Privacy Policy

We are delighted to have you visit our website. Below we would like to inform you about how we process your data according to Article 13 of the General Data Protection Regulation (GDPR).

Responsible Authority

Responsible for the below-mentioned data collection and processing is the authority named in the imprint.

Storage of IP Addresses

We store the IP address provided by your web browser for up to 30 days in the interest of detecting, limiting and eliminating attacks on our web pages. In order to find the origin of such attacks, a temporary storage of the IP address is necessary. After this period of time, we delete the IP address. The legal basis is Art. 6 (1) (f) GDPR.

Usage Data

When you visit our web pages, our web servers - we use our own servers (on the premise), as well as servers from HostEurope, PlusServer and Amazon Web Services (AWS) and all server locations are in Germany - temporarily log so-called usage data for statistical purposes to improve the quality of our websites. The legal basis is Art. 6 (1) (f). This record consists of

• the page from which the file was requested,
• the name of the file,
• the date and time of the query,
• the amount of data transferred,
• the access status (file transferred, file not found),
• the description of the type of web browser used,
• the IP address of the requesting computer

Ordering Photo Products

If you place an order, we store the following data:

• the page from which the file was requested,
• the name of the file,
• the date and time of the query,
• the amount of data transferred,
• the access status (file transferred, file not found),
• the description of the type of web browser used,
• the IP address of the requesting computer
• the image files you uploaded
• other information you provide, such as your email address, name, address

When an order is placed, we store this data for 6 months. In the event of a complaint, a longer storage is possible.
We need this longer period of 6 months for any legal defense. This is within the warranty within the consumer-friendly period of § 477 BGB (German Civil Code) (based on the Directive 1999/44/EC of the European Parliament and the European Council dated May 25, 1999) and required to be able to review asserted claims.
A longer storage beyond this is possible for legally binding reasons, such as accounting reasons.
Your unabridged IP address is only stored for 90 days.

Data Transmission to Third Parties

Data Transmission to Third Parties

We transfer your data within the scope of processing an order according to Art. 28 GDPR to service providers who support us in the operation of our websites and related processes. Our service providers are strictly bound to our instructions and thus contractually obliged. We use the following service providers:
To improve and monitor our website we use the following services: emar-sys, SalesForce, Facebook Business Manager - Facebook Custom Audience List, Google - Google Customer Match List, intelliAd, Google Analytics, Google AdSense, Google Adwords, YouTube.
For marketing purposes, we work with the following marketing partners: Google Adwords, Google AdSense, Google Display Network, YouTube, Bing, Facebook, and Affiliate Networks (Awin, Flexoffers, Cross sell, Zanox, Affilinet, Webgains, Tradetracker, Daisycon, CJ Affiliate by Conservant, Belboon, Adcell) and their affiliates partners.
These marketing partners check to see if you have reached our site by clicking on a promotion. So, there is the possibility to develop targeted marketing strategies and to ensure an optimal advertising experience for you as a user.
For the sending newsletters via email and regular mail we use: Optilyz.
For hosting purposes, we use the services: Amazon Elastic Cloud Computing (EC2), Amazon Elastic Load Balancer (ELB), Amazon Relational Database Services (RDS), and Amazon Simple Storage Service (S3) from Amazon Web Services (AWS). For this the AWS Data Center in Frankfurt is used.
Incidentally, we use the services from Sovendus GmbH. Thus, in the case of an order, the following applies:
For the selection of an interesting offer of regional interest you might be interested in, we will pseudonymize, encrypt and send your salutation, year of birth, country, postal code, hash of the email address and your IP address to Sovendus GmbH, Moltkestr. 11, 76133 Karlsruhe (Sovendus) (Article 6 (1) (f) GDPR). The pseudonymized hash of the email address is also used to take account of any possible opposition to advertising by Sovendus (Art. 21 (3), Article 6 (1) (c) GDPR). The IP address is used by Sovendus solely for the purposes of data security and is usually anonymized after seven days (Art. 6 (1) (f) GDPR).
When you click on an offer, your name, address and your email address will also be sent encrypted to Sovendus in preparation for the personalized requirement of the offer by the product provider (Article 6 (1) (b) (f) GDPR).
Further information on the processing of your data by Sovendus can be found in their online privacy policy at www.sovendus.de/datenschutz.

