Data Privacy

 

PART B: Detailed privacy policy

1. Introduction

With the following information, we would like to give you as a „data subject“ an overview of the processing of your personal data by us and your rights under data protection laws. In principle, it is possible to use our website without entering personal data. However, if you want to use special services of our enterprise via our website, processing of personal data could become necessary. If the processing of personal data is necessary and there is no legal basis for such processing, we will generally obtain your consent.

The processing of personal data, such as your name, address, or e-mail address, is always in line with the General Data Protection Regulation (GDPR) and in accordance with the country-specific data protection regulations applicable to us. By means of this privacy policy, we would like to inform you about the scope and purpose of the personal data collected, used and processed by us.

As the controller, we have implemented numerous technical and organizational measures to ensure the most complete protection of personal data processed through this website. Nevertheless, Internet-based data transmissions can generally have security gaps, so that absolute protection cannot be guaranteed. For this reason, you are also free to transmit personal data to us by alternative means, for example by telephone or by mail.

2. Person in charge

The responsible person in the sense of the GDPR is:

Tobias Hoffmann
Hainhölzer Straße 9
30159 Hannover

3. Data Protection Officer

We are not obliged to appoint a data protection officer. You can contact us directly at any time with all questions and suggestions regarding data protection via e-mail: datenschutz@deepstories.de.

4. Legal basis of processing

Art. 6 (1) a) GDPR (if applicable in conjunction with Section 15 (3) TMG) serves as the legal basis for processing operations in which we obtain consent for a specific processing purpose.

If the processing of personal data is necessary for the performance of a contract to which you are a party, as is the case, for example, with processing operations that are necessary for the provision of a service or consideration, the processing is based on Article 6 (1) (b) GDPR. The same applies to such processing operations that are necessary for the implementation of pre-contractual measures, for example in cases of inquiries about our offers.

If we are subject to a legal obligation by which a processing of personal data becomes necessary, such as for compliance with tax obligations, the processing is based on Art. 6 (1) c) GDPR.

Ultimately, processing operations could be based on Art. 6 (1) (f) GDPR. Processing operations that are not covered by any of the aforementioned legal bases are based on this legal basis if the processing is necessary to protect a legitimate interest of our company or a third party, provided that the interests, fundamental rights and freedoms of the data subject are not overridden. Such processing operations are permitted to us in particular because they were specifically mentioned by the European legislator. In this respect, it took the view that a legitimate interest could be assumed if you are a customer of our company (recital 47 sentence 2 GDPR).

5. Contact and transmission to third parties

5.1. Contact / Contact form

When contacting us (e.g. via contact form or e-mail), personal data is collected. Which data is collected in the case of a contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of responding to your request or for contacting you and the associated technical administration. The legal basis for processing the data is our legitimate interest in responding to your request in accordance with Art. 6 (1) lit. f) GDPR. If your contact aims at the conclusion of a contract, the additional legal basis for the processing is Art. 6 (1) lit. b) GDPR. Your data will be deleted after final processing of your request, this is the case if it can be inferred from the circumstances that the matter concerned has been conclusively clarified and provided that there are no legal storage obligations to the contrary.

5.2 Data sharing

We do not transfer your personal data to third parties for purposes other than those listed below.

We will only pass on your personal data to third parties if:

• you have given your express consent in accordance with Art. 6 (1) p. 1 lit. a) GDPR (if applicable in conjunction with § 15 (3) TMG),
• the disclosure is permissible in accordance with Art. 6 (1) p. 1 lit. f) GDPR for the protection of our legitimate interests and there is no reason to assume that you have an overriding interest worthy of protection in the non-disclosure of your data,
• in the event that a legal obligation exists for the disclosure pursuant to Art. 6 (1) p. 1 lit. c) GDPR, as well as
• this is legally permissible and necessary according to Art. 6 para. 1 p. 1 lit. b) GDPR for the processing of contractual relationships with you.

