PRIVACY NOTICE OF LIZENZDIREKT AG
We comply with the applicable data protection regulations, in particular the requirements of the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the German Act on Data Protection and the Protection of Privacy in Telecommunications and Digital Services (TDDDG) and other data protection provisions. We process your personal data only where the law permits such processing or where you have given your consent to the processing of your data. Transparency in data processing is important to us, which is why we would like to inform you comprehensively with the following data protection information.
This privacy notice applies to our website www.lizenzdirekt.com. Where you use our licence portal “LiPo”, this notice also applies to it on a supplementary basis; the relevant sections are each expressly marked as “in the LiPo portal”. The licence portal uses its own consent model, independent of the cookie consent used on the rest of our website, with its own third-party components (see Section 5(f) and Section 8); the general statements on cookies and third-party services in the other sections of this document refer to our website and not to the portal.
LizenzDirekt AG
Untermüli 7
6300 Zug
Switzerland
Phone: +41 41 5000 – 650
a. Scope & purpose of the processing of personal data
As a user of this website, we generally process your personal data only to the extent necessary to provide a functional website as well as our content and services. Your personal data is processed only on the basis of your purpose-specific consent, unless the processing is permitted by law without obtaining prior consent. The purposes of processing result from the processing activities described in more detail below.
b. Legal basis for the processing of personal data
Where we obtain your consent for processing operations involving personal data, Art. 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.
Where the processing of your data is necessary for the performance of a contract to which you are a party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary to take steps prior to entering into a contract.
Where processing is necessary for compliance with a legal obligation to which we are subject, Art. 6(1)(c) GDPR serves as the legal basis.
Where the vital interests of you or another natural person make the processing of personal data necessary, Art. 6(1)(d) GDPR serves as the legal basis.
Where processing is necessary for the purposes of the legitimate interests of our company or of a third party, and your interests, fundamental rights and freedoms do not override the first-mentioned interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing.
c. Data erasure and storage period
Your personal data will be erased or blocked as soon as the purpose of storage no longer applies. Data may also be stored beyond this if provided for by laws or other legal provisions binding on us. Data will also be blocked or erased when a storage period prescribed by the aforementioned legal provisions expires, unless further storage of the data is necessary for the conclusion or performance of a contract.
d. Types of data processed
- Master data (e.g. name, address);
- Contact data (e.g. email address, telephone number);
- Content data (e.g. text entries, photographs, videos);
- Usage data (e.g. pages visited, access times, personal interests);
- Communication and metadata (e.g. IP addresses, device information).
e. Purposes of processing
- Provision of the online offering, its functions and content;
- Responding to contact requests and communicating with users;
- Security measures;
- Reach measurement/marketing.
f. Categories of data subjects
Visitors to and users of the online offering (hereinafter “users”).
g. Requirements for the provision of data and consequences of failure to provide it
The provision of personal data is in some cases required by law (e.g. tax regulations) or may also result from contractual provisions (e.g. information on the contracting party). To conclude a contract, it may be necessary for you to provide us with personal data that we subsequently have to process. For example, you are obliged to provide us with personal data when our company concludes a contract with you. Failure to provide the personal data would mean that the contract could not be concluded.
h. Automated decision-making
We do not carry out automated decision-making.
i. Processing in connection with the licence portal “LiPo”
This privacy notice also applies to our licence portal “LiPo”, through which customers can manage the software licences purchased from us and create additional users. Where, in the portal, we process personal data of the users designated by our customers (in particular name, email address, role and usage data) on behalf of the respective customer, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR concluded with the respective customer; to that extent, the customer remains the controller of this data within the meaning of the GDPR. The currently valid version of this agreement can be requested from us informally using the contact details provided in Section 1. If an authorised user of the customer confirms a new version of this agreement in the portal, it replaces any previously existing version with effect for the future.
