PRIVACY POLICY

Privacy policy
Data protection is a very high priority at Naturpark Our. The use of the Internet pages of the Naturpark Our is possible without any indication of personal data. However, if a data subject wants to use special enterprise services via our website, processing of personal data may become necessary. If the processing of personal data is necessary and there is no legal basis for such processing, we generally obtain the consent of the data subject.
The processing of personal data, such as the name, address, e-mail address or telephone number of a data subject shall always comply with the General Data Protection Regulation (GDPR) and the country-specific data protection regulations applicable to Naturpark Our. By means of this data protection declaration, we wish to inform the general public about the nature, scope and purpose of the personal data we collect, use and process. This data protection declaration also informs data subjects of their rights.
As the data controller, Naturpark Our has implemented numerous technical and organisational measures to ensure the most comprehensive protection of personal data processed by this website. However, data transmissions over the Internet may in principle contain security gaps, so absolute protection cannot be guaranteed. For this reason, each person concerned is free to transfer personal data to us by alternative means, for example by telephone.

1. Definitions
The Naturpark Our data protection declaration is based on the terms used by the European legislator for the adoption of the General Data Protection Regulation (GDPR). Our data protection declaration must be legible and comprehensible for the general public, as well as our customers and business partners. To ensure this, we would first like to explain the terminology used.
In this data protection declaration, we use the following terms:

a) Personal data
Personal data is any information relating to an identified or identifiable natural person (hereinafter referred to as the «data subject»); an «identifiable natural person» is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

b) Person concerned
The data subject means each identified natural person whose personal data is processed by the person responsible for this processing.

c) Treatment
Processing means any operation or set of operations which is performed upon personal data or sets of data, whether or not by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

d) Limitation of processing
Limiting processing means marking personal data that has been retained, with a view to limiting its future processing.

e) Profiling
Profiling means any form of automated processing of personal data which consists in using such personal data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict factors concerning that individual’s work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

f) Pseudonymisation
Pseudonymisation means the processing of personal data in such a way that it can no longer be attributed to a specific data subject without recourse to additional information, provided that this additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.

g) Data controller
The controller is the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing; where the purposes and means of such processing are determined by Union law or by the law of a Member State, the controller may be designated or the specific criteria for such designation may be laid down by Union law or by the law of a Member State.

h) Sub-contractor
The processor is the natural or legal person, public authority, department or other body which processes personal data on behalf of the controller.

i) Recipient
The recipient is the natural or legal person, public authority, agency or any other body to whom personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the context of a particular enquiry in accordance with Union law or the law of a Member State shall not be regarded as recipients; the processing of such data by the public authorities in question shall comply with the data protection rules applicable to the purposes of the processing.

j) Τiers
The third party is a natural or legal person, a public authority, a service or a body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or the processor, are authorised to process personal data.

k) Consent
The data subject’s consent is any expression of free, specific, informed and unambiguous will by which the data subject accepts, by a declaration or by a clear positive act, that personal data concerning him or her may be processed.

2. Name and address of the data controller
The data controller for the purposes of the General Data Protection Regulation (GDPR), other data protection laws applicable to the Member States of the European Union and other provisions relating to data protection is:
Naturpark Our
12, Parc
9836 Hosingen
Luxemburg
Telephone number: 00352 9081881
Email: info@naturpark-our.lu
Website: www.naturpark-our.lu

3. Name and address of the Data Protection Officer
The Data Protection Officer is:
Mrs Annick Mousel
Naturpark Our
12, Parc
9836 Hosingen
Luxemburg
Telephone number: 00352 908188636
Email: annick.mousel@naturpark-our.lu
Website: www.naturpark-our.lu
Any data subject may contact our Data Protection Officer directly at any time with any questions or suggestions concerning data protection.

