We, the Marc O’ Polo Group, process the personal data of various people in connection with our business activities. In particular, this includes the following:
users of our company website: https://company.marc-o-polo.com/
our applicants,
our potential business partners (leads), our existing business partners and their employees,
users of our press portal
our visitors and
users of our guest Wi-Fi.
We process the personal data of users of our online services in connection with providing our online services, especially our website and the offers on our website. More detailed information is available in the privacy policy of each online service, such as https://www.marc-o-polo.com/en-gb/static/privacy for our online shop.
The protection of personal data is important to us. We only process personal data in accordance with the relevant data protection provisions, especially the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
Section A of this privacy policy contains information about the controller responsible for processing your personal data as well as the data protection officer of the controller.
Sections B to J contain information about how your personal data are processed.
Section K contains information about your rights with regard to the processing of your personal data.
The definitions of the data protection terminology used in this data protection information are the same as in the General Data Protection Regulation. You can find more detailed information about this in section L.
I. Name and contact details of the controller
II. Contact details of the data protection officer of the controller
Use of marketing technology and advertising networks (using marketing cookies)
I. Information about the personal data we process
II. Details about the processing of personal data
III. Details about the recipients of personal data and the transfer of personal data to third countries and/or international organisations
I. Information about the personal data we process
II. Details about the processing of personal data
III. Details about the recipients of personal data and the transfer of personal data to third countries and/or international organisations
I. Information about the personal data we process
II. Details about the processing of personal data
III. Details about the recipients of personal data and the transfer of personal data to third countries and/or international organisations
I. Information about the personal data we process
II. Details about the processing of personal data
III. Details about the recipients of personal data and the transfer of personal data to third countries and/or international organisations
I. Information about the personal data we process
II. Details about the processing of personal data
III. Details about the recipients of personal data and the transfer of personal data to third countries and/or international organisations
I. Information about the personal data we process
II. Details about the processing of personal data
III. Details about the recipients of personal data and the transfer of personal data to third countries and/or international organisations
I. Information about the personal data we process
II. Details about the processing of personal data
III. Details about the recipients of personal data and the transfer of personal data to third countries and/or international organisations
I. Right of access
II. Right to rectification
III. Right to erasure (‘right to be forgotten’)
IV. Right to restriction of processing
V. Right to data portability
VI. Right to object
VII. Right to withdraw consent
VIII. Right to lodge a complaint with a supervisory authority
This privacy policy applies to the following companies of the MARC O’POLO Group:
MARC O'POLO SE
MARC O'POLO International GmbH
MARC O'POLO Einzelhandels GmbH
MARC O'POLO France SARL
MARC O'POLO Retail RO SRL
MARC O'POLO Retail Espana
MARC O'POLO EH GmbH
MARC O'POLO Switzerland AG
MARC O'POLO License AG
You can contact all of these companies with the following contact details:
Hofgartenstrasse 1, 83071 Stephanskirchen, Germany
service@marc-o-polo.com
See the sections below for information about which of these companies is responsible for processing your personal data in each case.
II. Contact details of the data protection officer of the controller
(Under the data protection regulations, MARC O'POLO International GmbH (→ section A.I) is responsible for this processing.) When you use the website company.marc-o-polo.com for informational purposes, the browser you are using on your device will send certain information such as your IP address to the server of our website for technical reasons. We process this information in order to provide the content you access on the website. Additionally, the information is stored temporarily in a server log file in order to guarantee the security of the IT infrastructure used to provide the website.
For the purpose of providing the search tools on our website, the data you enter into our search tools shall be processed temporarily on our web server.
Information about consent you have granted is stored in cookies (→ section J) on your device in order to provide the administrative features for consent relating to our website (e.g. consent to the use of certain cookie-based technologies). During your visit to our website, the cookies and the information stored therein can be accessed in order to determine whether you have given your consent and to what. Additionally, for the purpose of providing your chosen language, data are processed temporarily on our web server in order to provide you with the website content you access in the language you have chosen.
To provide the language selection feature on the website.
To guarantee the security of the IT infrastructure used to provide the website, especially to identify, combat and document disruptions in a legally sound manner (e.g. DDoS attacks):
More detailed information about this is available below:
| Categories of personal data we process | Personal data in the categories | Sources of data | Obligation of the data subject to provide data | Duration of storage |
|---|---|---|---|---|
| HTTP data | Log data which are generated by the Hypertext Transfer Protocol Secure (HTTPS) for technical reasons when you visit the application portal: IP address, the type and version of your browser, your operating system, the page you visited, the page you were on previously (referrer URL) and the date and time of your visit. | Users of the website. | The provision of data is not required by law or by a contract and is not necessary for the conclusion of a contract. No obligation to make the data available exists. If you do not provide the data, we will be unable to provide the website content you wish to access. | Data are stored in server log files in a format which makes it possible to identify the data subjects for up to seven days unless a security incident occurs (e.g. a denial-of-service attack). If a security incident does occur, server log files shall be stored until the security incident has been overcome and fully investigated. |
| Search tool data | Data you enter into the search tools on our website. This includes all of the information you enter as search strings in each search box on the website. | Users of the website. | The provision of data is not required by law or by a contract and is not necessary for the conclusion of a contract. No obligation to make the data available exists. If you do not provide the data, we will be unable to provide the website content you wish to access. | Data are stored in server log files in a format which makes it possible to identify the data subjects for up to six weeks unless a security incident occurs (e.g. a denial-of-service attack). If a security incident does occur, server log files shall be stored until the security incident has been overcome and fully investigated. |
| Opt-in data | Data relating to consent you have granted with regard to our website. This includes your consent and potentially your individual selection regarding the use of cookie-based technologies. These data are stored in cookies on your device (→ section J). | Users of the website. | The provision of data is not required by law or by a contract and is not necessary for the conclusion of a contract. No obligation to make the data available exists. If you do not provide the data, we will be unable to take consent to cookies on this website into consideration. | We store these data temporarily on our systems while the website is being made available. The data are stored permanently in your browser. (→ section J for information about how long the cookies remain valid.) |
| Language selection data | Data which are stored in order to provide the language selection feature. This includes the language you select. | Users of the website. | The provision of data is not required by law or by a contract and is not necessary for the conclusion of a contract. No obligation to make the data available exists. If you do not provide the data, we will be unable to provide the website content you wish to access in the language you have chosen. | We store these data temporarily on our systems while the website is being made available. The data are stored locally and permanently in the user’s browser for up to two weeks. |
| Purpose of the processing of personal data | Categories of personal data we process | Automated decision-making | Legal grounds and legitimate interests | Recipients |
|---|---|---|---|---|
| To provide the website content accessed by the user: Data are processed temporarily on our web server for this purpose. | HTTP data. | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (balance of interests). We have a legitimate interest in providing the website content accessed by the user. | Hosting providers. |
| To provide the search tools on our website: The data you enter into our search tools are processed temporarily on our web server for this purpose. | Search tool data. | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (balance of interests). We have a legitimate interest in providing the website search tools accessed by the user. | Hosting providers. |
| To provide the administrative tool for granting consent with regard to the website: Certain features of our website require your consent (e.g. the use of certain cookie-based technology). We provide an administrative tool for granting consent with regard to the website so you can grant and withdraw your consent. For this purpose, information about consent you have granted is stored in cookies (→ section J) on your device. During your visit to our website, the cookies and the information stored therein can be accessed in order to determine whether you have given your consent and to what. | Opt-in data. | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (balance of interests). We have a legitimate interest in administrating the consent granted by the user with regard to this website. | Hosting providers. |
| To provide the language selection feature on the website: For this purpose, data are processed temporarily on our web server in order to provide you with the website content you access in the language you have chosen. | Language selection data. | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (balance of gitimate interest in guaranteeing the security of the IT interests). We have a legitimate interest in providing the website content accessed by the user in the language selected by the user. | Hosting providers. |
| To guarantee the security of the IT infrastructure used to provide the website, especially to identify, combat and document disruptions in a legally sound manner (e.g. DDoS attacks): Data are stored temporarily in log files on our web server and evaluated for this purpose. | HTTP data, Search tool data. | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (balance of interests). We have a leinfrastructure used to provide the website, especially so as to identify, combat and document disruptions in a legally sound manner (e.g. DDoS attacks). | Hosting providers. |
| Recipients | Role of the recipient | Transfer to third countries and/or to international organisations | Adequacy decision or appropriate or adequate guarantees for transfers to third countries and/or international organisations |
|---|---|---|---|
| Hosting providers: AWS | Processor. | USA | There is no adequacy decision from the European Commission in the sense of Article 45(3) GDPR. AWS has standard contractual clauses (SCC) which have been adopted in accordance with Article 46 GDPR. |
If you have given your consent for marketing purposes via the data privacy and cookie settings, we will use marketing technologies from different providers (Google, Meta, LinkedIn, Xing) for the following purposes:
Evaluation of user actions (conversion tracking), segmentation of visitors and evaluation of campaign performance
Strategic targeting of users of the website for advertising purposes (retargeting), including settling accounts with our retargeting partners for ad placement
Evaluation of the effectiveness of our advertisements and development of target groups for our advertisements using ‘pixels’
In some cases, we and the provider of the marketing technology are jointly responsible for the collection of data with this marketing technology on our website. Any further processing of the data by the provider in question for its own purposes or for the purposes of third parties is the sole responsibility of that provider. You can find information about whether we are jointly responsible with each provider and references to the privacy policies of the providers below.
We and each provider use cookies for this purpose (section I Marketing).
