The protection of your privacy is important to us. The data protection declaration below is designed to inform you about how and to what extent we collect your data when you visit our website.
I. Name and address of the responsible party
The responsible party within the meaning of the General Data Protection Regulation and other national data protection laws of the EU Member States, as well as other data protection regulations, is:
IGH Einkaufs- und Marketing eG
Kölner Straße 71
Tel.: +49 (0) 24 44 - 915 778 11 or 12
II. General information on data processing
1. The scope of the processing of personal data
We collect and utilise our users' personal data only insofar as this is necessary to make available an operational website and our content and services. Collection and utilisation of our users' personal data is only undertaken periodically with the user's consent. An exception applies in those cases where prior consent cannot be obtained for legal or circumstantial reasons and the processing of the data is permitted by law.
2. Legal basis for processing personal data
Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 para. 1 lit. a EU General Data Protection Regulation (GDPR) serves as the legal basis.
In the processing of personal data required for the performance of a contract to which the data subject is a party, Art. 6 para. 1 lit. b GDPR serves as the legal basis. This also applies to processing necessary for pre-contractual measures.
Insofar as the processing of personal data is required to fulfil a legal obligation to which our company is subject, Art. 6 para. 1 lit. c GDPR serves as the legal basis.
In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 Para. 1 lit. d GDPR applies as the legal basis.
If processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 para. 1 lit. f GDPR serves as the legal basis for processing.
3. Data deletion and storage duration
Your personal data will be deleted or blocked as soon as the purpose of storage ceases to apply. Furthermore, data may be stored if this has been provided for by European or national legislation in EU regulations, laws or other provisions to which the person responsible is subject. We will also block or delete data once the prescribed retention period has expired, unless their continued storage is necessary for entering into or fulfilling a contractual relationship.
III. Provision of the website and creation of log files
1. Description and scope of data processing
Every time you visit our website, our system automatically collects data and information from the computer system of the accessing computer.
The following data are collected:
If you use our member area, user name and password are also stored. Each time you log in, the data you enter are compared with the stored data.
2. Legal basis for data processing
Since these data are technically required for the use of the website, we have a legitimate interest in the data collection and use. The legal basis for the temporary storage of data and log files is Art. 6 para. 1 lit. f GDPR.
3. The purpose of data processing
Temporary storage of the IP address by the system is necessary to enable the delivery of the website to the user's device. To this end, the user's IP address must remain stored for the duration of the session.
The data are stored in log files to ensure the website's functionality. The data are also used to optimise the website and to ensure the security of our information technology systems. No evaluation of the data for marketing purposes is undertaken in connection with this.
Member name and password are stored so that the member area can be used.
Our legitimate interest in data processing pursuant to Art. 6 para. 1 lit. f GDPR also lies in these purposes.
4. Duration of storage
All data are deleted as soon as they are no longer required to achieve the purpose for which they were collected. In the case of the collection of data to provide the website, this is the case when the respective session is terminated.
If the data are stored in log files, this is the case after seven days at the latest. Data may be stored for longer than this. In this case, the user's IP addresses will be deleted or anonymised, so that they can no longer be associated with the accessing client.
Your username and password will be stored for six months after their expiration date.
5. Objection and removal option
Collection of data for the provision of the website and storage of data in log files is absolutely necessary for the functionality of the website. There is therefore no option to object on the part of the user.
a) Description and scope of data processing
b) Legal basis for data processing
The legal basis for the processing of personal data using cookies is Art. 6 para. 1 lit. f GDPR.
c) Purpose of data processing
The user data collected by technically necessary cookies are not used to create user profiles.
For these purposes, our legitimate interest also lies in the processing of personal data in accordance with Art. 6 para. 1 lit. f GDPR.
d) Cookie used
e) Duration of storage, objection and removal option
The cookie remains stored on your computer for 10 years.
V. Web analysis by Google Analytics
a) Description and scope of data processing
Our website uses Google Analytics, a web analytics service provided by Google LLC (Google). Google Analytics uses so-called «cookies», text files that are stored on your computer to help analyse your use of the website. The information generated by the cookie about your use of the website by the user will usually be transmitted to and stored by Google on servers in the USA.
Our website uses Google Analytics exclusively with the extension «_anonymizeIp()», which ensures an anonymization of the IP address by shortening it and does not allow individual users to be identified directly. Through the extension, your IP address will be shortened within Member States of the European Union or in other states that are contracting parties to the Agreement on the European Economic Area and then sent to a Google server in the USA where it is stored. Only in exceptional cases - such as when there is a technical problem - is the full IP address sent to a Google server in the US and shortened there. In these exceptional cases, the processing takes place in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in the statistical analysis of the user behaviour for optimisation and marketing purposes.
The IP address sent by your browser as part of Google Analytics will not be associated by Google with any other data.
Google, which is headquartered in the United States, is certified under the US-EU Privacy Shield Agreement, which ensures compliance with EU data protection standards.
b) Legal basis for data processing
The legal basis for the processing of data by Google Analytics is Art. 6 para. 1 lit. f GDPR.
c) Purpose of data processing
Google will use this information on our behalf to analyse how the website is used, to generate reports about website activities and to provide further services associated with the use of the website and of the internet.
d) Storage duration of data and cookies
The anonymised data will be stored for a maximum period of 14 months, after which they are automatically deleted.