4. Cookies
The Naturpark Our website uses cookies. Cookies are text files stored on a computer system by a web browser.
Many websites use cookies. Many cookies contain a so-called cookie ID. The cookie ID is a unique cookie identifier. It consists of a string of characters through which websites and servers can be assigned to a specific Internet browser in which cookies are stored. This enables visiting websites and servers to differentiate the individual Internet browser of the person concerned from other Internet browsers containing other cookies. Each specific Internet browser can be recognised and identified using a unique cookie ID.
Through the use of cookies, Naturpark Our can provide users of this website with more user-friendly services that would not be possible without the cookie configuration.
By means of cookies, the information and offers on our website can be optimised with the user in mind. As mentioned above, cookies enable us to recognise users of our website. The purpose of this recognition is to make it easier for users to use our website. Users of the website that uses cookies do not, for example, have to enter access data each time they access the site, because this is taken care of by the website and the cookie is thus stored on the user’s computer system. Another example is a shopping basket cookie on an online shop. The online shop remembers the products that a customer has placed in the virtual shopping basket via a cookie.
The person concerned can prevent cookies from being set via our website at any time by means of the corresponding configuration of the Internet browser used, and can therefore permanently refuse the setting of cookies. In addition, cookies that have already been set can be deleted at any time using an Internet browser or other software. This is possible on all popular Internet browsers. If the person concerned deactivates the setting of cookies on the fully usable Internet browser.

5. Data collection and general information
The Naturpark Our website collects a series of general data and information when a data subject or automated system calls up the website. This general data and information is stored in server log files. Collected may be (1) the types of Internet browsers and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (so-called referrers), (4) the sub-websites, (5) the date and time of access to the website, (6) an Internet Protocol address (IP address), (7) the Internet service provider of the access system, and (8) any other similar data and information that may be used in the event of an attack on our computer systems.
By using this general data and information, Naturpark Our does not draw any conclusions about the data subject. Rather, this information is used to (1) correctly deliver the content of our website, (2) optimize the content of our website as well as its advertising, (3) ensure the long-term viability of our computer systems and website technology, and (4) provide law enforcement authorities with information necessary for criminal prosecution in the event of a cyber attack. Naturpark Our analyses anonymously collected data and information statistically, with the aim of increasing the data protection and data security of our company, and to ensure an optimum level of protection for the personal data we process. Anonymised data from server log files is kept separate from any personal data provided by the data subject.

6. Subscribe to our newsletters
On the Naturpark Our website, users have the option of subscribing to newsletters from our company. The input mask used for this purpose determines which personal data is transmitted, as well as when the newsletter is ordered by the data controller.
Naturpark Our regularly informs its customers and business partners by means of a newsletter. The company’s newsletter can only be received by the data subject if (1) the data subject has a valid e-mail address, and (2) the data subject registers for the newsletter. A confirmation e-mail will be sent for the first time to the e-mail address registered by the data subject, for legal reasons, during the double opt-in procedure. This confirmation e-mail serves to prove that the owner of the e-mail address is authorised as a data subject to receive the newsletter.
During registration for the newsletter, we also store the IP address of the computer system assigned by the Internet Service Provider (ISP) and used by the data subject during registration, as well as the date and time of registration. The collection of this data is necessary in order to understand the (possible) misuse of the data subject’s e-mail address at a later date, and therefore serves the purpose of the data controller’s legal protection.
The personal data collected as part of the newsletter registration will be used solely to send our newsletter. In addition, newsletter subscribers may be informed by e-mail as long as this is necessary for the operation of the newsletter service or for the registration in question, for example in the event of changes to the newsletter offer or in the event of a change in technical circumstances. The newsletter service will not pass on personal data to third parties. Registration for our newsletter may be terminated at any time by the person concerned. The consent given by the data subject to the storage of personal data for the purpose of sending the newsletter may be revoked at any time. To revoke consent, there is a corresponding link in each newsletter. It is also possible to unsubscribe from the newsletter at any time directly on the website of the data controller or to contact the data controller in a different way.

7. Newsletter-Tracking
The Naturpark Our newsletter contains so-called tracking pixels. I448. This enables statistical analysis of the success or failure of online marketing campaigns. Based on the integrated tracking pixel, Naturpark Our can see if and when an e-mail was opened by the data subject and which links in the e-mail were opened by the data subject.
The personal data collected by the tracking pixels contained in the newsletter is stored and analysed by the data controller in order to optimise the sending of newsletters and to tailor the content of future newsletters to the interests of the data subject. This personal data is not passed on to third parties. Data subjects have the right at any time to revoke their separate declaration of consent expressed by means of the double opt-in procedure. After revocation, this personal data will be deleted by the controller. Naturpark Our automatically regards withdrawal from the newsletter as a revocation.