When your personal data is processed, you have the following rights, about which we are pleased to inform you below. You can contact us as the controller for this purpose; the contact details can be found above under Section 1. Where your data is processed as a user in the LiPo portal on behalf of a customer (see Section 2(i)), the respective customer is the controller of this data within the meaning of the GDPR; in this case, please contact your customer or employer first. We will forward any such requests that nevertheless reach us to the relevant customer without undue delay, provided we know the customer’s identity.
a. Right of access (Art. 15 GDPR)
Upon request, we will confirm whether personal data concerning you is being processed. If this is the case, you have the right to be informed of the following:
- the purpose(s) of the data processing,
- the categories of data processed, and
- where applicable, the recipients or categories of recipients to whom data is disclosed on the basis of legal obligations or contractual relationships, in particular recipients in third countries
- the envisaged storage period or, if this is not possible, the criteria used to determine that period
- the existence of the right to request rectification or erasure of personal data concerning you, or restriction of processing by us, or to object to such processing
- the right to lodge a complaint with a supervisory authority
- where the personal data is not collected from the data subject: any available information as to its source
- the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject
- in the event of a transfer to a third country or to an international organisation, the appropriate safeguards relating to the transfer.
Upon request, you will receive a copy of the data collected and processed about you. This is generally free of charge.
b. Right to rectification (Art. 16 GDPR)
You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
c. Right to erasure (Art. 17 GDPR) (“right to be forgotten”)
Upon request, or after performance or termination of the contract with us, your personal data will be erased promptly, unless this is precluded by retention or documentation obligations under tax or commercial law, or unless safeguarding the legitimate interests of the controller would be jeopardised.
A right to erasure exists under the following conditions:
- The personal data was collected or otherwise processed for purposes for which it is no longer necessary.
- You withdraw your consent on which the processing was based pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, and there is no other legal ground for the processing.
- You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR.
- the personal data has been processed unlawfully.
- the erasure of the personal data is required for compliance with a legal obligation under Union or Member State law to which the controller is subject.
- The personal data was collected in relation to the offer of information society services referred to in Art. 8(1) GDPR (consent was given by a child)
d. Right to restriction of processing (Art. 18 GDPR) (blocking)
You have the right to request the restriction of processing, i.e. the blocking of your personal data for processing, under the following conditions:
- you contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data.
- the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead.
- the controller no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims.
- The user has objected to processing pursuant to Art. 21(1) GDPR, pending verification whether the legitimate grounds of the controller override those of the user.
e. Right to data portability (Art. 20 GDPR)
Upon request, your data can be provided for a fee in a structured, commonly used and machine-readable format for you and a subsequent service provider, in order to enable a quick transfer. This applies in any case where the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and the processing is carried out by automated means.
f. Right to withdraw your consent (Art. 7(3) GDPR)
You can withdraw any consent you have given at any time by notifying us. As a result, we may no longer continue the data processing based on this consent in the future.
g. Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
If you believe that data protection provisions have been infringed, you have the right to lodge a complaint with the competent supervisory authority. For companies in Hamburg, for example, this is the Hamburg Commissioner for Data Protection and Freedom of Information: https://www.datenschutz-hamburg.de
h. Right to object (Art. 21 GDPR)
You also have the right to object to the processing of your personal data. Where the processing is carried out for direct marketing purposes (e.g. newsletters), this right applies at any time. Otherwise, you may also have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you. This applies only where the processing is based on Art. 6(1)(e) or (f) GDPR (performance of a task in the public interest or pursuit of legitimate interests by the controller). We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
To exercise this right of withdrawal, you can also send us an informal message stating your email address, using the contact details provided in Section 1, in which you express your intention to withdraw.
a. Log files
When you use the website purely for information purposes, i.e. if you do not register or otherwise transmit information to us, we only collect the personal data that your browser transmits to our server. When you view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure its stability and security (the legal basis is Art. 6(1)(f) GDPR and Section 25(2) TDDDG):
Date and time of access, name of the pages accessed, IP address of the requesting device, referrer URL (the URL from which visitors came to our website), amount of data transferred, loading time, browser type, language & version, name of the visitor’s access provider, operating system and its interface.
b. Hosting
We use a hosting provider to provide certain services in connection with the operation of this website: specifically, these include IT infrastructure, computing capacity, database services, email delivery, security services, server storage space and technical maintenance services. In doing so, we or our host, acting on our behalf pursuant to Art. 28 GDPR, process master data, contact data, content data, contract data, usage data, metadata and communication data of the visitors to our website on the basis of our legitimate interest in the professional and secure provision of our website pursuant to Art. 6(1)(f) GDPR. Data is also transferred to and stored on servers of our service provider located in Switzerland. For Switzerland, there is an adequacy decision of the EU Commission within the meaning of Art. 45 GDPR (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02000D0518-20161217).
In addition to the data mentioned above, cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive by the browser you use and that allow certain information to flow to us as the entity that set the cookie. Cookies cannot run programs or transfer viruses to your computer. They serve to make the website more user-friendly and effective overall.
