In accordance with the legal requirements of data protection law (in particular the BDSG as amended and the European Data Protection Regulation ‘DS-GVO’), we inform you below about the nature, scope and purpose of the processing of personal data by our company.
Name and contact details of the person(s) responsible
Our responsible person(s) (hereinafter “responsible person(s)”) within the meaning of Art. 4 item. 7 GDPR is:
Aerial Athletics UG (haftungsbeschränkt) & Co. KG
Roderbirkener Str. 6A
40591 Düsseldorf, Germany
Register court: Local court Düsseldorf
Registration number: HRA 24332
Fitness EnterTraining UG (limited liability)
Rethelstr. 28 Court
40237 Düsseldorf, Germany
Managing Director: Huong Vu
Commercial Register No.: HRB 67840
Register court: Local court Düsseldorf
E-mail address: firstname.lastname@example.org
Types of data, purposes of processing and categories of data subjects
In the following, we inform you about the type, scope and purpose of the collection, processing and use of personal data.
1. types of data we process
Usage data (access times, websites visited, etc.), inventory data (name, address, etc.), contact data (telephone number, e-mail, fax, etc.), payment data (bank data, account data, payment history, etc.), contract data (subject of the contract, term, etc.), content data (text entries, videos, photos, etc.),
2. purposes of the processing according to Art. 13 para. 1 c) GDPR
Settlement of contracts, purposes of proof / preservation of evidence, technical and economic optimization of the website, easy access to the website, fulfillment of contractual obligations, contact in case of legal complaints by third parties, fulfillment of legal retention obligations, optimization and statistical analysis of our services, improve user experience, website user-friendly design, economic operation of advertising and website, marketing / sales / advertising, compilation of statistics, prevention of SPAM and abuse, customer service and customer care, handle contact requests, provide websites with functions and content, security measures, uninterrupted, secure operation of our website,
3. categories of data subjects referred to in Article 13(1). 1 e) GDPR
Visitors/users of the website, customers, suppliers, interested parties, employees,
The data subjects are collectively referred to as “users”.
Legal basis for the processing of personal data
In the following we inform you about the legal basis of the processing of personal data:
- If we have obtained your consent for the processing of personal data, Art. 6 para. 1 S. 1 lit. (a) DS-GVO Legal basis.
- If the processing is necessary for the performance of a contract or for the implementation of pre-contractual measures taken at your request, Art. 6 para. 1 S. 1 lit. (b) DS-GVO Legal basis.
- If the processing is necessary for the fulfilment of a legal obligation to which we are subject (e.g. statutory retention obligations), Art. 6 para. 1 S. 1 lit. (c) DS-GVO Legal basis.
- Where processing is necessary to protect the vital interests of the data subject or of another natural person, Article 6(1)(b) shall apply. 1 S. 1 lit. (d) DS-GVO Legal basis.
- If the processing is necessary to protect our legitimate interests or the legitimate interests of a third party and if your interests or fundamental rights and freedoms are not overridden in this respect, Art. 6 (1) of the Data Protection Act shall apply. 1 S. 1 lit. (f) DS-GVO Legal basis.
Disclosure of personal data to third parties and processors
As a matter of principle, we do not pass on any data to third parties without your consent. Should this nevertheless be the case, then the data will be passed on on the basis of the aforementioned legal grounds, e.g. in the case of the passing on of data to online payment providers for the fulfilment of a contract or on the basis of a court order or because of a legal obligation to hand over the data for the purpose of criminal prosecution, to avert danger or to enforce intellectual property rights.
