This Privacy Policy explains the nature, scope and purpose of the processing of personal data (hereinafter referred to simply as “data”) within our online offering and the websites, functions and content connected with it, as well as external online presences, such as our social media profiles (collectively referred to as the “Online Offering”). With regard to the terminology used, such as “processing” or “controller”, please refer to the definitions in Article 4 of the General Data Protection Regulation (GDPR).
Controller
Jürgen Kracht
c/o Fiducia Management Consultants
15th Floor OTB Tower
160 Gloucester
Hong Kong
[Legal Notice]
Types of Data Processed
- Personal data, such as names and addresses.
- Contact data, such as email addresses and telephone numbers.
- Content data, such as text entered by users, photographs and videos.
- Usage data, such as websites visited, interest in content and access times.
- Meta and communication data, such as device information and IP addresses.
Purpose of Processing
- Provision of the Online Offering, including its functions and content.
- Responding to contact enquiries and communicating with users.
- Security measures.
- Audience measurement and marketing.
- Terminology
“Personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”). A natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (such as a cookie), or one or more characteristics expressing the physical, physiological, genetic, mental, economic, cultural or social identity of that person.
“Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers virtually every handling of personal data.
The “controller” is the natural or legal person, public authority, agency or other body which alone or jointly determines the purposes and means of processing personal data.
Legal Bases for Processing
In accordance with Article 13 GDPR, we provide information about the legal bases for our data processing activities. Unless a specific legal basis is stated in this Privacy Policy, the following applies:
The legal basis for obtaining consent is Article 6(1)(a) and Article 7 GDPR. The legal basis for processing necessary for the performance of our services and the implementation of contractual measures, as well as for responding to enquiries, is Article 6(1)(b) GDPR. The legal basis for processing necessary to comply with legal obligations is Article 6(1)(c) GDPR. The legal basis for processing necessary to protect our legitimate interests is Article 6(1)(f) GDPR. Where the processing of personal data is necessary to protect the vital interests of the data subject or another natural person, Article 6(1)(d) GDPR serves as the legal basis.
Security Measures
We ask you to regularly review the content of this Privacy Policy. We will amend this Privacy Policy whenever changes to the data processing carried out by us make this necessary. We will inform you whenever such changes require any action on your part, such as providing consent, or require individual notification.
Cooperation with Processors and Third Parties
Where, as part of our processing activities, we disclose data to other persons or companies (processors or third parties), transfer data to them, or otherwise grant them access to data, this will only take place on the basis of a legal permission, for example where a transfer to a payment service provider is necessary for the performance of a contract under Article 6(1)(b) GDPR, where you have given your consent, where a legal obligation requires this, or where this is based on our legitimate interests, such as when engaging service providers or web hosting companies.
Where we commission third parties to process data on the basis of a so-called Data Processing Agreement, this is carried out in accordance with Article 28 GDPR.
Transfers to Third Countries
Where we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or where this takes place through the use of third-party services or through the disclosure or transfer of data to third parties, this will only take place where required for the fulfilment of our contractual or pre-contractual obligations, on the basis of your consent, due to a legal obligation, or on the basis of our legitimate interests.
Subject to legal or contractual permissions, we process or arrange for the processing of data in a third country only where the special requirements of Articles 44 et seq. GDPR are fulfilled. This may include relying on appropriate safeguards or recognised contractual arrangements, such as Standard Contractual Clauses.
Rights of Data Subjects
You have the right to request confirmation as to whether personal data concerning you is being processed and to request information about such data, as well as further information and a copy of the data, in accordance with Article 15 GDPR.
In accordance with Article 16 GDPR, you have the right to request completion or correction of personal data concerning you.
In accordance with Article 17 GDPR, you have the right to request the immediate deletion of personal data concerning you, or alternatively, in accordance with Article 18 GDPR, to request restriction of processing.
You have the right to receive the personal data concerning you that you have provided to us in accordance with Article 20 GDPR and to request that such data be transmitted to another controller.
You also have the right, pursuant to Article 77 GDPR, to lodge a complaint with a competent supervisory authority.
Right to Withdraw Consent
You have the right to withdraw any consent you have given at any time with effect for the future, in accordance with Article 7(3) GDPR.
Right to Object
You may object at any time to the future processing of personal data concerning you in accordance with Article 21 GDPR. You may object in particular to processing for the purposes of direct advertising.
Cookies and Right to Object to Direct Advertising
“Cookies” are small files stored on users’ devices. Cookies can contain various types of information. A cookie is primarily used to store information about a user or their device during or after their visit to an online offering.
Temporary or “session” cookies are deleted when users leave the online offering and close their browser. Such cookies may contain, for example, the contents of a shopping basket or a login status.
“Permanent” or “persistent” cookies remain stored even after the browser has been closed. They may, for example, be used to retain login status for several days. Cookies may also be used to store user interests for audience measurement or marketing purposes. “Third-party cookies” are cookies provided by third parties other than the operator of the online offering; otherwise, they are referred to as “first-party cookies”.
We may use temporary and permanent cookies and will provide information about these in this Privacy Policy.
If users do not wish cookies to be stored on their devices, they are asked to disable the relevant option in their browser settings. Cookies already stored can be deleted through the browser settings. Disabling cookies may result in restrictions on the functionality of this online offering.
