Data protection

I. Name and address of the controller

The controller in the context of the General Data Protection Regulation and other national data protection laws of the Member States and other data protection law provisions is:

Brookfield CEE Holding GmbH
Speersort 10
20095 Hamburg
Germany
Phone: +49 (0) 40 688 788 0
E-mail: info@cee-group.de
Website: www.cee-group.net

 

II. Name and address of the data protection officer

The controller’s data protection officer is:

Dr. Michael Foth
IBS data protection services and consulting GmbH

Zirkusweg 1
20359 Hamburg
Germany
Phone: +49 (0) 40 540 90 97 80

E-mail: datenschutz@cee-group.de
Website: https://ibs-data-protection.de

 

 

III. General information on data processing

1. Scope of the processing of personal data

We collect and use personal data on our users fundamentally only to the extent that this is necessary to provide a functioning website and our content and services. The collection and use of the personal data on our users is generally done only after consent by the user. An exception applies in cases where obtaining consent in advance is not possible on factual grounds and processing of the data is permitted by statutory provisions.

2. Legal basis for the processing of personal data

If we obtain consent from the data subject for the processing operations of personal data, Article 6 (1) (a) of the EU General Data Protection Regulation (GDPR) serves as a legal basis.

For the processing of personal data which is necessary to perform a contract to which the data subject is party, Article 6 (1) (b) GDPR serves as a legal basis. This also applies for processing operations which are necessary for the performance of pre-contractual measures.

If processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Article 6 (1) (c) GDPR serves as a legal basis.

In the case that vital interests of the data subject or another natural person make the processing of personal data necessary, then Article 6 (1) (d) GDPR serves as a legal basis.

If the processing is necessary for the protection of a legitimate interest of our company or a third party and the interests, basic rights and basic freedoms of the data subject do not override the former interest, then Article (1) (f) GDPR serves as a legal basis for the processing.

3. Deletion of data and duration of storage

The personal data of the data subject is deleted or blocked as soon as the purpose of the storage is extinguished. Storage can continue beyond this point if this is provided for by European or national legislators in EU law regulations, statutes or other provisions to which the controller is subject. Blocking or deletion of the data can also be done if a retention duty prescribed by the stated norms expires unless there is a necessity for continued storage of the data for contractual conclusion or contractual fulfilment.

 

IV. Provision of the website and creation of logfiles

1. Description and scope of the data processing

Each time our Internet page is called up, our system automatically collects data and information from the computer system of the terminal calling up the site.

The following data is collected here:

• Referrer (website visited previously)
• Requested website or file
• Browser type and browser version
• Operating system used
• Type of device used
• Time of access
• IP address in anonymised form (is only used to establish the place of access)

The data is also stored in the logfiles of our system. This data is not stored together with other personal data of the user.

2. Legal basis for the data processing

The legal basis for the temporary storage of the data and the logfiles is Article 6 (1) (f) GDPR.

3. Purpose of data processing

In 1&1 WebAnalytics data is collected exclusively for statistical evaluation and technical optimisation of web presentation.

Storage in logfiles is done to ensure the functionality of the website. In addition we use the data to optimise the website and ensure the security of our information systems. No evaluation of the data for marketing purposes is carried out in this connection.

These purposes also represent our legitimate interest in the data protection in line with Article 6 (1) (f) GDPR.

4. Duration of storage

The data is deleted as soon as it is no longer needed to achieve the purpose of its collection. If collection of the data is for provision of the website, this is the case when the relevant session is ended.

In the case of storage of data in logfiles this is the case at the latest after seven days. Storage beyond this point is possible. In this case the IP addresses of the users are deleted or distorted so that allocation to the client who accessed the website is not longer possible.

5. Possibility of objection and removal

The collection of data for provision of the website and the storage of data in logfiles is absolutely essential for operation of the website. Consequently there is no possibility of objection on the part of the user.

 

V. Use of cookies

1. Description and scope of the data processing

Our website uses cookies. Cookies are text files which are stored on the Internet browser or by the Internet browser on the computer system of the user. If a user calls up a website, a cookie can be stored on the operating system of the user. This cookie contains a characteristic sequence of characters which enables unequivocal identification of the browser when the website is visited again.

