by the EU Commission, i.e. the level of data protection is recognised as adequate, even if, exceptionally, the processing is carried out in the USA.

6.2. Bing Ads

Our website uses Bing Ads, a service provided by the Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (“Microsoft”). Microsoft uses cookies and similar technologies to present advertisements relevant to you. The use of these technologies enables Microsoft and its partner sites to serve ads based on previous visits to our and other websites on the Internet. The access data arising in this context may be transmitted by Microsoft to a server in the USA for evaluation and storage there. In the event that personal data is transferred to the USA, Microsoft has acceded to the EU-US Privacy Shield. This means that data processing within Google is subject to an adequacy finding by the EU Commission, i.e. the level of data protection is recognised as adequate, even if, exceptionally, the processing is carried out in the USA.
Should you not wish Microsoft to process your access data in this way, you may opt out of the use of third-party cookies required for this purpose. You may also prevent Microsoft from collecting and processing this information by declaring your objection via the link below: http://choice.microsoft.com/de-DE/opt-out. For more information about data protection and the use of cookies by Microsoft and Bing Ads, visit the Microsoft website at https://privacy.microsoft.com/en-us/privacystatement.

6.3. Integration of the Trusted Shop Trustbadge

The Trusted Shops Trustbadge is integrated on this website to display our Trusted Shops Seal of Approval and the possibly collected evaluations as well as to offer Trusted Shops products to buyers after they place an order.

This serves to safeguard our predominantly legitimate interests in optimised marketing within the framework of balancing interests by enabling secure purchasing in accordance with Article 6 (1) (1) (f) GDPR. The Trustbadge and the services promoted there are an offer of Trusted Shops GmbH, Subbelrather Str. 15C, 50823 Cologne, Germany. The Trustbadge is provided by a Content Delivery Network (CDN) provider as part of order processing. Trusted Shops GmbH also uses service providers from the USA. An adequate level of data protection is ensured. You can find further information on data privacy at Trusted Shops GmbH here: https://www.trustedshops.de/impressum/#datenschutz

When the Trustbadge is called up, the web server automatically saves a server log file entry and documents the call. The log file entry also contains your IP address, the date and time of the call, the amount of data transferred and the requesting provider (access data). Individual access data is stored in a security database for analysis of security vulnerabilities. The log files are automatically deleted 90 days after creation at the latest.

Further personal data is transferred to the Trusted Shops GmbH if, after conclusion of an order, you decide to use Trusted Shops products or have already registered to use them. The contractual agreement between you and Trusted Shops shall apply. To this end, automatic collection of personal data from the order data takes place. Whether you as a buyer are already registered for use of a product is automatically checked on the basis of a neutral parameter that uses the e-mail address hashed by a cryptological one-way function. Before it is transmitted, the e-mail address is converted to this hash value, which cannot be decrypted for Trusted Shops. After checking for a match, the system automatically deletes the parameter.

This is necessary for fulfilment of our own and Trusted Shops’ predominantly legitimate interests in always providing buyer protection linked to the specific order and the transactional valuation services in accordance with Article 6 (1) (1) (f) GDPR. Further details, including information in regard to objections, can be found in the Trusted Shops’ privacy policy linked above and in the Trustbadge.

6.4 Outbrain

In some areas of our website we use technology from the provider Outbrain UK Ltd, Outbrain UK Limited, 5 New Bridge Street, London, EC4V 6JAUK. With the help of a so-called widget, users are referred to additional content within our website and to websites of third parties which may also be of interest to them. The content displayed in the Outbrain widget is automatically controlled and delivered by Outbrain in terms of content and technology.

Reading recommendations, usually integrated below an article, are determined based on the content the user has read so far. Outbrain uses cookies, which are stored on the user's device or browser, to display this additional content. Outbrain collects the device source, browser type and the user's IP address, where the last octet is deleted for anonymisation. Outbrain issues a Universally Unique Identifier (UUID) which can be used to identify the user when they visit a website where the Outbrain widget is implemented. Outbrain creates user profiles which aggregate user interactions (e.g. page views and clicks) from a browser or terminal device to derive the preferences of the UUID.

