Privacy Policy

Privacy Policy

We are very deligh­ted that you have shown inte­rest in our enter­prise. Data protec­tion is of a parti­cu­larly high prio­rity for Chris­tiane Mahler-Scharf & Birgit de Fries GbR.

The use of the Inter­net pages of Chris­tiane Mahler-Scharf & Birgit de Fries GbR is possi­ble without any indi­ca­tion of perso­nal data; howe­ver, if a data subject wants to use special enter­prise services via our website, proces­sing of perso­nal data could become neces­sary. If the proces­sing of perso­nal data is neces­sary and there is no statu­tory basis for such proces­sing, we gene­rally obtain consent from the data subject.

The proces­sing of perso­nal data, such as the name, address, e‑mail address, or tele­phone number of a data subject shall always be in line with the Gene­ral Data Protec­tion Regu­la­tion (GDPR), and in accordance with the coun­try-speci­fic data protec­tion regu­la­ti­ons appli­ca­ble to Chris­tiane Mahler-Scharf & Birgit de Fries GbR. By means of this data protec­tion decla­ra­tion, our enter­prise would like to inform the gene­ral public of the nature, scope, and purpose of the perso­nal data we coll­ect, use and process. Further­more, data subjects are infor­med, by means of this data protec­tion decla­ra­tion, of the rights to which they are entitled.

As the control­ler, Chris­tiane Mahler-Scharf has imple­men­ted nume­rous tech­ni­cal and orga­niza­tio­nal measu­res to ensure the most complete protec­tion of perso­nal data proces­sed through this website. Howe­ver, Inter­net-based data trans­mis­si­ons may in prin­ci­ple have secu­rity gaps, so abso­lute protec­tion may not be guaran­teed. For this reason, every data subject is free to trans­fer perso­nal data to us via alter­na­tive means, e.g. by telephone.

1. Definitions

The data protec­tion decla­ra­tion of Chris­tiane Mahler-Scharf & Birgit de Fries GbR is based on the terms used by the Euro­pean legis­la­tor for the adop­tion of the Gene­ral Data Protec­tion Regu­la­tion (GDPR). Our data protec­tion decla­ra­tion should be legi­ble and under­stan­da­ble for the gene­ral public, as well as our custo­mers and busi­ness part­ners. To ensure this, we would like to first explain the termi­no­logy used.

In this data protec­tion decla­ra­tion, we use, inter alia, the follo­wing terms:

• a) Personal data

  Perso­nal data means any infor­ma­tion rela­ting to an iden­ti­fied or iden­ti­fia­ble natu­ral person (“data subject”). An iden­ti­fia­ble natu­ral person is one who can be iden­ti­fied, directly or indi­rectly, in parti­cu­lar by refe­rence to an iden­ti­fier such as a name, an iden­ti­fi­ca­tion number, loca­tion data, an online iden­ti­fier or to one or more factors speci­fic to the physi­cal, physio­lo­gi­cal, gene­tic, mental, econo­mic, cultu­ral or social iden­tity of that natu­ral person.

• b) Data subject

  Data subject is any iden­ti­fied or iden­ti­fia­ble natu­ral person, whose perso­nal data is proces­sed by the control­ler respon­si­ble for the processing.

• c) Processing

  Proces­sing is any opera­tion or set of opera­ti­ons which is perfor­med on perso­nal data or on sets of perso­nal data, whether or not by auto­ma­ted means, such as coll­ec­tion, recor­ding, orga­ni­sa­tion, struc­tu­ring, storage, adapt­a­tion or altera­tion, retrie­val, consul­ta­tion, use, disclo­sure by trans­mis­sion, disse­mi­na­tion or other­wise making available, alignment or combi­na­tion, rest­ric­tion, erasure or destruction.

• d) Restriction of processing

  Rest­ric­tion of proces­sing is the marking of stored perso­nal data with the aim of limi­ting their proces­sing in the future.

• e) Profiling

  Profil­ing means any form of auto­ma­ted proces­sing of perso­nal data consis­ting of the use of perso­nal data to evaluate certain perso­nal aspects rela­ting to a natu­ral person, in parti­cu­lar to analyse or predict aspects concer­ning that natu­ral person’s perfor­mance at work, econo­mic situa­tion, health, perso­nal prefe­ren­ces, inte­rests, relia­bi­lity, beha­viour, loca­tion or movements.

• f) Pseudonymisation

  Pseud­ony­mi­sa­tion is the proces­sing of perso­nal data in such a manner that the perso­nal data can no longer be attri­bu­ted to a speci­fic data subject without the use of addi­tio­nal infor­ma­tion, provi­ded that such addi­tio­nal infor­ma­tion is kept sepa­ra­tely and is subject to tech­ni­cal and orga­ni­sa­tio­nal measu­res to ensure that the perso­nal data are not attri­bu­ted to an iden­ti­fied or iden­ti­fia­ble natu­ral person.

• g) Controller or controller responsible for the processing

  Control­ler or control­ler respon­si­ble for the proces­sing is the natu­ral or legal person, public autho­rity, agency or other body which, alone or jointly with others, deter­mi­nes the purpo­ses and means of the proces­sing of perso­nal data; where the purpo­ses and means of such proces­sing are deter­mi­ned by Union or Member State law, the control­ler or the speci­fic crite­ria for its nomi­na­tion may be provi­ded for by Union or Member State law.

• h) Processor

  Proces­sor is a natu­ral or legal person, public autho­rity, agency or other body which proces­ses perso­nal data on behalf of the controller.

• i) Recipient

  Reci­pi­ent is a natu­ral or legal person, public autho­rity, agency or another body, to which the perso­nal data are disc­lo­sed, whether a third party or not. Howe­ver, public autho­ri­ties which may receive perso­nal data in the frame­work of a parti­cu­lar inquiry in accordance with Union or Member State law shall not be regarded as reci­pi­ents; the proces­sing of those data by those public autho­ri­ties shall be in compli­ance with the appli­ca­ble data protec­tion rules accor­ding to the purpo­ses of the processing.

