Privacy Policy

This Privacy Policy clarifies the nature, scope and purpose of the processing of personal data (hereinafter referred to as “data”) within our online service and the associated websites, functions and content as well as external online presences, such as our Social Media Profile (hereinafter jointly referred to as “online offer”). With regard to the terms used, such as “processing” or “person respon­sible”, we refer to the defin­i­tions in Art. 4 of the General Data Protection Regulation (DSGVO).

Controller

SRC
Security Research & Consulting GmbH
Emil-Nolde-Str.7
GER-53113 Bonn
Telephone: +49 (228) 2806 – 0
Telefax: +49 (228) 2806 – 199
Internet: www.src-gmbh.de
eMail: info[at]src-gmbh.de
CEO: Gerd Cimiotti
Commercial register: Bonn HRB 9414
VAT ID number: DE 212254844

You can contact our data protection officer as follows:

Florian Reichert
Adenauer­allee 136
53113 Bonn

Tel.: +49 (0) 228–227 226–0
Fax: +49 (0) 228–227 226–26
Contact: http://www.scheja-partner.de/kontakt/kontakt.html
www.scheja-partner.de

Types of data processed:

• Inventory data (for example, names, addresses).
• Contact details (e.g., e‑mail, telephone numbers).
• Content data (e.g., text input, photographs, videos).
• Usage data (e.g., visited websites, interest in content, access times).
• Meta/communication data (e.g., device infor­mation, IP addresses).

Purpose of the data processing

• Provision of the online offer, its functions and contents.
• Response to contact requests and commu­ni­cation with users.
• Security measures.
• Range measurement/marketing

Terms used

“Personal data” means any infor­mation relating to an identified or identi­fiable natural person (hereinafter referred to as “data subject”); an identi­fiable natural person is one who can be identified, directly or indirectly, in particular by assignment to an identifier such as a name, an identi­fi­cation number, location data, an online identifier (e.g. cookie) or to one or more special features that express the physical, physi­o­logical, genetic, psycho­logical, economic, cultural or social identity of that natural person.

“Processing” means any operation or set of opera­tions which is performed on personal data or on sets of personal data, whether or not by automated means. The term covers practi­cally every handling of data.

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, deter­mines the purposes and means of the processing of personal data.

Decisive legal bases

In accor­dance with Art. 13 DSGVO, we inform you about the legal basis of our data processing. If the legal basis is not mentioned in the data protection decla­ration, the following applies: The legal basis for obtaining consents is Art. 6 para. 1 lit. a and Art. 7 DSGVO, the legal basis for processing for the perfor­mance of our services and perfor­mance of contractual measures as well as for answering inquiries is Art. 6 para. 1 lit. b DSGVO, the legal basis for processing to fulfil our legal oblig­a­tions is Art. 6 para. 1 lit. c DSGVO, and the legal basis for processing to protect our legit­imate interests is Art. 6 para. 1 lit. f DSGVO. In the event that the vital interests of the data subject or another natural person require the processing of personal data, Article 6(1)(d) DSGVO serves as the legal basis.

Security measures

We ask you to inform yourself regularly about the contents of our privacy policy. We adapt the privacy policy as soon as changes in the data processing carried out by us require this. We will inform you as soon as the changes require your cooper­ation (e.g. consent) or if any other individual notifi­cation is required.

Cooper­ation with processors and third parties

If, in the course of our processing, we disclose data to other persons and companies (processors or third parties), transfer them or grant them access to the data in any other way, this shall take place as follows

• on the basis of a legal permission (e.g. if a trans­mission of the data to third parties, such as to payment service providers, is necessary in accor­dance with Art. 6 para. 1 lit. b DSGVO for contract fulfilment),
• if you have consented,
• if a legal oblig­ation requires it, or
• on the basis of our legit­imate interests (e.g. when using agents, web hosts, etc.).