A general objection to the use of cookies for online marketing purposes may be submitted through a number of services, particularly in connection with tracking, including the US website AboutAds and the EU website YourOnlineChoices. Cookies may also be disabled through browser settings.
Deletion of Data
Data processed by us will be deleted or its processing restricted in accordance with Articles 17 and 18 GDPR. Unless expressly stated otherwise in this Privacy Policy, the data we store will be deleted as soon as it is no longer required for the purpose for which it was collected, provided that there are no statutory retention obligations preventing its deletion.
Where data is not deleted because it is required for other legally permissible purposes, its processing will be restricted. In such cases, the data will be blocked and will not be processed for other purposes.
According to the statutory requirements in Germany, retention periods include, in particular, six years pursuant to Section 257(1) of the German Commercial Code (HGB) and ten years pursuant to Section 147(1) of the German Fiscal Code (AO).
According to the statutory requirements in Austria, retention periods include, in particular, seven years pursuant to Section 132(1) of the Federal Fiscal Code (BAO), 22 years in connection with real estate and ten years for records relating to electronically supplied services, telecommunications, broadcasting and television services provided to non-business customers in EU Member States and covered by the Mini One-Stop Shop (MOSS).
Hosting
The hosting services we use provide infrastructure and platform services, computing capacity, storage space and database services, security services and technical maintenance required for operating this Online Offering.
We, or our hosting provider, process personal data, contact data, content data, contractual data, usage data and meta and communication data of customers, prospective customers and visitors to this Online Offering on the basis of our legitimate interests in providing the Online Offering efficiently and securely, pursuant to Article 6(1)(f) GDPR in conjunction with Article 28 GDPR (conclusion of a Data Processing Agreement).
Collection of Access Data and Server Log Files
We, or our hosting provider, collect data concerning every access to the server on which this service is hosted on the basis of our legitimate interests pursuant to Article 6(1)(f) GDPR. Such data is referred to as server log files.
Access data includes the name of the website or file accessed, date and time of access, amount of data transferred, notification of successful retrieval, browser type and version, operating system, referrer URL (the previously visited website), IP address and requesting provider.
For security reasons, such as investigating misuse or fraud, log file information is stored for a maximum of seven days and then deleted. Data whose further retention is required as evidence is excluded from deletion until the relevant incident has been finally resolved.
Contact
When you contact us, for example by contact form, email, telephone or social media, the information you provide is processed for the purpose of handling and responding to your enquiry in accordance with Article 6(1)(b) GDPR.
The information provided may be stored in a customer relationship management system (“CRM system”) or a comparable enquiry-management system.
We delete enquiries when they are no longer required. We review whether they are still required every two years. Statutory archiving obligations remain unaffected.
Comments and Contributions
When users leave comments or other contributions, their IP addresses may be stored for seven days on the basis of our legitimate interests pursuant to Article 6(1)(f) GDPR.
This is done for security purposes in case unlawful content, such as insults or prohibited material, is posted in comments. In such cases, we may have a legal interest in identifying the author.
We also reserve the right, on the basis of our legitimate interests pursuant to Article 6(1)(f) GDPR, to process user information for the purpose of detecting spam.
Social Media Presences
We maintain online presences within social networks and platforms in order to communicate with customers, prospective customers and users who are active there and to provide them with information about our activities.
When users access the relevant social networks and platforms, the terms and conditions and data-processing policies of the respective operators apply.
Unless otherwise stated in this Privacy Policy, we process users’ data when they communicate with us through social networks and platforms, for example by posting on our online presences or sending us messages.
Integration of Third-Party Services and Content
Within our Online Offering, we use third-party content and service offerings on the basis of our legitimate interests, namely our interest in analysing, optimising and operating our Online Offering efficiently and commercially, in order to integrate content and services such as videos or fonts.
This always requires the third-party providers of such content to receive the user’s IP address, because without the IP address they would not be able to send the content to the user’s browser.
We endeavour to use only providers that use the IP address solely to deliver the requested content.
Third-party providers may also use so-called pixel tags (invisible graphics or web beacons) for statistical or marketing purposes. These can be used to analyse visitor traffic on our online offering.
Pseudonymous information may also be stored in cookies on users’ devices and may include technical information such as browser and operating system, referring websites, visit times and other usage information. Such information may be combined with information from other sources.
Ionic Framework
This website uses the open-source Ionic Framework to display content on mobile devices. When a page is accessed, your browser loads the libraries required from the Ionic servers into its browser cache so that texts and fonts can be displayed correctly.
For this purpose, your browser must establish a connection to Ionic’s servers. Ionic therefore becomes aware that our website has been accessed via your IP address.
The use of the Ionic Framework is based on our legitimate interest in providing a consistent and attractive presentation of our online content.
Further information about the Ionic Framework can be found at https://ionicframework.com/ and in Ionic’s Privacy Policy.
YouTube
We embed videos from the YouTube platform, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Privacy Policy: Google Privacy Policy
Opt-out: Google Ads Settings
Within our Online Offering, we use functions and content provided by LinkedIn, including images, videos, text and buttons that allow users to interact with content, follow authors or subscribe to posts.
If users are members of LinkedIn, LinkedIn may associate their visit to the relevant content and functions with their LinkedIn profile.
LinkedIn’s Privacy Policy can be found at: