We take the protection of your personal data very seriously and observe the applicable data protection regulations. In the following we inform you about how we handle your data.
1. General information
service provider according to § 13 Telemediengesetz (TMG) and responsible body according to § 3 para. 7 BDSG/ Art. 4 No. 7 DS-GVO:
60325 Frankfurt am Main
data protection officer for my notarial office:
Attorney Dr. Frank Tykwer
Mrs Katharina Rux
Our data protection declaration is based on the terms used by the European legislator for directives and regulations when the Basic Data Protection Regulation (DS-GVO) was adopted. Our data protection declaration should be easy to read and understand for the public as well as for our clients and business partners. To ensure this, we would like to explain some of the particularly relevant terms used here and borrowed from the Basic Data Protection Regulation.
- Personal data
“Personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”) An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, online identification, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Processing is any operation or set of operations, performed with or without the aid of automated means, which is performed upon personal data, such as collection, recording, organisation, organisation, filing, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
- Restriction of processing
Restriction of processing is the marking of stored personal data with the aim of limiting their future processing.
Profiling is any automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects relating to the performance of work, economic situation, health, personal preferences, interests, reliability, conduct, location or change of location of that natural person.
Pseudonymisation is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the need for additional information, provided that this additional information is kept separately and is subject to technical and organisational measures which ensure that the personal data is not attributed to an identified or identifiable natural person.
- Responsible person or responsible for the processing
Responsible person or responsible for the processing is the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by European Law or national law, provision may be made for the controller or for the specific criteria for his or her designation in accordance with European Law or national law.
Processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
The recipient is any natural or legal person, public authority, agency or other body to whom personal data are disclosed, whether or not that person is a third party. However, authorities which may receive personal data in the context of a specific investigation mandate under Union or national law shall not be considered as recipients.
- Third party
Third party means any natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or the processor, are authorized to process the personal data.
Consent shall mean any freely given and informed unequivocal expression of the data subject’s wishes in the specific case, in the form of a statement or any other unequivocal affirmative act by which the data subject signifies his or her consent to the processing of personal data relating to him or her.
2. Visiting the website
Our website can generally be visited without registration.
Data such as the pages called up or the name of the file called up, date and time, are stored on the server for statistical purposes, as well as information in the server log files, which are transmitted by the browser, unless this has been deactivated by you. The latter include, for example, the IP address of the requesting computer, the http response code, the website from which you are visiting us, the time of the server request and the browser type, browser version and operating system used by the requesting computer. A person-related evaluation of the server log files does not take place. These data can never be assigned to specific persons by the provider. A consolidation of this data with other data sources is not carried out. Personal data, in particular name, address or e-mail address, is collected, as far as possible, on a voluntary basis and is only processed for the purpose for which you have made the data available to us. The legal basis for the processing of this data is Section 15 (1) of the German Telemedia Act (TMG)/Art. 7 lit. f of Directive 95/46/EC or, from 25 May 2018, Art. 6 (1) sentence 1 lit. f of the European Data Protection Basic Regulation 2016/679.
Beyond this, for example for sending advertising, we will only collect, process or use your data within the scope of the statutory provisions or with your express consent. Insofar as you give your consent electronically within the framework of our Internet offer, we will observe the legal obligations to provide information and record your consent using suitable technical systems.
In addition, the website offers the possibility to contact us. The personal data transmitted to us will be used exclusively for processing the respective inquiries. The legal basis for the processing of the data described is therefore § 28 para. 1 sentence 1 no. 1 or 2 of the Federal Data Protection Act (BDSG) or, from 25 May 2018, Article 6 para. 1 lit. b or f of the European Data Protection Basic Regulation 2016/679.
The data will not be passed on to third parties without your consent or a corresponding legal obligation. When third parties are involved in processing operations, the provisions of the BDSG / DS-GVO are complied with. The service providers are carefully selected by us and bound to data secrecy.