• j) Third party

  Third party is a natu­ral or legal person, public autho­rity, agency or body other than the data subject, control­ler, proces­sor and persons who, under the direct autho­rity of the control­ler or proces­sor, are autho­ri­sed to process perso­nal data.

• k) Consent

  Consent of the data subject is any freely given, speci­fic, infor­med and unam­bi­guous indi­ca­tion of the data subjec­t’s wishes by which he or she, by a state­ment or by a clear affir­ma­tive action, signi­fies agree­ment to the proces­sing of perso­nal data rela­ting to him or her.

2. Name and Address of the controller

Control­ler for the purpo­ses of the Gene­ral Data Protec­tion Regu­la­tion (GDPR), other data protec­tion laws appli­ca­ble in Member states of the Euro­pean Union and other provi­si­ons rela­ted to data protec­tion is:

Chris­tiane Mahler-Scharf
Bahn­hof­straße 17
82327 Tutz­ing on Lake Starn­berg / Germany
Phone +49 8158 907 36 37 
c.mahler-scharf@n4yk.com

3. Cookies

The Inter­net pages of Chris­tiane Mahler-Scharf & Birgit de Fries GbR use cookies. Cookies are text files that are stored in a compu­ter system via an Inter­net browser.

Many Inter­net sites and servers use cookies. Many cookies contain a so-called cookie ID. A cookie ID is a unique iden­ti­fier of the cookie. It consists of a charac­ter string through which Inter­net pages and servers can be assi­gned to the speci­fic Inter­net brow­ser in which the cookie was stored. This allows visi­ted Inter­net sites and servers to diffe­ren­tiate the indi­vi­dual brow­ser of the dats subject from other Inter­net brow­sers that contain other cookies. A speci­fic Inter­net brow­ser can be reco­gni­zed and iden­ti­fied using the unique cookie ID.

Through the use of cookies, Chris­tiane Mahler-Scharf & Birgit de Fries GbR can provide the users of this website with more user-friendly services that would not be possi­ble without the cookie setting.

By means of a cookie, the infor­ma­tion and offers on our website can be opti­mi­zed with the user in mind. Cookies allow us, as previously mentio­ned, to reco­gnize our website users. The purpose of this reco­gni­tion is to make it easier for users to utilize our website. The website user that uses cookies, e.g. does not have to enter access data each time the website is acces­sed, because this is taken over by the website, and the cookie is thus stored on the user’s compu­ter system. Another exam­ple is the cookie of a shop­ping cart in an online shop. The online store remem­bers the artic­les that a custo­mer has placed in the virtual shop­ping cart via a cookie.

The data subject may, at any time, prevent the setting of cookies through our website by means of a corre­spon­ding setting of the Inter­net brow­ser used, and may thus perma­nently deny the setting of cookies. Further­more, alre­ady set cookies may be dele­ted at any time via an Inter­net brow­ser or other soft­ware programs. This is possi­ble in all popu­lar Inter­net brow­sers. If the data subject deac­ti­va­tes the setting of cookies in the Inter­net brow­ser used, not all func­tions of our website may be enti­rely usable.

4. Collection of general data and information

The websites of Chris­tiane Mahler-Scharf & Birgit de Fries GbR coll­ects a series of gene­ral data and infor­ma­tion when a data subject or auto­ma­ted system calls up the website. This gene­ral data and infor­ma­tion are stored in the server log files. Coll­ec­ted may be (1) the brow­ser types and versi­ons used, (2) the opera­ting system used by the acces­sing system, (3) the website from which an acces­sing system reaches our website (so-called refer­rers), (4) the sub-websites, (5) the date and time of access to the Inter­net site, (6) an Inter­net proto­col address (IP address), (7) the Inter­net service provi­der of the acces­sing system, and (8) any other simi­lar data and infor­ma­tion that may be used in the event of attacks on our infor­ma­tion tech­no­logy systems.

When using these gene­ral data and infor­ma­tion, Chris­tiane Mahler-Scharf & Birgit de Fries GbR does not draw any conclu­si­ons about the data subject. Rather, this infor­ma­tion is needed to (1) deli­ver the content of our website correctly, (2) opti­mize the content of our website as well as its adver­ti­se­ment, (3) ensure the long-term viabi­lity of our infor­ma­tion tech­no­logy systems and website tech­no­logy, and (4) provide law enforce­ment autho­ri­ties with the infor­ma­tion neces­sary for crimi­nal prose­cu­tion in case of a cyber-attack. Ther­e­fore, Chris­tiane Mahler-Scharf & Birgit de Fries GbR analy­zes anony­mously coll­ec­ted data and infor­ma­tion statis­ti­cally, with the aim of incre­asing the data protec­tion and data secu­rity of our enter­prise, and to ensure an opti­mal level of protec­tion for the perso­nal data we process. The anony­mous data of the server log files are stored sepa­ra­tely from all perso­nal data provi­ded by a data subject.

5. Subscription to our newsletters

On the websites of Chris­tiane Mahler-Scharf & Birgit de Fries GbR, users are given the oppor­tu­nity to subscribe to our enter­pri­se’s newsletter. The input mask used for this purpose deter­mi­nes what perso­nal data are trans­mit­ted, as well as when the newsletter is orde­red from the controller.

Chris­tiane Mahler-Scharf & Birgit de Fries GbR informs its custo­mers and busi­ness part­ners regu­larly by means of a newsletter about enter­prise offers. The enter­pri­se’s newsletter may only be recei­ved by the data subject if (1) the data subject has a valid e‑mail address and (2) the data subject regis­ters for the newsletter ship­ping. A confir­ma­tion e‑mail will be sent to the e‑mail address regis­tered by a data subject for the first time for newsletter ship­ping, for legal reasons, in the double opt-in proce­dure. This confir­ma­tion e‑mail is used to prove whether the owner of the e‑mail address as the data subject is autho­ri­zed to receive the newsletter.