We pass on collected data for processing to the respective (internal) bodies or to external service providers, order processors (e.g. hosting, shipping, handling service providers) in accordance with the required purposes (to carry out the sending of the products, advertising, communication). In order to protect your data and to allow us to transfer data to third countries (outside the EU/EEA), if necessary, we have concluded commissioned processing agreements based on the standard contractual clauses of the European Commission with commissioned processors used by us.

6. Technology

6.1 SSL/TLS encryption

Our site uses SSL or TLS encryption to ensure the security of data processing and to protect the transmission of confidential content, such as orders, login data or contact requests that you send to us as the operator. You can recognize an encrypted connection by the fact that there is a „https://“ instead of a „http://“ in the address line of the browser and by the lock symbol in your browser line. If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

6.2 Data collection when visiting the website

During the merely informational use of our website, i.e. if you do not register or otherwise transmit information to us, we only collect such data that your browser transmits to our server (in so-called „server log files“). Our website collects a series of general data and information with each call of a page by you or an automated system. This general data and information is stored in the server log files. The following can be recorded

1. browser types and versions used,
2. the operating system used by the accessing system,
3. the website from which an accessing system arrives at our website (so-called referrer),
4. the sub-websites that are accessed via an accessing system on our website,
5. the date and time of an access to the website,
6. a shortened Internet Protocol address (anonymized IP address),
7. the Internet service provider of the accessing system.

When using this general data and information, we do not draw any conclusions about your person. This information is rather required in order to

1. to deliver the contents of our website correctly,
2. to optimize the content of our website and the advertising for it,
3. to ensure the long-term operability of our IT systems and the technology of our website, and
4. to provide law enforcement authorities with the information necessary for prosecution in the event of a cyberattack.

Therefore, the data and information collected will be evaluated by us statistically, on the one hand, and, on the other hand, with the aim of increasing the data protection and data security of our enterprise so as to ultimately ensure an optimal level of protection for the personal data we process. The data of the server log files are stored separately from any personal data provided by a data subject and are automatically deleted after 7 days.

The legal basis for the data processing is Art. 6 para. 1 p. 1 lit. f) GDPR. Our legitimate interest follows from the purposes for data collection listed above.

7. Cookies

7.1 General information about cookies

We use cookies on our website. These are small files that are automatically created by your browser and stored on your IT system (laptop, tablet, smartphone or similar) when you visit our site. Cookies do not cause any damage to your end device, do not contain viruses, Trojans or other malware. In the cookie, information is stored that arises in each case in connection with the specific end device used. This does not mean, however, that we gain direct knowledge of your identity. The use of cookies serves on the one hand to make the use of our offer more pleasant for you. For example, we use so-called session cookies to recognize that you have already visited individual pages of our website. These are automatically deleted after you leave our site. In addition, we also use temporary cookies to optimize user-friendliness, which are stored on your terminal device for a certain fixed period of time. If you visit our site again to make use of our solutions, it is automatically recognized that you have already been with us and which entries and settings you have made so that you do not have to enter them again. On the other hand, we use cookies to statistically record the use of our website and to evaluate it for the purpose of optimizing our solutions for you. These cookies enable us to automatically recognize that you have already been to our site when you visit it again. These cookies are automatically deleted after a defined period of time.

Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer or so that a message always appears before a new cookie is created. However, the complete deactivation of cookies may mean that you cannot use all the functions of our website.

7.2. Instructions on how to „avoid cookies“ in all common browsers

You have the option of deleting cookies, only allowing selected cookies or completely deactivating them at any time via the settings of the browser you are using. You can find more information on the support pages of the respective providers:

Clear, enable, and manage cookies in Chrome
Manage cookies and website data in Safari on Mac
Clear cookies and site data in Firefox
Delete cookies in Microsoft Edge

7.3. Legal basis for the use of cookies

The data processed by cookies, which are required for the proper functioning of the website, are thus necessary to protect our legitimate interests as well as those of third parties in accordance with Art. 6 (1) p. 1 lit. f) GDPR. For all other cookies, it applies that you have given your consent to this via our opt-in cookie banner within the meaning of Art. 6 (1) lit. a) GDPR.

