1) Introduction and contact details of the data controller

1.1 We are delighted that you are visiting our website and thank you for your interest. Below, we inform you about the handling of your personal data when using our website. Personal data in this context is all data with which you can be personally identified.

1.2 The data controller responsible for processing data on this website for the purposes of the General Data Protection Regulation (GDPR) is Gottfried Sandböck, Pfistershamer Str. 1, 84155 Bodenkirchen OT Binabiburg, Germany, Tel.: 08741 925 25 10, email: gottfried@sandboeck.de. The data controller responsible for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

2) Data collection when visiting our website

2.1 During the merely informational use of our website, meaning if you do not register or otherwise transmit information to us, we only collect data that your browser transmits to the page server (so-called „server log files“). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

• The website we visited
• Date and time of access
• Amount of data sent in bytes
• Referrer
• Browser used
• Operating system used
• Used IP address (if applicable: in anonymised form)

Processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. However, we reserve the right to check the server log files retrospectively if there are concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (such as orders or enquiries directed to the data controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string „https://“ and the lock symbol in your browser's address bar.

3) Making contact

When you contact us (e.g. via contact form or email), personal data is collected. Which data is collected in the case of a contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of responding to your enquiry or for contacting you and the associated technical administration.

The legal basis for processing this data is our legitimate interest in responding to your enquiry in accordance with Art. 6 (1) (f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 (1) (b) GDPR. Your data will be deleted after your enquiry has been finally processed. This is the case when it can be inferred from the circumstances that the matter in question has been definitively resolved and provided that there are no statutory retention obligations to the contrary.

4) Use of customer data for direct marketing

4.1 Sign up for our email newsletter

By signing up to our email newsletter, we will regularly send you information about our offers. The only mandatory information for sending the newsletter is your email address. Providing further data is voluntary and will be used to address you personally. We use the so-called double opt-in procedure to send the newsletter. This means that we will only send you an email newsletter once you have explicitly confirmed to us that you consent to receiving newsletters. We will then send you a confirmation email asking you to confirm by clicking on a corresponding link that you wish to receive the newsletter in future.

By clicking the confirmation link, you give us your consent to use your personal data in accordance with Art. 6 (1) (a) GDPR. When you sign up for the newsletter, we store the IP address assigned by your internet service provider (ISP) as well as the date and time of registration in order to be able to trace any potential misuse of your email address at a later date. The data collected by us when you register for the newsletter is used exclusively for the purpose of sending promotional messages via the newsletter. You can unsubscribe from the newsletter at any time via the link provided in the newsletter or by sending a corresponding message to the controller named at the beginning. Following unsubscription, your email address will be deleted from our newsletter distribution list without delay, unless you have explicitly consented to the further use of your data or we reserve the right to further data use that is legally permitted and about which we inform you in this statement.

4.2 MailPoet

Our email newsletters are sent via this provider: Aut O’Mattic A8C Ireland Ltd., Grand Canal Dock, 25 Herbert Pl, Dublin, D02 AY86, Ireland

Based on our legitimate interest in effective and user-friendly newsletter marketing, we disclose the data you provided when signing up for the newsletter to this provider in accordance with Art. 6 (1) (f) GDPR so that they can handle the dispatch of the newsletter on our behalf.

Subject to your explicit consent pursuant to Art. 6(1)(a) GDPR, the provider also conducts a statistical evaluation of the success of newsletter campaigns using web beacons or tracking pixels in the sent emails, which can measure open rates and specific interactions with the newsletter's content. In the process, device information (e.g. time of access, IP address, browser type and operating system) is also collected and evaluated, but is not merged with other data sets.

You can withdraw your consent to newsletter tracking at any time with future effect.

We have concluded a data processing agreement with the provider that protects the data of our site visitors and prohibits transfer to third parties.

5) Rights of the data subject

5.1 Under current data protection law, you are entitled to the following data subject rights (rights of access and intervention) vis-à-vis the data controller with regard to the processing of your personal data; please refer to the legal basis cited for the respective conditions for exercising these rights:

• Right of access pursuant to Art. 15 GDPR;
• Right to rectification under Article 16 of the GDPR;
• Right to erasure under Article 17 of the GDPR;
• Right to restriction of processing under Article 18 of the GDPR;
• Right to notification pursuant to Art. 19 GDPR;
• Right to data portability pursuant to Article 20 of the GDPR;
• Right to withdraw consent given in accordance with Art. 7(3) GDPR;
• Right to lodge a complaint under Article 77 of the GDPR.

5.2 RIGHT TO OBJECT

IF, IN THE CONTEXT OF A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA IN QUESTION. WE RESERVE THE RIGHT TO CONTINUE PROCESSING, HOWEVER, IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING IS NECESSARY FOR THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE AFFECTED DATA FOR DIRECT MARKETING PURPOSES.

6) Period of storage of personal data

The period for which personal data is stored is determined by the relevant legal basis, the purpose of the processing and – where applicable – the relevant statutory retention period (e.g. retention periods under commercial and tax law).

When processing personal data on the basis of explicit consent pursuant to Art. 6 (1) (a) GDPR, the data concerned will be stored until you withdraw your consent.

Where statutory retention periods apply to data processed in the context of contractual or quasi-contractual obligations on the basis of Article 6(1)(b) of the GDPR, such data shall be routinely deleted upon expiry of the retention periods, provided that it is no longer required for the performance of a contract or for entering into a contract and/or we no longer have a legitimate interest in continuing to store it.

When personal data is processed on the basis of Art. 6 (1) (f) GDPR, such data shall be stored until you exercise your right to object pursuant to Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

When personal data is processed for the purposes of direct marketing on the basis of Article 6(1)(f) of the GDPR, this data will be stored until you exercise your right to object under Article 21(2) of the GDPR.

Unless otherwise stated in the other information provided in this declaration regarding specific processing situations, stored personal data shall otherwise be erased when they are no longer necessary for the purposes for which they were collected or otherwise processed.