During the regis­tra­tion for the newsletter, we also store the IP address of the compu­ter system assi­gned by the Inter­net service provi­der (ISP) and used by the data subject at the time of the regis­tra­tion, as well as the date and time of the regis­tra­tion. The coll­ec­tion of this data is neces­sary in order to under­stand the (possi­ble) misuse of the e‑mail address of a data subject at a later date, and it ther­e­fore serves the aim of the legal protec­tion of the controller.

The perso­nal data coll­ec­ted as part of a regis­tra­tion for the newsletter will only be used to send our newsletter. In addi­tion, subscri­bers to the newsletter may be infor­med by e‑mail, as long as this is neces­sary for the opera­tion of the newsletter service or a regis­tra­tion in ques­tion, as this could be the case in the event of modi­fi­ca­ti­ons to the newsletter offer, or in the event of a change in tech­ni­cal circum­s­tances. There will be no trans­fer of perso­nal data coll­ec­ted by the newsletter service to third parties. The subscrip­tion to our newsletter may be termi­na­ted by the data subject at any time. The consent to the storage of perso­nal data, which the data subject has given for ship­ping the newsletter, may be revo­ked at any time. For the purpose of revo­ca­tion of consent, a corre­spon­ding link is found in each newsletter. It is also possi­ble to unsub­scribe from the newsletter at any time directly on the website of the control­ler, or to commu­ni­cate this to the control­ler in a diffe­rent way.

6. Newsletter-Tracking

The news­let­ters of Chris­tiane Mahler-Scharf & Birgit de Fries GbR conta­ins so-called track­ing pixels. A track­ing pixel is a minia­ture graphic embedded in such e‑mails, which are sent in HTML format to enable log file recor­ding and analy­sis. This allows a statis­ti­cal analy­sis of the success or fail­ure of online marke­ting campaigns. Based on the embedded track­ing pixel, Sebas­tian Neuhaus may see if and when an e‑mail was opened by a data subject, and which links in the e‑mail were called up by data subjects.

Such perso­nal data coll­ec­ted in the track­ing pixels contai­ned in the news­let­ters are stored and analy­zed by the control­ler in order to opti­mize the ship­ping of the newsletter, as well as to adapt the content of future news­let­ters even better to the inte­rests of the data subject. These perso­nal data will not be passed on to third parties. Data subjects are at any time entit­led to revoke the respec­tive sepa­rate decla­ra­tion of consent issued by means of the double-opt-in proce­dure. After a revo­ca­tion, these perso­nal data will be dele­ted by the control­ler. Chris­tiane Mahler-Scharf & Birgit de Fries GbR auto­ma­ti­cally regards a with­dra­wal from the receipt of the newsletter as a revocation.

7. Contact possibility via the website

The websites of the Chris­tiane Mahler-Scharf & Birgit de Fries GbR contain infor­ma­tion that enables a quick elec­tro­nic cont­act to our enter­prise, as well as direct commu­ni­ca­tion with us, which also includes a gene­ral address of the so-called elec­tro­nic mail (e‑mail address). If a data subject cont­acts the control­ler by e‑mail or via a cont­act form, the perso­nal data trans­mit­ted by the data subject are auto­ma­ti­cally stored. Such perso­nal data trans­mit­ted on a volun­t­ary basis by a data subject to the data control­ler are stored for the purpose of proces­sing or cont­ac­ting the data subject. There is no trans­fer of this perso­nal data to third parties.

8. Routine erasure and blocking of personal data

The data control­ler shall process and store the perso­nal data of the data subject only for the period neces­sary to achieve the purpose of storage, or as far as this is gran­ted by the Euro­pean legis­la­tor or other legis­la­tors in laws or regu­la­ti­ons to which the control­ler is subject to.

If the storage purpose is not appli­ca­ble, or if a storage period prescri­bed by the Euro­pean legis­la­tor or another compe­tent legis­la­tor expi­res, the perso­nal data are routi­nely blocked or erased in accordance with legal requirements.

9. Rights of the data subject

• a) Right of confirmation

  Each data subject shall have the right gran­ted by the Euro­pean legis­la­tor to obtain from the control­ler the confir­ma­tion as to whether or not perso­nal data concer­ning him or her are being proces­sed. If a data subject wishes to avail hims­elf of this right of confir­ma­tion, he or she may, at any time, cont­act any employee of the controller.

• b) Right of access

  Each data subject shall have the right gran­ted by the Euro­pean legis­la­tor to obtain from the control­ler free infor­ma­tion about his or her perso­nal data stored at any time and a copy of this infor­ma­tion. Further­more, the Euro­pean direc­ti­ves and regu­la­ti­ons grant the data subject access to the follo­wing information:

  • the purpo­ses of the processing;
  • the cate­go­ries of perso­nal data concerned;
  • the reci­pi­ents or cate­go­ries of reci­pi­ents to whom the perso­nal data have been or will be disc­lo­sed, in parti­cu­lar reci­pi­ents in third count­ries or inter­na­tio­nal organisations;
  • where possi­ble, the envi­sa­ged period for which the perso­nal data will be stored, or, if not possi­ble, the crite­ria used to deter­mine that period;
  • the exis­tence of the right to request from the control­ler recti­fi­ca­tion or erasure of perso­nal data, or rest­ric­tion of proces­sing of perso­nal data concer­ning the data subject, or to object to such processing;
  • the exis­tence of the right to lodge a complaint with a super­vi­sory authority;
  • where the perso­nal data are not coll­ec­ted from the data subject, any available infor­ma­tion as to their source;
  • the exis­tence of auto­ma­ted decis­ion-making, inclu­ding profil­ing, refer­red to in Article 22(1) and (4) of the GDPR and, at least in those cases, meaningful infor­ma­tion about the logic invol­ved, as well as the signi­fi­cance and envi­sa­ged conse­quen­ces of such proces­sing for the data subject.