If we commission third parties with the processing of data on the basis of a so-called “processing contract”, this is done in accor­dance with the relevant require­ments of Art. 28 DSGVO.

Transfers to third countries

If we process data

• in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or
• the processing takes place in the context of the use of services of third parties, or
• data will be disclosed or trans­mitted to third parties,

this only happens if it is

• to fulfil our (pre)contractual oblig­a­tions or on the basis of
• your consent,
• a legal oblig­ation or
• on the basis of our legit­imate interests.

Subject to legal or contractual permis­sions, we process or have the data processed in a third country only if the special require­ments of Art. 44 ff. DSGVO are fulfilled. This means that the processing is carried out, for example, on the basis of special guarantees, such as the officially recog­nised deter­mi­nation of a data protection level corre­sponding to the EU or compliance with officially recog­nised special contractual oblig­a­tions (so-called “standard contractual clauses”).

Rights of the data subject

Infor­mation rights

You have the right to receive infor­mation about your personal data stored by us.

Right of recti­fi­cation and deletion

You can request us to rectify incorrect data and — insofar as the legal require­ments are fulfilled — to delete your data.

Restriction of processing

As far as the legal require­ments are fulfilled, you can demand that we restrict the processing of your data.

Data portability

If you have provided us with data on the basis of a contract or consent, you may, if the legal require­ments are met, request that you receive the data provided by you in a struc­tured, current and machine-readable format or that we transmit it to another person responsible.

Objection to data processing in the case of a “legit­imate interest” legal basis

You have the right to object to our processing of your data at any time for reasons arising from your particular situation, insofar as this is based on the legal basis of “legit­imate interest”. If you use your right of objection, we will stop processing your data unless we can — in accor­dance with the statutory provi­sions — prove compelling reasons worthy of protection for further processing, which exceed your rights.

Controlling the use of cookies

You can control the use of cookies at any time. Please refer to the Cookies section for details. We offer you an appro­priate tool for this purpose.

Revocation of consent

If you have given us your consent to the processing of your data, you can revoke this at any time with effect for the future. The legality of the processing of your data until revocation remains unaffected by this.

Right of appeal at the super­visory authority

You may also lodge a complaint with the competent super­visory authority if you believe that the processing of your data is contrary to applicable law. You can contact the data protection authority respon­sible for your place of residence or country or the data protection authority respon­sible for us.

Your contact to us:

Furthermore, you can contact us free of charge with questions regarding the processing of your personal data, your data subject rights and any consent given. To make use of all your afore­men­tioned rights, please contact datenschutz@src-gmbh.de or via post to the address indicated under point 1 above. Please ensure that we can uniquely identify you.

Right of objection in the case of a “legit­imate interest” legal basis

Objection to data processing on the legal basis of “legit­imate interest”: You have the right, for reasons arising from your particular situation, to object at any time to the future processing of the data concerning you by us, insofar as this is based on the legal basis of “legit­imate interest”. If you exercise your right of objection, we will stop the processing of your data unless we can — in accor­dance with the statutory provi­sions — prove compelling reasons worthy of protection for further processing, which outweigh your rights.

To exercise your right to object, please contact

Cookies

“Cookies” are small files that are stored on the user’s computer. Different data can be stored within the cookies. A cookie is primarily used to store infor­mation about a user (or the device on which the cookie is stored) during or after his or her visit to an online offer. Temporary cookies, or “session cookies” or “transient cookies”, are cookies that are deleted after a user leaves an online offer and closes the browser. In such a cookie, for example, the content of a shopping basket can be stored in an online shop or a login jam. Cookies are referred to as “permanent” or “persistent” if they remain stored even after the browser is closed. For example, the login status can be saved when users visit it after several days. Likewise, the interests of users used for range measurement or marketing purposes may be stored in such a cookie. “Third-party cookies” are cookies that are offered by providers other than the person respon­sible for operating the online offer (otherwise, if they are only operator cookies, they are referred to as “first-party cookies”).

