Data Privacy Policy
I. The controller’s name and address
Controller for the purposes of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act, and service provider within the meaning of §13 German Teleservices Act is:
Irene Berlin Finanzierungsvermittlungs GmbH & Co. KG
Gartenstr. 9
55494 Rheinböllen, Germany
E-mail: berlin.irene@berlin-finanzierungen.de
II. General remarks regarding data processing
1. Scope of personal data processing
As a rule, the controller collects and processes the data subjects’ personal data only as far as it is needed to provide a functioning website and deliver its contents, especially with regards to the controller’s services. The collection and use of a data subject’s personal data is regularly conducted only after obtaining the data subject’s consent. An exception applies in cases in which obtaining consent ahead of time is unfeasible due to factual circumstance and the processing of data is permitted by legal regulations.
2. Legal basis for the processing of personal data
Art. 6 (1) lit. a GDPR serves as the legal basis for processing operations for which we obtain a data subject’s consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is party, the processing is based on Article 6 (1) lit. b GDPR. The same applies to such processing operations that are necessary for carrying out pre-contractual measures. Shall our company be subject to any legal obligation by which processing of personal data is required, the processing is based on Art. 6 (1) lit. c GDPR. In case the processing of personal data may be necessary to protect the vital interests of the data subject or of another natural person, the processing of personal data would also be based on Art. 6 (1) lit. d GDPR. Processing operations could be based on Article 6 (1) lit. f GDPR, if processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the data subject’s interests or fundamental rights and freedoms.
3. Data erasure and storage period
A data subject’s personal data shall be erased or blocked as soon as they are no longer necessary in relation to the purposes for which they were collected. The storage period may be extended if the European or national legislator provides for it in European regulations, laws or other provisions the controller is subject to. The blocking or erasure of data will also take place when the storage time limit prescribed by aforementioned norms expires, except in cases in which it is necessary to continue storing the data for the purpose of conclusion or fulfilment of a contract.
III. Website operation and log file creation
1. Description and scope of data processing
The controller’s website collects general data and information when a data subject or automated system calls up the website.
The following data is collected:
(1) the operating system used by the accessing system;
(2) the Internet service provider used by the accessing system;
(3) the IP address of the accessing system;
(4) the date and time of access to the Internet site;
(5) the website from which an accessing system reaches our website.
These general data and information are also stored in our system’s log files. These general data and information will not be stored in combination with the data subject’s other personal data.
2. Legal basis for data processing
Article 6 (1) lit. f GDPR forms the legal basis for the temporary storage of data and log files.
3. Purpose of data processing
The system’s temporary storage of the IP address is needed to facilitate the delivery of our website’s content to a data subject’s computer system. Thus, the data subject’s IP address must be stored for the duration of the session.
Log files are stored to ensure the website’s functioning. Additionally, this data serves the purpose of website optimisation and to ensure the security of our information technology systems. A data analysis for marketing purposes will not take place in this context.
These objectives are based on the pursuit of our legitimate interest in data processing under Article 6 (1) lit. f GDPR.
4. Length of storage period
The data will be erased as soon as the purpose of their storage is no longer required. Regarding the collection of data for the purpose of delivering a website’s content, this shall take effect as soon as the respective session is terminated.
Data stored in log files will be erased within seven days at the latest. A continued storage is, however, possible. In this case, the data subject’s IP address will be erased or rendered anonymous, making it impossible to trace back to the requesting client.
5. Objection and withdrawal procedures
The data collection for the purpose of website delivery and the storage of data in log files is absolutely necessary for the website’s operation. Thus, there is no right to object on the part of the data subject.
IV. Contact form and E-mail contact
1. Description of the scope of data processing
The controller’s website offers a contact form which can be used for establishing contact electronically. If a data subject chooses to use this means of communication, the data and information entered into this form will be transmitted to and stored by the controller. This data contains:
(1) title, first and last name;
(2) company name;
(3) telephone number;
(4) E-mail address.
Alternatively, the data subject may use the provided E-mail address to get in contact. In this case, the data subject’s personal data transmitted with this E-mail will be stored.
