Privacy Policy for DENIOS-Apps

The use of our application requires the processing of personal data. With the following information, we would like to give you, the "data subject", an overview of the processing of your personal data by us and your rights under the data protection laws.

The processing of personal data, for example your name, address, or e-mail address, is always carried out in accordance with the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).

By means of this data protection statement, we would like to inform you about the scope and purpose of the personal data we collect, use and process.

As the controller, we have implemented numerous technical and organisational measures to ensure the most complete protection possible for personal data processed via our application. Nevertheless, Internet-based data transmissions may always have security vulnerabilities, so that absolute protection cannot be guaranteed..

DENIOS SE
Dehmer Strasse 54-66
32549 Bad Oeynhausen

Telephone: 05731 753-0
Fax: 05731 753-199
E-Mail: info@denios.de

You may contact the data protection officer as follows:
datenschutz@denios.de

You may contact our data protection officer directly at any time with any questions or suggestions regarding data protection.

The data protection statement is based on the terms used by the European legislator for directives and regulations when the General Data Protection Regulation (GDPR) was adopted. Our data protection statement is intended to be easy to read and understand for the public as well as for our customers and business partners. In order to guarantee this, we would like to explain the terms used in advance.

We use the following terms, among others, in this data protection statement:

1. Personal data

Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more characteristics specific to the physical, physiological, genetic, psychological, economic, cultural or social identity of this natural person.

2. Data subject

The data subject is any identified or identifiable natural person whose personal data is processed by the controller (our company).

3. Processing

Processing is any operation or series of operations performed in connection with personal data, whether or not by automated methods, such as collection, recording, organisation, filing, storage, adaptation or modification, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of provision, comparison or combination, restriction, erasure or destruction.

4. Restriction of processing

Restriction of processing is the marking of stored personal data with the aim of limiting its future processing.

5. Profiling

Profiling is any form of automated processing of personal data which consists in using such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects relating to that natural persons’ performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or change of location.

6. Pseudonymisation

Pseudonymisation is the processing of personal data in such a way that the personal data can no longer be assigned to a specific data subject without the use of additional information, provided that this additional information is stored separately and is subject to technical and organisational measures which ensure that the personal data cannot be attributed to an identified or identifiable natural person.

7. Contract processor

The contract processor is a natural person or legal entity, authority, institution, or other body that processes personal data on behalf of the controller.

8. Recipient

A recipient is a natural person or legal entity, public authority, institution, or other body to which personal data is disclosed, whether or not a third party. However, public authorities that may receive personal data in the context of a specific investigative mission under Union law or the law of the member states shall not be considered as recipients.

9. Third party

A third party is a natural person or legal entity, public authority, institution, or body other than the data subject, the controller, the contract processor and the persons authorised to process the personal data under the direct responsibility of the controller or the contract processor.

10. Consent

Consent is any voluntary, informed and unambiguous declaration of intent given by the data subject for the specific case in the form of a declaration or other unequivocal affirmative action by which the data subject indicates that he consents to the processing of personal data relating to him.

This application uses SSL or TLS encryption to guarantee the security of data processing and to protect the transmission of confidential content, such as orders, login data or contact requests that you send to us as the operator.

We use this technology to protect your transmitted data.on.

Our application offers you the option of using it ten times without registration. Free registration as a user is possible at any time. Even without registration, our application collects a range of general data and information during use. The following data is recorded in the server log files:

1. Browser types and versions used,

2. The operating system used by the accessing system,

3. The features that are controlled via an accessing system in the application,

4. The date and time of access to the application,

5. An Internet protocol address (IP address),

6. The Internet service provider of the accessing system,

7. Password.

The application also records the number of times it has been used to date.

When processing this general data and information, we do not draw any conclusions about your person. Rather, this information is needed

1. To correctly deliver the contents of the application,

2. To ensure the long-term functionality of our IT systems and the technology of our website, and

3. To provide law enforcement authorities with the information necessary for prosecution in the event of a cyberattack.

4. To be able to limit the free use of the DENIOS app.

The data and information collected is analysed by us with the aim of increasing data protection and data security in our company in order to ultimately ensure an optimal level of protection for the personal data processed by us, and in order to be able to limit the free use of the DENIOS app.

The data in the server log files is stored separately from all personal data provided by a data subject.

The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest follows from the data collection purposes listed above.

The data in the server log files is stored separately from all personal data provided by a data subject and is automatically deleted after 7 days at the latest. The number of times the application has been used to date is stored for the duration of the installation of the application, but at the longest until the time of registration as a user.

After using the application ten times, you will be prompted to register by the application. However, you already have the option of registering as a user of our application before this, by providing personal data.