The following cookies are automatically deleted after the specified period:
_ga: 2 years
_gid: 1 day
_gat: 1 day
e) Objection and removal option
You can prevent the installation of cookies by selecting the appropriate settings in your browser; please note, however, that in this case you may not be able to use all the features of this website. You can additionally prevent the collection of data produced by the cookie and associated with your use of the website (including your IP address), its transmission to, and its processing by Google, by downloading and installing the browser plugin available at the following link:
VI. Rights of the data subject
1. Right to obtain information
In accordance with Art. 15 para. 1 GDPR, you can request a confirmation from the responsible entity about whether your personal data are processed by us.
If this is the case, you can, in accordance with Art. 15 para. 1 GDPR, request the following information from the responsible entity:
(1) the purposes for which the personal data are processed;
(2) the categories of personal data which are processed;
(3) the recipients or categories of recipients to whom the relevant personal data were disclosed or will be disclosed;
(4) if possible, the planned duration of storage of your personal data or, if no specific information can be provided, criteria for determining the duration of storage;
(5) the existence of a right to correction or deletion of your personal data, a right to restricting their processing by the responsible entity or a right of objection against their processing;
(6) the existence of a right to appeal to a supervisory authority;
(7) all available information about the source of the data, if the personal data were not collected from the data subject;
(8) the existence of automated decision-making including profiling in accordance with Art. 22 para. 1 and 4 GDPR and – at least in these cases – relevant information about the logic involved as well as the implications and the intended effects of such processing for the data subject.
You have the right to request information about whether your personal data are transmitted to a third country or an international organisation. In this context, you can request to be informed of the appropriate safeguards in accordance with Art. 46 GDPR relating to the transmission.
2. Right to correction
In accordance with Art. 16 GDPR you have the right vis-à-vis the responsible entity to correction and/or completion if the personal data concerning you are incorrect or incomplete. The responsible entity must perform the correction immediately.
3. Right to restriction of processing
In accordance with Art. 18 GDPR, you may request the restriction of the processing of your personal data under the following conditions:
(1) if you contest the accuracy of the personal data for a period enabling the responsible entity to verify the accuracy of the personal data;
(2) the processing is unlawful and you oppose the deletion of the personal data and request the restriction of its use instead;
(3) the responsible entity no longer needs the personal data for the purposes of the processing, but you need it to assert, exercise or defend legal claims, or
(4) you have objected to processing in accordance with Art. 21 para. 1 GDPR and it is not yet certain whether the legitimate grounds of the responsible entity override yours.
4. Right to deletion
a) Deletion obligation
You can request, in accordance with Art. 17 GDPR, that the responsible entity immediately deletes your personal data, and the responsible entity is obliged to immediately delete these data if one of the following reasons applies:
(1) You personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
(2) You revoke your consent which the processing in accordance with Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR was based on, and there is no other legal basis for their processing.
(3) You file an objection against their processing in accordance with Art. 21 para. 1 GDPR and there are no overriding legitimate reasons for their processing, or you file an objection against their processing in accordance with Art. 21 para. 2 GDPR.
(4) Your personal data were processed unlawfully.
(5) The deletion of your personal data is required to meet a legal obligation under EU law or the law of the Member States the responsible entity is subject to.
(6) Your personal data were collected in relation to the services offered by the information society in accordance with Art. 8 para. 1 GDPR.
5. Right to data portability
You have the right, in accordance with Art. 20 GDPR, to receive your personal data which you have provided to a responsible entity in a structured, commonly used and machine-readable format. You also have the right to transmit these data to another responsible entity without hindrance from the responsible entity to which the personal data were provided, where
(1) the processing is based on consent in accordance with Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract in accordance with Art. 6 para. 1 lit. b GDPR and
(2) the processing of data was carried out in automated form.
In exercising your right to data portability, you also have the right to have the personal data transmitted directly from one responsible entity to another, if this is technically feasible. This must not impact the freedoms and rights of other persons.
The right to data portability does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the responsible entity.
6. Right of objection
In accordance with Art. 21 para. 1 GDPR, you have the right to object, on grounds relating to your particular situation, to the processing of your personal data at any time based on Art. 6 para. 1 lit. e or f GDPR; this includes profiling based on those provisions.
7. Right to revoke the declaration of consent regarding data protection
In accordance with Art. 7 para. 3 GDPR, you have the right to revoke your declaration of consent regarding data protection at any time with effect for the future. The revocation of consent does not affect the lawfulness of processing based on consent before its revocation.
8. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right, in accordance with Art. 77 GDPR, to lodge a complaint with a supervisory authority, in particular in the Member State of your place of residence, place of work or place of the alleged violation if you believe that the processing of personal data relating to you violates the GDPR.
The supervisory authority with which the complaint has been lodged will inform the complainant on the progress and the outcome of the complaint, including the possibility of a judicial remedy in accordance with Art. 78 GDPR.