8. Contact via the website
The website of the Naturpark Our contains information which enables rapid electronic contact with our enterprise, as well as direct communication with us, also including a general address of the so-called e-mail address. If the data subject contacts the controller via e-mail or a contact form, the personal data transmitted by the data subject is automatically stored. The personal data voluntarily transmitted by the data subject to the data controller is stored for the purpose of processing or communicating with the data subject. This personal data is not passed on to third parties.

9. Routine deletion and blocking of personal data
The data controller must process and retain the data subject’s personal data only for as long as is necessary to achieve the purpose for which it is to be retained, or for as long as is permitted by the European legislator or other legislators in the laws or regulations to which the data controller is subject.
If the retention purpose is not applicable, or if the retention period prescribed by the European legislator or another competent legislator expires, personal data is routinely blocked or deleted in accordance with legal requirements.

10. Rights of the person concerned

a) Right of confirmation
Every data subject has the right to obtain confirmation from the controller as to whether or not personal data relating to him or her is being processed. If the data subject wishes to exercise this right of confirmation, he or she may, at any time, contact an employee of the controller.

b) Right of access
The data subject has the right granted by the European legislator to obtain, at any time, access by the data controller to information about his/her personal data stored and a copy of this information. In addition, the European directives and regulations grant the data subject access to the following information:
the purposes of the processing;
the categories of personal data concerned;
the recipients or categories of recipient to whom the personal data has been or will be disclosed, in particular recipients established in third countries or international organisations;
where possible, the length of time for which the personal data will be kept or, where this is not possible, the criteria used to determine this length of time;
the existence of the right to request from the controller the rectification or erasure of personal data, or a restriction on the processing of personal data relating to the data subject, or the right to object to such processing;
the right to lodge a complaint with a supervisory authority;
where personal data is not collected from the data subject, any available information as to its source;
the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4) and, at least in such cases, useful information concerning the underlying logic and the significance and intended consequences of such processing for the data subject.
In addition, the data subject has the right to be informed if personal data is transferred to a third country or to an international organisation. Where this is the case, the data subject has the right to be informed of the appropriate safeguards with regard to this transfer.
If the data subject wishes to exercise this right of access, he or she may, at any time, contact an employee of the data controller.

c) Right of rectification
The data subject has the right granted by the European legislator to obtain from the controller, as soon as possible, the rectification of inaccurate personal data relating to him or her. Given the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by providing a supplementary declaration.
If the data subject wishes to exercise this right of rectification, he or she may, at any time, contact an employee of the data controller.

d) Right to erasure (“right to be forgotten”)
The data subject has the right granted by the European legislator to obtain from the controller the erasure, as soon as possible, of personal data relating to him or her and the controller has the obligation to erase such personal data as soon as possible, where one of the following grounds applies:
Personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
The data subject withdraws the consent on which the processing is based, in accordance with Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing.
The data subject objects to the processing pursuant to Article 21(1) of the GDPR, and there are no compelling legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) of the GDPR.
Personal data has been processed unlawfully.
Personal data must be erased in order to comply with a legal obligation laid down by Union law or by the law of the Member State to which the controller is subject.
The personal data has been collected as part of the information society services referred to in Article 8, paragraph 1 of the RGPD.
If one of the aforementioned reasons applies, and a data subject wishes to request the erasure of personal data stored by Naturpark Our, he or she may, at any time, contact any employee of the controller. An employee of Naturpark Our shall promptly assure the data subject that the requested erasure has been completed immediately.
Where the controller has made the personal data public and is required to erase it pursuant to Article 17(1), the controller shall, taking into account the available technologies and the costs of implementation, take reasonable steps, including technical steps, to inform the controllers processing such personal data that the data subject has requested the erasure by those controllers of any links to, or copies or reproductions of, such personal data, to the extent that the processing is not required. An employee of the Naturpark Our will arrange the necessary measures in individual cases.

e) Right to limit processing
The data subject has the right granted by the European legislator to obtain from the controller the restriction of processing where any of the following applies:
The accuracy of personal data is contested by the data subject for a period of time allowing the controller to verify the accuracy of the personal data.
The processing is unlawful and the data subject objects to their erasure and demands instead that their use be restricted.
The controller no longer needs the personal data for the purposes of the processing operation, but the data is still necessary for the data subject to establish, exercise or defend legal claims.
The data subject has objected to the processing under Article 21(1) of the GDPR during the verification as to whether the legitimate grounds pursued by the controller override those of the data subject.
If one of the following applies, and a data subject wishes to request the restriction of the processing of personal data stored by Naturpark Our, he or she may, at any time, contact any employee of the controller. An employee of Naturpark Our will arrange the restriction of the processing.