We may use temporary and permanent cookies and explain this when using our website. When you visit our website for the first time, you will receive a pop-up message at the bottom of the screen with infor­mation on the use of cookies. If you click on the accept button, we save a cookie so that we know that you have taken note of our message and that it will not be displayed again on your next visit.

If users do not want cookies to be stored on their computer, they are asked to deactivate the corre­sponding option in the system settings of their browser. Stored cookies can be deleted in the system settings of the browser. The exclusion of cookies can lead to functional restric­tions of this online offer.

The legal basis for the processing of personal data using techni­cally necessary cookies is Art. 6 para. 1 lit. f DSGVO. Our legit­imate interests are the simpli­fi­cation of the use of our website and the recog­nition of the user’s browser even after a switch of the website.

Deletion of data

The data processed by us will be deleted or their processing restricted in accor­dance with Articles 17 and 18 DSGVO. Unless expressly stated in this data protection decla­ration, the data stored by us will be deleted as soon as it is no longer required for its intended purpose and the deletion does not conflict with any statutory storage oblig­a­tions. If the data is not deleted because it is necessary for other and legally permis­sible purposes, its processing is restricted. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax reasons.

In accor­dance with statutory require­ments in Germany, the records are kept in particular for 6 years in accor­dance with § 257 (1) HGB (trading books, inven­tories, opening balance sheets, annual financial state­ments, commercial letters, accounting documents, etc.) and for 10 years in accor­dance with § 147 (1) AO (books, records, management reports, accounting documents, commercial and business letters, documents relevant for taxation, etc.).

Order processing for services

We process our customers’ data as part of the ordering process in our online ticket management system to enable them to select and order the selected products and services, as well as their payment and delivery or execution.

The processed data includes inventory data, commu­ni­cation data, contract data, payment data. The persons affected by the processing include our customers, inter­ested parties and other business partners. The processing takes place for the purpose of providing contractual services in the context of operating an online shop, billing, delivery and customer services. We use session cookies for storing the contents of the shopping cart and permanent cookies for storing the login status.

Processing is carried out on the basis of Art. 6 Para. 1 lit. b (execution of order processes) and c (legally required archiving) DSGVO. The infor­mation marked as necessary is required to establish and fulfil the contract. We disclose the data to third parties only within the framework of delivery, payment or within the framework of legal permits and oblig­a­tions to legal advisors and author­ities. The data will only be processed in third countries if this is necessary for the fulfilment of the contract (e.g. at the customer’s request upon delivery or payment).

When regis­tering, re-regis­tering and using our online services, we store the IP address and the time of the respective user action. This data is stored on the basis of our legit­imate interests as well as the users’ interest in protection against misuse and other unautho­rized use. A passing on of this data to third parties does not take place in general, unless it is necessary to pursue our claims or there is a legal oblig­ation according to Art. 6 para. 1 lit. c DSGVO.

The deletion takes place after the expiry of statutory warranty and compa­rable oblig­a­tions, the necessity of data storage is reviewed every three years; in the case of statutory archiving oblig­a­tions, the deletion takes place after their expiry (end of commercial law (6 years) and tax law (10 years) storage obligation).

Agency services

We process our customers’ data as part of our contractual services, which include conceptual and strategic consulting, campaign planning, software and design devel­opment / consulting or mainte­nance, imple­men­tation of campaigns and processes / handling, server admin­is­tration, data analysis / consulting services and training services.