We use cookies to make our website more user friendly. Some elements of our Internet page require that the browser calling up the site can also be identified after the page is left.

The following data is stored and transmitted in the cookies:

• Language settings
• Number of page views

2. Legal basis for the data processing

The legal basis for the processing of personal data using cookies which are technically necessary is Article 6 (1) (f) GDPR.

The legal basis for the processing of personal data using cookies for analysis purposes in the case of consent from the user is Article 6 (1) (a) GDPR.

3. Purpose of data processing

The purpose of using technically necessary cookies is to facilitate use of the website for the users. Some functions of our Internet page cannot be provided without the use of cookies. For this it is necessary that the browser is recognised again even after changing to another site.

The user data collected through technically necessary cookies is not used to create user profiles.

These purposes represent our legitimate interest in the processing of personal data in accordance with Article 6 (1) (f) GDPR.

4. Duration of the storage, possibility of objection and removal

Cookies are stored on the computer of the user and transmitted from there to our website. Therefore you as user also have full control over the use of cookies. By changing the settings on your Internet browser you can deactivate or restrict the transmission of cookies. Cookies already stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website it may be that not all the functions of the website will still be fully functional.

 

VI. Newsletter

1. Description and scope of the data processing

On our Internet page it is possible to subscribe to a free newsletter. Upon registration for the newsletter the following data is transmitted to us from the input screen: e-mail address, first name, last name.

In addition the following data is collected upon registration:

• IP address of the computer calling up the site
• date and time of registration

Your consent to the processing of the data is obtained in the course of the registration process and reference is made to this Privacy Statement.

Registration for our newsletter is done by means of the double opt-in procedure. According to this an interested party submits their first name, surname and e-mail address via an input screen. Then another mail is sent to the address entered with a request to confirm the wish for future subscription to the newsletter.

No data is passed on to third parties in connection with the processing of data for sending newsletters. The data is used exclusively for sending the newsletters.

2. Legal basis for the data processing

The legal basis for the processing of data after registration for the newsletter by the user where consent is obtained is Article 6 (1) (a) GDPR.

3. Purpose of data processing

Collection of the user’s e-mail address serves delivery of the newsletter.

The collection of other personal data in the course of the registration process serves to prevent misuse of the services or of the e-mail address used.

4. Duration of storage

The data is deleted as soon as it is no longer needed to achieve the purpose of its collection. The e-mail address of the user is therefore stored for as long as the newsletter subscription is active.

The other personal data collected in the course of the registration process is generally deleted after a period of seven days.

5. Possibility of objection and removal

Subscription to the newsletter can be cancelled at any time by the relevant user. For this purpose there is a corresponding link in every newsletter.

This also enables a withdrawal of the consent to storage of the personal data collected during the registration process.

 

VII. Registration

1. Description and scope of the data processing

On our Internet page we offer users the possibility to register associated with the submission of personal data. The data is entered through an input screen, transmitted to us and stored. No data is passed on to third parties. The following data is collected in the course of the registration process:

At the time of registration the following data is also stored:

• IP address of the user
• date and time of registration

In the course of the registration process the user’s consent to processing of the data is obtained.

2. Legal basis for the data processing

The legal basis for processing of the data where consent is obtained from the user is Article 6 (1) (a) GDPR.

If the registration serves the performance of a contract to which the user is party or the implementation of pre-contractual measures, then the additional legal basis for processing the data is Article 6 (1) (b) GDPR.

3. Purpose of data processing

Registration of the user is necessary for provision of certain content and services on our website.

4. Duration of storage

The data is deleted as soon as it is no longer needed to achieve the purpose for which it was collected.

This is the case for data collected during the registration process if the registration for our website is cancelled or changed.

5. Possibility for objection and removal

As a user you have the option of cancelling the registration at any time. You can have the stored data concerning you altered at any time.

There follows is a more detailed explanation of how deletion of the account and alteration of the data is possible.

 

VIII. Contact form and e-mail contact

1. Description and scope of the data processing

On our Internet page there is a contact form which can be used for establishing electronic contact. If a user takes advantage of this option then the data entered on the input screen is transmitted to us and stored. This data is:

At the time the message is sent the following data is also stored

• IP address of the user
• date and time of registration

Your consent is obtained for the processing of data collected in the course of the sending operation and reference is made to this Privacy Statement.