  Further­more, the data subject shall have a right to obtain infor­ma­tion as to whether perso­nal data are trans­fer­red to a third coun­try or to an inter­na­tio­nal orga­ni­sa­tion. Where this is the case, the data subject shall have the right to be infor­med of the appro­priate safe­guards rela­ting to the transfer.

  If a data subject wishes to avail hims­elf of this right of access, he or she may, at any time, cont­act any employee of the controller.

• c) Right to rectification

  Each data subject shall have the right gran­ted by the Euro­pean legis­la­tor to obtain from the control­ler without undue delay the recti­fi­ca­tion of inac­cu­rate perso­nal data concer­ning him or her. Taking into account the purpo­ses of the proces­sing, the data subject shall have the right to have incom­plete perso­nal data comple­ted, inclu­ding by means of provi­ding a supple­men­tary statement.

  If a data subject wishes to exer­cise this right to recti­fi­ca­tion, he or she may, at any time, cont­act any employee of the controller.

• d) Right to erasure (Right to be forgotten)

  Each data subject shall have the right gran­ted by the Euro­pean legis­la­tor to obtain from the control­ler the erasure of perso­nal data concer­ning him or her without undue delay, and the control­ler shall have the obli­ga­tion to erase perso­nal data without undue delay where one of the follo­wing grounds applies, as long as the proces­sing is not necessary:

  • The perso­nal data are no longer neces­sary in rela­tion to the purpo­ses for which they were coll­ec­ted or other­wise processed.
  • The data subject with­draws consent to which the proces­sing is based accor­ding to point (a) of Article 6(1) of the GDPR, or point (a) of Article 9(2) of the GDPR, and where there is no other legal ground for the processing.
  • The data subject objects to the proces­sing pursu­ant to Article 21(1) of the GDPR and there are no over­ri­ding legi­ti­mate grounds for the proces­sing, or the data subject objects to the proces­sing pursu­ant to Article 21(2) of the GDPR.
  • The perso­nal data have been unlawfully processed.
  • The perso­nal data must be erased for compli­ance with a legal obli­ga­tion in Union or Member State law to which the control­ler is subject.
  • The perso­nal data have been coll­ec­ted in rela­tion to the offer of infor­ma­tion society services refer­red to in Article 8(1) of the GDPR.

  If one of the afore­men­tio­ned reasons applies, and a data subject wishes to request the erasure of perso­nal data stored by Sebas­tian Neuhaus, he or she may, at any time, cont­act any employee of the control­ler. An employee of Sebas­tian Neuhaus shall promptly ensure that the erasure request is complied with immediately.

  Where the control­ler has made perso­nal data public and is obli­ged pursu­ant to Article 17(1) to erase the perso­nal data, the control­ler, taking account of available tech­no­logy and the cost of imple­men­ta­tion, shall take reasonable steps, inclu­ding tech­ni­cal measu­res, to inform other control­lers proces­sing the perso­nal data that the data subject has reques­ted erasure by such control­lers of any links to, or copy or repli­ca­tion of, those perso­nal data, as far as proces­sing is not requi­red. An employees of Sebas­tian Neuhaus will arrange the neces­sary measu­res in indi­vi­dual cases.

• e) Right of restriction of processing

  Each data subject shall have the right gran­ted by the Euro­pean legis­la­tor to obtain from the control­ler rest­ric­tion of proces­sing where one of the follo­wing applies:

  • The accu­racy of the perso­nal data is contes­ted by the data subject, for a period enab­ling the control­ler to verify the accu­racy of the perso­nal data.
  • The proces­sing is unlawful and the data subject oppo­ses the erasure of the perso­nal data and requests instead the rest­ric­tion of their use instead.
  • The control­ler no longer needs the perso­nal data for the purpo­ses of the proces­sing, but they are requi­red by the data subject for the estab­lish­ment, exer­cise or defence of legal claims.
  • The data subject has objec­ted to proces­sing pursu­ant to Article 21(1) of the GDPR pending the veri­fi­ca­tion whether the legi­ti­mate grounds of the control­ler over­ride those of the data subject.

  If one of the afore­men­tio­ned condi­ti­ons is met, and a data subject wishes to request the rest­ric­tion of the proces­sing of perso­nal data stored by Sebas­tian Neuhaus, he or she may at any time cont­act any employee of the control­ler. The employee of Sebas­tian Neuhaus will arrange the rest­ric­tion of the processing.

• f) Right to data portability

  Each data subject shall have the right gran­ted by the Euro­pean legis­la­tor, to receive the perso­nal data concer­ning him or her, which was provi­ded to a control­ler, in a struc­tu­red, commonly used and machine-reada­ble format. He or she shall have the right to trans­mit those data to another control­ler without hindrance from the control­ler to which the perso­nal data have been provi­ded, as long as the proces­sing is based on consent pursu­ant to point (a) of Article 6(1) of the GDPR or point (a) of Article 9(2) of the GDPR, or on a contract pursu­ant to point (b) of Article 6(1) of the GDPR, and the proces­sing is carried out by auto­ma­ted means, as long as the proces­sing is not neces­sary for the perfor­mance of a task carried out in the public inte­rest or in the exer­cise of offi­cial autho­rity vested in the controller.

  Further­more, in exer­cis­ing his or her right to data porta­bi­lity pursu­ant to Article 20(1) of the GDPR, the data subject shall have the right to have perso­nal data trans­mit­ted directly from one control­ler to another, where tech­ni­cally feasi­ble and when doing so does not adver­sely affect the rights and free­doms of others.