We process inventory data (e.g., customer master data, such as names or addresses), contact data (e.g., e‑mail, telephone numbers), content data (e.g., text entries, photographs, videos), contract data (e.g., subject matter of the contract, term), payment data (e.g., bank details, payment history), usage and metadata (e.g. as part of the evalu­ation and perfor­mance measurement of marketing measures). We do not process special categories of personal data unless these are part of commis­sioned processing. This includes our customers, prospects, their customers, users, website visitors or employees, as well as third parties. The purpose of the processing is to provide contractual services, billing and our customer service. The legal basis for processing results from Art. 6 para. 1 lit. b DSGVO (contractual services), Art. 6 para. 1 lit. f DSGVO (analysis, statistics, optimi­sation, safety measures). We process data which are necessary to justify and fulfil the contractual services and point out the necessity of their disclosure. Disclosure to external parties only takes place if it is necessary within the framework of an order. When processing the data provided to us within the scope of an order, we act in accor­dance with the instruc­tions of the client and the legal require­ments for order processing pursuant to Art. 28 DSGVO and process the data for no other purposes than those stipu­lated in the order.

We delete the data after the expiry of statutory warranty and compa­rable oblig­a­tions. The necessity of storing the data is checked every three years; in the case of statutory archiving oblig­a­tions, the data is deleted after their expiry (6 years, in accor­dance with § 257 Paragraph 1 HGB, 10 years, in accor­dance with § 147 Paragraph 1 AO). In the case of data disclosed to us within the scope of an order by the customer, we delete the data in accor­dance with the speci­fi­ca­tions of the order, generally after the end of the order.

Fulfilment of contractual services

We process inventory data (e.g., names and addresses as well as contact data of users), contract data (e.g., services used, names of contact persons, payment infor­mation) for the purpose of fulfilling our contractual oblig­a­tions and services pursuant to Art. 6 para. 1 lit b. DSGVO. The entries marked as oblig­atory in online forms are required for the conclusion of the contract.

When using our online services, we store the IP address and the time of the respective user action. The data is stored on the basis of our legit­imate interests as well as the user’s protection against misuse and other unautho­rized use. A passing on of this data to third parties does not take place in principle, unless it is necessary for the pursuit of our claims or there is a legal oblig­ation according to Art. 6 Abs. 1 lit. c DSGVO.
The data will be deleted after the expiry of statutory warranty and compa­rable oblig­a­tions; the necessity of storing the data will be reviewed every three years; in the case of statutory archiving oblig­a­tions, the data will be deleted after their expiry. Infor­mation in the possible customer account remain up to its deletion.

Admin­is­tration, financial accounting, office organ­i­sation, contact management

We process data within the framework of admin­is­trative tasks as well as the organ­i­sation of our company, financial accounting and compliance with legal oblig­a­tions, e.g. archiving. We process the same data that we process as part of the perfor­mance of our contractual services. The processing bases are Art. 6 para. 1 lit. c. DSGVO, Art. 6 para. 1 lit. f. DSGVO. Customers, prospects, business partners and website visitors are affected by the processing. The purpose and our interest in the processing lies in the admin­is­tration, financial accounting, office organi­zation, archiving of data, thus tasks which serve the mainte­nance of our business activ­ities, and the provision of our services. The deletion of the data with regard to contractual services and contractual commu­ni­cation corre­sponds to the infor­mation provided in these processing activities.

We disclose or transmit data to the tax author­ities, consul­tants, such as tax consul­tants or auditors, as well as other fee offices and payment service providers.

Furthermore, we store infor­mation on suppliers, event organ­isers and other business partners on the basis of our business interests, e.g. for the purpose of making contact at a later date. We store this data, which is mainly company-related, permanently.

Business analysis and market research

In order to operate our business econom­i­cally and to identify market trends, customer and user require­ments, we analyse the data available to us on business trans­ac­tions, contracts, enquiries, etc., in order to ensure that we are able to offer our customers the best possible service. We process inventory data, commu­ni­cation data, contract data, payment data, usage data, metadata on the basis of Art. 6 para. 1 lit. f. DSGVO, whereby the persons concerned include customers, inter­ested parties, business partners, visitors and users of the online offer.