Data Transmission to Third Countries

We sometimes transfer personal information to a third country outside the EU. In each case, we have taken care for an appropriate level of data protection:
In the case of data transmission to the USA, an appropriate level of data protection ensues from the corresponding participation of the service providers in the Privacy Shield Agreement (Art. 45 (1) GDPR).
In the case of EU countries, the EU Commission passed an appropriate data protection level according to Art. 45 (1) GDPR.

Cookies

Cookies

We use cookies on our web pages. Cookies are small text files that can be stored and read on your device. A distinction is made between session cookies, which are deleted again as soon as you close your browser, and permanent cookies that are saved after the individual session has ended. Cookies may contain data that makes it possible to recognize the device used. In some cases, cookies only contain information about certain settings that are not personally identifiable.
We use first and third party cookies on our websites as session and persistent cookies. Processing is based on Art. 6 (1)(f) GDPR and in the interest to optimize the user guidance and to customize the presentation of our website.
The following tools set cookies on our website and collect personal data. In particular, the IP address User ID:
Emarsys (as an email marketing partner, stores the data only for the duration of your visit),
Facebook Ads (for the evaluation of social media marketing projects, stores the data for a maximum of 2 years),
Twitter Connect (to connect to our social media accounts, stores the data for a maximum of 30 days), Instagram (linking to our social media accounts, stores the data until they are manually deleted), Pinterest (linking to our Social media accounts, stores the data for a maximum of 30 days), Google+ Platform (linking to our social media accounts, stores the data for a maximum of 2 years), Facebook Connect (to connect to our social media accounts, stores the data for a maximum 5 years),
Google Analytics (saves an anonymized IP address for web analysis, stores the data for a maximum of 2 years),
intelliAd (for web analysis, stores the data for a maximum of 100 days)
Olark (as a support chat tool),
Google Certified (as a tool for customer reviews, stores the data for a maximum of 2 years), Trusted Shops (as a tool for customer reviews), eKomi (as a tool for customer reviews)
Sovendus (as an advertising partner for discounts, anonymizes the data after 7 days and deletes it after 2 years),
Rocket Fuel/Sizmek (as advertising partner),
as well as first party cookies (for the functionality of the website)
You can set your browser to inform you about the placement of cookies. This way, the use of cookies becomes transparent for you. You can also delete cookies at any time via the appropriate browser setting and prevent the setting of new cookies (opt-out). Please note that in this case, our web pages may not be displayed optimally and some functions may no longer be technically available.
For details, please refer to the following statements:

Tracking Tools

Google Analytics and intelliAd

In order to design our website as required, we create pseudonymous usage profiles using Google Analytics and intelliAd. The functionality of both tools is explained using the example of Google Analytics. Google Analytics uses cookies, which can be stored on your device and read out by us. In this way, we are able to recognize and count recurring visitors as such. Data processing is based on the basis of Art. 6 (1) (f) GDPR or § 15 (3) TMG and rooted in the interest to find out how often our websites were accessed by different users.
The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. However, as we have enabled IP anonymization on this website, your IP address will previously be truncated by Google within member states of the European Union. Only in exceptional cases will the full IP address be sent to a Google server in the US (Per Google's participation in the Privacy Shield, an adequate level of data protection is provided similar to Art. 45 (1) GDPR) and only shortened there. In addition, we have entered into an order processing agreement with Google Inc. (USA) pursuant to Art. 28 GDPR. Therefore, Google may use all information only strictly earmarked to evaluate the use of our website for us and to compile reports on the website activities.
You can object to the processing at any time. In order to do so, please use one of the following options:

1. You can prevent the storage of cookies by a corresponding setting of your browser software; however, please note that if you do this, you may not be able to use all the features of this website to the fullest extent possible.
2. In addition, you may prevent Google from collecting the data generated by the cookie and related to your use of the website (including your IP address) as well as the processing of this data by downloading and installing the following browser plug-in: (http://tools.google.com/dlpage/gaoptout?hl=de)
3. To opt out of intelliAd, please click here: https://login.intelliad.com/optout.php

Retargeting

In order to provide you with advertising tailored to your interests on other Internet pages as well, we use retargeting technologies from Adobe Media Optimizer AMO in conjunction with Google, Facebook and Bing.

Retargeting Technologies

The data processing is based on Art. 6 (1) (f) GDPR. In the following, the functionality of these tools is explained using the example of Google and applies accordingly to all retargeting technologies.