We also use contract processors (external service providers, e.g. for web hosting of our websites and databases) to process your data. If data is passed on to processors within the framework of a commissioned processing agreement, this is always done in accordance with Art. 28 DS-GVO. We select our processors carefully, monitor them regularly and have been granted the right to issue instructions regarding the data. In addition, the processors must have taken appropriate technical and organisational measures and must comply with the data protection provisions in accordance with the Data Protection Act. Comply with BDSG n.F. and DS-GVO
Data transfer to third countries
The adoption of the European General Data Protection Regulation (GDPR) has created a uniform basis for data protection in Europe. Your data will therefore be processed mainly by companies to which the GDPR applies. However, if the processing is carried out by services of third parties outside the European Union or the European Economic Area, these must meet the special requirements of Art. 44 et seq. GDPR. This means that the processing is carried out on the basis of special guarantees, such as the officially recognised determination by the EU Commission of a level of data protection corresponding to the EU or the observance of officially recognised special contractual obligations, the so-called “standard contractual clauses”.
Insofar as we, due to the ineffectiveness of the so-called “Privacy Shield”, according to Art. 49 para. 1 S. 1 lit. a) DSGVO to obtain your express consent to the transfer of data to the USA, we point out in this regard the risk of secret access by US authorities and the use of the data for monitoring purposes, possibly without any legal remedy for EU citizens.
Deletion of data and storage period
Unless expressly stated in this data protection declaration, your personal data will be deleted or blocked as soon as you revoke your consent to the processing or the purpose for the storage no longer applies or the data is no longer required for the purpose, unless their continued storage is necessary for evidentiary purposes or is contrary to statutory storage obligations. This includes, for example, commercial law obligations to retain business letters in accordance with § 257 para. 1 HGB (6 years) as well as tax law storage obligations according to § 147 Abs. 1 AO of supporting documents (10 years). If the prescribed retention period expires, your data will be blocked or deleted, unless the storage is still necessary for the conclusion or fulfilment of a contract.
Existence of automated decision making
We do not use automated decision making or profiling.
Provision of our website and creation of log files
- If you only use our website for informational purposes (i.e. no registration and no other transmission of information), we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data:
– IP address;
– Internet service provider of the user;
– Date and time of the retrieval;
– Browser type;
– Language and browser version;
– Contents of the call;
– Time Zone;
– Access Status/HTTP Status Code;
– Amount of data;
– Websites from which the request comes;
– Operating system.
A storage of these data together with other personal data of you does not take place.
- This data serves the purpose of user-friendly, functional and secure delivery of our website to you with functions and content as well as its optimization and statistical evaluation.
- The legal basis for this is our legitimate interest in data processing, which also lies in the above purposes, in accordance with Art. 6 Para. 1 S.1 lit. (f) GDPR.
- For security reasons, we store this data in server log files for a storage period of 90 days. After this period, they are automatically deleted, unless we need to keep them for evidence purposes in the event of attacks on the server infrastructure or other legal violations.
Execution of contracts
- We process inventory data (e.g. company, title/academic degree, names and addresses as well as contact data of users, e-mail), contract data (e.g. services used, names of contact persons) and payment data (e.g. bank details, payment history) for the purpose of fulfilling our contractual obligations (knowledge of who is a contracting party; justification, content and execution of the contract; checking the plausibility of the data) and services (e.g. contacting customer service) in accordance with the German Data Protection Act. Art. 6 para. 1 p. 1 lit b) DS-GVO. The entries marked as obligatory in online forms are required for the conclusion of the contract.
- This data will not be passed on to third parties unless it is necessary for the pursuit of our claims (e.g. transfer to a lawyer for debt collection) or for the fulfilment of the contract (e.g. transfer of the data to a payment provider) or if there is a legal obligation to do so in accordance with the German Data Protection Act. Art. 6 para. 1 S. 1 lit. (c) GDPR.
- We may also process the data you provide to inform you about other interesting products from our portfolio or to send you e-mails with technical information.
- The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. This is the case for inventory and contract data when the data is no longer required for the performance of the contract and claims can no longer be asserted under the contract because they are time-barred (warranty: two years / standard limitation period: three years). We are obliged by commercial and tax law to store your address, payment and order data for a period of ten years. However, we will restrict processing after three years if the contract is terminated, i.e. your data will only be used to comply with legal obligations. Information in the user account remains until it is deleted.