3. Storage duration
Personal data that has been communicated to us via our website is only stored until the purpose for which it was entrusted to us has been fulfilled. The storage period for certain data can be up to 10 years, provided that commercial and tax law retention periods must be observed. Otherwise, we ensure that your data is deleted in accordance with the BDSG / DS-GVO.
On our website we use external fonts, Google Web Fonts. This is also a service of Google Inc. mentioned under 5. The integration of these web fonts is done by a server call, usually a Google server in the USA. Through this it is transmitted to the server that you have visited our website. The IP address of the browser of the visitor’s end device is also saved by Google.
On our website we use the reCAPTCHA function of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). This function is mainly used to distinguish whether an entry is made by a natural person or whether it is abusive through automatic and automated processing. The service includes the sending of the IP address and, if applicable, other data required by Google for the reCAPTCHA service to Google and is carried out in accordance with Art. 6 para. 1 lit. f DSGVO on the basis of our legitimate interest in establishing individual responsibility on the Internet and avoiding abuse and spam. In the course of using Google reCAPTCHA, personal data may also be transmitted to the servers of Google LLC. in the USA.
In the event that personal data is transferred to Google LLC. based in the USA, Google LLC. has certified itself for the us European data protection agreement “Privacy Shield”, which guarantees compliance with the level of data protection applicable in the EU. A current certificate can be viewed here: https://www.privacyshield.gov/list
This website uses Google Maps to display interactive maps and to provide directions. Google Maps is a map service of Google Inc, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA. By using Google Maps, information about the use of this website, including your IP address and the (start) address entered in the route planner function, can be transmitted to Google in the USA. When you call up a website of our Internet presence that contains Google Maps, your browser establishes a direct connection with the Google servers. The map content is transmitted by Google directly to your browser and integrated into the website by it. We therefore have no influence on the extent of the data collected by Google in this way. According to our state of knowledge, this is at least the following data:
- Date and time of your visit to the website in question,
- Internet address or URL of the web page called up,
- IP address, (start) address entered during route planning.
We have no influence on the further processing and use of the data by Google and can therefore not take responsibility for this.
For the purpose and scope of the data collection and the further processing and use of the data by Google, as well as your rights and setting options for protecting your privacy, please refer to Google’s data protection information (https://policies.google.com/privacy?hl=de).
By using our website, you agree to the processing of the data collected about you by Google Maps Route Planner in the manner and for the purpose described above.
9. Special functions of our website and information on the contact form
Our website offers you various functions, during the use of which your personal data is collected, processed and stored by us. In the following we explain what happens with your data:
- Scope of processing of personal data:
The data you enter in our contact forms.
- Legal basis for the processing of personal data:
Art. 6 para. 1 lit.a DSGVO.
- Purpose of data processing:
We will use the data entered via our contact form or via our contact forms only for the processing of the specific contact request received via the contact form.
- Duration of storage
After processing your request, the collected data will be deleted immediately, as far as no legal retention periods exist.
- Possibility of objection and removal
The options for objection and removal are based on the general regulations on the right of objection and deletion under data protection law described in the following in this data protection declaration.
10. Deletion routine, right of information and cancellation, correction, further information
- Routine deletion and blocking of personal data
The data controller processes and stores personal data of the data subject only for the period of time necessary to achieve the purpose of storage or if provided for by the European Directives and Regulations or by any other legislator in laws or regulations to which the data controller is subject.
- Rights of the data subject
Right to confirmation
Every data subject shall have the right to obtain confirmation from the controller as to whether personal data relating to him or her are being processed. If a data subject wishes to exercise this right of confirmation, he or she may at any time contact our Data Protection Officer or any other employee of the controller.
