The controller pursuant to the General Data Protection Regulation, other data protection laws applicable in the member states of the European Union and further legal regulations relating to data protection is Kober-Kümmerly + Frey Media AG, Rolandstr. 83, 50677 Cologne, Germany, represented by Managing Director Tim Kober (hereinafter „controller” or „we” or „us”).
Personal data means individual details regarding the personal or material relationships of a certain or identifiable natural person. That includes information such as name, address, telephone number and email address, but also an IP address, which can be linked to a particular network connection. Information that cannot be directly linked to the identity of an individual – for example website preferences or the number of visitors to a page – is not personal data.
We fundamentally only collect and use our users’ personal data insofar as such data is required for the provision of a functioning website, our content and services. Our users’ personal data is generally only recorded and used with the consent of the user. Cases where the prior consent of the user is not possible for material reasons and the processing of data is permissible pursuant to the applicable legal requirements are an exception.
Insofar as we have received consent from the data subject for processes that involve the processing of personal data, Article 6(1) point (a) of the EU General Data Protection Regulation (GDPR) serves at the legal basis for the processing of that personal data.
When data is processed for the performance of a contract to which the data subject is a party, then Article 6(1) point (b) GDPR serves at the legal basis. That also applies to processing required in the scope of pre-contractual measures.
If data processing is required for us to pursue the legitimate interests of our company or a third party, and those interests are not overridden by the interests or fundamental rights and freedoms of the data subject, then Article 6(1) point (f) GDPR serves at the legal basis for processing.
The data subject’s personal data will be deleted or restricted as soon as the purpose of recording no longer applies. Data may only be recorded after that time if such recording is allowed by the applicable European or national legislator in European Union directives, laws or other regulations. The restriction or erasure of data is also carried out when the storage period pursuant to the standards listed above expires, unless further storage of the data is required to enter into or perform a contract.
Every time our website is visited, we record data and information using an automated system. The following data are thereby recorded:
The data is recorded in log files by our system. The data is not recorded together with other personal data regarding the user.
The legal basis for the temporary recording of data and log files is Article 6(1) point (f) GDPR.
The temporary recording of the IP address by the system is necessary to allow delivery of the website to the user’s computer. The user’s IP address must be recorded for the duration of their visit for this purpose.
Recording in log files is carried out to ensure the functionality of the website. We also use the data to optimise the website and ensure the security of our IT systems.
These purposes also represent legitimate interests in data processing pursuant to Article 6(1) point (f) GDPR.
The data is deleted as soon as it is no longer required for the purpose for which it was recorded. In the case of data recorded to allow delivery of the website, that is the case when the visit ends.
In the case of data recorded in log files, that is the case after a maximum of six weeks. It is possible that such files are stored after that period. In such cases, users’ IP addresses are deleted or anonymised so that they can no longer be allocated to the accessing client.
The recording of data for the provision of the website and the recording of data in log files is essential to the operation of the website. Therefore, the user does not have the possibility to object.
Our websites use „cookies“ in a number of areas. Cookies are small text files that are saved to your computer by your browser. They allow specific user-related information to be saved to your PC while you visit our website. Cookies help determine a website’s user frequency and visitor numbers, and help make an online offering as convenient and efficient as possible for the user.
We use „session cookies“ that are only saved temporarily while you use one of our websites. „Session cookies“ are automatically deleted at the end of your visit.
We also use „permanent cookies“ to collect information about users who visit one of our websites repeatedly. The purpose of such cookies is to offer you optimum navigation, and to allow us to recognise you and avoid the need for a renewed login when you return to the site. The content of a permanent cookie is limited to an identification number. Names, IP addresses etc. are not recorded. Individual profiles containing information about your usage patterns are not created.
When a user visits our website, they are informed about the use of cookies for the purpose of analysis, and is given the option to deactivate these cookies. Reference is thereby made to this data protection statement.
The legal basis for the processing of personal data due to the use of technically necessary cookies and the use of cookies for the purposes of analysis is Article 6(1) point (f) GDPR.