  In order to assert the right to data porta­bi­lity, the data subject may at any time cont­act any employee of Sebas­tian Neuhaus.

• g) Right to object

  Each data subject shall have the right gran­ted by the Euro­pean legis­la­tor to object, on grounds rela­ting to his or her parti­cu­lar situa­tion, at any time, to proces­sing of perso­nal data concer­ning him or her, which is based on point (e) or (f) of Article 6(1) of the GDPR. This also applies to profil­ing based on these provisions.

  Chris­tiane Mahler-Scharf & Birgit de Fries GbR shall no longer process the perso­nal data in the event of the objec­tion, unless we can demons­trate compel­ling legi­ti­mate grounds for the proces­sing which over­ride the inte­rests, rights and free­doms of the data subject, or for the estab­lish­ment, exer­cise or defence of legal claims.

  Chris­tiane Mahler-Scharf & Birgit de Fries GbR proces­ses perso­nal data for direct marke­ting purpo­ses, the data subject shall have the right to object at any time to proces­sing of perso­nal data concer­ning him or her for such marke­ting. This applies to profil­ing to the extent that it is rela­ted to such direct marke­ting. If the data subject objects to Sebas­tian Neuhaus to the proces­sing for direct marke­ting purpo­ses, Chris­tiane Mahler-Scharf & Birgit de Fries GbR will no longer process the perso­nal data for these purposes.

  In addi­tion, the data subject has the right, on grounds rela­ting to his or her parti­cu­lar situa­tion, to object to proces­sing of perso­nal data concer­ning him or her by Chris­tiane Mahler-Scharf & Birgit de Fries GbR for scien­ti­fic or histo­ri­cal rese­arch purpo­ses, or for statis­ti­cal purpo­ses pursu­ant to Article 89(1) of the GDPR, unless the proces­sing is neces­sary for the perfor­mance of a task carried out for reasons of public interest.

  In order to exer­cise the right to object, the data subject may cont­act any employee of Chris­tiane Mahler-Scharf & Birgit de Fries GbR. In addi­tion, the data subject is free in the context of the use of infor­ma­tion society services, and notwi­th­stan­ding Direc­tive 2002/58/EC, to use his or her right to object by auto­ma­ted means using tech­ni­cal specifications.

• h) Automated individual decision-making, including profiling

  Each data subject shall have the right gran­ted by the Euro­pean legis­la­tor not to be subject to a decis­ion based solely on auto­ma­ted proces­sing, inclu­ding profil­ing, which produ­ces legal effects concer­ning him or her, or simi­larly signi­fi­cantly affects him or her, as long as the decis­ion (1) is not is neces­sary for ente­ring into, or the perfor­mance of, a contract between the data subject and a data control­ler, or (2) is not autho­ri­sed by Union or Member State law to which the control­ler is subject and which also lays down suita­ble measu­res to safe­guard the data subjec­t’s rights and free­doms and legi­ti­mate inte­rests, or (3) is not based on the data subjec­t’s expli­cit consent.

  If the decis­ion (1) is neces­sary for ente­ring into, or the perfor­mance of, a contract between the data subject and a data control­ler, or (2) it is based on the data subjec­t’s expli­cit consent, Chris­tiane Mahler-Scharf & Birgit de Fries GbR shall imple­ment suita­ble measu­res to safe­guard the data subjec­t’s rights and free­doms and legi­ti­mate inte­rests, at least the right to obtain human inter­ven­tion on the part of the control­ler, to express his or her point of view and contest the decision.

  If the data subject wishes to exer­cise the rights concer­ning auto­ma­ted indi­vi­dual decis­ion-making, he or she may, at any time, cont­act any employee of Chris­tiane Mahler-Scharf & Birgit de Fries GbR.

• i) Right to withdraw data protection consent

  Each data subject shall have the right gran­ted by the Euro­pean legis­la­tor to with­draw his or her consent to proces­sing of his or her perso­nal data at any time.

  If the data subject wishes to exer­cise the right to with­draw the consent, he or she may, at any time, cont­act any employee of Chris­tiane Mahler-Scharf & Birgit de Fries GbR.

10. Data protection for applications and the application procedures

The data control­ler shall coll­ect and process the perso­nal data of appli­cants for the purpose of the proces­sing of the appli­ca­tion proce­dure. The proces­sing may also be carried out elec­tro­ni­cally. This is the case, in parti­cu­lar, if an appli­cant submits corre­spon­ding appli­ca­tion docu­ments by e‑mail or by means of a web form on the website to the control­ler. If the data control­ler concludes an employ­ment contract with an appli­cant, the submit­ted data will be stored for the purpose of proces­sing the employ­ment rela­ti­onship in compli­ance with legal requi­re­ments. If no employ­ment contract is concluded with the appli­cant by the control­ler, the appli­ca­tion docu­ments shall be auto­ma­ti­cally erased two months after noti­fi­ca­tion of the refu­sal decis­ion, provi­ded that no other legi­ti­mate inte­rests of the control­ler are oppo­sed to the erasure. Other legi­ti­mate inte­rest in this rela­tion is, e.g. a burden of proof in a proce­dure under the Gene­ral Equal Treat­ment Act (AGG).

11. Data protection provisions about the application and use of Facebook

On this website, the control­ler has inte­gra­ted compon­ents of the enter­prise Face­book. Face­book is a social network.

A social network is a place for social meetings on the Inter­net, an online commu­nity, which usually allows users to commu­ni­cate with each other and inter­act in a virtual space. A social network may serve as a plat­form for the exch­ange of opini­ons and expe­ri­en­ces, or enable the Inter­net commu­nity to provide perso­nal or busi­ness-rela­ted infor­ma­tion. Face­book allows social network users to include the crea­tion of private profiles, upload photos, and network through friend requests.

