Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. This includes, above all, information that makes it possible to draw conclusions about your identity, such as your name, telephone number, address or e-mail address. Statistical data that we may collect, for example, when you visit our website and that cannot be associated with your person, is not covered by the term personal data.
II. Responsible Person
The person responsible within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states as well as other data protection regulations is:
Aufgang C, 1. Etage links
Managing Director: Dr. Robin P. G. Tech
III. Types of data processed
We may process the following types of data from visitors of websites, users and clients of the online offer or applicants:
Inventory data (e.g., names, addresses),
Contact details (e.g., email, telephone numbers),
Content data (e.g., text input, photographs, videos),
Usage data (e.g., visited websites, interest in content, access times),
Meta/communication data (e.g., device information, IP addresses).
IV. Purpose of processing and applicable legal bases
Notwithstanding any other provisions in this Data Protection and Cookies Policy, we process personal data for the following purposes:
- Provision of the online offers, its functions and contents;
- Answering contact requests and communication with visitors, users, clients or applicants;
- Adopting security measures;
- Conducting marketing;
- Execution of order processing in the online shop;
- Provision of payment services;
- Administrative, financial accounting, and office organization;
- Contacting and contact management;
- Sending newsletters;
- Hosting and collection of access data and log files;
- Carrying out an application procedure.
In accordance with Art. 13 GDPR, we inform you of the legal basis of our data processing. If the legal basis is not explicitly mentioned in this Data Protection Policy, the following applies: The legal basis for obtaining consents is Art. 6(1)(a) and Art. 7 GDPR, the legal basis for processing for the performance of our services and performance of contractual measures as well as for answering inquiries is Art. 6(1)(b) GDPR, the legal basis for processing to fulfil our legal obligations is Art. 6(1)(c) GDPR, and the legal basis for processing to protect our legitimate interests is Art. 6(1)(f) GDPR. In the event that the vital interests of the data subject or another natural person require the processing of personal data, Article 6(1)(d) DSGVO serves as the legal basis.
A. Business related data processing
Additionally we may process
- contract data (for example, contract object, term, customer category) and
- payment data (e.g., bank details, payment history)
from our customers, interested parties and business partners for the purpose of providing contractual services, service and customer care, marketing, advertising and market research.
B. Order processing in the online shop and client account
We process the data of our clients in the context of the order processes in our online shop to enable them to select and order the selected products and services, as well as their payment and delivery, or execution.
The processed data includes inventory data, communication data, contract data, payment data and the persons affected by the processing include our customers, interested parties and other business partners. The processing takes place for the purpose of providing contractual services in the context of operating an online shop, billing, delivery and customer services. We use session cookies for storing the contents of the shopping cart and permanent cookies for storing the login status.
Processing is carried out on the basis of Art. 6 (1)(b) (execution of order processes) and Art. 6(1)(c) (legally required archiving) GDPR. The information marked as necessary is required to establish and perform the contract. We disclose the data to third parties only within the framework of delivery, payment or within the framework of legal permits and obligations to legal advisors and authorities. The data will only be processed in third countries if this is necessary for the performance of the contract (e.g. at the client’s request upon delivery or payment).
Users can optionally create a user account, in particular by viewing their orders. During the registration process, the required information will be communicated to the users. The user accounts are not public and cannot be indexed by search engines. If users have terminated their user account, their data will be deleted with regard to the user account, subject to its storage is necessary for commercial or tax reasons according to Art. 6(1)(b) GDPR. Data in the customer account are stored up to its deletion with subsequent archiving in the case of a legal obligation. It is up to the users to save their data before the end of the contract if they have given notice of termination.
When registering, re-registering, and using our online services, we may store the IP address and the time of the respective user action. The data are stored on the basis of our legitimate interests as well as the user’s protection against misuse and other unauthorized use. A passing on of this data to third parties does not take place in principle, unless it is necessary for the pursuit of our claims or there is a legal obligation according to Art. 6(1)(c) GDPR.
The deletion takes place after the expiry of statutory warranty and comparable obligations, the necessity of data storage is reviewed every three years; in the case of statutory archiving obligations, the deletion takes place after their expiry (end of commercial law (6 years) and tax law (10 years) storage obligation).