f) Right to data portability
Data subjects shall have the right granted by the European legislator to receive personal data relating to them which they have supplied to a controller, in a structured, commonly used and machine-readable format. Data subjects must have the right to transmit such data to another controller without any obstacle from the controller to whom the personal data have been communicated, where the processing is based on consent pursuant to Article 6(1)(a) or Article 9, paragraph 2, point a) RGPD, or on a contract pursuant to Article 6, paragraph 1, point b) RGPD, and the processing is carried out using automated processes, if the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
In addition, by exercising the right to portability pursuant to Article 20(1) of the GDPR, the data subject has the right to have personal data transmitted directly from one controller to another, where this is technically possible and where it does not adversely affect the rights and freedoms of others.
In order to assert the right to data portability, the data subject may, at any time, contact an employee of Naturpark Our.

g) Right to object
The data subject has the right granted by the European legislator to object at any time, on grounds relating to his or her particular situation, to processing of personal data concerning him or her based on Article 6(1)(e) or (f) of the GDPR. This also applies to profiling based on these provisions.
Naturpark Our shall no longer process personal data unless it can demonstrate compelling legitimate grounds for the processing which override the interests and rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
If Naturpark Our processes personal data for canvassing purposes, the data subject shall have the right to object at any time to the processing of his/her personal data for such canvassing purposes. This also applies to profiling insofar as it is linked to such canvassing. If the data subject objects to the processing for canvassing purposes, the personal data will no longer be processed for these purposes.
In addition, the data subject has the right, on grounds relating to his or her particular situation, to object to the processing of personal data concerning him or her by Naturpark Our for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) of the GDPR, unless the processing is necessary for the performance of a task carried out in the public interest.
In order to exercise the right to object, the data subject may, at any time, contact any employee of the Naturpark Our. Furthermore, in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his/her right to object by means of automated processes using technical specifications.

h) Automated individual decision and profiling
The data subject shall have the right granted by the European legislator not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or significantly affects him or her in a similar way, where the decision (1) is not necessary for the conclusion or performance of a contract between the data subject and a controller, or (2) is not authorised by Union law or the law of the Member State to which the controller is subject and which also provides for appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject, or (3) is not based on the data subject’s explicit consent.
If the decision (1) is necessary for entering into, or the performance of, a contract between the data subject and a controller, or (2) is based on the data subject’s explicit consent, Naturpark Our shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
If the data subject wishes to exercise the rights concerning automated individual decision-making, he or she may, at any time, contact any employee of the Naturpark Our.

i) Right to withdraw consent to processing
The data subject has the right granted by the European legislator to withdraw his or her consent to the processing of his or her personal data at any time.
If the data subject wishes to exercise the right to withdraw consent, he or she may at any time contact any employee of the Naturpark Our.

11. Data protection provisions relating to the application and use of Facebook
On this website, the data controller has integrated components from the company Facebook. Facebook is a social network.
A social network is a social meeting place on the Internet, an online community that enables users to communicate with each other and interact in a virtual space. A social network can serve as a platform for exchanging opinions and experiences, or enable the Internet community to provide personal or professional information. Facebook allows social network users to create private profiles, upload photos and create networks via friend requests.
The operating company of Facebook is Facebook, Inc, 1 Hacker Way, Menlo Park, CA 94025, United States. For persons living outside the United States, the data controller is Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
By calling up one of the individual pages of this website which is operated by the controller and on which a Facebook component (Facebook plug-in) has been integrated, the Internet browser on the data subject’s computer system is automatically prompted by the Facebook component to download the display of the Facebook component. An overview of all Facebook plug-ins can be found at https://developers.facebook.com/docs/plugins/. During this technical procedure, Facebook recognises the specific sub-sites of our website that the person concerned has visited.
If the data subject is simultaneously logged in on Facebook, Facebook detects when the data subject calls up our website - and for the duration of their visit to our website - which specific sub-site of our website has been visited by the data subject. This information is collected via the Facebook component and linked to the data subject’s Facebook account. If the data subject clicks on one of the Facebook buttons integrated into our website, for example the “Like” button, or if the data subject submits a comment, Facebook associates this information with the data subject’s personal Facebook account and stores the personal data.
Facebook always receives information about the data subject’s visit to our website via the Facebook component whenever the data subject is logged in to Facebook at the same time as visiting our website. This occurs irrespective of whether or not the data subject clicks on the Facebook component. If the data subject does not want information to be transferred to Facebook in this way, he or she can prevent this by logging out of the Facebook account before calling up our website.
The data protection directive published by Facebook, which is available at https://facebook.com/about/privacy/, provides information on the collection, processing and use of personal data by Facebook. In addition, it explains the setting options that Facebook offers to protect the privacy of the data subject. Different configuration options are also available to enable data transmissions to Facebook to be eliminated. These applications can be used by the data subject to prevent data being transferred to Facebook.

