Relevant legal bases

In the following, we provide the legal basis for the Basic Data Protection Regulation (German DSGVO), on the basis of which we process personal data. Please note that in addition to the regulations of the German DSGVO, national data protection regulations may apply in your or our country of residence and domicile. Should more specific legal provisions apply in individual cases, we will inform you of these in the data protection declaration.

• Consent (Art. 6 para. 1 sentence 1 lit. a DSGVO) - The data subject has given his or her consent to the processing of personal data relating to him or her for one or more specific purposes.

• Fulfilment of a contract and pre-contractual enquiries (Art. 6 para. 1 sentence 1 lit. b. DSGVO) - Processing is necessary for the performance of a contract to which the data subject is party or for carrying out pre-contractual measures taken at the request of the data subject.

• Protection of vital interests (Art. 6 para. 1 sentence 1 lit. d. DSGVO) - Processing is necessary in order to protect the vital interests of the data subject or of another natural person.

• Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. DSGVO) - The processing is necessary to safeguard the legitimate interests of the controller or of a third party, unless the interests or fundamental rights and freedoms of the data subject which require the protection of personal data outweigh these.

National data protection regulations in Germany: In addition to the data protection regulations of the basic data protection regulation, national regulations on data protection apply in Germany. These include in particular the law on protection against misuse of personal data in data processing (Federal Data Protection Act - BDSG). In particular, the BDSG contains special regulations on the right to disclose, the right to delete, the right of objection, the processing of special categories of personal data, processing for other purposes and transmission as well as automated decision making in individual cases including profiling. Furthermore, it regulates data processing for the purposes of the employment relationship (§ 26 BDSG), in particular with regard to the establishment, implementation or termination of employment relationships and the consent of employees. Furthermore, state data protection laws of the individual federal states may apply.

Security measures

We take appropriate technical and organisational measures in accordance with the legal requirements, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing, as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons, in order to ensure a level of protection commensurate with the risk.

These measures include in particular ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access, input, disclosure, safeguarding of availability and separation of data. Procedures have also been put in place to ensure that data subjects' rights are respected, that data are deleted and that responses to data breaches are made. Furthermore, we take the protection of personal data into account as early as the development or selection of hardware, software and procedures in accordance with the principle of data protection, by designing technology and by using data protection-friendly default settings.

SSL encryption (https): To protect your data transmitted via our online offer, we use SSL encryption. You can recognise such encrypted connections by the prefix https:// in the address line of your browser.

​

Transmission and disclosure of personal data

In the course of our processing of personal data, it may happen that the data is transferred to or disclosed to other bodies, companies, legally independent organisational units or persons. The recipients of this data may include, for example, payment institutions in the context of payment transactions, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases we observe the legal requirements and in particular conclude appropriate contracts or agreements with the recipients of your data which serve to protect your data.

Transfer of information within the organisation: We may transfer or grant access to personal information to other entities within our organisation. If this transfer is for administrative purposes, the transfer of the data is based on our legitimate business and commercial interests or takes place if it is necessary to fulfil our contractual obligations or if the consent of the persons concerned or legal permission has been obtained.