The use of Outbrain's services serves to safeguard our predominant, legitimate interests in the optimal marketing of our website in accordance with Art. 6 Para. 1 S. 1 lit. f DSGVO.
You can opt out of Outbrain's tracking of interest-based recommendations at any time by clicking on the "Opt-out" box under Outbrain's privacy policy, available at http://www.outbrain.com/de/legal/privacy. The opt-out will only apply to the device you are using and will also expire if you delete your cookies.

7. Newsletter

You have the possibility to order our newsletter, in which we regularly inform you about new products and special offers.

For ordering our newsletters we use the so-called double opt-in procedure, i.e. we will only send you newsletters by e-mail if you confirm in our notification e-mail by clicking a link that you are the owner of the e-mail address provided (this step may be omitted if we already know your e-mail address from other contexts, in particular a registration for a customer account). If you confirm your e-mail address, we will store your e-mail address, the time of registration and the IP address used for registration until you unsubscribe from the newsletter. This storage is solely for the purpose of sending you the newsletter and to prove your registration. You can unsubscribe from the newsletter at any time. A corresponding unsubscribe link can be found in every newsletter. A message to the contact details given above or in the newsletter (e.g. by e-mail or letter) is of course also sufficient for this. The legal basis of the processing is your consent (Article 6 paragraph 1 letter a DSGVO).

We use commercially available technologies in our newsletter with which the interactions with the newsletter can be measured (e.g. opening of the e-mail, links clicked on). We use this data in pseudonymous form for general statistical evaluations as well as to optimise and further develop our content and customer communication. This is done by means of small graphics embedded in the newsletter (so-called pixels). The data is only collected pseudonymously, the collected data is also not linked to your other personal data. The legal basis for this is our aforementioned legitimate interest according to article 6 paragraph 1 letter f DSGVO. Through our newsletter, we want to share content that is relevant to our customers and better understand what readers are actually interested in. If you do not wish to receive the analysis of user behaviour, you can unsubscribe from the newsletter or deactivate graphics in your e-mail program by default. Through our newsletter we want to share content that is as relevant to our customers as possible and better understand what readers are actually interested in. The data on the interaction with our newsletters are stored pseudonymously for 30 days and then completely anonymised.

It is possible to unsubscribe from the newsletter at any time, e.g. using the unsubscribe link included at the end of each newsletter. Alternatively, you can also send your unsubscription request at any time to the contact data mentioned above.

8. Disclosure of data

8.1. Principles

We only disclose your data if:

• You have given your express consent thereto, pursuant to Article 6 (1) (a) of the GDPR
• Disclosure is necessary under Article 6 (1) (f) of the GDPR in order to bring, exercise or defend the legal claims of an Interseroh company, and no grounds exist to suppose that you have a compelling interest in your data not being disclosed which overrides these considerations,
• We have a statutory duty of disclosure under Article 6 (1) (c) of the GDPR
• Disclosure is permitted by law and is necessary, under Article 6 (1) (b) of the GDPR, for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract.

8.2. Disclosure to external service providers of INTERSEROH Dienstleistungs GmbH

A part of the data processing set out in this Data Protection Notice may be carried out on our behalf by external service providers. Along with the service providers named in this Data Protection Notice, these may include in particular data centres which store our websites and databases, IT service providers which maintain our systems, and corporate consultants.

Should we disclose data to our service providers, these providers may only use the said data to carry out their tasks. These service providers are carefully selected and commissioned by ourselves. They are contractually bound to follow our instructions, have suitable technical and organisational measures in place to protect the rights of data subjects, and are monitored regularly by ourselves.