| Categories of personal data we process | Personal data in the categories | Sources of data | Obligation of the data subject to provide data | Duration of storage |
|---|---|---|---|---|
| Google Ads, Meta, HTTP data. | Log data which are generated by the Hypertext Transfer Protocol Secure (HTTPS) for technical reasons when you visit the application portal: IP address, the type and version of your browser, your operating system, the page you visited, the page you were on previously (referrer URL) and the date and time of your visit. | Users of the website. | The provision of data is not required by law or by a contract and is not necessary for the conclusion of a contract. No obligation to make the data available exists. If you do not provide the data, we will be unable to provide the website content you wish to access. | Data are stored in server log files in a format which makes it possible to identify the data subjects for up to seven days unless a security incident occurs (e.g. a denial-of-service attack). If a security incident does occur, server log files shall be stored until the security incident has been overcome and fully investigated. |
| Google Ads, Meta, Cookie data. | Data that are stored in cookies for the respective tracking (for Meta, for example, the Meta pixel) on the user’s device. This includes a unique ID which makes it possible to recognise returning visitors. Additionally, we incorporate the following information into the cookies through our data layer in order to help the provider of each tracking pixel display the right adverts for each user: ● Page type (which page the user was on – e.g. career page, job advertisement). (Section I.III. for more detailed information about the content of the cookies.) | Users of the website. | The provision of data is not required by law or by a contract and is not necessary for the conclusion of a contract. No obligation to make the data available exists. If you do not provide the data, we will be unable to provide the website content you wish to access. | 12 months. |
| Google Ads profile data. | Data generated by the respective web tracking tool and stored separately for the respective web tracking tool in pseudonymised user profiles. This includes information about the use of the website, in particular page views, the frequency of visits and the length of time spent on visited pages, allocated to the unique visitor ID of the respective visitor contained in the respective cookie data, the origin of the visitor (i.e. which advertising partner/advertising campaign a visitor came to the website) and the bounce rate. | Generated by the respective provider. | We do not store these data. The partner is responsible for storing these data. | |
| Meta pixels Event data. | Data that the respective provider collects using the respective tracking pixel. These data include actions (also known as events) which take place on the website. This includes, for example, accessing a specific page or subscribing to the newsletter. | Users of the website. | The provision of data is not required by law or by a contract and is not necessary for the conclusion of a contract. No obligation to make the data available exists. If you do not provide the data, the tracking pixels might not function properly or at all. | We do not collect or store these data ourselves. These data are collected and processed under the responsibility of the provider of the respective tracking pixel. We do not know how long the data are stored. |
| Meta pixels Analysis data. | Data that the provider of the respective tracking pixel generates separately on the basis of the information collected by the respective tracking pixel. This includes information about the effectiveness of advertisements through the provider in question and the allocation of users to target groups for advertisements through the provider. Using the collected information, the provider in question can potentially generate other data for its own purposes or for the purposes of third parties. We have no knowledge of the details of the data generated by the provider. | Generated independently by each provider. | – | Each provider merely provides us with aggregated and anonymised data. We cannot associate these data with a natural person. The provider in question is responsible for collecting and processing personal data. We do not know how long the data are stored. |
| Purpose of the processing of personal data | Categories of personal data we process | Automated decision-making | Legal grounds and legitimate interests | Recipient |
|---|---|---|---|---|
| Evaluation of visit actions (conversion tracking) using Google Ads conversion pixel / Google Ads remarketing | ||||
| Evaluation of user actions (conversion tracking). The behaviour of users on our website is captured and analysed in a pseudonymised format. Users of the website are tagged in a pseudonymised format to make it possible to recognise you on the website or partner websites in future. Pseudonymised user profiles are derived from this information. The pseudonymised user profiles are not merged with data relating to the bearer of the pseudonym. The objective of the process is to gauge how effectively a targeted group of people are moved to perform desired actions. For this purpose, we use the web tracking tool Google Ads offered by Google. Google might process data for other purposes within its own sphere of responsibility of which we have no knowledge. We would therefore also like to refer to their data protection information: https://policies.google.com/privacy?hl=de The web tracking tool uses cookies for these purposes. (Section I.III. for detailed information about the purposes of the cookies.) | Google Ads HTTP data, Google Ads cookie data, Google Ads profile data. | No automated decision-making takes place. | Point (a) of Article 6(1) of the GDPR (consent). | Google LLC. |
| Strategic targeting of users of the website for advertising purposes (retargeting) through various retargeting partners, including settling accounts with each retargeting partner for ad placement. The behaviour of users on our website is captured and analysed in a pseudonymised format. Users of the website are tagged in pseudonymised format with a unique ID assigned by each retargeting partner so they can be recognised on our website and on websites which display adverts from each retargeting partner (i.e. publisher), as well as on websites operated by each of our retargeting partners. Pseudonymised user profiles are derived from this information and stored by the retargeting partner in question together with the unique ID assigned by that retargeting partner. The pseudonymised user profiles are not merged with data relating to the bearer of the pseudonym. The objective of the process is to make a user who has already shown interest in a website or product aware of the website or product again in order to increase the relevance of adverts and in turn the click and conversion rate (e.g. the order rate). We use web tracking tools from the following retargeting partners on our website for this purpose: Google (Google Ads Conversion Pixel / Google Ads Remarketing) The web tracking tool uses cookies for these purposes. (Section I.III. for detailed information about the purposes of the cookies.) In this context, we and each retargeting partner are responsible for processing personal data with regard to the data protection regulations. Our advertising partners might process data for other purposes within their own spheres of responsibility of which we have no knowledge. Additionally, for more information from our retargeting partners about the processing of personal data, please see their privacy policies: Google: https://policies.google.com/privacy?hl=us | Google Ads HTTP data Google Ads cookie data Google Ads profile data | No automated decision-making takes place. | Point (a) of Article 6(1) of the GDPR (consent). | For Google: Google Ireland Limited |
| Meta pixels | ||||
| Evaluation of the effectiveness of our Facebook adverts and creation of target groups for our Facebook adverts: The “meta pixel” records actions that users perform on our website (such as making a purchase) and reports these actions to Meta. If you are registered with a Meta service, Meta may assign the visit to your account. Even if you are not registered or logged into Facebook, it is possible that Facebook will gain access to and store your IP address and other identifiers. Based on the information collected by Meta, Meta provides us with aggregated, anonymised measurement results for our Meta ads. In particular, we can tell whether users who see our Meta adverts perform certain actions on our website – for instance, making a purchase (these are known as conversions). Additionally, on the basis of the information it collects, Meta enables us to reach people who have visited our website or carried out a certain action on our website through Meta adverts within six months of their last visit to our website and optimise our types of target group (audiences). Such adverts can be shown to the users of our website when they visit the social network Meta or other websites that also use this method. Meta also enables us to create ‘lookalike audiences’ on the basis of the information collected by Meta so we can show our Meta adverts to people who have similar characteristics to the users of our website. Meta merely provides us with aggregated and anonymised assessments or other information generated on the basis of the collected data. We cannot attribute the information provided to us to any natural person. Meta is responsible for collecting and processing personal data. We have no knowledge of the details of how Meta processes the data within its own sphere of responsibility. Information about Meta’s processing of personal data can be found in the Meta privacy policy: https://de-de.facebook.com/about/privacy/. | Meta pixel HTTP data, Meta pixel cookie data, Mata pixel event data, Meta pixel analysis data. | We do not use automated decision-making within our own sphere of responsibility. We have no knowledge of the details of how Meta processes the data within its own sphere of responsibility, especially with regard to automated decision-making. | Legal grounds for facilitating the collection of personal data by Meta on our website: Point (a) of Article 6(1) of the GDPR (consent). We do not process personal data within our own sphere of responsibility. We have no knowledge of the details of how Meta processes the data within its own sphere of responsibility, especially with regard to the legal grounds on which Meta processes the data. | Meta Ireland Limited |
| Evaluation of the activity of users of our website for the purposes of Meta or third parties: Facebook can also use the information collected by the Meta pixel for its own purposes or the purposes of third parties, e.g. to create target groups for other clients who wish to display adverts. Meta is responsible for collecting and processing personal data. We have no knowledge of the details of how Meta processes the data within its own sphere of responsibility. For information about how Meta processes personal data, see the Facebook privacy policy at https://www.facebook.com/about/privacy/. | Meta pixel HTTP data, Meta pixel cookie data, Mata pixel event data, Meta pixel analysis data. | We do not use automated decision-making within our own sphere of responsibility. We have no knowledge of the details of how Meta processes the data within its own sphere of responsibility, especially with regard to automated decision-making. | Legal grounds for facilitating the collection of personal data by Meta on our website: Point (a) of Article 6(1) of the GDPR (consent). We do not process personal data within our own sphere of responsibility. We have no knowledge of the details of how Meta processes the data within its own sphere of responsibility, especially with regard to the legal grounds on which Meta processes the data. | Meta Ireland Limited |
| Recipient | Role of the recipient | Transfer to third countries and/or to international organisations | Adequacy decision or appropriate or adequate guarantees for transfers to third countries and/or international organisations |
|---|---|---|---|
| Google Ads Conversion Pixel / Google Ads Remarketing | |||
| Google LLC | |||
| Google Ireland Limited Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland | (Joint) controller. | EU and USA. | There is no adequacy decision from the European Commission in the sense of Article 45(3) of the GDPR. Google has standard contractual clauses (SCC) which have been adopted in accordance with Article 46 of the GDPR. |
| Meta | |||
| Meta Ireland Limited 4 GRAND CANAL SQUARE, D2 Dublin, Ireland | (Joint) controller. | EU and USA. | There is no adequacy decision from the European Commission in the sense of Article 45(3) of the GDPR. Facebook has standard contractual clauses (SCC) which have been adopted in accordance with Article 46 of the GDPR. |
(Under the data protection regulations, MARC O'POLO SE is responsible for this processing when you use the website https://company.marc-o-polo.com/ (→ section A.I). When you use our press portal https://press.marc-o-polo.com/, Marc O’Polo License AG is responsible for web analytics.)
If you have consented to analytical purposes in the data privacy and cookie settings, we will use web analytics technology to improve website navigation (e.g. to increase the number of page visits):
When you visit our website, the web analytics tool collects information about how you use our website and stores it in a profile that is specific to your device. In order to allocate this information to your device, your device is assigned a unique ID that is linked with the device-specific profile. This ID is stored in cookies (→ section J Analytics) on your device. When you visit our website, we can recognise your device based on the ID assigned to it.
We use Google Analytics for this purpose.
More detailed information about this is available below:
| Categories of personal data we process | Personal data in the categories | Sources of data | Obligation of the data subject to provide data | Duration of storage |
|---|---|---|---|---|
| Google Analytics, HTTP data. | Log data which are generated by the Hypertext Transfer Protocol Secure (HTTPS) for technical reasons when a web analytics tool (e.g. Google Analytics) is used on the website. These data include your IP address, the type and version of your browser, your operating system, the page you visited, the page you were on previously (referrer URL) and the date and time of your visit. | Users of the website. | The provision of data is not required by law or by a contract and is not necessary for the conclusion of a contract. No obligation to make the data available exists. If you do not provide the data, we will be unable to carry out web analytics with the web analytics tool in question. | IP anonymisation is active on this website for the web analytics tool Google Analytics. This means that the IP address sent by your browser for technical reasons is truncated (the last octet of the IP address is deleted) in order to anonymise it before it is stored. We shall store the other data for 38 months. |
| Google Analytics, Cookie data. | Data which are stored in cookies for the web analytics tool (e.g. Google Analytics) on your device. This includes a unique ID in each case which makes it possible to recognise returning visitors. (→ section J for more detailed information about the content of the cookies.) | Users of the website. | The provision of data is not required by law or by a contract and is not necessary for the conclusion of a contract. No obligation to make the data available exists. If you do not provide the data, we will be unable to carry out web analytics with the web analytics tool in question. | 38 months. (→ section J for information about how long the cookies remain valid.) |
| Google Analytics profile data. | Data which are generated by each web analytics tool (e.g. Google Analytics) and stored separately in pseudonymised user profiles for each web analytics tool. This includes information about how you use the website, especially page visits, the frequency of visits, the time you spend on pages you visit and the origin of the visitor (i.e. which promotional partners or initiatives brought the user to the website), allocated to the unique user ID of each visitor contained in the Google Analytics cookie data. | Generated independently. | - | 38 months. |
| Datadog HTTP data | Log data which are generated by the Hypertext Transfer Protocol Secure (HTTP(S)) for technical reasons when the respective monitoring tool used on the website (such as Datadog) is used. These data include your IP address, the type and version of your browser, your operating system, the page you visited, the page you were on previously (referrer URL) and the date and time of your visit. | Users of the website. | The provision of data is not required by law or by a contract and is not necessary for the conclusion of a contract. No obligation to make the data available exists. If you do not provide the data, we will not be able to record the session with the respective monitoring tool. | When using the Datadog monitoring tool, no IP addresses are stored. We store the other data for 30 days. |
| Datadog cookie data | Data stored in cookies for the respective web analytics tool on the user’s device. This includes a unique ID which makes it possible to recognise returning visitors during a session. (Section I for more detailed information about the content of the cookies.) | Users of the website. | The provision of data is not required by law or by a contract and is not necessary for the conclusion of a contract. No obligation to make the data available exists. If you do not provide the data, we will be unable to provide the website content you wish to access. | 30 days. |
| Purpose of the processing of personal data | Categories of personal data we process | Automated decision-making | Legal grounds and legitimate interests | Recipients |
|---|---|---|---|---|
| Web analytics in order to improve the website and improve website navigation (e.g. to increase the number of page visits): When you visit our website, the web analytics tool collects information about how you use our website and stores it in a profile that is specific to your device. In order to allocate this information to your device, your device is assigned a unique ID that is linked with the device-specific profile. This ID is stored in cookies (→ section J) on your device. When you visit our website, we can recognise your device based on the ID assigned to it. The objective of analytics is to investigate where users come from, what sections of our website are visited and how often sub-pages and categories are viewed, including for how long. The information we obtain helps us improve our website and improve website navigation (e.g. to increase the number of page visits). | Google Analytics HTTP data, Google Analytics cookie data, Google Analytics profile data. | No automated decision-making takes place. | Point (a) of Article 6(1) GDPR (consent). | Google Ireland Limited |
| Video recording of the session to improve the website and quickly identify errors: When you visit our website, the web analytics tool collects information about how you use our website and stores it in a profile that is specific to your device. In order to allocate this information to your device, your device is assigned a unique ID that is linked with the device-specific profile. This ID is stored in cookies (→ section I) on your device. When you visit our website, we can recognise your device based on the ID assigned to it. When entering text fields, the text is rendered unrecognisable, (i.e. entries are displayed in the video recordings as ‘xxxxxxxxx’, for example). No data is therefore recorded. The aim of the analysis is to identify sources of errors on the website and to trace the origin of these errors. The information obtained helps us to improve our website and better achieve our website objectives (e.g. good navigation on the website). | Datadog HTTP data, Datadog cookie data | No automated decision-making takes place. | No automated decision-making takes place. | Datadog |
| Recipients | Role of the recipient | Transfer to third countries and/or to international organisations | Adequacy decision or appropriate or adequate guarantees for transfers to third countries and/or international organisations |
|---|---|---|---|
| Google Ireland Limited | Joint controller | USA | There is no adequacy decision from the European Commission in the sense of Article 45(3) GDPR. Google has standard contractual clauses (SCC) which have been adopted in accordance with Article 46 GDPR. |
| Datadog | Processor. | USA | There is no adequacy decision from the European Commission in the sense of Article 45(3) of the GDPR. Datadog has standard contractual clauses (SCC) which have been adopted in accordance with Article 46 of the GDPR. |
(Under the data protection regulations, MARC O'POLO International SE → section A.I) is responsible for this processing as it is in charge of central applicant management for the MARC O’POLO Group. The MARC O’POLO Group company (→ section A.I) that is advertising the vacancy to which you have applied is also responsible.)