Use of cookies:
a) Temporary cookies are deleted automatically when you close your browser. These include, in particular, session cookies. They store a so-called session ID, with which various requests from your browser can be assigned to the same session. This allows your computer to be recognised when you return to our website. Session cookies are deleted when you log out or close your browser.
b) Persistent cookies remain stored even after the browser is closed. In this way, for example, settings or preferences can be saved.
c) First-party cookies are set by the respective website operator itself, whereas third-party cookies are used by third parties (e.g. advertising partners).
d) Necessary cookies (also called essential cookies) are either strictly necessary for the operation of a website (e.g. to store logins or other user input) or required for security reasons.
e) In addition, cookies are set, for example, for personalisation, statistical purposes and marketing.
Where these cookies are not necessary and/or the information they contain constitutes personal data, the legal basis for the data processing is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG, which is stored via a cookie. Your consent covers the storage of the cookie on your device, the transmission of the information stored on your device by cookies, and the associated processing of personal data.
Where these cookies are necessary cookies and/or the information they contain constitutes personal data, the legal basis for the data processing is Art. 6(1)(f) GDPR and Section 25(2) No. 1 TDDDG. Our interest in maintaining the functionality of our website is to be regarded as legitimate within the meaning of the aforementioned provision.
Where the processing is based on your consent, you may withdraw it at any time with effect for the future and thereby prevent further collection of your data by deselecting optional (non-essential) cookies in the cookie settings. If and to the extent that you do not consent or withdraw consent you have given, the (further) collection of data by means of optional cookies requiring consent, and the associated data processing, will not take place. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
More detailed information on the cookies we use and how to activate and deactivate them can be found in our Cookie Policy.
You can configure your browser settings according to your preferences and, for example, refuse to accept third-party cookies or all cookies. Please note that you may then not be able to use all functions of this website. In addition, you can generally object to the use of cookies for online marketing, for example on the website http://www.youronlinechoices.com.
Details of the third-party services mentioned above can be found in the sections below.
f) Cookies in the LiPo portal. The foregoing statements in this Section 5, as well as the Cookie Policy available at www.lizenzdirekt.com/cookie-richtlinie-eu/, relate exclusively to our website. In our licence portal “LiPo”, we use a separate consent model with different third-party components: when you log in to the portal itself, no cookies are set beyond the technically necessary session (legal basis for these necessary cookies: Art. 6(1)(f) GDPR, Section 25(2) No. 1 TDDDG). After logging in, a consent banner appears on the first portal page, allowing you to choose between the options “Reject all”, “Accept all” and “Necessary only”. Only after selecting “Accept all” are cookies and similar technologies for third-party content embedded in the portal loaded on the basis of your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), in particular for the support chat (see Section 8) as well as for embedded videos and statistics tools in the portal; which third-party providers are specifically concerned results exclusively from the portal-specific sections of this document, not from the website third-party services listed above. You can change your selection at any time via the settings function in the footer of the portal.
In connection with the provision of pre-contractual or contractual services, we process your data as our contractual partner or prospective customer pursuant to Art. 6(1)(b) GDPR. The type, content, scope and purpose of the data processed by us, as well as the necessity thereof, result from the underlying (pre-)contractual relationship. This includes the master data of our contractual partners, contact data (such as email address, telephone number) as well as contract data and payment data (e.g. the bank details provided). As a rule, we do not process special categories of personal data unless they form part of commissioned or contractual processing.
We process data – where necessary – to establish and fulfil the agreed contractual services. Where this is not obvious, we inform our customers accordingly. Data is disclosed to third parties only to the extent necessary for the contract. When you use our online services, we may store the IP address and the time of the respective user action. This storage is based on our legitimate interests and serves to protect against misuse and other unauthorised use. This data is not disclosed to third parties unless this is necessary to pursue claims within the meaning of Art. 6(1)(f) GDPR or there is a legal obligation pursuant to Art. 6(1)(c) GDPR.