Should we, over and above this Data Protection Notice, pass on your data to a service provider located in a country outside the European Economic Area (EEA), we shall inform you separately of this fact as it becomes necessary and tell you of the specific guarantees on which this data transfer is based. Should you wish to receive copies of guarantees certifying an adequate level of data protection, please communicate with our Data Protection Officer (see Section 1). 

8.3 Transfer to Cloudflare

We use Cloudflare, a so-called content delivery network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Content delivery networks such as Cloudflare provide server capacities for website operators so that the services can be optimally used even with high data throughput. Cloudflare therefore accelerates our online service while simultaneously protecting against third-party attacks. Further information can be found in the Cloudflare privacy policy:  https://www.cloudflare.com/security-policy/.

In the event that personal data is transferred to the USA, Cloudflare has subjected itself to the EU-US Privacy Shield. This means that data processing within Google is subject to an adequacy finding by the EU Commission, i.e. the level of data protection is recognised as adequate, even if, exceptionally, the processing is carried out in the USA.

9. Period of storage

Unless stated otherwise in this Data Protection Notice, we shall store and use your data only as long as this is necessary to perform our contractual or statutory duties or to satisfy the purpose for which the data were collected. Following expiry of the statutory period of limitation, however, we shall restrict their processing, i.e. from that time your data will only be used to comply with statutory duties.

We shall then erase your data immediately, unless we still need these data until expiry of the statutory period of limitation for purposes of evidence in civil claims or to comply with statutory retention periods. Even thereafter it may be necessary for us to store your data for accounting purposes. We have a duty to do this in order to satisfy statutory rules of documentation which may arise under the German Commercial Code, the German Tax Code, the German Credit and Loans Act, the German Money Laundering Act and the German Securities Trading Act. The periods of storage stipulated in these Acts run from two to ten years.   
The legal basis for this data protection for purposes of compliance with statutory duties of documentation and storage is Article 6 (1) (c) of the GDPR.

10. Your rights

To exercise your rights as set out below, you can communicate at any time with our Data Protection Officer (see Section 1):

• You have the right at any time to access information on the processing of your personal data by ourselves. In supplying such information we shall explain this data processing to you and provide you with an overview of the data which we have saved relating to your person.
• Should data stored with us be incorrect or no longer up-to-date, you have the right to have these data corrected.
• You can also require that your data be erased. Should, in exceptional cases, such erasure not be possible due to other legal regulations, the data will be blocked, so that they are only available for this legal purpose.
• You can further have the processing of your data restricted, e.g. if you believe that the data which we have stored are not correct.
• You have the right of data portability, i.e. should you wish, we must send you a digital copy of the personal data which you have provided.

You also have the right to complain to a data protection supervisory authority. For Interseroh this is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Post Office Box 20 04 44, 40102 Düsseldorf.

11. Right of revocation and objection 

If you would like to make use of your following rights of revocation or objection, an informal communication to the contact data mentioned above under Section 1 is sufficient.

Revocation of consent Pursuant to Article 7 Paragraph 2 GDPR, you have the right to revoke your consent to us at any time. The consequence of this is that we will no longer continue the data processing based on this consent in the future. The revocation of your consent does not affect the legality of the processing carried out on the basis of the consent up to the revocation.

Objection to the processing of your data If we process your data on the basis of legitimate interests pursuant to Article 6 Paragraph 1 Letter f GDPR, you have the right pursuant to Article 21 GDPR to object to the processing of your data if there are reasons which arise from your particular situation or the objection is directed against direct advertising. In the latter case, you have a general right of objection which will be implemented by us even if no reasons are given.

12. Data security

We maintain technical measures adequate to guarantee data security for our online services, particularly for the protection of your data against dangers posed during data transmission and against unauthorised cognizance by third parties. These measures are constantly revised to reflect the latest state of technology. To secure the personal data which you have specified on our website, we use transport layer security (TLS), which encrypts the information which you have entered.

13. Amendments to this Data Protection Notice

We shall update this Data Protection Notice from time to time, for instance when we revise our website or if statutory rules or official regulations should change.