We use your personal information process payments, and communicate with you about orders, products, services, and promotional offers. We employ external payment service providers on the basis of our legitimate interests in accordance with Art. 6(1)(f) DSGVO to provide our users with effective and secure payment options. The data processed by the payment service providers includes inventory data such as name and address, bank data such as account numbers or credit card numbers, passwords, TANs, and checksums as well as contract, totals, and recipient information. This information is required to execute the transactions. However, the data entered will only be processed and stored by the payment service providers. This means that we do not receive any account or credit card related information, but only confirmation or negative information about the payment. The data may be transferred by the payment service providers to credit agencies. The purpose of this transmission is to verify identity and creditworthiness. We refer to the terms and conditions and data protection information of the payment service providers. For payment transactions, the terms and conditions and the data protection information of the respective payment service providers, which can be accessed within the respective websites or transaction applications, apply. We refer to these also for the purpose of further information and assertion of rights of revocation, information and other interested parties.
D. Administration, financial accounting, office organization, contact management
We process data within the framework of administrative tasks as well as the organisation of our company, financial accounting and compliance with legal obligations, e.g. archiving. We process the same data that we process in the course of providing our contractual services. The respective legal bases for data processing are Art. 6(1)(c) GDPR, Art. 6(1)(f) GDPR. Customers, interested parties, business partners and website users are affected by the processing. The purpose and our interest in the processing lies in the administration, financial accounting, office organization, archiving of data, thus tasks which serve the maintenance of our business activities, perception of our tasks and provision of our services. The deletion of the data with regard to contractual services and contractual communication corresponds to the information provided in these processing activities.
We disclose or transmit data to the tax authorities, consultants, such as tax consultants or auditors, as well as other fee offices and payment service providers.
Furthermore, we store information on suppliers, event organisers and other business partners on the basis of our business interests, e.g. for the purpose of making contact at a later date. We store this data, which is mainly company-related, permanently.
E. Business analyses and market research
In order to operate our business economically and to identify market trends, customer and user requirements, we analyse the data available to us on business transactions, contracts, enquiries, etc., in order to ensure that we are able to offer our clients the best possible service. We process inventory data, communication data, contract data, payment data, usage data, metadata on the basis of Art. 6(1)(f) GDPR, whereby the persons concerned include clients, interested parties, business partners, visitors, and users of the online offer. The analyses are carried out for the purpose of economic evaluations, marketing and market research. We can take into account the profiles of registered users with information, e.g. on the services they have used. The analyses serve us to increase the user-friendliness, the optimization of our offer and the economic efficiency. The analyses serve us alone and are not disclosed externally, unless they are anonymous analyses with aggregated values. If these analyses or profiles are personal, they will be deleted or made anonymous upon termination of the user, otherwise after two years from the conclusion of the contract. For the rest, macroeconomic analyses and general trend determinations are conducted anonymously wherever possible.
When contacting us (e.g. via contact form, e-mail, telephone or social media), the contacting person’s details are processed for processing the contact enquiry and its processing in accordance with Art. 6(1)(b) GDPR. User information can be stored in a customer relationship management system (“CRM system”) or comparable request organization. We delete the requests if they are no longer necessary. We review this requirement every two years; the statutory archiving obligations also apply.
With the following information we inform you about the contents of our newsletter as well as the registration, dispatch and statistical evaluation procedure and your rights to object. By subscribing to our newsletter you agree to the receipt and the described procedures. Content of the newsletter: We send newsletters, e-mails and other electronic notifications containing advertising information (hereinafter “newsletters”) only with the consent of the recipients or a legal permission. If the contents of a newsletter are specifically described within the scope of a registration, they are decisive for the consent of the users. In addition, our newsletters contain information about our services and us. Double opt-in and logging: Subscription to our newsletter takes place in a so-called double opt-in procedure. This means that after registration you will receive an email asking you to confirm your registration. This confirmation is necessary so that no one can log in with other email addresses. Subscriptions to the newsletter are logged in order to be able to prove the registration process in accordance with legal requirements. This includes the storage of the login and confirmation time, as well as the IP address. The changes to your data stored with the shipping service provider are also logged. Credentials: To subscribe to the newsletter, simply enter your e-mail address. Optionally, we ask you to enter a name in the newsletter in order to be addressed by us personally. The dispatch of the newsletter and the performance measurement associated with it is based on the recipient’s consent pursuant to Art. 6(1)(a), Art. 7 GDPR in conjunction with Section 7 para. 2 no. 3 German Act Against Unfair Competition or on the basis of the legal permission pursuant to Section 7 para. 3 German Act Against Unfair Competition.