Right to information
Any person concerned by the processing of personal data has the right to obtain at any time and free of charge from the controller information on personal data relating to him/her and a copy thereof. Furthermore, the European Directive and Regulation Giver has granted the data subject access to the following information:
- the processing purposes
- the categories of personal data processed
- the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular to recipients in third countries or international organisations
- if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration
- the existence of a right of rectification or erasure of personal data relating to him or her or of a restriction on processing by the controller or a right to object to such processing
- the existence of a right of appeal to a supervisory authority
- if the personal data are not collected from the data subject: All available information on the origin of the data
- the existence of automated decision-making, including profiling, in accordance with Article 22(1) and (4) of the DPA and, at least in these cases, meaningful information on the logic involved and the scope and intended impact of such processing on the data subject
The data subject shall also have the right to obtain information as to whether personal data have been transferred to a third country or to an international organisation. If this is the case, the data subject shall also have the right to obtain information on the appropriate safeguards relating to the transfer.
If a data subject wishes to exercise this right of access, he or she may at any time contact our Data Protection Officer or any other employee of the controller.
Right of rectification
Any person affected by the processing of personal data has the right, granted by the European legislator, to request the rectification without delay of inaccurate personal data concerning him. The data subject shall also have the right to obtain the completion of incomplete personal data, including by means of a supplementary declaration, having regard to the purposes of the processing.
If a data subject wishes to exercise this right of rectification, he or she may at any time contact our Data Protection Officer or any other employee of the controller.
Right of deletion
Any person affected by the processing of personal data has the right, granted by the European Directives and Regulations, to obtain from the controller the immediate erasure of personal data relating to him/her, if one of the following reasons applies and provided that the processing is not necessary:
- The personal data has been collected or otherwise processed for purposes for which it is no longer necessary.
- The data subject withdraws the consent on which the processing was based pursuant to Article 6(1)(a) of the DPA or Article 9(2)(a) of the DPA and there is no other legal basis for the processing.
- The data subject lodges an objection to the processing pursuant to Article 21 (1) DPA and there are no overriding legitimate reasons for the processing, or the data subject lodges an objection to the processing pursuant to Article 21 (2) DPA.
- The personal data were processed unlawfully.
- The deletion of the personal data is necessary to comply with a legal obligation under Union law or the law of the Member States to which the controller is subject.
- The personal data was collected in relation to information society services offered in accordance with Article 8 (1) of the DS-GVO.
If one of the above reasons applies and a data subject wishes to request the deletion of personal data, he or she may at any time contact our data protection officer or another employee of the data controller. The data protection officer or another employee will ensure that the request for deletion is complied with without delay.
If the personal data have been made public by us and if our company, as the controller, is obliged to delete the personal data in accordance with Art. 17 (1) DS-GVO, we will take reasonable measures, including technical measures, taking into account the available technology and the implementation costs, to inform other data controllers who process the published personal data that the data subject has requested these other data controllers to delete all links to these personal data or copies or replications of these personal data, unless the processing is necessary. Our data protection officer or another member of staff will arrange the necessary steps in individual cases.
Right to limitation of processing
Any person concerned by the processing of personal data shall have the right to obtain from the controller the restriction of the processing if one of the following conditions is met:
- The accuracy of the personal data is contested by the data subject, for a period of time that allows the controller to verify the accuracy of the personal data.
- The processing is unlawful, the data subject refuses to have the personal data deleted and instead requests that the use of the personal data be restricted.
- The controller no longer needs the personal data for the purposes of the processing, but the data subject needs them in order to assert, exercise or defend legal claims.
- The data subject has lodged an objection to the processing pursuant to Article 21 (1) of the DPA and it is not yet clear whether the legitimate reasons of the controller outweigh those of the data subject.
If one of the above conditions is met and a data subject wishes to request the restriction of personal data, he or she may at any time contact our data protection officer or another employee of the data controller. The Data Protection Officer or another employee will arrange for the restriction of the processing.
Right to data transferability
Any person affected by the processing of personal data has the right, granted by the European Directives and Regulations, to receive the personal data concerning him/her which have been made available to a controller by the data subject in a structured, common and machine-readable format. He or she also has the right to have this data communicated to another controller without hindrance by the controller to whom the personal data has been made available, provided that the processing is based on the consent pursuant to Article 6 paragraph 1 letter a DPA or Article 9 paragraph 2 letter a DPA or on a contract pursuant to Article 6 paragraph 1 letter b DPA and that the processing is carried out by means of automated procedures, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Furthermore, when exercising their right to data transfer pursuant to Art. 20 Para. 1 DPA, the data subject has the right to request that personal data be transferred directly from one controller to another controller, insofar as this is technically feasible and provided that this does not adversely affect the rights and freedoms of other persons.