To register as a user, you must provide the following data:

• Salutation

• First name

• Surname

• Company name (optional)

• Postcode (optional)

• E-mail address

By registering on our website, the IP address assigned by your Internet service provider (ISP), the date and the time of registration are also stored.

The personal data you enter during registration will be processed for the following purposes:

• Sending our newsletter, provided you have given your consent to this (see point 10.1).

• Sending postal advertising, provided you do not object to postal advertising.

• For the purpose of displaying interest-based advertising, provided you have not objected to the processing of your data for this purpose.

• Offering content or services which, due to their nature, can only be offered to registered users.

The storage of the IP address assigned by your Internet service provider, the date as well as the time of registration takes place against the background that only in this way can the misuse of our services be prevented, and if necessary, this data makes it possible to resolve criminal offences that have been committed. In this respect, the storage of this data is necessary for our protection.

The processing of your data is based on the following legal grounds:

• Sending our newsletter: this processing activity is based on your consent; Art. 6, Para 1, lit. a GDPR.

• Sending postal advertising: this processing activity is based on our legitimate interest in advertising our products; Art. 6, Para. 1, lit. f GDPR.

• Display of interest-based advertising: this processing activity is based on your consent; Art. 6, Para. 1, lit. a GDPR.

• Offer of content or services for registered users is based on your consent; Art. 6 Para. 1, lit. a GDPR.

• Storage of IP address, date and time of registration: This processing activity is based on our legitimate interest in preventing the misuse of our services; Article 6, Para 1, lit. f GDPR.

We store the data you provide to us in the context of registering as a user until you request the deletion of your account.

The application offers you the opportunity to send us your feedback on its use and to contact us for advice on our products and services.

Personal data is collected when you contact us via the feedback or advice feature of the application.

In the case of the feedback feature, this is the following data:

• Surname

• Company name

• Postcode

• E-mail address

• Your message

The data collected in the case of an advice request depends on whether you decide to contact us by telephone or to use our contact form. If you contact us by telephone, the data collected is the data you provide to us.

If you use our contact form, the following data is collected:

• Company name

• First name

• Surname

• Telephone

• E-mail address

• Postcode

• Your preferred callback date

• Your message

The data provided will be stored and used exclusively for the purpose of responding to your request or for contacting you, and the associated technical administration. If you have given us your telephone number, we will regularly contact you by calling the number you provided. If you have not provided us with your telephone number, we will contact you at the e-mail address you provided.

The legal basis for processing the data in the case of the feedback feature is our legitimate interest in evaluating your suggestions, and in the case of the advice feature, the response to your request in accordance with Art. 6 Para. 1 lit. f GDPR.

If your contact in the case of the advice feature is aimed at concluding a contract, an additional legal basis for processing is Art. 6 para. 1, lit. b GDPR.

We store the data that you provide to us in the context of using the feedback feature until we evaluate your suggestion and decide whether or not to implement it. If your suggestion is implemented, this period is no longer than until the time of implementation. If your suggestion is not implemented, the data you provided will be deleted immediately after the decision not to implement it.

The data you provide when contacting us for advice purposes will be deleted after your request has been processed. This is the case when it is evident from the circumstances that the matter in question has been conclusively settled and unless there are statutory retention obligations to the contrary. These may be up to ten years from the end of the year of contact in accordance with the relevant commercial and tax regulations.

Google Analytics for Firebase (Google Inc.)

Google Analytics for Firebase or Firebase Analytics is an analysis service provided by Google Inc. Further information on Google’s use of data can be found in Google's Partner Policy. Firebase Analytics may share data with other tools provided by Firebase such as Crash Reporting, Authentication, Remote Config or Notifications. The user may review this data protection statement for a detailed explanation of the other tools used by the owner.

This application uses mobile device identifiers (including Android Advertising ID and Advertising Identifier for iOS) and cookie-like technologies to run the Google Analytics for Firebase service.

Users may opt out of certain Firebase features via the corresponding mobile device settings, such as mobile advertising settings.

Personal data collected: Cookie, Unique Device Identifier for Advertising (Google Advertising ID or IDFA, for example) and Usage Data. Processing location: United States – Data protection statement.

These processing operations are only carried out when express consent is given in accordance with Art. 6 para. 1 lit. a GDPR.

Advertising newsletter

We inform our customers and business partners about our offers at regular intervals by means of a newsletter. Our application gives them the opportunity to subscribe to our company’s newsletter. We use the following data for this purpose:

• First name

• Surname

• E-mail address

When subscribing to the newsletter, for legal reasons a confirmation e-mail will be sent to the e-mail address you entered during registration using the double opt-in procedure. This confirmation e-mail is used to check whether you, as the owner of the e-mail address, have authorised receipt of the newsletter.