- You can subscribe to our newsletter with your voluntary consent by entering your e-mail address. Only this one is mandatory. The indication of further data is voluntary and serves only the purpose of a personal address. We use the so-called “double opt-in procedure” for registration. After you have registered with your e-mail, you will receive an e-mail from us with a link to confirm your registration. If you click on this confirmation link, your e-mail will be added to the newsletter distribution list and stored for the purpose of sending e-mails. If you do not click on the confirmation link within 24 hours, your registration data will be blocked and automatically deleted after 30 days.
- In addition, we log your IP address used during registration as well as the date and time of the double opt-in (registration and confirmation). The purpose of this storage is the fulfilment of legal requirements regarding the proof of your registration as well as the prevention of abuse regarding your e-mail.
- Within the scope of your declaration of consent, the contents (e.g. advertised products/services, offers, advertising and topics) of the newsletter are described in detail.
- We use the following dispatch service provider for sending e-mails:
- When sending the newsletter, we evaluate your user behaviour. For this purpose, the newsletters contain so-called “web beacons” or “tracking pixels”, which are called up when the newsletter is opened. For the evaluations we link the web beacons with your e-mail address and an individual ID. Links received in the newsletter also contain this ID. The data is collected exclusively pseudonymously, i.e. the IDs are not linked to your other personal data, a direct personal reference is excluded. With this data we can determine whether and when you have opened the newsletter and which links in the newsletter have been clicked. This serves the purpose of optimizing and statistically evaluating our newsletter.
- The legal basis for the newsletter dispatch, performance measurement and the storage of the e-mail is your consent in accordance with §§ 3, 4 and 5 of the German Data Protection Act. Art. 6 para. 1 S. 1 lit. a) DS-GVO in conjunction with § 7 para. 2 No. 3 UWG and for the recording of consent Art. 6 para. 1 S. 1 lit. f) DS-GVO, as this serves our legitimate interest of legal provability.
- You can object to tracking at any time by clicking the unsubscribe link at the end of the newsletter. In this case, however, the receipt of the newsletter would also be terminated. If you deactivate the display of images in your e-mail software, tracking is also not possible. However, this may have restrictions on the functions of the newsletter and included images will then not be displayed.
- You can revoke your consent to receive the newsletter at any time. You can exercise the revocation by clicking the unsubscribe link at the bottom of the newsletter, an email or message to our contact details above. We store your data as long as you have subscribed to the newsletter. After unsubscribing, your data will only be stored anonymously for statistical purposes.
- We have integrated the website analysis tool “Google Analytics”(service provider: Google Ireland Limited, Reg. No.: 368047, Gordon House, Barrow Street, Dublin 4, Ireland) integrated on our website.
- Purpose of processing: The use of Google Analytics serves the purpose of analyzing, optimizing and improving our website.
- Legal basis: If you have given your consent (“opt-in”) for the processing of your personal data by means of “Google Analytics” from the third-party provider, then Art. 6 para. 1 S. 1 lit. a) DS-GVO the legal basis. The legal basis is also our legitimate interest in the above purposes (the analysis, optimization and improvement of our website) in the data processing in accordance with Art. 6 Para. 1 S.1 lit. (f) GDPR. In the case of services provided in connection with a contract, the tracking and analysis of user behaviour is carried out in accordance with Art. 6 para. 1 S. 1 lit. b) DS-GVO, in order to be able to offer optimized services for the fulfillment of the contract purpose with the information gained thereby.
- Storage period: The data sent by us and linked to cookies, user IDs (e.g. user ID) or advertising IDs are automatically deleted after months. The deletion of data whose retention period has been reached takes place automatically once a month.
- Data transfer/recipient category: Google, Ireland and USA. We have also concluded an order processing agreement with Google in accordance with Art. 28 DS-GVO.
