Privacy Policy

Controller

Thomas Kämmerling

Email address: info@thomaskaemmerling.de

Legal notice: Legal Notice

Overview of processing

The following overview summarises the types of data processed and the purposes of their processing, and refers to the data subjects concerned.

Types of data processed

• Master data.
• Payment data.
• Contact data.
• Contract data.
• Usage data.
• Meta, communication and process data.

Categories of data subjects

• Prospective clients.
• Users.
• Business and contractual partners.

Purposes of processing

• Provision of contractual services and fulfilment of contractual obligations.
• Communication.
• Security measures.
• Office and organisational procedures.
• Managing and responding to enquiries.
• Provision of our online offering and user-friendliness.
• Information technology infrastructure.

Relevant legal bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. Should more specific legal bases be relevant in individual cases, we will inform you of these in the privacy policy.

• Performance of a contract and pre-contractual enquiries (Art. 6 (1) sentence 1 lit. b) GDPR) - Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.
• Legal obligation (Art. 6 (1) sentence 1 lit. c) GDPR) - Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6 (1) sentence 1 lit. f) GDPR) - Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

National data protection regulations in Germany: In addition to the data protection provisions of the GDPR, national data protection regulations apply in Germany. These include, in particular, the Act on the Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act - BDSG). The BDSG contains, in particular, special provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transmission, as well as automated decision-making in individual cases, including profiling. Furthermore, the data protection laws of the individual federal states may apply.

Note on the applicability of the GDPR and the Swiss FADP: This privacy notice serves to provide information both under the Swiss Federal Act on Data Protection (Swiss FADP) and under the General Data Protection Regulation (GDPR). For this reason, please note that the terms of the GDPR are used because of their broader territorial application and comprehensibility. In particular, instead of the terms "processing" of "personal data", "overriding interest" and "particularly sensitive personal data" used in the Swiss FADP, the terms "processing" of "personal data", "legitimate interest" and "special categories of data" used in the GDPR are used. However, within the scope of application of the Swiss FADP, the legal meaning of these terms continues to be determined by the Swiss FADP.

Rights of data subjects

Rights of data subjects under the GDPR: As a data subject, you are entitled to various rights under the GDPR, arising in particular from Articles 15 to 21 GDPR:

• Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 (1) lit. e or f GDPR; this also applies to profiling based on these provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
• Right to withdraw consent: You have the right to withdraw any consent you have given at any time.
• Right of access: You have the right to obtain confirmation as to whether data concerning you is being processed, and to access this data as well as further information and a copy of the data in accordance with the statutory provisions.
• Right to rectification: In accordance with the statutory provisions, you have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.
• Right to erasure and restriction of processing: In accordance with the statutory provisions, you have the right to request that data concerning you be erased without undue delay or, alternatively, in accordance with the statutory provisions, to request a restriction of the processing of the data.
• Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format in accordance with the statutory provisions, or to request its transmission to another controller.
• Complaint to a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

Business services

We process data of our contractual and business partners, e.g. customers and prospective clients (collectively referred to as "contractual partners"), within the framework of contractual and comparable legal relationships and related measures, and with regard to communication with contractual partners (or pre-contractually), for example to answer enquiries.

We use this data to fulfil our contractual obligations. These include, in particular, the obligations to provide the agreed services, any update obligations and remedies in the event of warranty and other performance disruptions. In addition, we use the data to safeguard our rights and for the purposes of the administrative tasks associated with these obligations and of business organisation. Furthermore, we process the data on the basis of our legitimate interests in proper and economical business management as well as in security measures to protect our contractual partners and our business operations from misuse and from risks to their data, secrets, information and rights (e.g. for the involvement of telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Within the framework of applicable law, we only pass on the data of contractual partners to third parties to the extent that this is necessary for the aforementioned purposes or to fulfil legal obligations. Contractual partners are informed about further forms of processing, for example for marketing purposes, within the framework of this privacy policy.

We inform contractual partners which data is required for the aforementioned purposes before or during data collection, e.g. in online forms, by special marking (e.g. colours) or symbols (e.g. asterisks or similar), or in person.

We delete the data after the expiry of statutory warranty and comparable obligations, i.e. generally after four years, unless the data is stored in a customer account, e.g. for as long as it must be retained for statutory archiving reasons (for tax purposes, usually ten years). Data disclosed to us by the contractual partner in the course of an assignment is deleted in accordance with the requirements and generally after the end of the assignment.

• Types of data processed: Master data (e.g. full name, home address, contact information, customer number, etc.); payment data (e.g. bank details, invoices, payment history); contact data (e.g. postal and email addresses or telephone numbers). Contract data (e.g. subject matter of the contract, term, customer category).
• Data subjects: Prospective clients. Business and contractual partners.
• Purposes of processing: Provision of contractual services and fulfilment of contractual obligations; communication; office and organisational procedures. Managing and responding to enquiries.
• Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6 (1) sentence 1 lit. b) GDPR); legal obligation (Art. 6 (1) sentence 1 lit. c) GDPR). Legitimate interests (Art. 6 (1) sentence 1 lit. f) GDPR).

Provision of the online offering and web hosting

We process users' data in order to be able to provide our online services to them. For this purpose, we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or device.

• Types of data processed: Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, persons involved).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Provision of our online offering and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)). Security measures.
• Legal bases: Legitimate interests (Art. 6 (1) sentence 1 lit. f) GDPR).

Further information on processing operations, procedures and services:

• Collection of access data and log files: Access to our online offering is logged in the form of so-called "server log files". Server log files may include the address and name of the web pages and files accessed, the date and time of access, the volume of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. Server log files can be used for security purposes, e.g. to avoid overloading the servers (especially in the case of abusive attacks, so-called DDoS attacks), and to ensure the utilisation and stability of the servers; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 lit. f) GDPR). Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymised. Data whose further retention is required for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.

Changes and updates

We ask you to inform yourself regularly about the content of our privacy policy. We adapt the privacy policy as soon as changes in the data processing we carry out make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

Where we provide addresses and contact information of companies and organisations in this privacy policy, please note that addresses may change over time and please check the information before contacting them.