The registration procedure is recorded on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR. We are interested in the use of a user-friendly and secure newsletter system that serves both our business interests and the expectations of users and also allows us to provide proof of consent. Cancellation/Revocation: You can cancel the newsletter service at any time, i.e. revoke your consent. You will find a link to cancel the newsletter at the end of each newsletter. We may store the email addresses of users that have unsubscribed for up to three years on the basis of our legitimate interests before we delete them in order to be able to prove a previously given consent. The processing of these data is limited to the purpose of a possible defence against claims. An individual application for cancellation is possible at any time, provided that at the same time the former existence of a consent is confirmed.
The hosting services we use provide: infrastructure and platform services, computing capacity, storage space and database services, security services, and technical maintenance services that we use for the purpose of operating this online offering. We, or our hosting provider, process inventory data, contact data, content data, contract data, usage data, meta- and communication data of customers, interested parties, and visitors of this online offer on the basis of our legitimate interests in an efficient and secure provision of this online service and offer according to Art. 6(1)(f) GDPR in conjunction with. Art. 28 GDPR (conclusion of order processing contract).
I. Collection of access data and log files
We, or our hosting provider, collect the following data on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR data on each access to the server on which this service is located (so-called server log files). Access data includes the name of the accessed website, file, date and time of access, transferred data volume, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page), IP address and the requesting provider. Log file data will be stored for security reasons (e.g., to investigate misuse or fraud) and deleted after a reasonable time, typically within 8 weeks. Data needed for security incident handling are excluded from deletion until the respective incident has been finally clarified.
J. Job Applications
If you apply for an open position or send us an unsolicited application we may process, among other things:
- Birth data
- Contact details
- Application documents (CV, certificates, letter of motivation, etc.)
- Will to get informed in future
The legal basis for the processing of data in the context of job applications is Art. 6(1)(b) GDPR. The purpose of data processing is the electronic submission and examination of applications, application documents, and, if applicable, to inform applicants in future about job opportunities. If the application is for employment within the scope of a project, the data will be deleted three months after the end of the project if the application is rejected, and six months after the end of the application procedure if the application is not project-related. Upon request, we will delete the stored data before the end of the storage period, provided there is no longer storage due to commercial, tax or social security law storage obligations. In the event of employment, the application documents will be deleted three years after termination of employment, provided that there is no longer retention due to commercial, tax or social security retention obligations.
V. Data security
We have implemented appropriate technical and organisational controls to protect your personal data against unauthorised processing and against accidental loss, damage, or destruction. You are responsible for choosing a secure password when we ask you to set up a password to access parts of our sites or apps. You should keep this password confidential and you should choose a password that you do not use on any other site. You should not share your password with anyone else, including anyone who works for us. Unfortunately, sending information via the internet is not completely secure. Although we will do our best to protect your personal data once with us, we cannot guarantee the security of any personal data sent to our site while still in transit and so you provide it at your own risk.
VI. Cooperation with processors and third parties
If we disclose data to other persons and companies (contract processors or third parties) within the scope of our processing, transmit it to them or otherwise grant them access to the data, this shall only take place on the basis of a legal permission (e.g. if a transmission of the data to third parties, such as payment service providers, in accordance with Art. 6(1)(b) GDPR for contract performance is necessary), if you have consented, if a legal obligation provides for this or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.). If we commission third parties with the processing of data on the basis of a so-called “data processing agreement”, this is done on the basis of Art. 28 GDPR.
VII. Transfers of personal data to third countries
If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this occurs in the context of the use of third-party services or disclosure or transfer of data to third parties, this only takes place if it occurs for the performance of our (pre)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or leave the data in a third country only if the special requirements of Art. 44 et seq. GDPR. This means, for example, processing is carried out on the basis of special guarantees, such as the officially recognised determination of a data protection level corresponding to the EU (e.g. for the USA by the “Privacy Shield”) or compliance with officially recognised special contractual obligations (so-called “standard contractual clauses”).