We process the personal data of people who apply to us in connection with our business activities.
We process the data of our applicants for the following purposes:
To provide an application portal in which you can share your data with us in order to submit your application.
To carry out the application process, especially to examine applications, contact applicants and carry out interviews designed to evaluate and select suitable applicants
To perform a sanction list check in compliance with legal obligations
To reimburse application costs
If the data are not provided: To keep the applicant in mind for future vacancies, especially to store the personal data shared for the purposes of the application process, to check the applicant’s suitability for future vacancies and to contact the applicant in order to initiate an application process
Conducting surveys
To anonymise data resulting from application processes so as to be able to evaluate the information for internal statistical purposes, such as to improve our application procedure
Storage for a transition period to serve as evidence for the purposes of filing, exercising or defending against legal claims
To file, exercise or defend against legal claims, including cooperation with external legal firms
To cooperate with supervisory authorities, courts and other public bodies in order to comply with legal obligations
Storage of data in order to comply with statutory storage obligations, especially those imposed by tax or commercial law
More detailed information about this is available below:
| Categories of personal data we process | Personal data in the categories | Sources of data | Obligation of the data subject to provide data | Duration of storage |
|---|---|---|---|---|
| HTTP data | Log data which are generated by the Hypertext Transfer Protocol Secure (HTTPS) for technical reasons when you visit the application portal: IP address, the type and version of your browser, your operating system, the page you visited, the page you were on previously (referrer URL) and the date and time of your visit. | Applicants | The provision of data is not required by law or by a contract and is not necessary for the conclusion of a contract. No obligation to make the data available exists. If you do not provide the data, we will be unable to provide the application portal content you wish to access. | Data are stored in server log files in a format which makes it possible to identify the data subjects for up to seven days unless a security incident occurs (e.g. a denial-of-service attack). If a security incident does occur, server log files shall be stored until the security incident has been overcome and fully investigated. |
| Master data | Name First name Date of birth Nationality Place of birth Country of birth | Applicants or employment agencies hired by applicants, from the Xing or LinkedIn profile, if consent to use the data has been given | Disclosure of the data is not legally or contractually necessary. The data subject is not obliged to provide the data. The data must be provided in order to enter into a contract. If the data are not provided, it will not be possible to carry out an application procedure or potentially offer employment. | In the event of employment, the data will be added to the personnel file. For details about the duration of storage, see the information about how our employees’ personal data are processed. If the data subject gives consent to this and if the data subject is not offered employment, we will store the data for 12 months (or until consent is withdrawn) after the end of the application procedure so as to bear the applicant in mind for future vacancies. Otherwise, the data will only be stored as evidence for the purposes of filing, exercising or defending against legal claims for six months after the end of the application procedure. Additionally, we shall store these anonymised data in order to evaluate them for internal statistical purposes. |
| Contact data | Private address Email address Phone number WhatsApp Recruiting Process: WhatsApp username WhatsApp phone number | Applicants or employment agencies hired by applicants | Disclosure of the data is not legally or contractually necessary. The data subject is not obliged to provide the data. The data must be provided in order to enter into a contract. If the data are not provided, it will not be possible to carry out an application procedure or potentially offer employment. | In the event of employment, the data will be added to the personnel file. For details about the duration of storage, see the information about how our employees’ personal data are processed. If the data subject gives consent to this and if the data subject is not offered employment, we will store the data for 12 months (or until consent is withdrawn) after the end of the application procedure so as to bear the applicant in mind for future vacancies. Otherwise, the data will only be stored as evidence for the purposes of filing, exercising or defending against legal claims for six months after the end of the application procedure. |
| Application data | Content of application documents: especially photo, CV, references and application videos or language tests, if applicable. Content of the written (including electronic) correspondence relating to the application WhatsApp Recruiting Process: We also store the following data during the WhatsApp recruiting process: - If process is started via “Go”: Date and time of registration, chat history and time of last activity in the chat - If process is ended via “Stop”: Date and time of any logout from the WhatsApp recruiting process | Applicants or employment agencies hired by applicants | Disclosure of the data is not legally or contractually necessary. The data subject is not obliged to provide the data. The data must be provided in order to enter into a contract. If the data are not provided, it will not be possible to carry out an application procedure or potentially offer employment. | In the event of employment, the data will be added to the personnel file. For details about the duration of storage, see the information about how our employees’ personal data are processed. If the data subject gives consent to this and if the data subject is not offered employment, we will store the data for 12 months (or until consent is withdrawn) after the end of the application procedure so as to bear the applicant in mind for future vacancies. Otherwise, the data will only be stored as evidence for the purposes of filing, exercising or defending against legal claims for six months after the end of the application procedure. |
| Application data | Consent to storage of the personal data shared for the purposes of the application process in order to keep the applicant in mind for future vacancies if the applicant is not offered employment | Applicants | The provision of the data is not required by law or by a contract and is not necessary for the conclusion of a contract. The data subject is not obliged to provide the data. If the data are not provided, we will only be able to consider your application for the vacancy to which you applied and not for any future vacancies if you are not offered employment. | In the event of employment, the data will be added to the personnel file. For details about the duration of storage, see the information about how our employees’ personal data are processed. If the data subject gives consent to this and if the data subject is not offered employment, we will store the data for 12 months (or until consent is withdrawn) after the end of the application procedure so as to bear the applicant in mind for future vacancies. Otherwise, the data will only be stored as evidence for the purposes of filing, exercising or defending against legal claims for six months after the end of the application procedure. |
| Application data | Content of examination results, appraisals from application interviews, feedback and evaluations Documentation of any consent given by the applicant to storage of the personal data shared for the purposes of the application process in order to keep the applicant in mind for future vacancies if the applicant is not offered employment, especially the date of the consent and of any withdrawal of consent | Generated by us | - | In the event of employment, the data will be added to the personnel file. For details about the duration of storage, see the information about how our employees’ personal data are processed. If the data subject gives consent to this and if the data subject is not offered employment, we will store the data for 12 months (or until consent is withdrawn) after the end of the application procedure so as to bear the applicant in mind for future vacancies. Otherwise, the data will only be stored as evidence for the purposes of filing, exercising or defending against legal claims for six months after the end of the application procedure. |
| Payment data | Data provided by applicants for the purposes of application cost reimbursement: This includes name and surname, date, location, point of contact, bank details and details of the nature and amount of the application costs | Applicants | The provision of the data is not required by law or by a contract and is not necessary for the conclusion of a contract. The data subject is not obliged to provide the data. If the data are not provided, we will be unable to reimburse application costs. | We shall store the data until the purposes for which the data are being processed is achieved. We shall store the data if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 of the German Tax Code (AO) and Section 257 of the German Commercial Code (HGB)). |
| Payment data | Data we generate in connection with the reimbursement of application costs: This includes documentation of the payment and documentation of any agreed waiver of the reimbursement of application costs | Generated by us | - | We shall store the data until the purposes for which the data are being processed is achieved. We shall store the data if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 of the German Tax Code (AO) and Section 257 of the German Commercial Code (HGB)). |
| Market research data | Information that we collect as part of surveys for market research purposes in order to analyse, in pseudonymised form, the satisfaction of our applicants and to improve the content of our services | Users of the website. | The provision of data is not required by law or by a contract and is not necessary for the conclusion of a contract. No obligation to make the data available exists. If you do not provide the data, we will be unable to carry out surveys or analyses for market research purposes. | We shall store these pseudonymised data for up to 38 months. Additionally, we shall store these anonymised data in order to evaluate them for internal statistical purposes. |
| Purpose of the processing of personal data | Categories of personal data we process | Automated decision-making | Legal grounds and legitimate interests | Recipients |
|---|---|---|---|---|
| To provide an application portal in which you can share your data with us in order to submit your application. | HTTP data | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (balance of interests). We have a legitimate interest in providing the application portal accessed by the user. | Application portal |
| To carry out the application process, especially to examine applications, contact applicants and carry out interviews designed to evaluate and select suitable applicants (including WhatsApp Recruiting Process) MARC O'POLO SE carries out the application processes. If you apply for a job at an affiliated company (→ section A.I), your data will also be shared with that affiliated company. | Master data Contact data Application data | No automated decision-making takes place. | Article 6 (1) (b) GDPR (fulfilment of a contract to which the data subject is party or performance of pre-contractual measures taken at the request of the data subject) | Application portal, affiliated companies of MARC O’POLO, IT service providers language test provider, WhatsApp Recruiting Provider |
| To perform a sanction list check in compliance with legal obligations: Pursuant to the anti-terrorism Council Regulations 2580/2001 and 881/2002, we are obliged to perform a check against a list of sanctions for every applicant. If the result of this sanction list check turns out to be positive after we compare the name of the applicant and potentially his/her date of birth and address against a publicly accessible ‘terror list’, we are obliged to notify the German Federal Office for Economic Affairs and Export Control (BAFA) so it can investigate further. | Master data Contact data | No automated decision-making takes place. | Point (c) of Article 6(1) GDPR (compliance with a legal obligation) | German Federal Office for Economic Affairs and Export Control (BAFA). |
| To reimburse application costs | Payment data | No automated decision-making takes place. | Point (c) of Article 6(1) GDPR (compliance with a legal obligation) | Banks |
| If the data are not provided: To keep the applicant in mind for future vacancies, especially to store the personal data shared for the purposes of the application process, to check the applicant’s suitability for future vacancies and to contact the applicant in order to initiate an application process | Master data Contact data Application data | No automated decision-making takes place. | Point (a) of Article 6(1) GDPR (consent) | Application portal |
| To carry out customer surveys for market research purposes and pseudonymised analyses of market research data in order to develop and improve the content of our website. | Market research data. | No automated decision-making takes place. | Balance of interests (point (f) of Article 6(1) of the GDPR). We have a legitimate interest in the development and improvement of our website. | Survey agency. |
| To anonymise data resulting from application processes so as to be able to evaluate the information for internal statistical purposes, such as to improve our application procedure | Master data Application data | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (pursuit of a legitimate interest with consideration for a balance of interests): | - |
| Storage to serve as evidence for the purposes of filing, exercising or defending against legal claims | Master data Contact data Application data | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (pursuit of a legitimate interest with consideration for a balance of interests): We have a legitimate interest in filing, exercising or defending against legal claims. | - |
| To file, exercise or defend against legal claims, including cooperation with external legal firms | Master data Contact data Application data | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (pursuit of a legitimate interest with consideration for a balance of interests): We have a legitimate interest in filing, exercising or defending against legal claims. | Courts Lawyers |
| To cooperate with supervisory authorities, courts and other public bodies in order to comply with legal obligations | Master data Contact data Application data | No automated decision-making takes place. | Point (c) of Article 6(1) GDPR (compliance with a legal obligation) | Supervisory authorities, courts and other public bodies |
| Storage of data in order to comply with statutory storage obligations, especially those imposed by tax or commercial law: Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). | Payment data | No automated decision-making takes place. | Point (c) of Article 6(1) GDPR (compliance with a legal obligation) | - |
| Recipients | Role of the recipient | Transfer to third countries and/or to international organisations | Recipients Role of the recipient Transfer to third countries and/or to international organisations Adequacy decision or appropriate or adequate guarantees for transfers to third countries and/or international organisations |
|---|---|---|---|
| German Federal Office for Economic Affairs and Export Control (BAFA) | Controller | No transfer to third countries and/or international organisations takes place. | - |
| Banks | Controller | No transfer to third countries and/or international organisations takes place. | - |
| Lawyers | Controller | No transfer to third countries and/or international organisations takes place. | - |
| Supervisory authorities, courts and other public bodies | Controller | No transfer to third countries and/or international organisations takes place. | - |
| Affiliated group companies | Controller | No transfer to third countries and/or international organisations takes place. | - |
| Application portal (Talentsoft SA, 8 Rue Heyrault, Boulogne-Billancourt 92100, France) | Processor | No transfer to third countries and/or international organisations takes place. | - |
| IT service providers | Processor | USA | There is no adequacy decision from the European Commission in the sense of Article 45(3) GDPR. The IT service providers have standard contractual clauses (SCC) which have been adopted in accordance with Article 46 GDPR. |
| Language test provider | Processor | USA | There is no adequacy decision from the European Commission in the sense of Article 45(3) of the GDPR. The language test provider shall have standard contractual clauses (SCCs) approved in accordance with Article 46 of the GDPR. |
| Survey agency (LamaPoll) | Processor. | EU | - |
| WhatsApp Recruiting Provider mercu Name: Flyp Pte Ltd Trading Name: Mercu Adress: 160 Robinson Road, #14-04 SBFCenter, S068914 Singapore Contact: accounts@mercu.com | Processor. | Singapore | - |
(Under the data protection regulations, the MARC O’POLO Group company (→ section A.I) with which you are in business contact or for which you are working is responsible for this processing.)