The data is erased when its storage is no longer necessary to fulfil contractual or statutory obligations or to deal with any warranty and comparable obligations. The necessity is generally reviewed every three years. Otherwise, data is retained if and for as long as statutory retention obligations exist.
a. Newsletter
If you wish to receive the newsletter offered on our website, we require your email address as well as information that allows us to verify that you are the owner of the email address provided and that you agree to receive the newsletter. For newsletter registration we use the so-called double opt-in procedure. This means that after you register, we send an email to the email address provided asking you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 24 hours, your information will be blocked and automatically deleted after one month. In addition, we store the IP addresses you used and the times of registration and confirmation. The purpose of this procedure is to be able to prove your registration and, if necessary, to investigate any possible misuse of your personal data. We use your data exclusively for sending the newsletter. The legal basis for this data processing is your consent pursuant to Art. 6(1)(a) GDPR.
The newsletter is sent on the basis of our legitimate interest in an effective, secure and user-friendly newsletter system pursuant to Art. 6(1)(f) GDPR as processing on our behalf (Art. 28 GDPR) by the service provider CleverReach GmbH & Co KG, Mühlenstr. 43, 26180 Rastede, Germany, under a data processing agreement concluded with it. The privacy policy of the mailing service provider can be found at: https://www.cleverreach.com/de/datenschutz/.
The newsletters contain a so-called web beacon. These are small graphics that enable log file recording and log file analysis, which are used for statistical evaluations for online marketing and are retrieved from CleverReach when the newsletter email is opened. As part of this retrieval, technical information such as information about your browser and system and the time of retrieval is collected. This information is used to technically improve our services based on the technical data, the target groups and their respective reading behaviour. The statistical surveys include whether a newsletter is opened, when it is opened and which links are clicked. The use of the web beacon and the processing of the log files are based on your consent pursuant to Art. 6(1) GDPR and Section 25(1) TDDDG, which you gave when registering for the newsletter. If you wish to object to data analysis for statistical evaluation purposes, you must unsubscribe from the newsletter.
The data you provide to us for the purpose of receiving the newsletter will be stored by us or by CleverReach until you unsubscribe from the newsletter and will be deleted from the newsletter distribution list after you unsubscribe. Data stored by us for other purposes remains unaffected.
After you have been removed from the newsletter distribution list, your email address may be stored by us or CleverReach in a blacklist in order to prevent future mailings. The data from the blacklist is used only for this purpose and is not combined with other data. This serves both your interest and our interest in complying with the legal requirements when sending newsletters (legitimate interest within the meaning of Art. 6(1)(f) GDPR). Storage in the blacklist is not limited in time. You may object to the storage if your interests outweigh our legitimate interest.
Note on the right of withdrawal
You can withdraw your consent to receiving the newsletter at any time with effect for the future and unsubscribe from the newsletter. You can declare your withdrawal by clicking on the link provided in every newsletter email or, for example, by email to us (see Section 1).
b. Advertising with consent
We process your data for marketing purposes only on the basis of your express consent to these purposes pursuant to Art. 6(1)(a) GDPR.
Proper data processing agreements have been concluded with service providers that we engage for the purpose of delivering advertising and that process data on our behalf strictly in accordance with our instructions.
Note on the right to object
You can object to the use of your personal data for the aforementioned advertising purposes at any time, free of charge and with effect for the future, using the contact details provided in Section 1.
If you object, your data will be blocked for further advertising-related data processing. Please note that in exceptional cases, advertising material may still be sent temporarily even after your objection has been received. This is technically due to the necessary lead time in the selection process and does not mean that we have not implemented your objection.
c. Advertising to existing customers
We generally have a legitimate interest in using the data of our existing customers for marketing purposes. We collect the following data from our existing customers for our own marketing purposes: first name, last name, postal address, email address, year of birth. The legal basis for the use of personal data for marketing purposes is Art. 6(1)(f) GDPR.
Proper data processing agreements have been concluded with service providers that we engage for the purpose of delivering advertising and that process data on our behalf strictly in accordance with our instructions.
Note on the right to object
You can object to the use of your personal data for the aforementioned advertising purposes at any time, free of charge and with effect for the future, using the contact details provided in Section 1.
If you object, your data will be blocked for further advertising-related data processing. Please note that in exceptional cases, advertising material may still be sent temporarily even after your objection has been received. This is technically due to the necessary lead time in the selection process and does not mean that we have not implemented your objection.
On our website, on the basis of consent pursuant to Art. 6(1)(a) GDPR or, where consent has not been given in an individual case and is not legally required, on the basis of our legitimate interests (i.e. interest in analysing the use of our website and improving its operation within the meaning of Art. 6(1)(f) GDPR), we use offerings from third-party providers in order to integrate their content and services, such as videos or fonts (hereinafter uniformly referred to as “content”).