If you decide to pay with the online payment service PayPal, your personal data will be transmitted to PayPal. The PayPal service is offered by PayPal (Europe) S.à.r.l. & Cie . S.C.A., 22 – 24 Boulevard Royal, L – 2449 Luxembourg. In the context of payment, the following personal data will usually be processed in accordance with Article 6(1.)(b) GDPR for the performance of the contract: First and last name, gender, address, start and destination coordinates of your ride, country, language, email address, mobile phone number, credit card holder’s first and last name, credit card issuer, first six and last four digits of the credit card number, credit card’s expiry date, the email address of your PayPal account if applicable, information about your terminal equipment (device ID, etc.), or other data required for order processing. The transfer of data is necessary to process your order using the payment method you have selected, in particular to confirm your identity, to administer your payment and the customer relationship. Please note, however, that PayPal may also pass on personal data to service providers, subcontractors or other affiliated companies if this is necessary to fulfil the contractual obligations arising from your order or if the personal data is to be processed on behalf of PayPal. Depending on the payment method selected via PayPal, e.g., invoice or direct debit, the personal data transmitted to PayPal is transmitted by PayPal to credit agencies. This transfer serves to verify your identity and creditworthiness with regard to the order you have placed. You can find out which credit agencies are involved and which data are generally collected, processed, stored and passed on by PayPal in the PayPal data protection declaration at https://www.paypal.com/ie/webapps/mpp/ua/privacy-full?locale.x=en_IE.
E. Google G Suite
All websites are hosted at our hosting provider One.com. You can contact the european representative of One.com at European representative One.com, A/S Kalvebod Brygge 24, 1560 Copenhagen V, Denmark or via email at email@example.com. You can access the Data Processor Agreement at https://www.one.com/static/info/data-processing-agreement-en.pdf and the One.com Privacy Notice at https://www.one.com/static/info-privacy-notice.do#DATACONTROL.
VIII. Rights of data subjects
You have the right to request confirmation as to whether the data concerned are being processed and to request information about these data as well as further information and a copy of the data in accordance with Art. 15 GDPR. In accordance with Art. 16 GDPR, you have the right to request the completion of data concerning you or the correction of incorrect data concerning you. In accordance with Art. 17 GDPR, you have the right to demand that relevant data be deleted immediately or, alternatively, to demand a restriction on the processing of the data in accordance with Art. 18 GDPR. You have the right to request that the data concerning you that you have provided to us be received in accordance with Art. 20 GDPR and to request its transmission to other persons responsible. In accordance with Art. 77 GDPR, they also have the right to file a complaint with the competent supervisory authority. The “Berlin Commissioner for Data Protection and Freedom of Information” (https://www.datenschutz-berlin.de/kontakt.html) is responsible for this.
A. Right to withdraw consent
You have the right to withdraw your consent pursuant to Art. 7(3) GDPR at any time with future effect. The withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
B. Right to object
You can object to the future processing of the data concerning you in accordance with Art. 21 GDPR at any time. You may object in particular against processing for direct marketing purposes.
C. Cookies and right to object to processing related to direct marketing
D. Erasure of personal data
The data processed by us will be deleted or their processing restricted in accordance with Articles 17 and 18 GDPR. Unless expressly stated in this Data Protection and Cookies Policy, the data stored by us will be deleted as soon as it is no longer required for its intended purpose and the deletion does not conflict with any statutory storage obligations. If the data are not deleted because they are necessary for other and legally permissible purposes, their processing is restricted. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax reasons. According to legal requirements in Germany, the storage is carried out in particular for 10 years in accordance with Section 147 para. 1 AO, Section 257 para. 1 no. 1 and 4, para. 4 HGB (books, records, management reports, accounting documents, trading books, documents relevant for taxation, etc.) and 6 years in accordance with Section 257 para. 1 no. 2 and 3, para. 4 HGB (commercial letters).
E. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with any supervisory authority if you believe that the processing of data relating to you is illegal. The data protection supervisory authority responsible for AtomLeap is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstr. 219, 10969 Berlin, Germany; email: firstname.lastname@example.org.
IX. Changes to this policy
Last updated: November 2018