We process the personal data of potential business partners (leads), our existing business partners and their employees in connection with our business activities.
A business partner is any natural person or legal entity with whom we have a business relationship. This includes our customers, suppliers and sales partners in particular. Data belonging to our business partners can be personal data if the business partner is a natural person. Additionally, data that relate to employees of our business partners are personal data.
We process the data of potential business partners (leads), our existing business partners and their employees for the following purposes:
To identify potential business partners (leads) and initiate business relationships, including initiating contact with a view to establishing a business relationship
To identify our business partners
To perform a sanction list check in compliance with legal obligations
To take steps prior to entering into a contract, including pre-contractual communication and the generation of quotations and cost estimates
To evaluate the creditworthiness of our business partners and set/monitor the credit limits of our customers
To execute contracts with our business partners, including contractual communication, an exchange of services, invoicing and payment processing
Accurate accounting and storage in order to comply with contractual and legal storage obligations, especially under tax and commercial law
Storage to serve as evidence for the purposes of filing, exercising or defending against legal claims
To file, exercise or defend against legal claims, including cooperation with external legal firms
To cooperate with external tax consultants and/or auditors in order to comply with legal obligations
To cooperate with supervisory authorities, courts and other public bodies in order to comply with legal obligations
Business relationship management, including making contact in order to notify our business partners, maintain relationships with our business partners and align our services with the needs and wishes of our business partners
More detailed information about this is available below:
| Categories of personal data we process | Personal data in the categories | Sources of data | Obligation of the data subject to provide data | Duration of storage |
|---|---|---|---|---|
| Lead data | Company Industry Name Function Business contact details (address, e-mail address, phone number) | (Potential) business partners (leads) | Disclosure of the data is not legally or contractually necessary. The data subject is not obliged to provide the data. It might be necessary to provide the data in order to enter into a contract. If the data are not provided, it might not be possible to initiate a business relationship under certain circumstances. | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Lead data | Company Industry Name Function Business contact details (address, e-mail address, phone number) | (Existing) business partners Other third parties Public sources (e.g. websites and industrial directories) | - | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Master data | Company Registered office Commercial register number VAT number Business identification number Industry Association membership | Business partners | As a rule, disclosure of the data is not legally or contractually necessary. The data subject is not generally obliged to provide the data. The data must be provided in order to enter into a contract. If the data are not provided, it might not be possible to conclude or execute a contract under certain circumstances. | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Master data | Customer number(s) Supplier number(s) | Generated by us | - | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| KYC data | Data we collect as part of the Know-Your-Customer (KYC) process: This includes information about the ownership structures and beneficial owners of our business partners | Business partners | Disclosure of the data can be legally or contractually necessary. The data subject is obliged to provide the data under certain circumstances. It might be necessary to provide the data in order to enter into a contract. If the data are not provided, it might not be possible to conclude or execute a contract under certain circumstances. | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| KYC data | Data we collect as part of the Know-Your-Customer (KYC) process: This includes information about the ownership structures and beneficial owners of our business partners | Commercial register | - | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Contact data | Name Function Business contact details (address, e-mail address, phone number, fax number) | Business partners | Disclosure of the data can be legally or contractually necessary. The data subject is obliged to provide the data under certain circumstances. It might be necessary to provide the data in order to enter into a contract. If the data are not provided, it might not be possible to conclude or execute a contract under certain circumstances. | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Bank details | Account holder Bank IBAN BIC Account number Routing number | Business partners | Disclosure of the data is not required by law, but it can be required under a contract. The data subject is obliged to provide the data under certain circumstances. It might be necessary to provide the data in order to enter into a contract. If the data are not provided, it might not be possible to conclude or execute a contract under certain circumstances. Die Bereitstellung kann für einen Vertragsabschluss erforderlich sein. Im Falle einer Nichtbereitstellung ist der Abschluss oder die Erfüllung eines Vertrages unter Umständen nicht möglich. | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). Wir speichern diese Daten außerdem darüber hinaus, soweit gesetzliche, insbesondere handels- und steuerrechtliche, Aufbewahrungspflichten bestehen. Je nach Art der Unterlagen können handels- und steuerrechtliche Aufbewahrungspflichten von sechs oder zehn Jahren bestehen (§ 147 Abgabenordnung (AO), § 257 Handelsgesetzbuch (HGB)). |
| Communication data | Content of business communication with our business partners: Especially by post, e-mail, phone and fax. | Business partners | Disclosure of the data is not legally or contractually necessary. The data subject is not obliged to provide the data. It might be necessary to provide the data in order to enter into a contract. If the data are not provided, it might not be possible to conclude or execute a contract under certain circumstances. | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Communication data | Circumstances of business communication with our business partners, especially the people involved, date/time and duration | Generated by us | - | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Creditworthiness data | Data we use to assess the creditworthiness of our business partners: In particular, this includes credit information provided by credit agencies and information generated by us regarding the punctual payment of amounts owed to us. | Credit agencies Generated by us | - | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Contractual data | Data we obtain from our business partners in order to take steps prior to entering into a contract and/or to execute contracts with our business partners | Business partners | Disclosure of the data is not legally or contractually necessary. The data subject is not obliged to provide the data. It might be necessary to provide the data in order to enter into a contract. If the data are not provided, it might not be possible to conclude or execute a contract under certain circumstances. | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Contractual data | Data from written (including electronic) contractual documents that we obtain from our business partners | Business partners | Disclosure of the data is not legally or contractually necessary. The data subject is not obliged to provide the data. It might be necessary to provide the data in order to enter into a contract. If the data are not provided, it might not be possible to conclude or execute a contract under certain circumstances. | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Contractual data | Data we might obtain from third parties in order to take steps prior to entering into a contract and/or to execute contracts with our business partners | Third parties | - | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 A anOd Section 257 HGB). |
| Contractual data | Data from written (including electronic) contractual documents that we generate | Generated by us | - | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Invoice data | Data from invoices and payment reminders that we receive from our business partners, especially dates, items and invoice amounts | Business partners | Disclosure of the data can be legally or contractually necessary. The data subject is obliged to provide the data under certain circumstances. The data are not required in order to enter into a contract. However, if the data are not provided, billing might not be possible under certain circumstances. | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Invoice data | Data we generate for billing purposes, especially content of internal time recording and activity reports. | Generated by us | - | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Invoice data | Data from invoices and payment reminders that we generate: Especially dates, items and invoice amounts | Generated by us | - | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Payment data | Transaction data: Especially dates and payment amounts | Generated by us | - | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Log data | Log data relating to the business content of meetings and conversations with our business partners that we arrange in order to nurture the business relationship | Generated by us | - | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Analytics data | Data from analyses of our business partners’ corporate structures that we use for strategic purposes in our business relationships | Generated by us | - | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Survey data | Responses to our voluntary surveys in which our business partners are invited to evaluate the business relationship | Business partners | The provision of the data is not required by law or by a contract and is not necessary for the conclusion of a contract. The data subject is not obliged to provide the data. If the data are not provided, we cannot take the results of that business partner’s survey into consideration. Otherwise, this has no effect on the business relationship. | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Purpose of the processing of personal data | Categories of personal data we process | Automated decision-making | Legal grounds and legitimate interests | Recipients |
|---|---|---|---|---|
| To identify potential business partners (leads) and initiate business relationships, including initiating contact with a view to establishing a business relationship: Depending on the nature of the business relationship we hope to establish, the identification of potential business partners and the initiation of contact might require us to cooperate with other companies in our group or companies outside of our group in individual cases. | Lead data | No automated decision-making takes place. | As a rule, the legal grounds for the identification of potential business partners and the initiation of business relationships are provided by: Point (f) of Article 6(1) GDPR (pursuit of a legitimate interest with consideration for a balance of interests): We have a legitimate interest in building new business relationships. Depending on the circumstances of each individual case, the legal grounds for contacting leads – especially the way in which we initiate contact with each lead – might be provided by: Point (a) of Article 6(1) GDPR (consent) Otherwise: Point (b) of Article 6(1) GDPR (performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract) Otherwise: Point (f) of Article 6(1) GDPR (pursuit of a legitimate interest with consideration for a balance of interests): We have a legitimate interest in building new business relationships. | Other companies in our group Cooperating companies outside of our group |
| To identify our business partners | Master data KYC data | No automated decision-making takes place. | Point (c) of Article 6(1) GDPR (compliance with a legal obligation, especially the German Anti-Money Laundering Act (GwG)) Otherwise: Point (f) of Article 6(1) GDPR (pursuit of a legitimate interest with consideration for a balance of interests): We have a legitimate interest in knowing our business partners. | Identification service providers |
| To perform a sanction list check in compliance with legal obligations: Pursuant to the anti-terrorism Council Regulations 2580/2001 and 881/2002, we are obliged to perform a check against a list of sanctions for every business partner from whom we receive a payment or to whom we make a payment. If the result of this sanction list check turns out to be positive after we compare the name of the business partner’s point of contact and potentially his/her date of birth and address against a publicly accessible ‘terror list’, we are obliged to notify the German Federal Office for Economic Affairs and Export Control (BAFA) so it can investigate further. | Master data Contact data KYC data | No automated decision-making takes place. | Point (c) of Article 6(1) GDPR (compliance with a legal obligation). | German Federal Office for Economic Affairs and Export Control (BAFA). |
| To take steps prior to entering into a contract, including pre-contractual communication and the generation of quotations and cost estimates: Depending on the service, we might cooperate with other companies in our group or companies outside of our group in individual cases in order to take steps prior to entering into a contract. | Master data Contact data Communication data Contractual data | No automated decision-making takes place. | Where the data subject is our (potential) business partner: Point (b) of Article 6(1) GDPR (performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract) Where the data subject is not our (potential) business partner: Point (f) of Article 6(1) GDPR (pursuit of a legitimate interest with consideration for a balance of interests): We have a legitimate interest in taking steps prior to entering into a contract at the request of our (potential) business partner. | Other companies in our group Cooperating companies outside of our group Delivery company IT service providers Translation service providers |
| To evaluate the creditworthiness of our business partners and set/monitor the credit limits of our customers: Before we enter into a contract with a business partner, we might check the creditworthiness of the business partner and set credit limits for our customers. We will monitor the creditworthiness and credit limits of a customer on a regular basis until payment is made in full. Depending on the service, we might cooperate with other companies in our group or companies outside of our group in individual cases in order to assess the creditworthiness of our business partners and set and monitor credit limits for our customers. | Master data Contact data Communication data Creditworthiness data Contractual data | We do not use automated decision-making. Any necessary information about automated decision-making by credit agencies will be provided by the relevant credit agency. | Point (f) of Article 6(1) GDPR (pursuit of a legitimate interest with consideration for a balance of interests): We have a legitimate interest in collecting accounts receivable. | Other companies in our group Cooperating companies outside of our group Credit agencies |
| To execute contracts with our business partners, including contractual communication, an exchange of services, invoicing and payment processing: Depending on the service, we might cooperate with other companies in our group or companies outside of our group in individual cases in order to execute contracts. | Master data Contact data Bank details Communication data Contractual data Invoice data Payment data | No automated decision-making takes place. | Where the data subject is our business partner: Point (b) of Article 6(1) GDPR (performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract) Where the data subject is not our business partner: Point (f) of Article 6(1) GDPR (pursuit of a legitimate interest with consideration for a balance of interests): We have a legitimate interest in executing the contract with our business partner. | Other companies in our group Cooperating companies outside of our group Delivery company Billing and payment service providers IT service providers |