When you visit our web pages, recognition features of your browser or device are retrieved, your IP address is evaluated or a re-recognition feature is saved as a small text file (e.g. so-called third-party cookies) on your end device. Your usage behavior is recorded when visiting various websites. The features are pseudonym. If you are logged in with your Google Account, these features can be assigned directly to your profile. Google may associate and store your visits to our web pages with your features to show you targeted advertising on other websites. This way, Google can also recognize your previous visit on our website. Your device and your browser will be recognized by Google, for example, if you visit a page that displays advertising on behalf of Google.

Below you will find more details about the conversion tools.

Google Conversion Tool: This website also uses the Google Conversion Tool for pseudonymous internal analysis of the performance of ads. If you reach our website from another website by clicking on one of our advertisements (text advertisements, banner ads), a cookie will be deposited in your browser program by the ad. If the banner was an advertising campaign commissioned by Google, Google will set the corresponding cookie when clicking on the banner. Neither our conversion partner, nor we can see which other internet pages you have visited. We also do not collect and receive any information that personally identifies users. The information collected through the Conversion Tracking is solely used to compile statistics on the success and use of our campaigns. These cookies lose their validity after 30 days. The legal basis for this use of cookie technology is Article 6 (1) (f) GDPR. If you do not want to participate in this analysis, you can deactivate the setting of cookies by means of a browser setting or declare your objection here: http://optout.networkadvertising.org/?c=1#!/

The information that you reach our website as an anonymous site visitor via a Picanova advertising banner is read out of your cookie and processed anonymously by us and our respective conversion partners (e.g. Google). Personal information about you will not be disclosed.

Bing Conversion Tool: This website also uses Microsoft Corporation's Bing Conversion Tracking analytics service (One Microsoft Way Redmond, WA 98052-6399) to gauge the success of other advertising promotions. In doing so, Microsoft places a cookie on your computer when you reach our website via a Pivanova ad from the Microsoft advertising network. These cookies lose their validity after 30 days and are not used for personal identification. Using Bing Conversion Tracking, we and Microsoft recognize that someone clicked on our ad within the Microsoft Network and was redirected to our site. However, we cannot see which other internet pages you have visited. The information collected through the Bing Conversion Tracking is solely used to compile statistics on the success and use of our advertising campaigns. However, we do not collect and receive any information that personally identifies users. The legal basis for this use of cookie technology is Article 6 (1) (f) GDPR.

If you do not want to participate in Bing Conversion Tracking, you can also opt out of setting a cookie - for example, via a browser setting that generally disables automatic cookies. To do this, just click the following link https://advertise.bingads.microsoft.com/en-us/resources/guidelines/optout-optimization and confirm your objection on the page. For more information about Microsoft advertising opportunities, please visit: https://advertise.bingads.microsoft.com/en-us/resources/policies/policies-for-datasafety-and-data-protection

The information that you reach our website as an anonymous site visitor via one of our advertising banners is read out of your cookie and processed anonymously by us and Microsoft. Personal information about you will not be disclosed.

Remarketing

We may label our websites with keywords that contain statements about the content of the website, such as products offered. We use Google Tag Manager, Visual Website Optimizer (VWO) and Adobe Media Optimizer (AMO), Google Adwords. The functionality is explained below using the example of Google. Google receives these keywords, which contain neither personal nor sensitive information. When you visit a page with specific keywords about products, Google stores it and associates it with your pseudonym recognition features. Google can use this link to see if and possibly which of our ads you are viewing.

Google Display Network: We also use Google's remarketing technologies on our websites. Cookies are used by us to recognize your computer on other websites that participate in the Google Display Network, based on the logged data (visit of our website including date and time, preferred language, browser type, operating system) and present you with advertisements tailored to your interests. The legal basis for this use of cookie technology is Article 6 (1) (f) GDPR. The categories that show you interest-based advertising across the entire Google Display Network with this technology can be viewed, removed, or added through Google's Ads Preferences Manager. Through this tool, you can also opt out of using cookies for interest-based advertising on the Google Display Network as a whole by downloading and installing the browser plug-in to disable the cookie for display preferences. For more information about personalized ad serving through Google, please visit https://policies.google.com/privacy?hl=de

As soon as you use the same browser program to search for other websites on the Internet whose operators have incorporated advertising space of the Google Display Network, the information from the cookie is automatically read out by this website operator and displays possibly interesting ads for you. This information is not stored by other site owners beyond this temporary anonymous evaluation.

Facebook Conversion Technology: We use “Facebook remarketing” on our websites. With the Facebook remarketing technology, users who have visited our web pages can be addressed again through targeted advertising on Facebook's internet pages. We do not collect and receive any information about which Facebook users are actually viewing targeted advertising. Identification of individual users is not possible here either. The legal basis for this use of data processing is Article 6 (1) (f) GDPR. To do this, just click the following link https://www.facebook.com/policies/cookies/ and confirm your objection on the page.