The opera­ting company of Face­book is Face­book, Inc., 1 Hacker Way, Menlo Park, CA 94025, United States. If a person lives outside of the United States or Canada, the control­ler is the Face­book Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

With each call-up to one of the indi­vi­dual pages of this Inter­net website, which is opera­ted by the control­ler and into which a Face­book compo­nent (Face­book plug-ins) was inte­gra­ted, the web brow­ser on the infor­ma­tion tech­no­logy system of the data subject is auto­ma­ti­cally prompted to down­load display of the corre­spon­ding Face­book compo­nent from Face­book through the Face­book compo­nent. An over­view of all the Face­book Plug-ins may be acces­sed under https://developers.facebook.com/docs/plugins/. During the course of this tech­ni­cal proce­dure, Face­book is made aware of what speci­fic sub-site of our website was visi­ted by the data subject.

If the data subject is logged in at the same time on Face­book, Face­book detects with every call-up to our website by the data subject—and for the entire dura­tion of their stay on our Inter­net site—which speci­fic sub-site of our Inter­net page was visi­ted by the data subject. This infor­ma­tion is coll­ec­ted through the Face­book compo­nent and asso­cia­ted with the respec­tive Face­book account of the data subject. If the data subject clicks on one of the Face­book buttons inte­gra­ted into our website, e.g. the “Like” button, or if the data subject submits a comment, then Face­book matches this infor­ma­tion with the perso­nal Face­book user account of the data subject and stores the perso­nal data.

Face­book always recei­ves, through the Face­book compo­nent, infor­ma­tion about a visit to our website by the data subject, when­ever the data subject is logged in at the same time on Face­book during the time of the call-up to our website. This occurs regard­less of whether the data subject clicks on the Face­book compo­nent or not. If such a trans­mis­sion of infor­ma­tion to Face­book is not desi­ra­ble for the data subject, then he or she may prevent this by logging off from their Face­book account before a call-up to our website is made.

The data protec­tion guide­line published by Face­book, which is available at https://facebook.com/about/privacy/, provi­des infor­ma­tion about the coll­ec­tion, proces­sing and use of perso­nal data by Face­book. In addi­tion, it is explai­ned there what setting opti­ons Face­book offers to protect the privacy of the data subject. In addi­tion, diffe­rent confi­gu­ra­tion opti­ons are made available to allow the elimi­na­tion of data trans­mis­sion to Face­book. These appli­ca­ti­ons may be used by the data subject to elimi­nate a data trans­mis­sion to Facebook.

12. Data protection provisions about the application and use of Google+

On this website, the control­ler has inte­gra­ted the Google+ button as a compo­nent. Google+ is a so-called social network. A social network is a social meeting place on the Inter­net, an online commu­nity, which usually allows users to commu­ni­cate with each other and inter­act in a virtual space. A social network may serve as a plat­form for the exch­ange of opini­ons and expe­ri­en­ces, or enable the Inter­net commu­nity to provide perso­nal or busi­ness-rela­ted infor­ma­tion. Google+ allows users of the social network to include the crea­tion of private profiles, upload photos and network through friend requests.

The opera­ting company of Google+ is Google Inc., 1600 Amphi­theatre Pkwy, Moun­tain View, CA 94043–1351, UNITED STATES.

With each call-up to one of the indi­vi­dual pages of this website, which is opera­ted by the control­ler and on which a Google+ button has been inte­gra­ted, the Inter­net brow­ser on the infor­ma­tion tech­no­logy system of the data subject auto­ma­ti­cally down­loads a display of the corre­spon­ding Google+ button of Google through the respec­tive Google+ button compo­nent. During the course of this tech­ni­cal proce­dure, Google is made aware of what speci­fic sub-page of our website was visi­ted by the data subject. More detailed infor­ma­tion about Google+ is available under https://developers.google.com/+/.

If the data subject is logged in at the same time to Google+, Google reco­gni­zes with each call-up to our website by the data subject and for the entire dura­tion of his or her stay on our Inter­net site, which speci­fic sub-pages of our Inter­net page were visi­ted by the data subject. This infor­ma­tion is coll­ec­ted through the Google+ button and Google matches this with the respec­tive Google+ account asso­cia­ted with the data subject.

If the data subject clicks on the Google+ button inte­gra­ted on our website and thus gives a Google+ 1 recom­men­da­tion, then Google assigns this infor­ma­tion to the perso­nal Google+ user account of the data subject and stores the perso­nal data. Google stores the Google+ 1 recom­men­da­tion of the data subject, making it publicly available in accordance with the terms and condi­ti­ons accepted by the data subject in this regard. Subse­quently, a Google+ 1 recom­men­da­tion given by the data subject on this website toge­ther with other perso­nal data, such as the Google+ account name used by the data subject and the stored photo, is stored and proces­sed on other Google services, such as search-engine results of the Google search engine, the Google account of the data subject or in other places, e.g. on Inter­net pages, or in rela­tion to adver­ti­se­ments. Google is also able to link the visit to this website with other perso­nal data stored on Google. Google further records this perso­nal infor­ma­tion with the purpose of impro­ving or opti­mi­zing the various Google services.

Through the Google+ button, Google recei­ves infor­ma­tion that the data subject visi­ted our website, if the data subject at the time of the call-up to our website is logged in to Google+. This occurs regard­less of whether the data subject clicks or doesn’t click on the Google+ button.

If the data subject does not wish to trans­mit perso­nal data to Google, he or she may prevent such trans­mis­sion by logging out of his Google+ account before calling up our website.

Further infor­ma­tion and the data protec­tion provi­si­ons of Google may be retrie­ved under https://www.google.com/intl/en/policies/privacy/. More refe­ren­ces from Google about the Google+ 1 button may be obtai­ned under https://developers.google.com/+/web/buttons-policy.