The analyses are carried out for the purpose of economic evalu­a­tions, marketing and market research. In doing so, we can consider the profiles of regis­tered users with infor­mation e.g. about their purchase processes. The analyses serve us to increase the user-friend­liness, the optimization of our offer and the economic efficiency. The analyses serve us alone and are not disclosed exter­nally, unless they are anonymous analyses with aggre­gated values.

If these analyses or profiles are personal, they will be deleted or made anonymous upon termi­nation of the user, otherwise after two years from the conclusion of the contract. For the rest, macro­eco­nomic analyses and general trend deter­mi­na­tions are prepared anony­mously wherever possible.

Privacy policy in the appli­cation process

We process the applicant data only for the purpose and in the context of the appli­cation procedure in accor­dance with the legal require­ments. The processing of the applicant data takes place in order to fulfil our (pre)contractual oblig­a­tions in the context of the appli­cation procedure within the meaning of Art. 6 para. 1 lit. b. DSGVO Art. 6 para. 1 lit. f. DSGVO if data processing becomes necessary for us, e.g. within the framework of legal proce­dures (in Germany § 26 BDSG additionally applies).

The appli­cation procedure requires that appli­cants provide us with their data. If we offer an online form, the necessary applicant data are marked otherwise result from the job descrip­tions and generally include personal data, postal and contact addresses and the documents belonging to the appli­cation, such as cover letter, curriculum vitae and certifi­cates. In addition, appli­cants may volun­tarily provide us with additional information.

By submitting the appli­cation to us, appli­cants agree to the processing of their data for the purposes of the appli­cation procedure in accor­dance with the type and scope set out in this data protection declaration.

Insofar as special categories of personal data within the meaning of Art. 9 para. 1 DSGVO are volun­tarily commu­ni­cated within the scope of the appli­cation procedure, they are additionally processed in accor­dance with Art. 9 para. 2 letter b DSGVO (e.g. health data, e.g. severely disabled status or ethnic origin). If special categories of personal data within the meaning of Art. 9 para. 1 DSGVO are requested from appli­cants during the appli­cation procedure, they are additionally processed in accor­dance with Art. 9 para. 2 lit. a DSGVO (e.g. health data, if these are required for the exercise of the profession).

Appli­cants can send us their appli­ca­tions via an online form on our website. The data is encrypted and trans­mitted to us according to the state of the art.

Appli­cants can also send us their appli­ca­tions by e‑mail. Please note, however, that e‑mails are generally not sent in encrypted form and that the appli­cants themselves must ensure that they are encrypted. We cannot therefore accept any respon­si­bility for the trans­mission of the appli­cation between the sender and receipt on our server and therefore recommend that you use an online form or the postal dispatch. Instead of applying via the online form or by e‑mail, appli­cants can still send us their appli­cation by post.

If the appli­cation is successful, the data provided by the appli­cants can be further processed by us for the purpose of employment. Otherwise, if the appli­cation for a job offer is not successful, the appli­cants’ data will be deleted. Appli­cants’ data will also be deleted if an appli­cation is withdrawn, which the appli­cants are entitled to do at any time.

The deletion will take place after a period of six months, subject to a justified revocation by the applicant, so that we can answer any follow-up questions to the appli­cation and meet our oblig­a­tions under the Equal Treatment Act. Invoices for any reimbursement of travel expenses are archived in accor­dance with tax regulations.

Contacting

When contacting us (e.g. via contact form, e‑mail or telephone), the user’s data will be processed in order to process the contact request and to handle it in accor­dance with Art. 6 Para. 1 lit. b) DSGVO. User infor­mation can be stored in a customer relationship management system (“CRM system”) or compa­rable request organization.

We delete the requests if they are no longer necessary. We review the necessity every two years; the statutory archiving oblig­a­tions also apply.

Newsletter

With the following infor­mation we inform you about the contents of our newsletter as well as the regis­tration, mailing and statis­tical evalu­ation procedure and your rights of objection. By subscribing to our newsletter you agree to the reception and the described procedures.