This may require the respective third-party providers to perceive your IP address, since they could not send the content to your browser without it. The IP address is therefore necessary for the delivery and display of this content.
YouTube
We embed YouTube videos on our website. YouTube is a service of YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube LLC is a subsidiary of Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. If you have given your consent pursuant to Art. 6(1)(a) GDPR and Section 25 TDDDG to the setting of cookies and the processing of your personal data for marketing purposes, or if you agree to the activation of the YouTube plugin by clicking on a video, your browser automatically connects to the servers of YouTube or Google. The following data is transmitted in the process:
- IP address
- Date and time of the request
- Time zone difference to Greenwich Mean Time (GMT)
- Content of the request (specific page)
- Access status/HTTP status code
- Amount of data transferred in each case
- Website from which the request originates
- Browser
- Operating system and its interface
- Language and version of the browser software.
- Hardware used (PC, smartphone, etc.)
- Location (if Google Maps is activated)
We have no influence on this data transmission.
If you are logged in to your YouTube or Google account, this data will be linked directly to your account. If you do not want it to be associated with your YouTube/Google profile, you must log out of your YouTube/Google account before activating the button.
YouTube/Google stores this data as usage profiles and uses them for advertising, market research and/or the demand-oriented design of its website. Such evaluation is carried out in particular (even for users who are not logged in or who do not have an account) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, and you must contact YouTube to exercise this right.
You can find information from the third-party provider at the following links:
https://policies.google.com/technologies/product-privacy?hl=de and https://www.google.de/intl/de/policies/privacy.
The information collected by this provider’s cookies is usually sent to a server in the USA and stored there. Where data is transferred to the USA, the transfer is based on standard contractual clauses.
We do not collect or process any personal data via YouTube. The disclosure of personal data by Google, in particular to third countries, is outside our area of responsibility.
You can opt out via this link: https://adssettings.google.com/authenticated.
Userlike / Lime Technologies (support chat in the LiPo portal)
In our licence portal “LiPo”, we integrate a support chat from the provider Userlike (Lime Technologies), through which you can contact us if you have questions about the portal. The chat button is visible regardless of cookie consent; the actual chat widget and the form for entering contact details are only loaded or displayed after you have consented to the integration of this third-party content via the consent banner (see Section 5(f)). In this context, the chat history and any contact details you voluntarily provide may be transmitted to and processed by Userlike (Lime Technologies) (provider’s registered office: Germany. All of the provider’s data is hosted in the EU, with the exception of its sub-service providers BunnyWay – region-dependent – and Twilio Inc. – USA.) A data processing agreement is in place between LizenzDirekt and Userlike/Lime-Connect. As things currently stand, the chat is operated without the use of artificial intelligence.
Matomo
On our website, we use the web analytics service “Matomo” in its on-premise version to analyse and improve our online offering and to design it commercially. Matomo is initially deactivated when you visit our website. Only when you consent to the use of “statistics” cookies in our cookie banner is your usage behaviour on our website recorded in anonymised form. The legal basis is accordingly Section 25 TDDDG and, where personal data is involved, Art. 6(1)(a) GDPR. All data is transmitted only to servers located within the European Union and under our control.
Depending on your consent, different cookies are used with Matomo. More detailed information can be found in our Cookie Policy. When usage analysis is activated, the information collected by the cookies about the use of our website is transmitted to our servers and stored there for the analysis of usage behaviour. Your IP address is anonymised immediately as specified below. Your usage data is also not passed on to third parties.
The information generated by the cookie about your use of this website includes, for example:
(1) The first six digits (2 bytes) of the IP address with which you access our site;
(2) The website accessed;
(3) The website from which you reached our website (referrer)
(4) The subpages accessed from the website visited
(5) The time spent on the website
(6) The frequency of visits to the website
We will delete your data immediately once it is no longer required for our recording purposes. The statistics generated and the underlying anonymous data are generally not deleted.
Contact by email, post & telephone
You can contact us in several ways: by email, by telephone or by post. When you contact us, we use the personal data that you voluntarily provide to us in this context solely for the purpose of contacting you and processing your enquiry.
The legal basis for this data processing is Art. 6(1)(b) GDPR. Your data will be deleted when it is no longer required for the purpose of processing and there is no statutory obligation to retain it.