- Possibilities of objection and removal (“Opt-Out”):
-You can generally prevent cookies from being stored on your hard drive by selecting “do not accept cookies” in your browser settings. However, this may result in a functional restriction of our offers. You can also prevent the collection of data generated by the cookie and related to your use of the website, as well as the processing of this data by Google, by downloading and installing the browser plugin available under the following link: http://tools.google.com/dlpage/gaoptout?hl=de-AlsAs an alternative to the above browser plugin, you can prevent Google Analytics from collecting data by selecting [__hier bitte__den Analytics Opt-Out Link Ihrer Webseite einfügen] click. By clicking, an “opt-out” cookie is set, which prevents the collection of your data when visiting this website in the future. This cookie is only valid for our website and your current browser and will only last until you delete your cookies. In that case, you would have to set the cookie again.-The cross-device user analysis in your Google account under “My data”. > Deactivate “personal data”.
- We have embedded YouTube videos from youtube.com on our website using the embedded function so that they can be called up directly on our website. YouTube belongs to Google Ireland Limited, Register No.: 368047, Gordon House, Barrow Street, Dublin 4, Ireland.
- Data category and description of data processing: Usage data (e.g. website accessed, content and access times). We have integrated the videos in the so-called “extended data protection mode” without using cookies to record user behaviour in order to personalise the video playback. Instead, video recommendations are based on the video currently playing. Videos that play in enhanced privacy mode in an embedded player do not affect which videos are recommended to you on YouTube. When you start a video (click on the video), you consent to YouTube tracking the information that you have accessed the corresponding subpage or video on our website and using this data for advertising purposes.
- Purpose of the processing: Provision of a user-friendly offer, optimization and improvement of our content.
- Legal basis: If you have given your consent (“opt-in”) for processing of your personal data by means of “etracker” from the third-party provider, then Art. 6 para. 1 S. 1 lit. a) DS-GVO the legal basis. The legal basis is also our legitimate interest in the processing of data in accordance with Art. 6 Para. 1 S.1 lit. (f) GDPR. In the case of services provided in connection with a contract, the tracking and analysis of user behaviour is carried out in accordance with Art. 6 para. 1 S. 1 lit. b) DS-GVO, in order to be able to offer optimized services for the fulfillment of the contract purpose with the information gained thereby.
- Data transfer/recipient category: third-party providers in the USA. The data obtained is transferred to the USA and stored there. This is done even without a user account with Google. If you are logged into your Google account, Google can assign the above data to your account. If you do not wish to do this, you must log out of your Google account. Google creates user profiles from such data and uses this data for the purposes of advertising, market research or optimisation of its websites.
- Storage period: Cookies up to 2 years or until the cookies are deleted by you as the user.
- We have integrated maps from “Google Maps”(provider: Google Ireland Limited, Reg. No.: 368047, Gordon House, Barrow Street, Dublin 4, Ireland).
- Data category and description of data processing: Usage data (e.g. IP, location, page viewed). Google Maps allows us to display the location of addresses and directions directly on our website in interactive maps and allows you to use this tool. When you visit our website where Google Maps is integrated, a connection is established to Google’s servers in the USA. In doing so, your IP and location may be transmitted to Google. In addition, Google receives the information that you have accessed the corresponding page. This is done even without a user account with Google. If you are logged into your Google account, Google can assign the above data to your account. If you do not wish to do this, you must log out of your Google account. Google creates user profiles from such data and uses this data for the purposes of advertising, market research or optimisation of its websites.
- Purpose of the processing: to provide a user-friendly, economic and optimised website.
- Legal basis: If you have given your consent (“opt-in”) for the processing of your personal data by means of “Google Maps” by the third party provider, then Art. 6 para. 1 S. 1 lit. a) DS-GVO the legal basis. The legal basis is also our legitimate interest in the processing of data in accordance with Art. 6 Para. 1 S.1 lit. (f) GDPR.
- Data transfer/recipient category: third-party providers in the USA.
- Storage period: Cookies up to 6 months or until you delete them. Otherwise, as soon as they are no longer needed for the processing purposes.