Alternatively, contact can be made via the e-mail address provided. In this case the personal data of the user transmitted with the e-mail is stored.

No data is transmitted to third parties in this process. The data is used exclusively for processing the conversation.

2. Legal basis for the data processing

The legal basis for the processing of data where consent is obtained from the user is Article 6 (1) (a) GDPR.

The legal basis for the processing of data transmitted in the course of sending an e-mail is Article 6 (1) (f) GDPR. If the intention of the e-mail contact is conclusion of a contract, then the additional legal basis for the processing is Article 6 (1) (b) GDPR.

3. Purpose of data processing

The processing of the personal data from the input screen is done by us solely to deal with the contact. If contact is made by e-mail this also represents the necessary legitimate interest in processing of the data.

The other personal data processed during the sending operation serves to prevent misuse of the contact form and ensure the security of our information systems.

4. Duration of storage

The data is deleted as soon as it is no longer needed to achieve the purpose for which it was collected. For the personal data from the input screen of the contact form and that which was sent by e-mail this is the case when the relevant conversation with the user is ended. The conversation is ended when it can be assumed from the circumstances that the relevant circumstances have been finally resolved.

The additional personal data collected during the sending operation is deleted at the latest after seven days.

5. Possibility of objection and removal

The user may withdraw his consent to the processing of the personal data at any time. If the user contacts us by e-mail, he can object to the storage of his personal data at any time. In such a case the conversation cannot be continued.

There follows a description of the way in which the withdrawal of consent and objection to storage is enabled.

All personal data stored in the course of an establishment of contact is deleted in this case.

 

IX. Rights of the data subject

If personal data concerning you is processed you are a data subject within the meaning of the GDPR and you have the following rights against the controller:

1. Right to information

You can demand confirmation from the controller as to whether personal data concerning you is processed by us.

If there is such processing you can demand the following information from the controller:

1. the purpose for which the personal data is processed;
2. the categories of personal data which are processed;
3. the recipients or categories of recipients to which the personal data concerning you was disclosed or will be disclosed;
4. the planned duration of the storage of personal data concerning you or, if actual details on this are not possible, criteria for establishing the duration of storage;
5. the existence of a right to correction or deletion of the personal data concerning you, a right to restriction of processing by the controller or a right to object to this processing;
6. the existence of a right to object to a supervisory authority;
7. all available information on the origin of the data if the personal data was not collected from the data subject;
8. the existence of automated decision-making including profiling in line with Article 22 (1) and (4) GDPR and – at least in these cases – meaningful information on the logic involved and the scope and intended effects of such processing for the data subject.

You have the right to demand information as to whether the personal data concerning you is transmitted to a third country or an international organisation. In this connection you can demand to be informed of the appropriate guarantees under Article 46 GDPR in connection with the transmission.

2. Right to correction

You have the right to obtain from the controller correction and/or completion if the processed personal data concerning you is incorrect or incomplete. The controller must carry out the correction without undue delay.

3. Right to restriction of processing

Under the following conditions you can demand restriction of the processing of personal data concerning you:

1. if the accuracy of the personal data concerning you is disputed, for a period which allows the controller to check the accuracy of the personal data;
2. the processing is unlawful and you can decline deletion of the personal data and instead demand a restriction of the use of the personal data;
3. the controller no longer needs the personal data for the purpose of the processing, but you still need the data for the establishment, exercise or defence of legal claims, or
4. if you have lodged an objection to the processing in line with Article 21 (1) GDPR and it has not yet been established whether the legitimate grounds of the controller override your grounds.

If the processing of the data concerning you was restricted, this data may – apart from its storage – only be processed with your consent or processed for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural person or legal entity or on the basis of an important public interest of the Union or one of the Member States.

If the restriction of processing was restricted in line with the above-mentioned conditions you will be notified by the controller before the restriction is lifted.