8. Web analytics

8.1 Matomo

We use the open-source software Matomo (formerly Piwik) for web analytics and statistical analysis of visits to our website. Matomo is a service provided by InnoCraft Ltd, 150 Willis St, 6011 Wellington, New Zealand, NZBN 6106769, („Matomo“). Your IP address is only recorded in shortened form (to two octets, e.g. 90.123.XXX.XXX). We thus process your personal usage data anonymously. It is not possible for us to draw conclusions about your person. The software is operated on the server of the data controller, and the log files, which are sensitive under data protection law, are stored exclusively on this server. We do not pass this data on to third parties.

Further information on the terms of use of Matomo and the data protection regulations can be found at: https://matomo.org/privacy/.

Furthermore, you have the option to object to the collection by Matomo or the use of data related to this website as well as to prevent such a collection. To do this, you must set an opt-out cookie. If your IT system is deleted, formatted or reinstalled at a later date, you must set an opt-out cookie again. With the setting of the opt-out cookie, however, there is the possibility that our website is no longer fully usable for you. Alternatively, most modern browsers have a so-called „Do Not Track“ option, with which they tell websites not to track your user activity. Matomo respects this option.

The use of Matomo is based on our legitimate interest in optimizing and further developing our website and solutions in accordance with Art. 6 (1) lit. f) GDPR.

9. Plugins and other services

9.1 2-Click Solution

Social plugins from the providers listed below are used on our websites. You can recognize the plugins by the fact that they are marked with the corresponding logo.

Information, which may also include personal data, may be sent to the service provider via these plugins and may be used by the service provider. We prevent the unconscious and unintentional collection and transmission of data to the service provider through a 2-click solution. To activate a desired social plugin, it must first be activated by clicking on the corresponding button. Only this activation of the plugin also triggers the collection of information and its transmission to the service provider. We do not collect any personal data ourselves by means of the social plugins or about their use.

We have no influence on what data an activated plugin collects and how it is used by the provider. Currently, it must be assumed that a direct connection to the services of the provider is established and that at least your IP address and device-related information is collected and used. Likewise, there is the possibility that the service providers attempt to store cookies on the computer used. Please refer to the data protection information of the respective service provider to find out which specific data is collected and how it is used.

We have integrated the social media buttons of the following companies on our website:

• Facebook Plugin
• Google+ Plugin
• Instagram Plugin
• LinkedIn Plugin

The use of social media buttons is based on Art. 6 para. 1 p. 1 lit. f GDPR. The underlying promotional purpose is to be regarded as a legitimate interest within the meaning of the GDPR.

9.2 Google reCPATCHA

We use „Google reCAPTCHA“ (hereinafter „reCAPTCHA“) on our websites. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland („Google“).

The purpose of reCAPTCHA is to verify whether the data input on our website (e.g. in a contact form) is made by a human or by an automated program. For this purpose, reCAPTCHA analyzes the behavior of the website visitor based on various characteristics. This analysis begins as soon as you click the „Load Google reCAPTCHA“ button on pages that contain a contact form. For the analysis, reCAPTCHA evaluates various information (e.g. IP address, time spent by the website visitor on the website or mouse movements made by the user). The data collected during the analysis is forwarded to Google.

The reCAPTCHA analyses run entirely in the background. You will not be notified that an analysis is taking place.

For more information about Google reCAPTCHA and Google’s privacy policy, please see the following links: https://policies.google.com/privacy?hl=de and https://www.google.com/recaptcha/about/.

The processing operations are carried out exclusively when explicit consent is given in accordance with Art. 6 Para. 1 lit. a GDPR.