Social media presence
- Data categories and description of data processing: usage data, contact data, content data, inventory data. Furthermore, user data within social networks is usually processed for market research and advertising purposes. For example, usage profiles can be created on the basis of the usage behaviour and the resulting interests of the users. The usage profiles can in turn be used, for example, to display advertisements within and outside the networks that presumably correspond to the interests of the users. For these purposes, cookies are usually stored on the users’ computers, in which the usage behaviour and the interests of the users are stored. Furthermore, data may also be stored in the usage profiles irrespective of the devices used by the users (in particular if the users are members of the respective platforms and are logged in to them). For a detailed description of the respective forms of processing and the possibilities of objection (opt-out), we refer to the data protection declarations and information provided by the operators of the respective networks. Also in the case of requests for information and the assertion of data subject rights, we point out that these can be asserted most effectively with the providers. Only the providers have access to the users’ data in each case and can take appropriate measures and provide information directly. If you still need help, then you can contact us.
- Purpose of the processing: communication with users connected and registered on the social networks; information and advertising of our products, offers and services; external presentation and image maintenance; evaluation and analysis of the users and contents of our presences in the social media.
- Legal basis: The legal basis for the processing of personal data is our legitimate interest in the above-mentioned purposes in accordance with Art. 6 Para. 1 S. 1 lit. (f) GDPR. Insofar as you have given us or the person responsible for the social network consent to the processing of your personal data, the legal basis is Art. 6 Para. 1 S. 1 lit. a) in conjunction with. Art. 7 DS-GVO.
- Data transfer/recipient category: social network.
Social Media Plug-ins
- Data category and description of data processing: usage data, content data, inventory data. When accessing our website, “Shariff” does not transmit any personal data to the third-party providers of the social plug-ins. Next to the logo or brand of the social network, you will find a slider that allows you to activate the plug-in with a click. This activation represents your consent in the form that the respective provider of the social network receives the information that you have accessed our website and your personal data is transmitted to the provider of the plug-in and stored there. These are so-called third party cookies. According to some providers such as Facebook and XING, your IP is anonymized immediately after collection. The data collected about the user is stored by the plug-in provider as usage profiles. You can revoke your consent at any time by deactivating the controller.
- Purpose of the data processing: improvement and optimization of our website; increase of our publicity by means of social networks; possibility of interaction with you and the users among themselves via social networks; advertising, analysis and/or demand-oriented design of the website.
- Legal basis: The legal basis for the processing of personal data is our legitimate interest in the above-mentioned purposes in accordance with Art. 6 Para. 1 S. 1 lit. (f) GDPR. Insofar as you have given us or the person responsible for the social network consent to the processing of your personal data, the legal basis is Art. 6 Para. 1 S. 1 lit. a) in conjunction with. Art. 7 DS-GVO. In the case of pre-contractual enquiries or the use of your personal data for the performance of a contract, Art. 6 para. 1 S. 1 lit. (b) DS-GVO Legal basis.
- Data transfer/recipient category: social network.
- Social networks used and objection: We refer to the respective privacy statements of the social networks with regard to the purpose and scope of data collection and processing. In addition, you will also find information on your rights and setting options for the protection of your personal data. You have the right to object to the creation of these user profiles, whereby you can contact the respective plug-in provider directly to exercise these rights.
- We have integrated plug-ins from the social network Instagram (service provider: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) as part of the so-called “two-click solution” from Shariff. You can recognize these by the Instagram logo in the shape of a square camera.
- If you voluntarily activate the plug-in, a connection is established from your browser to the servers of Instagram. In doing so, Instagram receives the information, including your IP address, that you have visited our site and transmits the information to Instagram servers in the USA, where this information is stored. If you are logged into your account on Instagram, Instagram can assign this information to your account and you can click the Instagram button and thus share and save the content of our pages on your Instagram account and possibly show it to your friends there. We have no knowledge about the exact content of the transmitted data, their use and storage period by Instagram.
- If you log out of Instagram before visiting our website and delete your cookies, no data about your visit to our website will be assigned to your profile on Instagram when the plug-in is activated.