12. Data protection provisions relating to the application and use of Instagram
On this website, the data controller has integrated components of Instagram. Instagram is a service that can be described as an audiovisual platform, which allows users to share photos and videos, as well as distribute this data to other social networks.
The company operating the services offered by Instagram is Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland.
By calling up one of the individual pages of this website which is operated by the controller and on which an Instagram component (the Insta button) has been integrated, the Internet browser of the data subject automatically downloads a display of the Instagram component via the respective Instagram component. During this technical procedure, Instagram of the specific individual sub-sites of this website that the data subject has visited.
If the data subject is at the same time logged in on Instagram, Instagram detects when the data subject calls up our website - and for the duration of their visit to our website - which specific sub-site of our website has been visited by the data subject. This information is collected via the Instagram component, and associated with the data subject’s respective Google+ account. If the data subject clicks on one of the integrated Instagram buttons on our website, Instagram associates this information with the data subject’s personal Instagram user account and records the personal data.
Instagram receives information via the Instagram component that the data subject has visited our website, if the data subject is at the same time logged in on Instagram. This occurs irrespective of whether or not the data subject clicks on the Instagram button. If such transmission of information to Instagram is not desired by the data subject, the data subject can prevent it by logging out of his/her Instagram account before calling up our website.
Further information and applicable Instagram provisions can be found at https://help.instagram.com/155833707900388 and https://www.instagram.com/about/legal/privacy/.

13. Data protection provisions concerning the application and use of Matomo
On this website, the data controller has integrated components of Matomo. Matomo is an open-source software tool for web analysis. Web analytics is the collection and analysis of data about the behaviour of visitors to websites. A web analytics tool captures, among other things, data relevant to which website a person arrived at via another website (the so-called “referrer”), which sub-site of a website was visited or how often and for how long that sub-site was viewed. Web analytics are mainly used to optimise a website in order to carry out a cost-benefit analysis of Internet advertising.
The software is run on the data controller’s server and the data protection-sensitive log files are stored exclusively on this server.
The purpose of the Matomo component is to analyse the flow of visitors to our website. The data controller uses the data and information obtained, among other things, to evaluate the use of this website in order to compile online reports showing activities on our Internet pages.
Matomo places a cookie on the data subject’s computer system. The definition of cookies is explained above. By configuring the cookie, an analysis of the use of our website is activated. When calling up one of the individual pages of this website, the Internet browser of the person concerned is automatically prompted by the corresponding Matomo component to submit data for online analysis purposes to our server. During this technical procedure, we are informed of personal data, such as the IP address of the data subject, which is used to understand the origin of visitors and clicks.
The cookie is used to store personal data, such as the time of access, the location from which access was made and the frequency of visits to our website. On each visit to our website, such personal data, including the IP address of the Internet access used by the person concerned, will be transmitted to our server. This personal data is stored by you. We do not disclose this data to third parties.
As stated above, the data subject may at any time prevent cookies from being placed via our website by making a corresponding setting on the Internet browser used and, in this way, permanently deny the setting of cookies. Such a setting of the Internet browser used will prevent Matomo from placing a cookie on the data subject’s computer system. Cookies already used by Matomo can also be deleted at any time using an Internet browser or other software.
The data subject also has the opportunity to object to the collection of data relating to the use of this site generated by Matomo and the processing of such data by Matomo, and the chance to prevent such collection. To this end, the data subject must select the “Do Not Track” option on the Internet browser.
However, by placing the opt-out cookie, it is possible that the data controller’s websites may not be fully usable by the data subject.
Further information and the applicable Matomo provisions can be found at https://matomo.org/privacy/.