| Accurate accounting and storage in order to comply with contractual and legal storage obligations, especially under tax and commercial law | Master data KYC data Contact data Bank details Communication data Contractual data Invoice data Payment data | No automated decision-making takes place. | Point (c) of Article 6(1) GDPR (compliance with a legal obligation): In particular, compliance with legal requirements pertaining to accurate accounting and statutory storage obligations, especially under employment, tax and commercial law Where the data subject is our business partner, the following also applies: Point (b) of Article 6(1) GDPR (performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract). Where the data subject is not our business partner, the following also applies: Point (f) of Article 6(1) GDPR (pursuit of a legitimate interest with consideration for a balance of interests): We have a legitimate interest in executing the contract with our business partner. | Accounting service providers Archiving service providers |
| Storage to serve as evidence for the purposes of filing, exercising or defending against legal claims | Master data KYC data Contact data Bank details Communication data Contractual data Log data Invoice data Payment data | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (pursuit of a legitimate interest with consideration for a balance of interests): We have a legitimate interest in filing, exercising or defending against legal claims. | Archiving service providers |
| To file, exercise or defend against legal claims, including cooperation with external legal firms | Master data KYC data Contact data Bank details Communication data Contractual data Invoice data Payment data | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (pursuit of a legitimate interest with consideration for a balance of interests): We have a legitimate interest in filing, exercising or defending against legal claims. | Courts Lawyers |
| To cooperate with external tax consultants and/or auditors in order to comply with legal obligations | Master data KYC data Contact data Bank details Communication data Contractual data Invoice data Payment data | No automated decision-making takes place. | Point (c) of Article 6(1) GDPR (compliance with a legal obligation) | Tax consultants Auditors |
| To cooperate with supervisory authorities, courts and other public bodies in order to comply with legal obligations | Master data KYC data Contact data Bank details Communication data Contractual data Invoice data Payment data | No automated decision-making takes place. | Point (c) of Article 6(1) GDPR (compliance with a legal obligation) | Supervisory authorities, courts and other public bodies |
| Business relationship management, including making contact in order to notify our business partners, maintain relationships with our business partners and align our services with the needs and wishes of our business partners | Master data Contact data Communication data Contractual data Log data Analytics data Survey data | No automated decision-making takes place. | The legal grounds for business relationship management are generally provided by: Point (f) of Article 6(1) GDPR (pursuit of a legitimate interest with consideration for a balance of interests): We have a legitimate interest in maintaining and strategically orienting our relationships with business partners and aligning our services with the needs and wishes of our business partners. Depending on the circumstances of each individual case, the legal grounds for contacting our business partners to notify them – especially the way in which we contact them – might be provided by: Point (a) of Article 6(1) GDPR (consent) Otherwise: Point (f) of Article 6(1) GDPR (pursuit of a legitimate interest with consideration for a balance of interests): We have a legitimate interest in notifying our business partners. | - |
| Recipients | Role of the recipient | Transfer to third countries and/or to international organisations | Adequacy decision or appropriate or adequate guarantees for transfers to third countries and/or international organisations |
|---|---|---|---|
| Other companies in our group | Controller | No transfer to third countries and/or international organisations takes place. | - |
| Cooperating companies outside of our group such as franchise partners, licence partners and shop construction firms | Controller | No transfer to third countries and/or international organisations takes place. | - |
| Lawyers | Controller | No transfer to third countries and/or international organisations takes place. | - |
| Auditors | Controller | No transfer to third countries and/or international organisations takes place. | - |
| Tax consultants | Controller | No transfer to third countries and/or international organisations takes place. | - |
| German Federal Office for Economic Affairs and Export Control (BAFA) | Controller | No transfer to third countries and/or international organisations takes place. | - |
| Supervisory authorities, courts and other public bodies | Controller | No transfer to third countries and/or international organisations takes place. | - |
| Delivery company | Controller | No transfer to third countries and/or international organisations takes place. | - |
| Credit agencies | Controller | No transfer to third countries and/or international organisations takes place. | - |
| Identification service providers | No transfer to third countries and/or international organisations takes place. | - | |
| Billing and payment service providers | No transfer to third countries and/or international organisations takes place. | - | |
| Accounting service providers | No transfer to third countries and/or international organisations takes place. | - | |
| Archiving service providers | No transfer to third countries and/or international orgaisationns takes place. | - | |
| IT service providers | USA | There is no adequacy decision from the European Commission in the sense of Article 45(3) GDPR. The IT service providers have standard contractual clauses (SCC) which have been adopted in accordance with Article 46 GDPR. | |
| Translation service providers | No transfer to third countries and/or international organisations takes place. | - |
((Under the data protection regulations, the MARC O’POLO Group company (→ section A.I) whose buildings and facilities you are visiting is responsible for this processing.)
We process the personal data of visitors to our buildings and facilities in connection with our business activities.
A visitor is any natural person who enters our buildings and facilities, excluding our employees. In particular, this might be our (potential) business partners and their employees.
We process the data of our visitors for the following purposes:
To identify our visitors and document visits in order to maintain the security of our buildings, facilities and employees, to ensure the safety of our visitors and to protect our property or the property of our business partners
To plan and organise the visit
To conduct video surveillance and evaluate video recordings in order to maintain the security of our buildings, facilities and employees, to ensure the safety of our visitors and to protect our property or the property of our business partners
Accurate accounting and storage in order to comply with legal storage obligations, especially under tax and commercial law
Storage to serve as evidence for the purposes of filing, exercising or defending against legal claims
To file, exercise or defend against legal claims, including cooperation with external legal firms
To cooperate with supervisory authorities, courts and other public bodies in order to comply with legal obligations
More detailed information about this is available below:
| Categories of personal data we process | Personal data in the categories | Sources of data | Obligation of the data subject to provide data | Duration of storage |
|---|---|---|---|---|
| Master data | Name Function Company Industry | Visitors | The provision of the data is not required by law or by a contract and is not necessary for the conclusion of a contract. The data subject is not obliged to provide the data. However, if the data are not provided, a visit might not be possible under certain circumstances. | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Contact data | Address Email address Phone number Fax number | Visitors | The provision of the data is not required by law or by a contract and is not necessary for the conclusion of a contract. The data subject is not obliged to provide the data. However, if the data are not provided, a visit might not be possible under certain circumstances. | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Registration data | Expected date/time Expected duration Purpose of visit Buildings or parts of buildings being visited Arrival and departure | Visitors | The provision of the data is not required by law or by a contract and is not necessary for the conclusion of a contract. The data subject is not obliged to provide the data. However, if the data are not provided, a visit might not be possible under certain circumstances. | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Registration data | Expected date/time Expected duration Purpose of visit Buildings or parts of buildings being visited Arrival and departure | Generated by us | - | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Additional data | Optional information about special dietary requirements the visitor might have, or other technical or organisational precautions to take for the visit, e.g. barrier-free access | Visitors | The provision of the data is not required by law or by a contract and is not necessary for the conclusion of a contract. The data subject is not obliged to provide the data. If these data are not provided, special requirements of the visitor cannot be taken into consideration. | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Communication data | Content of communication with visitors in order to plan and organise visits: Especially by post, e-mail, phone and fax | Visitors | The provision of the data is not required by law or by a contract and is not necessary for the conclusion of a contract. The data subject is not obliged to provide the data. However, if the data are not provided, a visit might not be possible under certain circumstances. | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Communication data | Circumstances of business communication with visitors: Especially the people involved, date/time and duration | Generated by us | - | We shall store the data until the purposes for which the data are being processed is achieved. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| CCTV data | Image material from CCTV cameras, including the date and time | Generated by us | - | We store the data for seven days. |
| Purpose of the processing of personal data | Categories of personal data we process | Automated decision-making | Legal grounds and legitimate interests | Recipients |
|---|---|---|---|---|
| To identify our visitors and document visits in order to maintain the security of our buildings, facilities and employees, to ensure the safety of our visitors and to protect our property or the property of our business partners: This includes checking access authority and checking the master and visitor data provided during the visit against any master and visitor data provided as part of pre-registration. | Master data Contact data Registration data | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (pursuit of a legitimate interest with consideration for a balance of interests): We have a legitimate interest in maintaining the security of our buildings, facilities and employees, ensuring the safety of our visitors and protecting our property or the property of our business partners. We also have a legitimate interest in ensuring that we have adequate data security measures in place pursuant to Article 32 GDPR. | IT service providers |
| To plan and organise the visit: We might ask visitors to pre-register prior to their visit for this reason. Furthermore, we will take into account any optional information about special dietary requirements our visitors might have, or other technical or organisational precautions to take for the visit, e.g. barrier-free access. | Master data Contact data Registration data Additional data Communication data | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (pursuit of a legitimate interest with consideration for a balance of interests): We have a legitimate interest in planning and organising the visit with consideration for the special wishes and requirements of our visitors. Where additional data are processed and the additional data are special categories of personal data (especially data concerning health), the processing is based on point (a) of Article 9(2) GDPR (explicit consent). | Canteen operators |
| To conduct video surveillance and evaluate video recordings in order to maintain the security of our buildings, facilities and employees, to ensure the safety of our visitors and to protect our property or the property of our business partners: All areas under CCTV surveillance are expressly designated as being under surveillance (normally by signs at access points to monitored areas). | CCTV data | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (pursuit of a legitimate interest with consideration for a balance of interests): We have a legitimate interest in maintaining the security of our buildings, facilities and employees, ensuring the safety of our visitors and protecting our property or the property of our business partners. We also have a legitimate interest in ensuring that we have adequate data security measures in place pursuant to Article 32 GDPR. | - |
| Accurate accounting and storage in order to comply with legal storage obligations, especially under tax and commercial law. | Master data Contact data Registration data Additional data Communication data | No automated decision-making takes place. | Point (c) of Article 6(1) GDPR (compliance with a legal obligation): In particular, compliance with legal requirements pertaining to accurate accounting and statutory storage obligations, especially under employment, tax and commercial law | Accounting service providers Archiving service providers |
| Storage to serve as evidence for the purposes of filing, exercising or defending against legal claims | Master data Contact data Registration data Additional data Communication data CCTV data | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (pursuit of a legitimate interest with consideration for a balance of interests): We have a legitimate interest in filing, exercising or defending against legal claims. Where additional data are processed and the additional data are special categories of personal data, the processing is based on point (f) of Article 9(2) GDPR (establishment, exercise or defence of legal claims). | - |
| To file, exercise or defend against legal claims, including cooperation with external legal firms | Master data Contact data Registration data Additional data Communication data CCTV data | No automated decision-making takes place. | automated decision-making takes place. Point (f) of Article 6(1) GDPR (pursuit of a legitimate interest with consideration for a balance of interests): We have a legitimate interest in filing, exercising or defending against legal claims. Where additional data are processed and the additional data are special categories of personal data, the processing is based on point (f) of Article 9(2) GDPR (establishment, exercise or defence of legal claims). | Courts Lawyers |
| To cooperate with supervisory authorities, courts and other public bodies in order to comply with legal obligations | Master data Contact data Registration data Additional data Communication data CCTV data | No automated decision-making takes place. | Point (c) of Article 6(1) GDPR (compliance with a legal obligation) Where additional data are processed and the additional data are special categories of personal data, the processing is based on point (f) of Article 9(2) GDPR (establishment, exercise or defence of legal claims). | Supervisory authorities, courts and other public bodies |
| Recipients | Role of the recipient | Transfer to third countries and/or to international organisations | Adequacy decision or appropriate or adequate guarantees for transfers to third countries and/or international organisations |
|---|---|---|---|
| Accounting service providers | Processor | No transfer to third countries and/or international organisations takes place. | - |
| Archiving service providers | Processor | No transfer to third countries and/or international organisations takes place. | - |
| Lawyers | Controller | No transfer to third countries and/or international organisations takes place. | - |
| Auditors | Controller | No transfer to third countries and/or international organisations takes place. | - |
| Tax consultants | Controller | No transfer to third countries and/or international organisations takes place. | - |
| Supervisory authorities, courts and other public bodies | Controller | No transfer to third countries and/or international organisations takes place. | - |
| Canteen operators | Controller | No transfer to third countries and/or international organisations takes place. | - |
| IT service providers | Processor | No transfer to third countries and/or international organisations takes place. | There is no adequacy decision from the European Commission in the sense of Article 45(3) GDPR. The IT service providers have standard contractual clauses (SCC) which have been adopted in accordance with Article 46 GDPR. |
(Under the data protection regulations, MARC O'POLO SE (→ section A.I) is responsible for this processing.)