Assuming that the user has consented to such use, the legal basis for the processing of personal date due to the use of cookies is Article 6(1) point (a) GDPR.
The purpose of the use of technically necessary cookies is to simplify use of the website for the user. Some of our website’s functions cannot be offered without using cookies. Those functions require that the browser is recognised when the user navigates to another page.
The user data collected for technically necessary cookies is not used to create user profiles.
The purpose of the use of analysis cookies is to improve the quality of our website and its content. Analysis cookies give us information about how the website is used, which allows us to make constant improvements.
These purposes also represent legitimate interests in the processing of personal data pursuant to Article 6(1) point (f) GDPR.
Cookies are saved to the user’s computer, which transfers them to our website. That is why you, the user, have full control over the use of cookies. You can deactivate or restrict the transfer of cookies by changing your browser’s settings. Saved cookies can be deleted at any time. They can also be deleted automatically. If the use of cookies is deactivated for our website, it is possible that some functions will not be fully available.
It is possible to use our website without using cookies. You can deactivate cookies in your browser, limit their use to certain websites, or set your browser to notify you when a cookie is sent. Please note that, in such cases, you will be shown a limited version of the website and your navigation may be restricted.
If a user subscribes to a newsletter offered by us, they must enter their email address using the respective form. When a user subscribes to or unsubscribes from a newsletter, the user’s IP address and the date and time of registration are recorded.
Permission to process the necessary data must be given during the registration process. Reference is thereby made to this data protection statement.
The data is transferred to us and our service partner, rapidmail GmbH, Augustinerplatz 2, 79098 Freiburg im Breisgau, Germany. rapidmail sends the newsletter on our behalf.
No data is transferred to other third parties in connection with the sending of newsletters. The data is only used to send the newsletter.
Newsletter subscriptions can be cancelled by the data subject at any time. Permission for the recording of personal data can also be revoked at any time. A link for this purpose is included in every newsletter.
Assuming that the user has consented to such use, the legal basis for the processing of data following registration for a newsletter is Article 6(1) point (a) GDPR.
The user’s email address is recorded for the purpose of delivering the newsletter. Other personal data is recorded during the registration process in order to prevent misuse of the services or the submitted email address.
The data will be deleted as soon as it is no longer required for the purpose for which it was recorded. That is the case when you unsubscribe from the newsletter. The other personal data recorded during the registration process is generally deleted after a period of six weeks.
Newsletter subscriptions can be cancelled by the data subject at any time. A link for this purpose is included in every newsletter. Such cancellation also allows for the revocation of permission to record personal data submitted during the registration process.
Registration is required to use mapz and download maps generated by the site. The registration process involves entering an email address and password.
Your email address is transferred to our service partner, apilayer GmbH, Hörlgasse 2/4, AT-1090 Vienna, Austria. apilayer examines your email address to determine whether it is a normal, permanent email address or a temporary email address (TrashMail). No data is transferred to other third parties in connection with the data processing for this examination. The data is only used for the examination.
When you register, you consent to us recording the email address provided and opening a customer account.
The user’s IP address and the date and time of registration are also recorded when the user registers.
We do not collect any further personal data when you download a free map preview.
We only require further information from you and the map user (if different) when a contract for a download of paid map material is entered into.
When you select paid map material, you therefore consent to us recording the data entered in the fields “Invoice address” and “Map user, if different”, such as the first name, last name, address and, if provided voluntarily, telephone number, and to us using that data for the purpose of performance of the contract.
You also guarantee that any other map user you name consents to the processing and recording of their personal data by us, and with regard to mapz.com, and that you have informed them about the extent of the data recorded, the purpose of recording, and the right to object, request erasure, or exercise other rights as a data subject pursuant to this data protection statement.
Permission to process such data is requested during the registration process, when entering into a contract, and when entering the name of another map user.
