Website Privacy Policy

1. Introduction

Below we provide information about the processing of personal data when using

• our website CiviReach.de
• our social media profiles.

Personal data is any data that can be related to a specific natural person, e.g., their name or IP address.

1.1 Contact details

The controller within the meaning of Art. 4 (7) of the EU General Data Protection Regulation (GDPR) is CiviReach UG (haftungsbeschränkt), Obere Hauptstraße 5, Freising, Germany, email: kontakt@civireach.de. We are legally represented by Michael Markus Weindl and Michael Florian Firlus.

Our data protection officer can be reached via heyData GmbH, Schützenstraße 5, 10117 Berlin, Germany, www.heydata.eu, email: datenschutz@heydata.eu.

1.2 Scope of data processing, purposes of processing, and legal bases

We describe the scope of data processing, the purposes of processing, and the legal bases in detail below. In principle, the following legal bases for data processing may apply:

• Art. 6 (1) sentence 1 (a) GDPR serves as our legal basis for processing operations for which we obtain consent.
• Art. 6 (1) sentence 1 (b) GDPR is the legal basis insofar as the processing of personal data is necessary for the performance of a contract, e.g., when a site visitor purchases a product from us or we perform a service for them. This legal basis also applies to processing that is necessary for pre-contractual measures, such as inquiries about our products or services.
• Art. 6 (1) sentence 1 (c) GDPR applies when we fulfill a legal obligation by processing personal data, as may be the case, for example, under tax law.
• Art. 6 (1) sentence 1 (f) GDPR serves as the legal basis when we can rely on legitimate interests to process personal data, e.g., for cookies that are necessary for the technical operation of our website.

1.3 Data processing outside the EEA

Insofar as we transfer data to service providers or other third parties outside the EEA, adequacy decisions of the EU Commission pursuant to Art. 45 (3) GDPR guarantee the security of the data during transfer where such decisions exist, as is the case, for example, for the United Kingdom, Canada, and Israel. When data is transferred to service providers in the USA, the legal basis for the transfer is an adequacy decision of the EU Commission if the service provider has additionally certified itself under the EU-U.S. Data Privacy Framework.

In other cases (e.g., if no adequacy decision exists), the legal basis for the data transfer is generally, i.e., unless we indicate otherwise, standard contractual clauses. These are a set of rules adopted by the EU Commission and form part of the contract with the respective third party. Pursuant to Art. 46 (2) (b) GDPR, they ensure the security of the data transfer. Many of the providers have given contractual guarantees that go beyond the standard contractual clauses and protect the data further. These include, for example, guarantees regarding the encryption of data or an obligation of the third party to notify data subjects if law enforcement agencies seek access to data.

1.4 Storage period

Unless expressly stated otherwise in this privacy policy, the data we store will be deleted as soon as it is no longer required for its intended purpose and no statutory retention obligations prevent its deletion. If the data is not deleted because it is required for other, legally permissible purposes, its processing will be restricted, i.e., the data will be blocked and not processed for other purposes. This applies, for example, to data that we must retain for reasons of commercial or tax law.

1.5 Rights of data subjects

Data subjects have the following rights vis-à-vis us with regard to their personal data:

• the right of access,
• the right to rectification or erasure,
• the right to restriction of processing,
• the right to object to processing,
• the right to data portability,
• the right to withdraw consent at any time.

Data subjects also have the right to lodge a complaint with a data protection supervisory authority about the processing of their personal data. Contact details of the data protection supervisory authorities are available at https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html.

1.6 Obligation to provide data

In the context of a business or other relationship, customers, prospective customers, or third parties only need to provide us with the personal data that is necessary for establishing, carrying out, and terminating the business or other relationship, or that we are legally obliged to collect. Without this data, we will generally have to refuse to conclude a contract or provide a service, or will no longer be able to perform an existing contract or other relationship.

Mandatory fields are marked as such.

1.7 No automated decision-making in individual cases

As a rule, we do not use fully automated decision-making pursuant to Article 22 GDPR to establish and carry out a business or other relationship. Should we use such procedures in individual cases, we will provide separate information about this where required by law.

1.8 Contacting us

When you contact us, e.g., by email or telephone, the data you provide (e.g., names and email addresses) is stored by us in order to answer your questions. The legal basis for the processing is our legitimate interest (Art. 6 (1) sentence 1 (f) GDPR) in responding to inquiries addressed to us. We delete the data arising in this context once storage is no longer necessary, or restrict processing if statutory retention obligations exist.

2. Newsletter

We reserve the right to inform customers who have already used our services or purchased goods about our offers from time to time by email or other means, provided they have not objected. The legal basis for this data processing is Art. 6 (1) sentence 1 (f) GDPR. Our legitimate interest lies in direct marketing (Recital 47 GDPR). Customers can object to the use of their email address for advertising purposes at any time at no additional cost, for example via the link at the end of each email or by sending an email to our email address stated above.

Interested parties can subscribe to a free newsletter. We process the data provided during registration exclusively for sending the newsletter. Registration takes place by selecting the corresponding field on our website, by ticking the corresponding field in a paper document, or by another unambiguous action by which interested parties declare their consent to the processing of their data, so that the legal basis is Art. 6 (1) sentence 1 (a) GDPR. Consent can be withdrawn at any time, e.g., by clicking the corresponding link in the newsletter or by notifying us at our email address stated above. The processing of data up to the time of withdrawal remains lawful even in the event of withdrawal.

Based on the consent of the recipients (Art. 6 (1) sentence 1 (a) GDPR), we also measure the open and click rates of our newsletters in order to understand which content is relevant to our recipients.

We send newsletters using the HubSpot tool from the provider HubSpot, Inc., 25 1st Street Cambridge, MA 0214, USA. The provider processes content data, usage data, meta/communication data, and contact data in the USA. Further information is available in the provider's privacy policy at https://legal.hubspot.com/privacy-policy.

We send newsletters using the HubSpot tool from the provider HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany. The provider processes content data, usage data, meta/communication data, and contact data in the EU. Further information is available in the provider's privacy policy at https://legal.hubspot.com/privacy-policy.

3. Data processing on our website

4. Data processing on social media platforms

We are present on social media networks in order to present our organization and our services there. The operators of these networks regularly process their users' data for advertising purposes. Among other things, they create user profiles from users' online behavior, which are used, for example, to show advertising on the networks' pages and elsewhere on the internet that matches users' interests. For this purpose, the network operators store information about usage behavior in cookies on users' computers. It also cannot be ruled out that the operators combine this information with other data. Users can find further information, as well as details on how they can object to processing by the site operators, in the privacy policies of the respective operators listed below. It is also possible that the operators or their servers are located in non-EU countries, so that they process data there. This may result in risks for users, e.g., because it becomes more difficult to enforce their rights or because government agencies gain access to the data.

When users of the networks contact us via our profiles, we process the data provided to us in order to respond to the inquiries. This constitutes our legitimate interest, so that the legal basis is Art. 6 (1) sentence 1 (f) GDPR.

5. Changes to this privacy policy

We reserve the right to change this privacy policy with effect for the future. The current version is always available here.

6. Questions and comments

If you have any questions or comments regarding this privacy policy, please feel free to contact us using the contact details provided above.