13. Data protection provisions about the application and use of Instagram

On this website, the control­ler has inte­gra­ted compon­ents of the service Insta­gram. Insta­gram is a service that may be quali­fied as an audio­vi­sual plat­form, which allows users to share photos and videos, as well as disse­mi­nate such data in other social networks.

The opera­ting company of the services offe­red by Insta­gram is Insta­gram LLC, 1 Hacker Way, Buil­ding 14 First Floor, Menlo Park, CA, UNITED STATES.

With each call-up to one of the indi­vi­dual pages of this Inter­net site, which is opera­ted by the control­ler and on which an Insta­gram compo­nent (Insta button) was inte­gra­ted, the Inter­net brow­ser on the infor­ma­tion tech­no­logy system of the data subject is auto­ma­ti­cally prompted to the down­load of a display of the corre­spon­ding Insta­gram compo­nent of Insta­gram. During the course of this tech­ni­cal proce­dure, Insta­gram beco­mes aware of what speci­fic sub-page of our website was visi­ted by the data subject.

If the data subject is logged in at the same time on Insta­gram, Insta­gram detects with every call-up to our website by the data subject—and for the entire dura­tion of their stay on our Inter­net site—which speci­fic sub-page of our Inter­net page was visi­ted by the data subject. This infor­ma­tion is coll­ec­ted through the Insta­gram compo­nent and is asso­cia­ted with the respec­tive Insta­gram account of the data subject. If the data subject clicks on one of the Insta­gram buttons inte­gra­ted on our website, then Insta­gram matches this infor­ma­tion with the perso­nal Insta­gram user account of the data subject and stores the perso­nal data.

Insta­gram recei­ves infor­ma­tion via the Insta­gram compo­nent that the data subject has visi­ted our website provi­ded that the data subject is logged in at Insta­gram at the time of the call to our website. This occurs regard­less of whether the person clicks on the Insta­gram button or not. If such a trans­mis­sion of infor­ma­tion to Insta­gram is not desi­ra­ble for the data subject, then he or she can prevent this by logging off from their Insta­gram account before a call-up to our website is made.

Further infor­ma­tion and the appli­ca­ble data protec­tion provi­si­ons of Insta­gram may be retrie­ved under https://help.instagram.com/155833707900388 and https://www.instagram.com/about/legal/privacy/.

14. Data protection provisions about the application and use of Twitter

On this website, the control­ler has inte­gra­ted compon­ents of Twit­ter. Twit­ter is a multi­l­in­gual, publicly-acces­si­ble micro­blog­ging service on which users may publish and spread so-called ‘tweets,’ e.g. short messa­ges, which are limi­ted to 280 charac­ters. These short messa­ges are available for ever­yone, inclu­ding those who are not logged on to Twit­ter. The tweets are also displayed to so-called follo­wers of the respec­tive user. Follo­wers are other Twit­ter users who follow a user’s tweets. Further­more, Twit­ter allows you to address a wide audi­ence via hash­tags, links or retweets.

The opera­ting company of Twit­ter is Twit­ter, Inc., 1355 Market Street, Suite 900, San Fran­cisco, CA 94103, UNITED STATES.

With each call-up to one of the indi­vi­dual pages of this Inter­net site, which is opera­ted by the control­ler and on which a Twit­ter compo­nent (Twit­ter button) was inte­gra­ted, the Inter­net brow­ser on the infor­ma­tion tech­no­logy system of the data subject is auto­ma­ti­cally prompted to down­load a display of the corre­spon­ding Twit­ter compo­nent of Twit­ter. Further infor­ma­tion about the Twit­ter buttons is available under https://about.twitter.com/de/resources/buttons. During the course of this tech­ni­cal proce­dure, Twit­ter gains know­ledge of what speci­fic sub-page of our website was visi­ted by the data subject. The purpose of the inte­gra­tion of the Twit­ter compo­nent is a retrans­mis­sion of the contents of this website to allow our users to intro­duce this web page to the digi­tal world and increase our visi­tor numbers.

If the data subject is logged in at the same time on Twit­ter, Twit­ter detects with every call-up to our website by the data subject and for the entire dura­tion of their stay on our Inter­net site which speci­fic sub-page of our Inter­net page was visi­ted by the data subject. This infor­ma­tion is coll­ec­ted through the Twit­ter compo­nent and asso­cia­ted with the respec­tive Twit­ter account of the data subject. If the data subject clicks on one of the Twit­ter buttons inte­gra­ted on our website, then Twit­ter assigns this infor­ma­tion to the perso­nal Twit­ter user account of the data subject and stores the perso­nal data.

Twit­ter recei­ves infor­ma­tion via the Twit­ter compo­nent that the data subject has visi­ted our website, provi­ded that the data subject is logged in on Twit­ter at the time of the call-up to our website. This occurs regard­less of whether the person clicks on the Twit­ter compo­nent or not. If such a trans­mis­sion of infor­ma­tion to Twit­ter is not desi­ra­ble for the data subject, then he or she may prevent this by logging off from their Twit­ter account before a call-up to our website is made.

The appli­ca­ble data protec­tion provi­si­ons of Twit­ter may be acces­sed under https://twitter.com/privacy?lang=en.

15. Data protection provisions about the application and use of YouTube

On this website, the control­ler has inte­gra­ted compon­ents of YouTube. YouTube is an Inter­net video portal that enables video publishers to set video clips and other users free of charge, which also provi­des free view­ing, review and commen­ting on them. YouTube allows you to publish all kinds of videos, so you can access both full movies and TV broad­casts, as well as music videos, trai­lers, and videos made by users via the Inter­net portal.

The opera­ting company of YouTube is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, UNITED STATES. The YouTube, LLC is a subsi­diary of Google Inc., 1600 Amphi­theatre Pkwy, Moun­tain View, CA 94043–1351, UNITED STATES.