Assuming that the user has consented to such use, the legal basis for the processing of data is Article 6(1) point (a) GDPR. If the registration serves the purpose of performance of a contract to which the user is a party, or of pre-contractual measures, then Article 6(1) point (b) GDPR serves as an additional legal basis. The legal basis for the processing of data regarding another map user is Article 6(1) point (f) GDPR. The legitimate interest on our part is knowledge of the licensee with rights of use to our copyrighted map material.
The provision of the user’s contractual information is required for the performance of a contract to which the user is a party, or of pre-contractual measures. The data entered during the registration process is also used as your contact information when a contract is entered into.
We retain the data after the complete performance of the contract and full payment of the purchase price to allow you to make further purchases using the recorded information. After the period required by tax and commercial law, you have the possibility to delete the recorded data yourself, thereby permanently removing it from our records.
As a user, you may terminate your registration at any time. You may change the data recorded about you at any time. Following login as a registered user, you can edit your data and thereby remove or change any data entered.
Our website has a contact form that can be used to contact us electronically. Alternatively, you can contact us using the email address provided.
If you contact us using the contact form, then your first and last name will always be transmitted to us, along with your email address and the message. The user’s IP address is also recorded, along with the date and time.
Permission to process the necessary data must be given during the sending process. Reference is thereby made to this data protection statement.
If you contact us by email, then your email address and message are transmitted to us and recorded by us. Furthermore, in case of contact by email we collect and store the IP address of the mail server used.
Assuming that the user has consented to such use, the legal basis for the processing of data is Article 6(1) point (a) GDPR.
The legal basis for the processing of data transmitted by sending an email is Article 6(1) point (f) GDPR. If the purpose of email contact is to enter into a contract, then Article 6(1) point (b) GDPR serves as an additional legal basis.
The sole purpose of processing of personal data entered via the contact form is handling your message. In the case of contact by email, there is also a legitimate interest in data processing.
Other personal data processed during the sending process serves the purpose of preventing misuse of the contact form and ensuring the security of our IT systems.
Insofar as a message or email was not received from a customer with whom we have a business relationship, the data is deleted at the end of the period required by commercial and tax law. With regard to the storage period for such messages and -mails, Section 5. applies accordingly.
The user has the possibility to revoke their permission to process personal data at any time. If the user contacts us by email, then they can object to the recording of their personal data at any time. In such cases, no further conversation can take place. The objection may be made by email, or by contacting us by telephone or post.
In such cases, any personal data recorded as a result of the contact will be deleted.
Insofar as „PayPal“ is selected as the payment type, your first and last name, address, email address and other information regarding your purchase must be submitted to „PayPal“ in order to process the order. We transfer that data to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Such transfers are carried out pursuant to Article 6(1) point (b) GDPR, and only insofar as necessary for payment processing.
When payment is made by PayPal invoice or in instalments, PayPal carries out a risk check and decides whether it will accept payment by your chosen method. That can involve your payment details being transferred to credit agencies based on PayPal’s legitimate interest in your ability to pay pursuant to Article 6(1) point (f) GDPR. PayPal uses the results of the credit check to determine the statistical probability of payment to decide whether to make the respective payment method available. The credit check may include probabilities (so-called score values).
Insofar as score values are used in the result of the credit check, they are based on recognised scientific, mathematical and statistical processes. Among other things, the calculation of score values is based on, but not limited to, address data. For further information regarding data protection, among other things with regard to the credit agencies used, please refer to Legal Agreements for PayPal Services and select your country.
You can object to the processing of your data in this manner at any time by contacting PayPal. However, in some circumstances, PayPal may have the right to continue processing your personal data insofar as necessary for contractually agreed payment processing.
Our website uses „Matomo“, an open-source software package for the statistical evaluation of user behaviour. „Matomo“ produces detailed statistics about visitors to a website. The „Matomo“ analysis software records and stores information about the search engine, search terms and language you use, the location of visitors by country, the browser and plug-ins used, referrers, viewing times, a visitor’s landing and exit page, bounce rates and the length of a visit to our website.