Our website also contains contact forms for enquiries about purchases and sales, which can be used for electronic contact. If a user takes advantage of this option, the data entered in the input form will be transmitted to us in encrypted form and stored.
Where you have given your consent, the legal basis for processing your data is Art. 6(1)(a) GDPR. If you have not given individual consent, we process your data on the basis of Art. 6(1)(b) GDPR. We process the personal data from the input form solely to handle your enquiry.
Where we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or where processing takes place in the context of using third-party services or disclosing or transferring data to other persons, bodies or companies, this is done only in accordance with the legal requirements.
Subject to express consent or a transfer required by contract or law, we process data, or have it processed, only in third countries with a recognised level of data protection, on the basis of contractual obligations through so-called standard contractual clauses of the EU Commission, where certifications exist, or on the basis of binding corporate rules (Art. 44 to 49 GDPR).
The products of US providers used in the context of this notice (e.g. Google LLC) may process personal data in the United States.
With Implementing Decision (EU) 2023/1795 of 10 July 2023, the European Commission determined that the USA – for organisations that have joined and are certified under the EU-US Data Privacy Framework (DPF) – ensures a level of data protection comparable to that of the EU (adequacy decision pursuant to Art. 45 GDPR). Where we transfer data to a recipient listed as “Active” on the US Department of Commerce’s “Data Privacy Framework List”, the transfer is therefore based on this legal basis; additional safeguards or your express consent are not required for this.
Otherwise, we only pass on your data to third parties if:
- you have given your express consent to this pursuant to Art. 6(1)(a) GDPR,
- the disclosure pursuant to Art. 6(1)(f) GDPR is necessary for the establishment, exercise or defence of legal claims and there is no reason to assume that you have an overriding legitimate interest in your data not being disclosed,
- there is a legal obligation for the disclosure pursuant to Art. 6(1)(c) GDPR, or
- this is permitted by law and necessary pursuant to Art. 6(1)(b) GDPR for the performance of contractual relationships with you.
Data is disclosed to tax authorities and social security institutions only where there is a legal obligation to do so; the legal basis is Art. 6(1)(c) GDPR. Data is disclosed to service providers only on the basis of a proper data processing agreement pursuant to Art. 28 GDPR.
We process the personal data of applicants for the purpose of handling the application process. Processing may also be carried out electronically. This is particularly the case if an applicant submits application documents to us electronically, for example by email. If an employment contract is concluded with an applicant, the data transmitted will be stored for the purpose of handling the employment relationship in compliance with the statutory provisions. If no employment contract is concluded, the application documents will be deleted automatically six months after notification of the rejection decision, provided that no other legitimate interests of the controller preclude deletion.
The controller reserves the right to adapt security and data protection measures where this becomes necessary due to technical or legal developments. In such cases, the controller will also adapt this privacy notice accordingly. Please therefore always refer to the current version of our privacy notice.
For better understanding, we would like to provide you below with the definitions of the GDPR, insofar as they are relevant to our privacy notice.
Supervisory authority
“Supervisory authority” means an independent public authority established by a Member State pursuant to Art. 51 GDPR.
Processor
Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Third party
Third party means a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or processor, are authorised to process personal data.
Restriction of processing
Restriction of processing means the marking of stored personal data with the aim of limiting its processing in the future (in the sense of blocking).
Consent
Consent means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Recipient
Recipient means a natural or legal person, public authority, agency or another body to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.
Personal data
Personal data means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Put simply, personal data are individual details about the personal or factual circumstances of a specific or identifiable natural person, i.e. not legal entities such as a limited liability company (GmbH). Personal data include, above all, details such as name, address and email address, but also the IP address.
Profiling
Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
Pseudonymisation
Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
Controller
Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
Processing
Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
ANY QUESTIONS?
Do you have questions about license sales? Would you like an initial consultation to receive an offer? We are happy to answer your questions and assist you in all belongings.
Andreas E. Thyen
Andreas E. Thyen
Graduate in Economics
Looking to purchase software
at the most attractive prices?
Over the past 10 years, a growing number of companies, public bodies and organisations have been taking the opportunity to significantly reduce their IT costs by using a mixture of new and pre-owned software.
You could save up to 70%!
CONTACT US
Do you have questions about pre-owned software? Would you like to find out more about selling your surplus software licenses? Or do you want to purchase affordable software licenses?
We’d be happy to provide you with the advice you need. Please be aware that we only sell to public bodies and businesses.