On the website, we provide you with the means of contacting us via contact forms. We process the information you provide in the contact forms in order to process your enquiry, such as the availability of certain products. Additionally, we might store the information as evidence for the purposes of filing, exercising or defending against legal claims or in order to comply with statutory storage obligations, especially those imposed by tax and commercial law.
When you use the contact forms on the website, the browser you are using on your device will send certain information such as your IP address to the server of our website for technical reasons. We process this information in order to provide the contact forms on the website and ensure the security of the IT infrastructure used to provide the form.
More detailed information about this is available below:
| Categories of personal data we process | Personal data in the categories | Sources of data | Obligation of the data subject to provide data | Duration of storage |
|---|---|---|---|---|
| Contact form HTTP data | Log data which are generated by the Hypertext Transfer Protocol Secure (HTTPS) when you access contact forms on the website. These data include your IP address, the type and version of your browser, your operating system, the page you visited, the page you were on previously (referrer URL) and the date and time of your visit. | Users of the website. | The provision of data is not required by law or by a contract and is not necessary for the conclusion of a contract. No obligation to make the data available exists. If you do not provide the data, we will be unable to provide the website content you wish to access. | Data are stored in server log files in a format which makes it possible to identify the data subjects for up to seven days unless a security incident occurs (e.g. a denial-of-service attack). If a security incident does occur, server log files shall be stored until the security incident has been overcome and fully investigated. |
| Contact form data | Data which you share with us in contact forms on the website. This includes the information you send us in each contact form on the website. It can include the following data in particular: Your name, date of birth, address, phone number, e-mail address and the content of your enquiry. | Users of the website. | The provision of data is not required by law or by a contract and is not necessary for the conclusion of a contract. No obligation to make the data available exists. If you do not provide the data, we will be unable to process your enquiry. | Data shall be stored until we finish handling your enquiry. Additionally, we shall store these data as evidence for the purposes of filing, exercising or defending against legal claims for a transition period of three years from the end of the year in which you shared the data with us or until the end of any ongoing legal disputes. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Purpose of the processing of personal data | Categories of personal data we process | Automated decision-making | Legal grounds and legitimate interests | Recipients |
|---|---|---|---|---|
| Provision of our contact forms on the website. HTTP data are processed temporarily on our web server for this purpose. | Contact form HTTP data. | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (balance of interests). We have a legitimate interest in providing the website content accessed by the user. | Hosting providers. |
| To guarantee the security of the IT infrastructure used to provide the form, especially to identify, combat and document disruptions in a legally sound manner (e.g. DDoS attacks). Data are stored temporarily in log files on our web server and evaluated for this purpose. | Contact form HTTP data. | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (balance of interests). We have a legitimate interest in guaranteeing the security of the IT infrastructure used to provide the form, especially so as to identify, combat and document disruptions in a legally sound manner (e.g. DDoS attacks). | Hosting providers. |
| To process your enquiry. | Contact form data. | No automated decision-making takes place. | Where your enquiry concerns a contract to which you are party or steps prior to entering into a contract: Point (b) of Article 6(1) GDPR (performance of a contract or steps prior to entering into a contract). Otherwise: Point (f) of Article 6(1) GDPR (balance of interests). In this case, we have a legitimate interest in processing your enquiry. | - |
| Storage and processing to serve as evidence for the purposes of filing, exercising or defending against legal claims. | Contact form data. | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (balance of interests). We have a legitimate interest in filing, exercising or defending against legal claims. | - |
| Storage of data in order to comply with statutory storage obligations, especially those imposed by tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). | Contact form data. | No automated decision-making takes place. | Point (c) of Article 6(1) GDPR (compliance with a legal obligation). | - |
| Recipients | Role of the recipient | Transfer to third countries and/or to international organisations | Adequacy decision or appropriate or adequate guarantees for transfers to third countries and/or international organisations |
|---|---|---|---|
| Hosting provider: AWS | Processor. | USA | There is no adequacy decision from the European Commission in the sense of Article 45(3) GDPR. AWS has standard contractual clauses (SCC) which have been adopted in accordance with Article 46 GDPR. |
(Under the data protection regulations, Marc O’Polo License AG (→ section A.I) is responsible for this processing.)
You can use our press portal on our website https://press.marc-o-polo.com/.
We process personal data when you use our press portal, including the data you share with us when you register for the press portal, in order to make press and image material available to download along with detailed information about our company and brands, to provide the consent administration tool, to guarantee the security of the IT infrastructure used to provide the press portal, to retain as evidence and in order to comply with statutory storage obligations.
We also use web analytics technology in our press portal (→ section H).
| Categories of personal data we process | Personal data in the categories | Sources of data | Obligation of the data subject to provide data | Duration of storage |
|---|---|---|---|---|
| HTTP data | Log data which are generated by the Hypertext Transfer Protocol Secure (HTTPS) for technical reasons when you visit the press portal: IP address, the type and version of your browser, your operating system, the page you visited, the page you were on previously (referrer URL) and the date and time of your visit. | Users of the press portal. | The provision of data is not required by law or by a contract and is not necessary for the conclusion of a contract. No obligation to make the data available exists. If you do not provide the data, we will be unable to provide the press portal content you wish to access. | Data are stored in server log files in a format which makes it possible to identify the data subjects for up to seven days unless a security incident occurs (e.g. a denial-of-service attack). If a security incident does occur, server log files shall be stored until the security incident has been overcome and fully investigated. |
| Master press data. | Data you share with us in the registration form on our website in order to register for the press portal (and create a press portal account). These data include: Title, name and surname, e-mail address, phone number, editorial office, postal address, country, password. | Users of the press portal. | The registration data must be provided in order to use the press portal. If you do not provide the mandatory data, we will be unable to grant you access to text and image-based press material or allow you to download it. | We will store these data for as long as you remain registered for the press portal. We shall store these data as evidence for the purposes of filing, exercising or defending against legal claims for a transition period of four years from the end of the year in which you left the scheme or until the end of any ongoing legal disputes. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Log-in data | Data generated when you log into your press portal account: This includes your e-mail address and password. It also includes a unique session ID for the session in which you are logged into your press portal account as well as the expiry date of that session. These data are stored in cookies on your device (→ section J) and can be read out while you use our press portal. | Users of the press portal. | The provision of the data is not required by law or by a contract and is not necessary for the conclusion of a contract. The data subject is under no obligation to provide the data. If you do not provide the data, we will be unable to let you log into the press portal. | We will only process the data for as long as you are logged into your press portal account. (See section J for details about how long the cookies stored on your device will remain valid.) |
| Basket data | Data relating to press material you add to your basket in the press portal. This includes images and press documents. | Users of the press portal. | The data must be provided for the purposes of the usage relationship. No obligation to make the data available exists. If you do not provide the data, you will not be able to purchase any items from our online store. | We will store these data permanently. We shall store these data as evidence for the purposes of filing, exercising or defending against legal claims for a transition period of four years from the end of the year in which you left the scheme or until the end of any ongoing legal disputes. |
| Opt-in data | Data relating to consent you have granted with regard to our website. This includes your consent and potentially your individual selection regarding the use of cookie-based technologies. These data are stored in cookies on your device (→ section J). | Users of the website. | The provision of data is not required by law or by a contract and is not necessary for the conclusion of a contract. No obligation to make the data available exists. If you do not provide the data, we will be unable to take consent to cookies on this website into consideration. | We store these data temporarily on our systems while the website is being made available. The data are stored permanently in your browser. (→ section J for information about how long the cookies remain valid.) |
| Verification data | Log data which are generated for technical reasons when you log in and out of the press portal. This includes the date and time of your registration for the press portal, the date and time the confirmation of registration was sent as part of the verification procedure, the date and time your registration was confirmed as part of the verification procedure, the IP address of the device used to confirm the registration and the date and time you close your press portal account, if applicable. | Users of the press portal. | The provision of data is not required by law or by a contract and is not necessary for the conclusion of a contract. No obligation to make the data available exists. If you do not provide the data, we will be unable to provide access to the press portal. | We will store these data for as long as you remain registered for our press portal. We shall store these data as evidence for the purposes of filing, exercising or defending against legal claims for a transition period of three years from the end of the year in which you left the scheme or until the end of any ongoing legal disputes. |
| Purpose of the processing of personal data | Categories of personal data we process | Automated decision-making | Legal grounds and legitimate interests | Recipients |
|---|---|---|---|---|
| To provide the press portal in which you can provide us with your data in order to create a press portal account. HTTP data are processed temporarily on our web server for this purpose. | HTTP data, master press data | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (balance of interests). We have a legitimate interest in providing the website content accessed by the user. | Hosting providers, service e-mail providers. |
| To operate a press database in which we administrate and update master press data and details. | Master press data | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (balance of interests). We have a legitimate interest in operating a structured press database in order to optimise our administration of press data. | Hosting providers, service e-mail providers. |
| To make press and image material available to download after registration | Basket data, master press data, log-in data | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (balance of interests). We have a legitimate interest in providing press and image material to registered users. | Hosting providers, service e-mail providers. |
| To provide the administrative tool for granting consent with regard to the website: Certain features of our website require your consent (e.g. the use of certain cookie-based technology). We provide an administrative tool for granting consent with regard to the website so you can grant and withdraw your consent. For this purpose, information about consent you have granted is stored in cookies (→ section J) on your device. During your visit to our website, the cookies and the information stored therein can be accessed in order to determine whether you have given your consent and to what. | Opt-in data | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (balance of interests). We have a legitimate interest in administrating the consent granted by the user with regard to this website. | Hosting providers, service e-mail providers. |
| To guarantee the security of the IT infrastructure used to provide the press portal, especially to identify, combat and document disruptions in a legally sound manner (e.g. DDoS attacks): Data are stored temporarily in log files on our web server and evaluated for this purpose. | HTTP data, basket data, log-in data | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (balance of interests). We have a legitimate interest in guaranteeing the security of the IT infrastructure used to provide the form, especially so as to identify, combat and document disruptions in a legally sound manner (e.g. DDoS attacks). | Hosting providers, service e-mail providers. |
| Verification procedure to authenticate the press portal: When you register for our press portal, we will send an e-mail asking you to confirm the e-mail address you provided when you registered. Your registration will only be complete when you confirm the e-mail address by clicking on the confirmation link in the e-mail. | Verification data | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (balance of interests). We have a legitimate interest in documenting your registration for the press portal for legal reasons. | Service e-mail providers. |
| Storage and processing to serve as evidence for the purposes of filing, exercising or defending against legal claims. | HTTP data, basket data, verification data. | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (balance of interests). We have a legitimate interest in filing, exercising or defending against legal claims. | Service e-mail providers. |
| Recipients | Role of the recipient | Transfer to third countries and/or to international organisations | Adequacy decision or appropriate or adequate guarantees for transfers to third countries and/or international organisations |
|---|---|---|---|
| Hosting providers: IONOS SE Elgendorfer Str. 57 56410 Montabaur | Processor. | EU | - |
| Service e-mail providers: | Processor. | USA | There is no adequacy decision from the European Commission in the sense of Article 45(3) GDPR. The service e-mail provider has standard contractual clauses (SCC) which have been adopted in accordance with Article 46 GDPR. |
MARC O’POLO provides free Wi-Fi for guests. Personal data are collected and processed for this purpose. Therefore, MARC O’POLO only uses your personal data in accordance with the principles described below and in compliance with the applicable data protection laws, especially the European General Data Protection Regulation (GDPR).