Contents of the newsletter

We will only send newsletters, e‑mails and other electronic notifi­ca­tions containing adver­tising infor­mation (hereinafter “newsletters”) with the consent of the recip­ients or a legal permission. If the contents of a newsletter are specif­i­cally described within the scope of a regis­tration, they are decisive for the consent of the users. In addition, our newsletters contain infor­mation about our services and us.

Double-Opt-In and logging

The regis­tration for our newsletter takes place in a so-called double opt-in procedure. This means that you will receive an e‑mail after your regis­tration in which you will be asked to confirm your regis­tration. This confir­mation is necessary so that nobody can register with external e‑mail addresses. The regis­tra­tions for the newsletter are logged in order to be able to prove the regis­tration process according to the legal require­ments. This includes the storage of the regis­tration and confir­mation time, as well as the IP address. Likewise the changes of your data stored with the service provider are logged.

Regis­tration details

To subscribe to the newsletter, simply enter your e‑mail address. Optionally we ask you to indicate a name for the purpose of personal address in the newsletter.

The dispatch of the newsletter and the perfor­mance measurement associated with it is based on the recipient’s consent pursuant to Art. 6 para. 1 lit. a, Art. 7 DSGVO in conjunction with § 7 para. 2 no. 3 UWG or on the basis of the legal permission pursuant to § 7 para. 3 UWG.

The regis­tration procedure is recorded on the basis of our legit­imate interests pursuant to Art. 6 para. 1 lit. f DSGVO. We are inter­ested in the use of a user-friendly and secure newsletter system that serves both our business interests and the expec­ta­tions of users and also allows us to provide proof of consent.

Cancellation/Revocation

You can cancel the receipt of our newsletter at any time, i.e. revoke your consent. You will find a link to cancel the newsletter at the end of each newsletter. We may store the e‑mail addresses we have unsub­scribed for up to three years on the basis of our legit­imate interests before we delete them in order to be able to prove a previ­ously given consent. The processing of these data is limited to the purpose of a possible defence against claims. An individual appli­cation for cancel­lation is possible at any time, provided that at the same time the former existence of a consent is confirmed.

Newsletter — Mailing service provider

The newsletter is sent by the mailing service provider MailJet GmbH, Rankestr. 21, 10789 Berlin, Germany. The data protection regula­tions of the shipping service provider can be viewed here: https://www.mailjet.de/privacy-policy/. The mailing service provider is used on the basis of our legit­imate interests according to Art. 6 Para. 1 letter f DSGVO and an order processing contract according to Art. 28 Para. 3 S. 1 DSGVO.

The mailing service provider can use the recipient’s data in pseudo­nymous form, i.e. without assignment to a user, to optimise or improve its own services, e.g. for technical optimi­sation of the dispatch and presen­tation of the newsletter or for statis­tical purposes. However, the mailing service provider does not use the data of our newsletter recip­ients to contact them itself or to pass the data on to third parties.

Connection of third-party services and content

Within our online offer, we provide infor­mation based on our legit­imate interests (i.e. interest in the analysis, optimi­sation and economic operation of our online offer within the meaning of Art. 6 para. 1 letter f). DSGVO) of content or service offerings of third parties in order to embed their content and services, such as videos or fonts (hereinafter uniformly referred to as “content”).

This always requires that the third party providers of this content perceive the IP address of the users, since without the IP address they could not send the content to their browser. The IP address is therefore required for the display of this content. We endeavour to use only those contents whose respective providers use the IP address only for the delivery of the contents. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statis­tical or marketing purposes. “Pixel tags” can be used to evaluate infor­mation such as visitor traffic on the pages of this website. The pseudo­nymous infor­mation may also be stored in cookies on the user’s device and may include technical infor­mation about the browser and operating system, referring websites, visiting time and other infor­mation about the use of our online offer, as well as be linked to such infor­mation from other sources.