9.3 Soundcloud

Our website uses services of „SoundCloud“ a platform for audio material. The provider is SoundCloud Global Limited & Co. KG, Rheinsberger Str. 76/77, 10115 Berlin in Germany. We use SoundCloud by embedding individual audio files or playlists from the platform on our website as a so-called iFrame, so that they can be played directly on our website.

When you visit a subpage of our website on which a SoundCloud iFrame is embedded, a direct connection is established between your browser and the SoundCloud server after the embedded content is activated. SoundCloud thereby receives the information that you have visited our page with your IP address. If you click the „Like Button“ or „Share Button“ while logged into your SoundCloud user account, you can link and/or share the content of our pages with your SoundCloud profile. This allows SoundCloud to associate your visit to our pages with your user account. For more information, please see SoundCloud’s privacy policy at: https://soundcloud.com/pages/privacy.

If you do not want SoundCloud to associate your visit to our pages with your SoundCloud user account, please log out of your SoundCloud user account before activating any SoundCloud plugin content.

These processing operations are carried out exclusively upon the granting of explicit consent pursuant to Art. 6 (1) lit. a GDPR.

9.4 Spotify

Our website uses services from „Spotify“ an audio streaming platform. The provider is Spotify AB, Regeringsgatan 19, 111 53 Stockholm in Sweden. We use Spotify by embedding individual audio files, albums or playlists from the platform on our website as a so-called iFrame, so that they can be played directly on our website as a stream.

When you visit a subpage of our website on which a Spotify iFrame is embedded, a direct connection is established between your browser and the Spotify server after the embedded content is activated. Spotify thereby receives the information that you have visited our site with your IP address. If you click the „Spotify button“ while logged into your SoundCloud user account, you can link the content of our pages to your Spotify profile. This allows Spotify to associate your visit to our pages with your user account. For more information, please see Spotify’s privacy policy: https://www.spotify.com/de/legal/privacy-policy/.

If you do not want Spotify to be able to associate the visit to our pages with your Spotify user account, please log out of your Spotify user account.

These processing operations are carried out exclusively upon the granting of explicit consent pursuant to Art. 6 (1) lit. a GDPR.

9.4 YouTube

Our website uses services from „YouTube“ a video platform. The provider is Google Ireland Limited („Google“), Gordon House, Barrow Street, Dublin 4 in Ireland. We use YouTube by embedding individual videos from the platform on our website as a so-called iFrame, so that they can be played directly on our website.

If you play an embedded video on a subpage of our website, a direct connection is established between your browser and the YouTube server after activation of the embedded content. YouTube thereby receives the information that you have visited our site with your IP address. If you click the „YouTube button“ while logged into your YouTube user account, you can link the content of our pages to your YouTube profile. This allows YouTube to associate your visit to our pages with your user account. For more information, please see YouTube’s privacy policy: www.google.com/intl/de-DE/policies/privacy/.

If you do not want YouTube to be able to associate the visit to our pages with your YouTube user account, please log out of your YouTube user account.

These processing operations are carried out exclusively upon the granting of explicit consent pursuant to Art. 6 (1) lit. a GDPR.

9.5 Facebook

Our website uses services of „Facebook“ a social network / exchange platform. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 in Ireland. We use Facebook by embedding individual videos and posts from the platform on our website as a so-called iFrame, so that they can be played / viewed directly on our website.

If you play an embedded video or post on a subpage of our website, a direct connection is established between your browser and the Facebook server after activation of the embedded content. Facebook thereby receives the information that you have visited our site with your IP address. If you click the „Facebook button“ while logged into your Facebook user account, you can link the content of our pages to your Facebook profile. This allows Facebook to associate your visit to our pages with your user account. For more information, please see Facebook’s privacy policy: https://www.facebook.com/privacy/policy.

If you do not want Facebook to be able to associate the visit to our pages with your Facebook user account, please log out of your Facebook user account.

These processing operations are carried out exclusively upon the granting of explicit consent pursuant to Art. 6 (1) lit. a GDPR.