14. Data protection provisions relating to the application and use of YouTube
On this website, the controller has integrated components from YouTube. YouTube is an Internet video portal that allows video publishers to upload video clips and other users to view, comment on and review them free of charge. YouTube also allows you to publish all kinds of videos, so you can access both films and full-length TV programmes, as well as music videos, trailers and user-generated videos via the Internet portal.
YouTube’s operating company is Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland.
By calling up one of the individual pages of this website which is operated by the controller and on which a YouTube component (YouTube video) has been integrated, the data subject’s Internet browser is automatically prompted to download a display of the YouTube component. Find out more about YouTube at https://www.youtube.com/yt/about/en/. During this technical procedure, YouTube and Google are informed of the specific sub-page of our website visited by the data subject.
If the data subject is at the same time logged on to YouTube, YouTube detects when the data subject calls up our website - and for the duration of their visit to our website - which specific sub-site of our website has been visited by the data subject. This information is collected via the YouTube component and associated with the data subject’s respective YouTube account.
YouTube and Google receive information via the YouTube component that the data subject has visited our website, if the data subject is at the same time connected to YouTube. This occurs irrespective of whether or not the data subject clicks on a YouTube video. If the data subject does not wish the information to be transmitted to Youtube and Google, he or she can prevent such transmission by logging out of his or her Youtube account before calling up our website.
YouTube’s data protection provisions, which can be found at https://www.google.com/intl/en/policies/privacy/, provide information about the collection, processing and use of personal data by YouTube and Google.

15. Legal basis for processing
Article 6(1)(a) GDPR serves as the legal basis for processing operations for which we obtain consent for the specific purpose of processing. If the processing of personal data is necessary for the performance of a contract to which the data subject is a party, for example where processing operations are necessary for the supply of goods or for any other service, the processing is based on Article (1) (b) GDPR. The same applies to such processing operations that are necessary for the performance of pre-contractual measures, for example in the case of requests concerning our products or services. If our company is subject to a legal obligation to process personal data, for example to comply with tax obligations, the processing is based on art. 6 (1) (c) RGPD. In some cases, the processing of personal data may be necessary to protect the vital interests of the data subject or of another natural person. This would be the case, for example, if the visitor were injured on our premises and his or her name, age, health insurance details or other vital information had to be passed on to a doctor, hospital or third party. This processing is then based on Article 6(1)(d) RGPD. Finally, processing operations may be based on Article 6(1)(f). This legal basis is used for processing operations that are not covered by any of the aforementioned articles, if the processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where the interests or fundamental rights and freedoms of the data subject override such interests which require the protection of personal data. Such processing operations are particularly permitted because they have been specifically mentioned by the European legislator. It considered that a legitimate interest could be assumed if the data subject was a customer of the controller (Recital 47 sentence 2 GDPR).

16. The legitimate interests pursued by the controller or by a third party
Where the processing of personal data is based on Article 6(1) (f) GDPR, our legitimate interest is to carry out our activities for the benefit of all our employees and shareholders.

17. Period for which personal data is kept
The criteria used to determine the retention period is the respective legal retention period. Once this period has expired, the data is systematically deleted as long as it is no longer required for the performance of the contract or the opening of a contract.

18. Provision of personal data as a legal or contractual requirement; Necessary to conclude a contract; Obligation of the data subject to provide personal data; Possible consequences of failure to provide such data.
We clarify that the provision of personal data is required in part by law (e.g. tax provisions) or contractual provisions (e.g. information about the contractual partner). Sometimes it may be necessary to conclude a contract with data that the data subject has provided to us and that can then be processed by us. The data subject is, for example, obliged to provide us with personal data when our company signs a contract with him or her. Failure to provide personal data would mean that the contract with the data subject could not be concluded. Before personal data is provided by the data subject, the data subject must contact an employee. The employee will clarify to the data subject whether the provision of the personal data is required by law or by contract or is necessary for the conclusion of a contract, whether there is an obligation to provide the personal data and the consequences of the data subject’s failure to provide the personal data.

19. Existence of an automated decision-making mechanism
As a responsible company, we do not use any automatic decision-making or profiling processes.