„Matomo“ uses so-called „cookies“, text files that are saved to your computer to allow analysis of your website usage. The information created about your use of this online offering is stored on our server in the Federal Republic of Germany. The IP address is anonymised immediately after processing and before it is recorded.
Matomo uses a heuristic method to attempt to identify returning visitors by taking certain data into account. That data includes, in particular, the IP address, the screen resolution, the browser, the plug-ins used and the operating system. This data is combined to generate a hash value. The aim of the heuristic method is to identify returning visitors even if no cookies are saved to their computer.
The heuristic method uses the full IP address internally. However, the IP address is not processed and recorded in isolation. In this process, the IP address is also not used to analyse user behaviour. Instead it is solely used to generate a pseudonym. The IP address is combined with the other data in a hash value.
The legal basis for data processing is Article 6(1) point (f) GDPR. The legitimate interest relates to the analysis of user numbers.
The processing of personal data only serves the purpose of optimising our advertising strategies and content.
The personal data recorded for this purpose is deleted after a maximum of seven days. Further storage is done for statistical purposes in accordance with Article 89(1) GDPR in the form of pseudonimized data that can not be used for measures or decisions against individual natural persons.
You can prevent a cookie being saved by changing your browser’s software settings. However, please note that, in such cases, you may not be able to fully use all the website’s functions.
If you do not consent to the recording and analysis of information about your visit, you can object by clicking below at any time. That will save a so-called opt-out cookie to your browser, which will prevent Matomo from recording any session data. However, if you delete your cookies then the opt-out cookie will also be deleted and must be reactivated, if required.
You can determine whether your browser may save a unique web analysis cookie that allows the website operator to collect and analyse a range of statistical data here.
If you want to object, please inform us by clicking the following link in order to save a Matomo deactivation cookie in your browser.
Your visit to this website is currently being recorded by Matomo web analytics. Click here to disable or re-enable recording.
This website uses a module provided by the platform YouTube, a subsidiary of Google. YouTube is headquartered at 901 Cherry Ave., San Bruno, CA 94066, USA. The module is a button labelled „Video introduction“.
We run the YouTube module in enhanced privacy mode. This means that by visiting this site, no information is provided or transmitted to YouTube.
Only when you view a video embedded on this page by clicking the „Video introduction“ button YouTube is informed that you have visited this page and clicked on the video in question. By clicking on the „Video introduction“ button, you therefore also agree to a transmission of the following data to YouTube in the USA.
If you watch the video without being logged into a Google or YouTube account, YouTube will register your IP address and other information transmitted through your browser, such as the website from which the video is viewed, browser type information, and the version used and your operating system.
If you watch the video while logged in to your Google or YouTube account, YouTube and Google also have the ability to associate your account with visiting our site and playing our video.
Although cookies are not activated by YouTube in the enhanced privacy mode and you are not logged into a Google or YouTube account, playing the video may already trigger data processing on Google and its affiliates, such as Google DoubleClick, beyond our control.
For data protection information from YouTube and Google, please refer to Google’s data protection statement.
The legal basis for data processing by YouTube is Article 6(1) point (a) GDPR, with consent given by clicking the „Video introduction“ button.
The processing of personal data when the user clicks the YouTube button only serves the purpose of contact with YouTube and linking your browsing behaviour with your YouTube account.
The period of storage of data collected by YouTube is governed by the YouTube Privacy Policy, which is defined in Google’s data protection policies.
To prevent YouTube connecting your visit to the page in question with your account, please log out of YouTube before visiting our website. You also prevent any transfer of data from your visit to YouTube by not clicking on the video provided on this page.
If your visit has already been recorded, you have the right in accordance with YouTube's privacy policy to object and request erasure pursuant to Google’s data protection policies.