9.6 Instagram

Our website uses services of „Instagram“ a(n) social network / sharing platform for images and videos. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 in Ireland. We use Instagram by embedding individual videos and posts from the platform on our website as a so-called iFrame, so that they can be played / viewed directly on our website.

If you play a video or post embedded on a subpage of our website, a direct connection is established between your browser and the Instagram server after activation of the embedded content. Instagram thereby receives the information that you have visited our site with your IP address. If you click the „Instagram button“ while logged into your Instagram user account, you can link the content of our pages to your Instagram profile. This allows Instagram to associate your visit to our pages with your user account. For more information, please see Instagram’s privacy policy: https://privacycenter.instagram.com/policy/.

If you do not want Instagram to be able to associate the visit to our pages with your Instagram user account, please log out of your Instagram user account.

These processing operations are carried out exclusively upon the granting of explicit consent pursuant to Art. 6 (1) lit. a GDPR.

9.7 PayPal

We have integrated components of PayPal on this website. PayPal is an online payment service provider. Payments are processed via so-called PayPal accounts, which represent virtual private or business accounts. In addition, PayPal offers the option of processing virtual payments via credit cards if a user does not maintain a PayPal account. A PayPal account is managed via an email address, which is why there is no classic account number. PayPal makes it possible to initiate online payments to third parties or to receive payments as well. PayPal also assumes trustee functions and offers buyer protection services.

The European operating company of PayPal is PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg.

If you choose „PayPal“ as payment option during the order process in our online store or in the context of the „Repost-Submission“, your data will be automatically transmitted to PayPal. By selecting this payment option, they consent to the transmission of personal data required for payment processing.

The personal data transmitted to PayPal are usually first name, last name, address, email address, IP address, phone number, cell phone number or other data necessary for payment processing. Also necessary for the processing of the purchase contract are such personal data that are related to the respective order.

The purpose of transmitting the data is payment processing and fraud prevention. We will transmit personal data to PayPal in particular if there is a legitimate interest for the transmission. The personal data exchanged between PayPal and us may be transmitted by PayPal to credit reporting agencies. The purpose of this transmission is to check identity and creditworthiness.

PayPal may share the personal data with affiliated companies and service providers or subcontractors to the extent necessary to fulfill contractual obligations or to process the data on behalf.

You have the option to revoke your consent to the handling of personal data at any time vis-à-vis PayPal. A revocation does not affect personal data that must be processed, used or transmitted mandatory for (contractual) payment processing.

PayPal is used in the interest of proper and smooth payment processing. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR.

The applicable data protection provisions of PayPal can be found at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

10. Your rights as a data subject

10.1 Right to confirmation

You have the right to request confirmation from us as to whether personal data concerning you is being processed.

10.2 Right to information Art. 15 GDPR

You have the right to receive from us at any time free of charge information about the personal data stored about you and a copy of this data.

10.3 Right of rectification Art. 16 GDPR

You have the right to request the rectification of inaccurate personal data concerning you. Furthermore, the data subject has the right to request the completion of incomplete personal data, taking into account the purposes of the processing.

10.4 Deletion Art. 17 GDPR

You have the right to demand that we delete the personal data concerning you without delay, provided that one of the reasons provided for by law applies and insofar as the processing is not necessary.

10.5 Restriction of processing Art. 18 GDPR

You have the right to demand that we restrict processing if one of the legal requirements is met.

10.6 Data portability Art. 20 GDPR

You have the right to receive the personal data concerning you, which has been provided to us by you, in a structured, common and machine-readable format. You also have the right to transfer this data to another controller without hindrance from us, to whom the personal data has been provided, provided that the processing is based on consent pursuant to Article 6 (1) (a) of the GDPR or Article 9 (2) (a) of the GDPR or on a contract pursuant to Article 6 (1) (b) of the GDPR and the processing is carried out with the aid of automated procedures, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

Furthermore, when exercising your right to data portability pursuant to Article 20 (1) of the GDPR, you have the right to have the personal data transferred directly from one controller to another controller, insofar as this is technically feasible and insofar as this does not adversely affect the rights and freedoms of other persons.