When you register for the newsletter, we also store the IP address assigned by your Internet service provider (ISP) to the IT system you used at the time of registration, as well as the date and time of registration. The collection of this data is necessary in order to be able to trace the (possible) misuse of your e-mail address at a later date, and therefore serves for our legal protection.

The consent to the storage of personal data that you have given us for sending the newsletter may be revoked at any time. There is a corresponding link in every newsletter for the purpose of withdrawing consent. You may also cancel your revocation by sending a corresponding message to the controller named at the beginning and via the data protection menu of the application.

Your e-mail address will be deleted if you revoke your consent, unless we have reserved the right to use the data for other purposes permissible under the data protection law, and about which we inform you in this data protection statement.

The legal basis for data processing for the purpose of sending the newsletter is Art. 6 Para. 1 lit. a GDPR.

We use different service providers to provide the application and the associated services, as well as for advertising purposes and to optimise the design of our application and our offer. We transmit your personal data to these service providers to the extent necessary in each case.

In addition to DENIOS SE, the recipients of your personal data are therefore the following within the scope of the purposes stated in this data protection statement:

• DENIOS Direct GmbH for the coordination and implementation of direct marketing measures and for assessing the success of these measures

• Hosting service providers (e. g. Amazon Web Services, SAP) for the technical provision of the application

• Support service providers (e. g. Sitegeist mediasolutions GmbH) for the elimination of malfunctions

• Tool service providers (e. g. EpiServer AB) for the purpose of sending the newsletter, as well as tracking opening and clicks on any links contained therein

• Tool service providers (e. g. Auth0)) for registration and user management

• Postal service providers (e. g. Deutsche Post AG, Citipost) for the purpose of delivering printed advertising.

• Tool service providers for analyses (Google Inc.)

If necessary, we share personal data with law enforcement authorities, courts and government agencies and authorised third parties if this is required for the purposes of law enforcement, the assertion, exercise or defence of our legal claims and / or authorised third parties.

We do not intend to transfer personal data to third countries.

The protection of your personal data is very important to DENIOS SE and its partners. Should you wish to assert your rights as a data subject, please contact us using the contact details of DENIOS SE or the Data Protection Officer.

12.1 Right to confirmation

You have the right to request confirmation from us as to whether personal data relating to you is being processed.

12.2 Right to information Art. 15 GDPR

You have the right to obtain from us, at any time and free of charge, information on the personal data stored about you as well as a copy of this data in accordance with the statutory provisions.

12.3 Right to correction Art. 16 GDPR

You have the right to request the correction of incorrect personal data concerning you. You also have the right, taking into account the purposes of the processing, to request the completion of incomplete personal data.

12.4 Deletion Art. 17 GDPR

You have the right to request that we delete the personal data concerning you immediately, as long as one of the reasons provided for by law applies and that processing or storage is not required.

12.5 Restriction of processing Art. 18 GDPR

You have the right to request that we restrict processing if one of the legal requirements applies.

12.6 Data portability Art. 20 GDPR

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, common and machine-readable format. You also have the right to transfer this data to another controller without hindrance from us, to whom the personal data has been provided, as long as the processing is based on consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR, and the processing is carried out using automated procedures, unless the processing is necessary for the performance of a task carried out in the public interest or takes place in the exercise of official authority vested in us.

Furthermore, when exercising your right to data portability pursuant to Art. 20 para. 1 GDPR, you have the right to have the personal data transmitted directly from one controller to another controller, in so far as this is technically feasible and in so far as this does not adversely affect the rights and freedoms of other persons.

12.7 Objection Art. 21 GDPR

You have the right to object at any time to the processing of personal data concerning you, which is carried out by virtue of Art. 6 para. sentence .1 lit. e (data processing in the public interest) or f (data processing based on a weighing of interests) GDPR.

If you object to us processing your data for direct advertising purposes, we will no longer process the personal data for these purposes. This also applies to profiling, in so far as it is connected with such direct advertising. You have the option to object at any time to the processing of your data for direct advertising purposes as well as interest-based advertising.

If you object to processing activities outside direct advertising, we will no longer process your personal data unless we can demonstrate compelling legitimate reasons for the processing that outweigh your interests, rights and freedoms, or the processing serves for the assertion, exercise or defence of legal claims.

12.8 Revocation of consent under data protection law

You have the right to revoke your consent to the processing of personal data at any time with effect for the future.

12.9 Complaint to a supervisory authority

You have the right to complain about our processing of personal data to a supervisory authority responsible for data protection.

This data protection statement is currently valid and has the status: April 2021.

Due to the further development of our application or due to changed legal or regulatory requirements, it may become necessary to amend this data protection statement. We therefore reserve the right to make changes at any time in compliance with the applicable data protection regulations.