Data protection in applications and in the application procedure
- Applications sent electronically or by post to the person responsible will be processed electronically or manually for the purposes of managing the application procedure.
- We expressly point out that application documents with “special categories of personal data” according to Art. 9 DS-GVO (e.g. a photo that gives conclusions about your ethnic origin, religion or marital status), with the exception of a possible severe disability, which you wish to disclose of your own free will, are undesirable. You should submit your application without this data. This will not affect your chances of applying.
- Legal bases for the processing are Art. 6 para. 1 S.1 lit. b) DS-GVO as well as § 26 BDSG n.F.
- If an employment relationship is entered into with the applicant after completion of the application process, the applicant data will be stored in compliance with the relevant data protection regulations. If you are not offered a job after the application process has been completed, your submitted letter of application including documents will be deleted 6 months after the rejection has been sent, in order to be able to satisfy any claims and obligations to provide evidence in accordance with the AGG.
Rights of the data subject
Objection or revocation against the processing of your data
Insofar as the processing is based on your consent pursuant to Art. 6 para. 1 S. 1 lit. a), Art. 7 DS-GVO, you have the right to revoke your consent at any time. The lawfulness of the processing carried out on the basis of the consent up to the revocation is not affected by this.Insofar as we base the processing of your personal data on the balancing of interests in accordance with Art. 6 Para. 1 S. 1 lit. f) DS-GVO, you may object to the processing. This is the case if the processing is not necessary, in particular, for the performance of a contract with you, which is shown by us in each case in the following description of the functions. When exercising such an objection, we will ask you to explain the reasons why we should not process your personal data as we have done. In the event of your justified objection, we will review the situation and either discontinue or adapt the data processing or show you our compelling legitimate grounds on the basis of which we will continue the processing.
You can object to the processing of your personal data for the purposes of advertising and data analysis at any time. You can exercise the right of objection free of charge. You can inform us of your advertising objection using the following contact details:
Aerial Athletics UG (haftungsbeschränkt) & Co. KG
Rethelstr. 28 Court
40237 Düsseldorf, Germany
Managing Director Huong Vu
Commercial register no.: HRA 24332
Register court: Local court Düsseldorf
E-mail address: email@example.com
- Right to information
You have the right to request confirmation from us as to whether personal data relating to you is being processed. If this is the case, you have a right to information about your personal data stored by us in accordance with Art. 15 DS-GVO. This includes, in particular, information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the origin of your data if it has not been collected directly from you.
- right of rectification
You have a right to correct inaccurate data or to complete correct data according to Art. 16 DS-GVO.
- right of cancellation
You have the right to have your data stored by us deleted in accordance with Art. 17 DS-GVO, unless legal or contractual retention periods or other legal obligations or rights to further storage prevent this.
- right to restriction
You have the right to request a restriction in the processing of your personal data if one of the conditions in Art. 18 Para. 1 lit. (a) to (d) of the GDPR is fulfilled:
– If you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;- The processing is unlawful and you object to the erasure of the personal data and request instead the restriction of the use of the personal data;- The controller no longer needs the personal data for the purposes of the processing, but you need them for the establishment, exercise or defence of legal claims, or
– if you object to the processing pursuant to Art. 21 para. 1 DS-GVO and it is not yet clear whether the legitimate reasons of the controller outweigh your reasons.
- Right to data portability
You have a right to data portability under Article 20 of the DS-GVO, which means that you can obtain the personal data we hold about you in a structured, commonly used and machine-readable format or request that it be transferred to another controller.
- right of appeal
You have a right to complain to a supervisory authority. As a rule, you can contact the supervisory authority for this purpose, in particular in the member state of your place of residence, your place of work or the place of the alleged infringement.
In order to protect all personal data transmitted to us and to ensure that the data protection regulations are complied with by us, as well as by our external service providers, we have taken appropriate technical and organisational security measures. Therefore, among other things, all data between your browser and our server is transmitted encrypted via a secure SSL connection.