10.7 Objection Art. 21 GDPR You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6 (1) (e) (data processing in the public interest) or (f) (data processing on the basis of a balance of interests) of the GDPR. This also applies to profiling based on these provisions within the meaning of Art. 4 No. 4 GDPR. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the assertion, exercise or defense of legal claims. In individual cases, we process personal data to conduct direct marketing. You may object to the processing of personal data for the purpose of such advertising at any time. This also applies to profiling, insofar as it is related to such direct advertising. If you object to us processing for direct marketing purposes, we will no longer process the personal data for these purposes. In addition, you have the right, on grounds relating to your particular situation, to object to processing of personal data concerning you which is carried out by us for scientific or historical research purposes, or for statistical purposes pursuant to Article 89(1) of the GDPR, unless such processing is necessary for the performance of a task carried out in the public interest. You are free to exercise your right to object in connection with the use of information society services, notwithstanding Directive 2002/58/EC, by means of automated procedures using technical specifications.

10.8 Revocation of consent under data protection law

You have the right to revoke consent to the processing of personal data at any time with effect for the future.

10.9 Complaint to a supervisory authority

You have the right to complain to a supervisory authority responsible for data protection about our processing of personal data.

11. Our activities in social networks

So that we can also communicate with you in social networks and inform you about our services, we are represented there with our own pages.

We are not the original provider (responsible party) of these pages, but merely use them within the scope of the possibilities offered to us by the respective providers.
As a precaution, we therefore point out that your data may also be processed outside the European Union or the European Economic Area. Use may therefore pose data protection risks for you, as it may be more difficult to protect your rights, e.g. to information, deletion, objection, etc., and the processing in the social networks is often carried out directly for advertising purposes or to analyze user behavior by the providers, without this being able to be influenced by us. If usage profiles are created by the provider, cookies are often used or the usage behavior is directly assigned to your own member profile of the social networks (if you are logged in here).

The described processing operations of personal data are carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest and the legitimate interest of the respective provider in order to be able to communicate with you in a timely manner or to inform you about our services. If you have to give your consent to data processing as a user with the respective providers, the legal basis refers to Art. 6 (1) lit. a GDPR in conjunction with. Art. 7 GDPR.

Since we do not have access to the providers‘ databases, we would like to point out that it is best to assert your rights (e.g. to information, correction, deletion, etc.) directly with the respective provider. Further information on the processing of your data in the social networks and the possibility of making use of your right of objection or revocation (so-called opt-out), we have listed below at the respective provider of social networks used by us:

11.1 Facebook

Responsible for data processing in Europe:
Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
Privacy Policy (Data Policy):
https://www.facebook.com/about/privacy
Opt-out and advertising settings:
https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen

11.2 Google+ / Youtube

Responsible for data processing in Europe:
Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Privacy Policy (Data Policy):
https://policies.google.com/privacy
Opt-out and advertising settings:
https://adssettings.google.com/authenticated

11.3 Instagram

Responsible for data processing in Europe:
Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
Privacy Policy (Data Policy):
http://instagram.com/legal/privacy/
Opt-out and advertising settings:
https://www.instagram.com/accounts/privacy_and_security/

12. Duration of the storage of personal data

The criterion for the duration of storage of personal data is the respective statutory retention period. After expiry of the period, the corresponding data is routinely deleted, provided that it is no longer required for the fulfillment or initiation of the contract.

13. Actuality and modification of the privacy policy

This privacy policy is currently valid and has the status October 2022.

Due to the further development of our website and solutions or due to changes in legal or regulatory requirements, it may become necessary to amend this data protection declaration. You can access and print out the current data protection statement at any time on the website at https://deepstories.de/datenschutz/.