In this context, however, there will be no passing on of data to any third parties. The data is stored for the sole purpose of processing the communication.
2. Legal basis for data processing
The legal basis for processing a data subject’s data is founded on the pursuit of our legitimate interest to respond to the data subject’s enquiry pursuant to Article 6 (1) lit. f GDPR.
The legal basis for the processing of data that have been transferred by sending an Email is Article 6 (1) lit. f GDPR. If the enquiry via E-mail is aimed at the conclusion of a contract, the additional legal basis for the processing of data is Article 6 (1) lit. b GDPR.
3. Purpose of data processing
The processing of a data subject’s data and information from the contact form serves the sole purpose of processing the enquiry. In case of an enquiry via E-mail, there is a necessary legitimate interest to process this data.
4. Length of storage period
The data will be erased as soon as the purpose of their storage is no longer required. With regards to personal data from the contact form and data sent via E-mail, this shall take effect when a respective communication with a data subject is concluded. A communication is concluded if the circumstances present evidence that a respective subject matter has been ultimately resolved.
5. Objection and withdrawal procedures
A data subject shall have the right to withdraw his or her consent to the processing of his or her personal data at any time.
If a data subject wishes to exercise the right to withdraw the consent, he or she may, at any time, contact the controller via E-mail. In this case, the communication cannot be continued.
All personal data stored as part of the enquiry shall be erased in this case.
V. A data subject’s rights
Whenever your personal data is being processed, you become a data subject under GDPR, thus granting you the following right vis-à-vis the controller:
1. Right of confirmation
You shall have the right to obtain from the controller the confirmation as to whether or not your personal data are being processed.
2. Right to rectification
You shall have the right to obtain from the controller without undue delay the rectification and/or completion of inaccurate personal data concerning you.
3. Right to restrict data processing
You shall have the right to demand restriction from processing your personal data.
Once the processing of your personal data has been restricted, these data – aside from their storage – may be processed only with your expressed consent or for the purpose of establishing, exercising, or defending of legal claims or the protection of a natural or legal person or based upon the important public interest of the European Union or a member state.
4. Right to erasure
You shall have the right to obtain from the controller the erasure of your personal data without undue delay, and the controller shall have the obligation to erase personal data without undue delay.
Where the controller has made public personal data and under Article 17 (1) GDPR is obliged to erase the personal data, the controller, taking account of available technology and implementation costs, shall take reasonable steps, including technical measures, to inform other controllers processing the personal data that the data subject has requested erasure by such controllers of any links to, or copy or replication of, those personal data.
5. Right of notification
Once you have exercised your right to rectify, erase or restrict the processing of your personal data vis-à-vis the controller, the controller shall be obliged to notify any recipient to whom your personal data has been disclosed to of this rectification or erasure of these data or their restriction, unless it is deemed unfeasible or involves a disproportionate effort.
You shall have the right to obtain from the controller notification of these recipients.
6. Right to data portability
You shall have the right to receive your personal data, which was provided to a controller, in a structured, commonly used and machine-readable format.
7. Right to object
You shall have the right to object, on grounds relating to your particular situation, at any time, to the processing of your personal data, which is based on point (e) or (f) of Article 6 (1) GDPR. This also applies to profiling based on these provisions.
The controller shall no longer process the personal data in the event of the objection, unless the controller can demonstrate compelling legitimate grounds for the processing which override the data subject’s interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.
If the controller processes personal data for direct marketing purposes, you shall have the right to object at any time to the processing of your personal data for such marketing. This also applies to profiling to the extent that it is related to such direct marketing.
If you object to the processing for direct marketing purposes, the controller shall no longer process your personal data for these purposes.
In addition, you shall be free in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, to use your right to object by automated means using technical specifications.
8. Right to withdraw from data privacy agreement
You shall have the right to withdraw your data privacy agreement at any time. In this context, the lawfulness of the processing of personal data up until the point of withdrawal from the agreement shall remain intact.
9. Right to register a complaint with a regulatory authority
You shall have the right to register a complaint with a regulatory authority if you have come to the conclusion that the processing of your personal data violates applicable law.