Our contact form uses the Google reCaptcha. The provider of the reCaptcha is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. When you visit our contact page, Google receives the information that you are visiting our website. When you click the reCaptcha, Google records the information that you have clicked the reCaptcha and determines whether your request is manual or was made by a computer. As part of this process, the IP address of your network connection, and the date and time of the visit are recorded and transferred to Google in the USA, along with information about the type of browser and version used, the Google account (if logged in), mouse movement over the reCaptcha surfaces and tasks that require you to identify images.
The legal basis for the processing of data by Google is our legitimate interest in preventing computer-generated requests via our contact form pursuant to Article 6(1) point (f) GDPR.
The processing of personal data when the reCaptcha interface is clicked only serves the purpose of preventing computer-generated requests via our contact form.
The period for which the data collected by Google is stored is defined in Google’s data protection policies.
There is no possibility to object to the use of the reCaptcha when using the contact form as we are unable to accept messages submitted via the contact form without this check.
If your personal data is processed, then you are a data subject pursuant to the GDPR and you have the following rights vis-à-vis us (“the controller”):
You may request confirmation whether personal data concerning you is processed by us. If such processing is taking place, you may request the following information from us:
You have the right to information about whether personal data concerning you was transferred to a third country or international organisation. In this regard, you may also request information about appropriate guarantees pursuant to Article 46 GDPR with regard to the transfer.
If the personal data processed is inaccurate or incomplete, you have the right to rectification or completion. We must rectify the information without undue delay.
You may request that personal data concerning you is erased without undue delay, and we have the obligation to erase that data without undue delay where one of the following grounds applies:
Where we have made the personal data concerning you public and are obliged, pursuant to Article 17 (1) GDPR to erase the personal data, then, taking account of available technology and the cost of implementation, we shall take reasonable steps, including technical measures, to inform those responsible for processing the personal data that you have requested the erasure of any links to, or copy or replication of, that personal data.
The right to erasure does not apply to the extent that processing is necessary
If the following conditions apply, you have the right to request restriction of processing of personal data concerning you:
Where processing of personal data concerning you has been restricted, such personal data shall, with the exception of storage, only be processed with your consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or one of its member states.
If processing has been restricted under the conditions described above, we will inform you before the restriction is lifted.
If you have exercised the right to rectification or erasure of personal data, or to restriction of processing, we are obliged to inform all recipients to whom the personal data has been disclosed about the rectification or erasure of personal data, or the restriction of processing, unless such notification proves impossible or involves disproportionate effort.
You also have the right to be informed about those recipients.
You have the right to receive the personal data concerning you that you provided to us in a structured, commonly used and machine-readable format. You also have the right to transmit that data to another controller without hindrance from us, insofar as
In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, insofar as technically feasible. The freedoms and rights of others may not be adversely affected thereby.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest.
You have the right to object, at any time, on grounds relating to your particular situation, to the processing of personal data concerning you based on Article 6(1) points (e) or (f), including profiling based on those provisions.
Following such an objection, we will no longer process the personal data concerning you unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.
Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing purposes. That includes profiling to the extent that it is related to such direct marketing.
If you object to processing for direct marketing purposes, personal data concerning you will no longer be processed for such purposes.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.
You have the right to revoke your declaration of consent under data protection law at any time. The revocation of the declaration of consent does not affect the legality of the processing carried out on the basis of the declaration of consent before it was revoked.
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly negatively affects you. This does not apply if the decision
However, such decisions may not be based on special categories of personal data referred to in Article 9(1) GDPR, unless Article 9(2) point (a) or (g) GDPR apply and suitable measures are in place to safeguard the data subject’s rights and freedoms and legitimate interests.
In the cases referred to in points (a) and (c) of paragraph 2, the data controller will implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement, if you believe that the processing of personal data concerning you infringes the GDPR.
The supervisory authority with which the complaint has been lodged will inform the complainant on the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 GDPR.
--
This privacy policy applies as of 4 pm on 24 May 2018 and replaces all previous versions.
The previous version is available here: privacy policy valid until 3:59 pm on 24 of May 2018