Pursuant to Article 4(7) GDPR, the controller of the guest Wi-Fi ‘MOPGUEST’ is MARC O’POLO International GmbH, Hofgartenstrasse 1, 83071 Stephanskirchen, Germany, info@marc-o-polo.com (hereinafter referred to as ‘MARC O’POLO’ or ‘we’).
You can contact our Data Protection Officer by e-mail (datenschutz@marc-o-polo.com) or at our postal address, stating ‘Data Protection Officer’.
We process data belonging to guest Wi-Fi users for the following purposes:
To register and create an account to use the guest Wi-Fi
To provide Wi-Fi for guests
To guarantee the security of the IT infrastructure used to provide the guest Wi-Fi, especially to identify, combat and document disruptions in a legally sound manner
To filter user activity in order to prevent violations of the terms of use of our guest Wi-Fi, violations of the law and infringements of third-party rights
Storage and processing to serve as evidence for the purposes of filing, exercising or defending against legal claims
To cooperate with supervisory authorities, courts and other public bodies in order to comply with legal obligations
| Categories of personal data we process | Personal data in the categories | Sources of data | Obligation of the data subject to provide data | Duration of storage |
|---|---|---|---|---|
| Registration data | Data you share with us when you register for the guest Wi-Fi. The data can include the following information in particular: Name and surname, your e-mail address, the e-mail address of a MARC O’POLO employee. This also includes your MAC address (a unique identifier your device sends automatically when you use a Wi-Fi connection). | Users of the guest Wi-Fi. | The data marked as mandatory in the registration process must be provided in order to use the guest Wi-Fi. No obligation to make the data available exists. If you do not provide the data, you will not be able to use the guest Wi-Fi. | The e-mail addresses will only be processed in order to send the transaction e-mails and will then be deleted. The MAC address will be stored for one year. We shall store these data as evidence for the purposes of filing, exercising or defending against legal claims or until the end of any ongoing legal disputes. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Registration data | Documentation that we have confirmed your registration (you cannot use the guest Wi-Fi until a MARC O’POLO employee provides confirmation) | Generated independently. | - | The e-mail addresses will only be processed in order to send the transaction e-mails and will then be deleted. The MAC address will be stored for one year. We shall store these data as evidence for the purposes of filing, exercising or defending against legal claims or until the end of any ongoing legal disputes. Furthermore, we shall store the data for longer if we are subject to a statutory storage obligation, especially under tax or commercial law. Depending on the nature of the documents, we may be obliged to store the data for six or ten years in accordance with tax and commercial law (Section 147 AO and Section 257 HGB). |
| Usage data | Data about the external conditions of the communication that are generated for technical reasons when you use the guest Wi-Fi. The data can include the following information in particular: The MAC address of your device and the local IP address assigned to your device by the guest Wi-Fi. The start and end of each connection (date and time) as well as the duration of use, the websites and IP addresses you visited, the volume of transferred data including the average packet size, technical features concerning the connection/disconnection, the hardware type and manufacturer of your device, operating system identification data, browser identification data, language and time zone of your browser. | Generated independently. | - | The data are stored in log files for up to 12 months unless a security incident occurs (such as a DDoS attack) or there are actual documented signs of misuse. If a security incident does occur or there are signs of misuse, log files will be stored until the incident has been resolved and fully investigated. |
| Usage data | Data about the external conditions of the communication that are generated for technical reasons when you use the guest Wi-Fi. The data can include the following information in particular: The MAC address of your device and the local IP address assigned to your device by the guest Wi-Fi. The start and end of each connection (date and time) as well as the duration of use, the websites and IP addresses you visited, the volume of transferred data including the average packet size, technical features concerning the connection/disconnection, the hardware type and manufacturer of your device, operating system identification data, browser identification data, language and time zone of your browser. | Users of the guest Wi-Fi | Disclosure of the data is not legally or contractually necessary. The data subject is not obliged to provide the data. However, if you do not provide the data, you will not be able to make full use of the guest Wi-Fi or even use it at all. | The data are stored in log files for up to 12 months unless a security incident occurs (such as a DDoS attack) or there are actual documented signs of misuse. If a security incident does occur or there are signs of misuse, log files will be stored until the incident has been resolved and fully investigated. |
| Content data | Information about (encrypted) content of communications over the guest Wi-Fi, i.e. the content of the data packages sent and received by your device. If you encrypt the content of your communications (such as by using a VPN), we will be unable to view the content of your communications. | Users of the guest Wi-Fi | Disclosure of the data is not legally or contractually necessary. The data subject is not obliged to provide the data. However, if you do not provide the data, you will not be able to make full use of the guest Wi-Fi or even use it at all. | We will only store these data on a short-term basis while each data package is transmitted over the guest Wi-Fi. |
| Purpose of the processing of personal data | Categories of personal data we process | Automated decision-making | Legal grounds and legitimate interests | Recipients |
|---|---|---|---|---|
| To register and create an account to use the guest Wi-Fi: We will pass on your request for access to our guest Wi-Fi to the MARC O’POLO employee you nominate. When that employee provides confirmation, your account will be activated automatically. Once your account has been activated, you will have access to the Internet for seven days. Your access privileges only apply to the device you used to request access to our guest Wi-Fi. We identify that device by its MAC address (a unique identifier your device sends automatically when you use a Wi-Fi connection). We will send you an e-mail to notify you when your account is activated. | Registration data | No automated decision-making takes place. | decision-making takes place. Point (b) of Article 6(1) GDPR (contract with the data subject). | Network management software service providers |
| To provide a guest Wi-Fi that can be used by employees and guests, including for private purposes: For this reason, we transmit the communication over our guest Wi-Fi to the public Internet via the Internet access provided by our Internet service provider. | Registration data (only MAC address) Usage data Content data | No automated decision-making takes place. | Point (b) of Article 6(1) GDPR (contract with the data subject). | Network management software service providers Internet service providers |
| To guarantee the security of the IT infrastructure used to provide the guest Wi-Fi, especially to identify, combat and document disruptions in a legally sound manner (e.g. DDoS attacks). Data are stored temporarily in log files and evaluated for this purpose. | Registration data (only MAC address) Usage data | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (balance of interests). We have a legitimate interest in ensuring the security of the IT infrastructure used to provide the guest Wi-Fi. | Firewall providers |
| To filter user activity in order to prevent violations of the terms of use of our guest Wi-Fi, violations of the law and infringements of third-party rights, especially copyright. For this reason, we use filter software which blocks access to certain websites, IP addresses and ports. | Usage data | No automated decision-making takes place. | Point (b) of Article 6(1) GDPR (contract with the data subject). Point (f) of Article 6(1) GDPR (balance of interests). We have a legitimate interest in preventing violations of the terms of use of our guest Wi-Fi, violations of the law and infringements of third-party rights, especially copyright. | Firewall providers |
| Storage to serve as evidence for the purposes of filing, exercising or defending against legal claims. | Registration data Usage data. | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (balance of interests). We have a legitimate interest in filing, exercising or defending against legal claims. | - |
| Establishment, exercise or defence of legal claims. | Registration data Usage data. | No automated decision-making takes place. | Point (f) of Article 6(1) GDPR (pursuit of a legitimate interest with consideration for a balance of interests): We have a legitimate interest in filing, exercising or defending against legal claims. | Courts Lawyers |
| To cooperate with supervisory authorities, courts and other public bodies in order to comply with legal obligations. | Registration data Usage data. | No automated decision-making takes place. | Point (c) of Article 6(1) GDPR (compliance with a legal obligation) | Supervisory authorities, courts and other public bodies |
| Recipients | Role of the recipient | Transfer to third countries and/or to international organisations | Adequacy decision or appropriate or adequate guarantees for transfers to third countries and/or international organisations |
|---|---|---|---|
| Network management software service providers: Cisco Meraki | Processor | USA | There is no adequacy decision from the European Commission in the sense of Article 45(3) GDPR. Cisco Meraki has standard contractual clauses (SCC) which have been adopted in accordance with Article 46 GDPR. |
| Firewall providers | Processor | USA | There is no adequacy decision from the European Commission in the sense of Article 45(3) GDPR. The firewall provider has standard contractual clauses (SCC) which have been adopted in accordance with Article 46 GDPR. |
| Internet service providers | Controller | EU | - |
| Lawyers | Controller | EU | - |
| Supervisory authorities, courts and other public bodies | Controller | EU | - |
The website uses cookies at several points in order to make our website more user-friendly, more effective and more secure. Cookies are small text files that are installed on your computer and stored by your browser. Most of the cookies we use are session cookies. They are erased automatically at the end of your visit. Cookies cause no damage to your computer and do not contain viruses.
| NAME | FIRST PARTY / THIRD PARTY | PURPOSE AND CONTENT | PERIOD OF VALIDITY |
|---|---|---|---|
| cookieoption | First party company.marc-o-polo.com | Cookie bar settings. This cookie contains details about consent you have granted and not granted and provides the consent administration tool. | 1 month |
These cookies require your consent. You can withdraw your consent at any time via the privacy and cookie settings linked in the footer of the respective website.