For more information on the purpose and scope of surveys and processing of your personal information by Facebook, as well as the options to protect your privacy on Facebook, see the Facebook Data Policy. You may opt-out of the Digital Advertising Alliance in the United States, the Digital Advertising Alliance of Canada in Canada, or the European Interactive Digital Advertising Alliance in Europe, or through your device settings, so you will not receive any interest-based online advertising from Facebook and other participating companies.

With the Facebook Conversion Pixel, we and Facebook can see that someone clicked on our Facebook ad and was redirected to our site. The information generated by the cookie and/or the graphics about your use of this website is transmitted to a Facebook server in the USA and stored there. Facebook uses the information obtained this way to evaluate your usage behavior regarding Facebook ads. If necessary, Facebook will also transfer this information to third parties, insofar as this is required by law or if third parties process this data on behalf of Facebook. Facebook does not link your IP address to other data stored by Facebook

Cross Device Remarketing

Google can technically link the pseudonymous features of e.g. your devices such as tablet, smartphone and email inbox (Cross Device Marketing). That is assuming that you stated in the past that you agree to this data processing with Google. This way, Google can carry out target-oriented advertising campaigns over different devices. We use this to evaluate our marketing strategies. The legal basis is Art. 6 (1) (f) GDPR.

Marketing Tools

To better adapt our website to your needs we use Visual Website Optimizer VWO, Adobe Media Optimizer AMO and Google Tag Manager, Google Attribution.
Google Tag Manager manages tags (code elements on the site) that measure traffic and visitor behavior, track the impact of online advertising and social media, use remarketing and audience targeting, and test and optimize the site.
Google Attribution offers us the opportunity to analyze the data from Google Analytics and Google Adwords bundled in one tool.
For further information see points 3 and following.

Social Media Plugins

For reasons of data protection, we do not include social plugins directly on our website. Therefore, when you visit our pages, no data will be transmitted to social media services, such as Facebook, Instagram, Twitter, XING or Google+. A profile formation by third parties is thus excluded. The integration of pages is only for forwarding to our accounts.
You still have the option to share selected pages with a click on Facebook, Twitter, Pinterest or Google+ buttons and also see how often they have been shared in the past when you view the posts.

Explanations of the Security Measures

Data Security

In order to protect your data against unwanted access as comprehensively as possible, we take technical and organizational measures. We use an encryption method on our website. Your information will be transferred from your computer to our server and vice versa over the internet via TLS encryption. You will recognize this by the fact that the lock symbol is closed in the status bar of your browser and the address bar starts with https://.

User’s Rights

Your Rights as a User

When processing your personal data, the GDPR grants you certain rights as a website user:

1. Right to Information (Article 15 GDPR):
   You have the right to ask for confirmation as to whether personal data relating to you will be processed; If this is the case, you have the right to information about the personal data and to the information listed in detail in Art. 15 GDPR.


2. Right to Rectification and Cancellation (Articles 16 and 17 GDPR):
   You have the right to immediately request the correction of incorrect personal data relating to you and, if necessary, the completion of incomplete personal data. You also have the right to demand that personal data relating to you be deleted immediately, provided one of the reasons listed in Art. 17 GDPR is met, e.g. when the data is no longer needed for the purposes pursued.


3. Right to Restriction of Processing (Art. 18 GDPR):
   You have the right to demand the restriction of processing if one of the conditions listed in Art. 18 GDPR is met, e.g. if you have objected to processing for the duration of any test.


4. Right to Data Portability (Art. 20 GDPR):
   In certain cases, which are listed in detail in Art. 20 GDPR, you have the right to receive your personal data concerning you in a structured, common and machine-readable format or to request the transmission of this data to a third party.


5. Right of Objection (Art. 21 GDPR):
   If data based on Art. 6 (1) (f) (data processing for the protection of legitimate interests) is collected, you have the right to object to the processing at any time for reasons that arise from your particular situation. We will no longer process the personal data when there are evidently compelling legitimate grounds for processing that outweigh the interests, rights and freedoms of the data subject, or the processing is for the purpose of enforcing, pursuing or defending legal claims.


6. Right of Appeal to a Supervisory Authority
   According to Art. 77 GDPR, you have the right to complain to a supervisory authority if you believe that the processing of your data violates data protection regulations. In particular, the right of appeal may be invoked by a supervisory authority in the State of your place of residence, place of work or place of alleged infringement.