4. Right to deletion

a) Duty to delete

You can demand from the controller that the personal data concerning you is deleted without undue delay and the controller is obliged to delete this data without undue delay if one of the following grounds applies:

1. The personal data concerning you is no longer needed for the purposes for which it was collected or otherwise processed.
2. You withdraw your consent upon which the processing was based in line with Article 6 (1) (a) or Article 9 (2) (a) GDPR, and there is no other legal basis for the processing.
3. You lodge an objection to the processing in line with Article 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or you lodge an objection to the processing in line with Article21 (2) GDPR.
4. The personal data concerning you was processed unlawfully.
5. The deletion of the personal data concerning you is required to fulfil a legal obligation under Union law or the law of the Member States to which the controller is subject.
6. The personal data concerning you was collected in relation to services provided by the information society in line with Article 8 (1) GDPR.

b) Information to third parties

If the controller has made personal data concerning you public and if he is obliged to delete this data in line with Article 17 (1) GDPR, then taking account of the available technology and the cost of implementation, he shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you as the data subject have demanded the deletion of all links to this personal data or copies or replications of this personal data.

c) Exceptions

There is no right to deletion if the processing is necessary

1. for the exercise of the right to freedom of expression and information;
2. to fulfil a legal obligation which requires the processing under the law of the Union or the Member States to which the controller is subject, or for performance of a task which is in the public interest or in the exercise of public authority vested in the controller;
3. for reasons of public interest in the area of public health in line with Article 9 (2) (h) and (i) and Article 9 (3) GDPR;
4. for archiving purposes which are in the public interest, in the interest of scientific or historic research or for statistical purposes in line with Article 89 (1) GDPR, provided that the right under section a) will foreseeably make realisation of the goals of this processing impossible or severely impair them, or
5. for the establishment, exercise or defence of legal claims.

5. Right to notification

If you have exercised your right to obtain from the controller the correction, deletion or restriction of the processing, then the controller is obliged to notify all recipients to whom the data concerning you was disclosed of this correction or deletion of the data or the restriction of the processing, unless this proves impossible or is associated with a disproportionate effort.

You have the right to be notified of these recipients by the controller.

6. Right to transferability of data

You have the right to receive the personal data concerning you which you have provided to the controller in a structured, commonly used and machine-readable form. In addition you have the right to transmit this data to another controller within hindrance by the controller to whom the personal data was given, provided

1. the processing is based upon consent in line with Article 6 (1) (a) GDPR or Article 9 (2) (a) GDPR or on a contract in line with Article 6 (1) (b) GDPR and
2. the processing is done by way of an automated procedure.

In the exercise of this right you also have the right for the personal data concerning you to be transmitted directly by one controller to another controller if this is technically feasible. Freedoms and the rights of other persons may not be impaired by this.

The right to transferability of data does not apply for a processing of personal data which is necessary for the performance of a task which is in the public interest or done in the exercise of public authority vested in the controller.

7. Right to object (marketing)

You have the right, for reasons arising from your specific situation, to lodge an objection at any time to the processing of personal data concerning you which is done on the basis of Article 6 (1) (e) or (f) GDPR; this also applies to profiling based on these provisions.

The controller will no longer process the personal data concerning you unless he can show compelling grounds for the processing which are worthy of protection and override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

If the personal data concerning you is processed for the purposes of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling if this is connected to such direct marketing.

If you object to processing for the purposes of direct marketing, then the personal data concerning you will no longer be processed for this purpose.

You have the possibility in connection with the use of services of the information society – notwithstanding Regulation 2002/58/EC – to exercise your right of objection by automated procedures in which technical specifications are used.

8. Right to withdraw the data protection law declaration of consent

You have the right to withdraw the data protection law declaration of consent at any time. The withdrawal of consent does not affect the legality of the processing carried out on the basis of the consent up until its withdrawal.

9. Right to complain to a supervisory authority

Regardless of an administrative or judicial legal remedy to the contrary, you have the right to complain to a supervisory authority in particular in he Member State of your place of residence, you place of employment or the place of the alleged violation of you are of the opinion that the processing of the data relating to you is in violation of the GDPR.

The supervisory authority to which the complaint was submitted the leader of the complaint informs of the status and the results of the complaint including the possibility of a judicial remedy in accordance with Article 78 GDPR.