Meta pixel cookies
These cookies are used for the Meta tool on our website (section B.II). At the time this privacy policy was generated, the following cookies were used for this purpose. In the meantime, our advertising partner might have added new cookies or modified the purposes, content and durations of storage of its cookies within its own field of responsibility. Therefore, for more information, please also refer to the privacy policy of our advertising partner; a link can be found in section B.II.
| Name | First party / third party | Purpose and content | Period of validity |
|---|---|---|---|
| c_user | First party | Is used together with the xs cookie to authenticate your identity with Facebook (user ID). | 90 days |
| datr | First party | Browser ID and time stamp Identifies the browser for the purposes of security and website integrity, including account restoration and the identification of potentially compromised accounts. | Persistent: 2 years |
| sb | First party | Browser ID and time stamp Identifies the browser for the purposes of log-in authentication | Persistent: 2 years |
| wd | First party | Screen or window dimensions Makes it possible to optimise the display on the user’s monitor | Persistent: 7 days |
| ds | First party | Session ID, creation time, authentication value, secure session status, caching group ID. Is used together with the C_user cookie to authenticate the identity of the user with Facebook. | Persistent: 90 days |
Google Ads conversion pixel cookies
These cookies are used by the Google Ads conversion pixel, a web tracking tool which evaluates user actions (conversion tracking) (see section B.II). At the time this privacy policy was generated, the following cookies were used for this purpose. In the meantime, our advertising partner might have added new cookies or modified the purposes, content and durations of storage of its cookies within its own field of responsibility. Therefore, for more information, please also refer to the privacy policy of our advertising partner; a link can be found in section B.II.
| Name | First party / third party | Purpose and content | Period of validity |
|---|---|---|---|
| Conversion AID DSID TAID _gcl_to | First party | These cookies are used by the Google Ads conversion pixel, a web tracking tool which evaluates user actions (conversion tracking) (see section B.II). They contain placeholders for the following information: · Unique ID to recognise returning visitors · Page type (e.g. order confirmation page, product details page, basket) The conversion pixel stores the purchasing and surfing habits of users. This includes the following information: · What product the customer purchased and at what price · What pages the customer navigated to · What was the total price of products in the basket This information is used to gauge the success of the adverts (e.g. whether the use of banners and videos generated revenue). In addition, these data are used to pseudonymise customers on retargeting lists in order to show them suitable ads or exclude them from campaigns. (see also ‘Google Ads remarketing cookies’ above) | Persistent: 60 days |
Analytics cookies for the use of Google Analytics cookies
These cookies require your consent. You can withdraw your consent at any time via the privacy and cookie settings linked in the footer of the respective website.
These cookies are used by the web analytics tool Google Analytics to capture and analyse user behaviour on our website in order to improve the website (-> section H)
| Name | First party / third party | Purpose and content | Period of validity |
|---|---|---|---|
| _ga | First party | This cookie contains a unique visitor ID and is used to tell users apart. | Persistent 1 month |
| _gat | First party | This cookie is used to throttle the demand rate. | Transient 1 month |
| _gid | First party | This cookie contains a unique visitor ID and is used to tell users apart. | |
| _dd_s | First party | This cookie is used to group all events of a visitor ID across all pages. | 30 days |
| dd_site_t est_* | First party | Temporary cookie used for testing purposes only | Expires immediately |
| dd_cookie_test_* | First party | Temporary cookie used for testing purposes only | Expires immediately |
| Name | First party / third party | Purpose and content | Period of validity |
|---|---|---|---|
| ASP.NET_ Sessionld | First party | The system uses these cookies to recognise you for the duration of your navigation | Duration of the navigation session |
| __AntiXsrfToken | First party | These cookies can be used to prevent fraudulent enquiries, i.e. tampering with your navigation, especially if you move to another navigation page on the same website. | Duration of the navigation session |
| Rflex_cookie | First party | With this ‘test’ cookie, we can manage the functionality and storage of cookies on your device. | Duration of the navigation session |
| ts_sessionid | First party | The system uses these cookies to recognise you for the duration of your navigation. | Duration of the navigation session |
| TsAuth | First party | The system uses these cookies to recognise you for the duration of your navigation. | Duration of the navigation session |
| Atidvisitor | First party | This cookie lists the pages you visit and stores technical data for the purposes of analysing the pages you visit. | 6 months |
| BigipServerREC_FRD_FO_AZDE | First party | This cookie manages the distribution of users on the infrastructure of Talentsoft. | Duration of the navigation session |
| atuserid | First party | This cookie lists the pages you visit and stores technical data for the purposes of analysing the pages you visit. | 6 months |
| Name | First party / third party | Purpose and content | Period of validity |
|---|---|---|---|
| mop-cookies | First party press.marc-o-polo.com | Cookie bar settings. This cookie contains details about consent you have granted and not granted and provides the consent administration tool. | 30 days |
| ga-disable-UA-115814377-2 | First Party | This cookie is used to prevent tracking by Google. | Persistent |
These cookies require your consent. You can withdraw your consent at any time in the data privacy and cookie settings to which you will find a link in the footer of each website.
These cookies are used by the web analytics tool Google Analytics to capture and analyse user behaviour on our website in order to improve the website (→ section H).
| Name | First party / third party | Purpose and content | Period of validity |
|---|---|---|---|
| _ga | First party | This cookie contains a unique visitor ID and is used to tell users apart. | Persistent 1 month |
| _gat | First party | This cookie is used to throttle the demand rate. | Transient 1 month |
| _gid | First party | This cookie contains a unique visitor ID and is used to tell users apart. | Persistent 1 month |
I. Right of access
As a data subject, you have a right to access information in line with the requirements of Article 15 GDPR.
In particular, this means that you have the right to obtain from us confirmation as to whether or not personal data concerning you are being processed. If this is the case, you also have a right to information about these personal data and to the information set out Article 15(1) GDPR. In particular, this information includes the purposes of the processing, the categories of personal data concerned and the recipients or categories of recipient to whom the personal data have been or will be disclosed (points (a), (b) and (c) of Article 15(1) GDPR).
For full details about your right of access, please refer to Article 15 GDPR at https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&qid=1640195526258&from=EN#d1e2599-1-1
II. Right to rectification
As a data subject, you have a right to rectification in line with the requirements of Article 16 GDPR.
In particular, this means that you have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you, as well as the right to have incomplete personal data completed.
For full details about your right to rectification, please refer to Article 16 GDPR at https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&qid=1640195526258&from=EN#d1e2599-1-1
III. Right to erasure (‘right to be forgotten’)
As a data subject, you have a right to erasure (‘right to be forgotten’) in line with the requirements of Article 17 GDPR.
This means that you have the right to obtain from us the erasure of personal data concerning you without undue delay, and we have the obligation to erase personal data without undue delay where one of the grounds set out in Article 17(1) GDPR applies. For example, this can be the case when personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed (point (a) of Article 17(1) GDPR).
Where we have made the personal data public and are obliged to erase the personal data, we, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data (Article 17(2) GDPR).
In an exceptional case, the right to erasure (‘right to be forgotten’) does not apply to the extent that the processing is necessary for the reasons set out in Article 17(3) GDPR. For example, this can be the case where the processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims (points (a) and (e) of Article 17(3) GDPR).
For full details about your right to erasure, please refer to Article 17 GDPR at https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&qid=1640195526258&from=EN#d1e2599-1-1
IV. Right to restriction of processing
As a data subject, you have a right to restriction of processing in line with the requirements of Article 18 GDPR.
This means that you have the right to obtain from us restriction of processing if one of the criteria set out in Article 18(1) GDPR is met. This can be the case, for example, if you contest the accuracy of the personal data. In this case, processing shall be restricted for a period enabling us to verify the accuracy of the personal data (point (a) of Article 18(1) GDPR).
Restriction means the marking of stored personal data with the aim of limiting their processing in the future (Article 4(3) GDPR).
For full details about your right to restriction of processing, please refer to Article 18 GDPR at: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&qid=1640195526258&from=EN#d1e2599-1-1
V. Right to data portability
As a data subject, you have a right to data portability in line with the requirements of Article 20 GDPR.
This means that you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from us, where the processing is based on consent pursuant to point (a) of Article 6(1) GDPR or point (a) of Article 9(2) GDPR or on a contract pursuant to point (b) of Article 6(1) GDPR, and the processing is carried out by automated means (Article 20(1) GDPR).
For information about whether processing is based on consent pursuant to point (a) of Article 6(1) GDPR or point (a) of Article 9(2) GDPR or on a contract pursuant to point (b) of Article 6(1) GDPR, please refer to the information about the legal grounds on which processing is based in sections B to J of this privacy policy.
In exercising your right to data portability, you also have the right to have the personal data transmitted directly from us to another controller, where technically feasible (Article 20(2) GDPR).
For full details about your right to restriction of processing, please refer to Article 20 GDPR at https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&qid=1640195526258&from=EN#d1e2599-1-1
VI. Right to object
As a data subject, you have a right to object in line with the requirements of Article 21 GDPR.
We shall expressly make you aware of your right to object when we first communicate with you at the very latest. More detailed information about this is available below:
1. Right to object for reasons arising from the particular situation of the data subject
As a data subject, you have the right, on grounds relating to your particular situation, to object at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on these provisions.
For information about whether processing is taking place on the basis of point (e) or (f) of Article 6(1) GDPR, please refer to the information about the legal grounds on which processing is based in sections B to J of this privacy policy.
If you object on grounds relating to your particular situation, we shall no longer process the personal data concerning you unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
For full details about your right to object, please refer to Article 21 GDPR at https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&qid=1640195526258&from=EN#d1e2599-1-1
2. Right to object to direct marketing
Where personal data are processed for direct marketing purposes, you have the right to object, at any time, to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.
For information about whether and to what extent personal data are being processed for direct marketing purposes, please refer to the information about the purposes of processing in sections B to J of this privacy policy.
If you object to processing for direct marketing purposes, we will no longer process your personal data for such purposes.
For full details about your right to object, please refer to Article 21 GDPR at https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&qid=1640195526258&from=EN#d1e2599-1-1
VII. Right to withdraw consent
If processing is based on consent in accordance with point (a) of Article 6(1) GDPR or point (a) of Article 9(2) GDPR, you, the data subject, have the right to withdraw your consent at any time pursuant to Article 7(3) GDPR. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. We shall make you aware of this before you grant consent.
For information about whether processing is based on consent pursuant to point (a) of Article 6(1) GDPR or point (a) of Article 9(2) GDPR, please refer to the information about the legal grounds on which processing is based in sections B to J of this privacy policy.
VIII. Right to lodge a complaint with a supervisory authority
As a data subject, you have a right to lodge a complaint with a supervisory authority in line with the requirements of Article 77 GDPR.
The following supervisory authority has jurisdiction over us:
Bayerisches Landesamt für Datenschutzaufsicht / Bavarian Data Protection Authority
Promenade 18, 91522 Ansbach
poststelle@lda.bayern.de
+49 (0) 981 180093-0
As a data subject, you have the following rights with regard to the processing of your personal data:
Right to access information (Article 15 GDPR)
Right to rectification (Article 16 GDPR)
Right to erasure (‘right to be forgotten’) (Article 17 GDPR)
Right to restriction of processing (Article 18 GDPR)
Right to data portability (Article 20 GDPR)
Right to object (Article 21 GDPR)
Right to withdraw consent (Article 7(3) GDPR)
Right to lodge a complaint with a supervisory authority (Article 77 GDPR)
If you wish to exercise your rights, you can contact us using the information provided in section A.
For information about any particular methods and mechanisms that make it easier for you to exercise your rights, especially your rights to data portability and to object, please refer to the information about how personal data are processed in sections B to J of this privacy policy as well as other separate data privacy information.
Below you will find more detailed information about your rights with regard to the processing of your personal data:
The definitions of the terminology used in this privacy policy are the same as in the General Data Protection Regulation.
For full details about the definitions in the General Data Protection Regulation, please refer Article 4 GDPR at https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&qid=1640195526258&from=EN#d1e2599-1-1
Below you will find more detailed information about the most important key terms of the General Data Protection Regulation on which this privacy policy is based:
‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
‘Data subject’ is the identified or identifiable natural person to whom personal data relate;
‘Processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
‘Profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
‘Controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
‘Processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
‘Recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;
‘Third party’ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;
‘International organisation’ means an organisation and its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries;
‘Third country’ means a country that is not a Member State of the European Union (EU) or European Economic Area (EEA);
‘Special categories of personal data’ means data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
This privacy policy was last amended on 20 August 2021.
Due to technical advancements and/or changes to statutory and/or official requirements, it might become necessary to amend this privacy policy.
The current version of the privacy policy is always available at https://company.marc-o-polo.com/en/ata-privacy