In order to assert the right to data transfer, the person concerned can contact our data protection officer or another employee at any time.
Right of appeal
Any person concerned by the processing of personal data has the right to object at any time, for reasons arising from his or her particular situation, to the processing of personal data concerning him or her carried out pursuant to Article 6(1)(e) or (f) of the DSGVO This also applies to profiling based on these provisions.
In the event of an objection, we no longer process the personal data unless we can demonstrate compelling reasons for processing that are worthy of protection and outweigh the interests, rights and freedoms of the data subject, or unless the processing serves to assert, exercise or defend legal claims.
Where we process personal data for the purpose of direct marketing, the data subject shall have the right to object, at any time, to the processing of personal data for the purpose of such marketing. This also applies to profiling, insofar as it is related to such direct marketing. If the data subject objects to us processing for the purposes of direct marketing, we will no longer process the personal data for those purposes.
In addition, the data subject has the right to object, for reasons arising from his or her particular situation, to the processing of personal data concerning him or her which is carried out by us for purposes of scientific or historical research or for statistical purposes in accordance with Article 89 (1) of the DSGVO, unless such processing is necessary for the performance of a task carried out in the public interest.
To exercise the right of objection, the data subject may contact our data protection officer or another member of staff directly. The data subject is also free to exercise his or her right of objection in connection with the use of information society services, notwithstanding Directive 2002/58/EC, by means of automated procedures involving technical specifications.
Automated decisions in individual cases, including profiling
Every data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or significantly affects him or her in a similar way, except where the decision (1 ) is necessary for the conclusion or performance of a contract between the data subject and the controller, or (2) is authorised by Union or national legislation to which the controller is subject and that legislation provides for adequate measures to safeguard the rights and freedoms and legitimate interests of the data subject, or (3) is done with the explicit consent of the data subject.
Where the decision (1) is necessary for the conclusion or performance of a contract between the data subject and the controller or (2) is taken with the express consent of the data subject, appropriate measures shall be taken to safeguard the rights and freedoms and legitimate interests of the data subject, including at least the right to obtain the intervention of the controller, to put forward his point of view and to challenge the decision.
If the data subject wishes to exercise rights relating to automated decisions, he or she may at any time contact our Data Protection Officer or any other employee of the controller.
Right to withdraw consent under data protection law
Any person concerned by the processing of personal data has the right to withdraw his or her consent to the processing of personal data at any time.
If the data subject wishes to exercise his or her right to withdraw consent, he or she may at any time contact our Data Protection Officer or any other employee of the controller.
11. Data protection in applications and in the application process
The controller collects and processes the personal data of applicants for the purpose of processing the application procedure. The processing may also be carried out by electronic means. This is particularly the case if an applicant submits relevant application documents to the controller electronically, for example by e-mail or via a web form on the website. If the data controller concludes an employment contract with an applicant, the transmitted data is stored for the purpose of processing the employment relationship in accordance with the legal provisions. If the controller does not conclude an employment contract with the applicant, the application documents are automatically deleted two months after notification of the rejection decision, provided that no other legitimate interests of the controller conflict with deletion. Other legitimate interests in this sense include, for example, an obligation to provide evidence in proceedings under the General Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz, AGG).
12. Place of data processing and storage
Personal data will be processed exclusively in data centres that are located within the scope of the European Data Protection Directive 95/46/EC or (from 25 May 2018) the EU Data Protection Directive 2016/679, unless otherwise stated in this declaration.
13. Changes to this data protection declaration
Changes in the legal situation or jurisdiction as well as adjustments to our business model may make it necessary to amend this data protection declaration under certain circumstances. We therefore reserve the right to amend this data protection declaration at any time. You can request the currently valid data protection declaration from us at any time or call it up under Data Protection.