Data Privacy Officer

Contact Details of the Data Privacy Officer

Our company data privacy officer is at your disposal for information or suggestions concerning data protection:

Datenschutz Süd GmbH
Wörthstraße 15
97082 Würzburg
Email: office@datenschutz-sued.de
For inquiries about data protection, in particular for the assertion of data subject rights, please contact the data protection email address stated in the imprint.

Newsletter

Newsletter

On our website, we offer you the opportunity to order our newsletter regardless of the order of photo products. For this we need and save your email address and your name. If you have given us a separate consent that we inform you by email about our own products and services, we will process them accordingly on the basis of Art. 6 (1) (a) GDPR. Your consent can be revoked at any time (e.g. via the link to unsubscribe from the newsletter, which you will find in every newsletter email), without this affecting the legality of the previous processing. If the consent is revoked, we will discontinue the appropriate data processing. Until the revocation, the data processing is lawful.
In addition, we send newsletters to our customers to the extent permitted by law. You can also object to this by clicking the link in such a newsletter email (opt-out).
We use the lettershop service Optilyz. Optilyz stores data from you for this purpose. You can find out more about the stored data at https://www.optilyz.com/de/datenschutzerklaerung .

Print Mailings

Incidentally, we use the address data provided by you when ordering for postal advertising within the legal limits. You can object to this advertising at any time.

Restricted Area

Restricted Area

If you want to create a personal login, you must first register. We collect the following data: Title, surname, first name, email address, street, zip code, city, country, telephone number (optional), password according to Art. 6 (1) (b) GDPR. Data that you submit to us as part of the registration process or your inquiries is used to create a profile for you so that you can place an order more easily. You can change or delete your profile at any time. The data will then be automatically removed from our system if there are no retention periods or if the data is not still required in individual cases (for example, in the case of outstanding claims for the collection of claims).

Online Shop

Online Shop

We store and use your personal data, which you transmit to us during the course of an order process, pursuant to Art. 6 (1) (b) GDPR exclusively for processing your orders, e-mail address, name, address, transmitted image files, IP address. In particular, we use your e-mail address for messages about the status of your order, as well as for the legally permitted newsletter distribution. You can unsubscribe at any time (see point 11). We use your image files exclusively for the execution of the order, as well as for internal marketing analysis. As a rule, your image files will be deleted after 6 months, see also section 1 Ordering Photo Products.

Offline Client

As far as an offline tool is available for download on our website, you can download it by clicking on the download button. Thus, you can personalize a photo book with your pictures offline and then order online.

Online Applications

We process your personal data in accordance with the applicable data protection regulations on the basis of § 26 BDSG (Federal Date Protection Act). We process the data you provide to us as part of your online application for the sole purpose of selecting applicants. Data processing for other purposes does not take place.
You yourself determine the scope of the data that you would like to submit to us as part of your online application. Online applications are electronically transferred to our HR department and processed there as quickly as possible. The transmission is encrypted. As a rule, applications are forwarded to the heads of the responsible specialist departments in our company. In addition, there is no disclosure of your data. Your information will be treated confidentially in our house. In case of an unsuccessful application, your documents will be deleted after 6 months.
In the event that we may also consider your application for other or future job postings, we kindly ask for a note on the application form. We then process your data on the basis of Art. 6 (1) (a) GDPR.

Facebook Company Page

We operate a Facebook page at the URL https://www.facebook.com/XXX. We do not collect, store or process personal data of our users on this page at any time. Furthermore, no other data processing is carried out or initiated by us. The data entered by you on our Facebook page, such as comments, videos or pictures, are never used or processed by us for any other purpose.
Facebook uses so-called web tracking methods on this page. Please be aware: It cannot be ruled out that Facebook uses your profile data, for example, to evaluate your habits, personal relationships, preferences, etc. We have no control over the processing of your data by Facebook. For more information, see Facebook's Privacy Policy.

Links to Other Websites

Incidentally, you will find links to other websites on our website. As soon as you have come to this website via such a link, recognizable by the changed URL, we are no longer responsible within the meaning of the GDPR.

Chats

For customer support we use the chat tool Olark.
If you use the chat tool Olark, Olark stores data. The data Olark stores are available at https://www.olark.com/privacy-policy.

Storage Duration

For more information on storage duration, see section 3. As far as there is no detailed information listed, the data is stored as soon as it is no longer required.