With each call-up to one of the indi­vi­dual pages of this Inter­net site, which is opera­ted by the control­ler and on which a YouTube compo­nent (YouTube video) was inte­gra­ted, the Inter­net brow­ser on the infor­ma­tion tech­no­logy system of the data subject is auto­ma­ti­cally prompted to down­load a display of the corre­spon­ding YouTube compo­nent. Further infor­ma­tion about YouTube may be obtai­ned under https://www.youtube.com/yt/about/en/. During the course of this tech­ni­cal proce­dure, YouTube and Google gain know­ledge of what speci­fic sub-page of our website was visi­ted by the data subject.

If the data subject is logged in on YouTube, YouTube reco­gni­zes with each call-up to a sub-page that conta­ins a YouTube video, which speci­fic sub-page of our Inter­net site was visi­ted by the data subject. This infor­ma­tion is coll­ec­ted by YouTube and Google and assi­gned to the respec­tive YouTube account of the data subject.

YouTube and Google will receive infor­ma­tion through the YouTube compo­nent that the data subject has visi­ted our website, if the data subject at the time of the call to our website is logged in on YouTube; this occurs regard­less of whether the person clicks on a YouTube video or not. If such a trans­mis­sion of this infor­ma­tion to YouTube and Google is not desi­ra­ble for the data subject, the deli­very may be preven­ted if the data subject logs off from their own YouTube account before a call-up to our website is made.

YouTube’s data protec­tion provi­si­ons, available at https://www.google.com/intl/en/policies/privacy/, provide infor­ma­tion about the coll­ec­tion, proces­sing and use of perso­nal data by YouTube and Google.

16. Legal basis for the processing

Art. 6(1) lit. a GDPR serves as the legal basis for proces­sing opera­ti­ons for which we obtain consent for a speci­fic proces­sing purpose. If the proces­sing of perso­nal data is neces­sary for the perfor­mance of a contract to which the data subject is party, as is the case, for exam­ple, when proces­sing opera­ti­ons are neces­sary for the supply of goods or to provide any other service, the proces­sing is based on Article 6(1) lit. b GDPR. The same applies to such proces­sing opera­ti­ons which are neces­sary for carry­ing out pre-contrac­tual measu­res, for exam­ple in the case of inqui­ries concer­ning our products or services. Is our company subject to a legal obli­ga­tion by which proces­sing of perso­nal data is requi­red, such as for the fulfill­ment of tax obli­ga­ti­ons, the proces­sing is based on Art. 6(1) lit. c GDPR.
In rare cases, the proces­sing of perso­nal data may be neces­sary to protect the vital inte­rests of the data subject or of another natu­ral person. This would be the case, for exam­ple, if a visi­tor were inju­red in our company and his name, age, health insu­rance data or other vital infor­ma­tion would have to be passed on to a doctor, hospi­tal or other third party. Then the proces­sing would be based on Art. 6(1) lit. d GDPR.
Finally, proces­sing opera­ti­ons could be based on Article 6(1) lit. f GDPR. This legal basis is used for proces­sing opera­ti­ons which are not covered by any of the above­men­tio­ned legal grounds, if proces­sing is neces­sary for the purpo­ses of the legi­ti­mate inte­rests pursued by our company or by a third party, except where such inte­rests are over­ridden by the inte­rests or funda­men­tal rights and free­doms of the data subject which require protec­tion of perso­nal data. Such proces­sing opera­ti­ons are parti­cu­larly permis­si­ble because they have been speci­fi­cally mentio­ned by the Euro­pean legis­la­tor. He conside­red that a legi­ti­mate inte­rest could be assu­med if the data subject is a client of the control­ler (Reci­tal 47 Sentence 2 GDPR).

17. The legitimate interests pursued by the controller or by a third party

Where the proces­sing of perso­nal data is based on Article 6(1) lit. f GDPR our legi­ti­mate inte­rest is to carry out our busi­ness in favor of the well-being of all our employees and the shareholders.

18. Period for which the personal data will be stored

The crite­ria used to deter­mine the period of storage of perso­nal data is the respec­tive statu­tory reten­tion period. After expi­ra­tion of that period, the corre­spon­ding data is routi­nely dele­ted, as long as it is no longer neces­sary for the fulfill­ment of the contract or the initia­tion of a contract.

19. Provision of personal data as statutory or contractual requirement; Requirement necessary to enter into a contract; Obligation of the data subject to provide the personal data; possible consequences of failure to provide such data

We clarify that the provi­sion of perso­nal data is partly requi­red by law (e.g. tax regu­la­ti­ons) or can also result from contrac­tual provi­si­ons (e.g. infor­ma­tion on the contrac­tual partner).

Some­ti­mes it may be neces­sary to conclude a contract that the data subject provi­des us with perso­nal data, which must subse­quently be proces­sed by us. The data subject is, for exam­ple, obli­ged to provide us with perso­nal data when our company signs a contract with him or her. The non-provi­sion of the perso­nal data would have the conse­quence that the contract with the data subject could not be concluded.

Before perso­nal data is provi­ded by the data subject, the data subject must cont­act any employee. The employee clari­fies to the data subject whether the provi­sion of the perso­nal data is requi­red by law or contract or is neces­sary for the conclu­sion of the contract, whether there is an obli­ga­tion to provide the perso­nal data and the conse­quen­ces of non-provi­sion of the perso­nal data.

20. Existence of automated decision-making

As a respon­si­ble company, we do not use auto­ma­tic decis­ion-making or profiling.

This Privacy Policy has been gene­ra­ted by the Privacy Policy Gene­ra­tor of the DGD — Your Exter­nal DPO that was deve­lo­ped in coope­ra­tion with German Lawy­ers from WILDE BEUGER SOLMECKE, Cologne.