Polityka prywatności

DATA PROTECTION INFORMATION

 

The Lorenz Bahlsen Snack-World GmbH & Co KG Germany (hereinafter referred to as the “Responsible party”) takes the protection of your personal data very seriously and observes the relevant data protection regulations, in particular the regulations of the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). In the following, we would particularly like to inform you about how we collect data within the scope of the use of our website, and how, and for what purposes, we use this data.

 

I. General information

 

1. Scope of the data processing

 

Fundamentally, we only collect and use the personal data of our users insofar as it is required for providing a functional website as well as it is required for the provision of our services and content. The collection and use of our users’ personal data is only processed insofar as the processing of the data is permitted on the basis of legal regulations or upon consent of the user.

 

2. Legal basis for data processing

 

Insofar as we request the consent of the user for processing their personal data on our website, Art. 6, Sec. 1 (a) GDPR serves as the legal basis for the processing of personal data.

 

In the processing of personal data, which is required for the fulfillment of a contract to which the user is a party, Art. 6, Sec. 1 (b) GDPR serves as the legal basis. This also applies to the processing operations, which are required for the processing of a similar contractual obligation or pre-contractual measures.

 

Insofar as a processing of personal data is required for the fulfillment of a legal obligation, which our company is subject to, then Art. 6, Sec. 1 (c) GDPR serves as the legal basis.

 

If the processing is required in order to safeguard a legitimate interest of our company or a third party, and if the interests, the fundamental rights and fundamental freedoms of the affected user do not outweigh the first interest, then Art. 6, Sec. 1 (f) GDPR serves as the legal basis for the data processing (so-called balancing of interests).

 

In addition, there are further legal bases for the processing of personal data, which we have specifically listed in the following, where relevant.

 

3. Storage time

 

The user's personal data is deleted or blocked (deactivated) as soon as the purpose for the storage of this data has ended. In addition, storage of data can also be processed if this has been planned for by the European or national laws in EU regulations, laws, or other provisions to which our company is subject. A blocking or deletion of the data is also processed if a required storage period mentioned in the standards expires, unless there is a requirement for an additional storage of the data for the conclusion or fulfillment of a contract.

 

4. Forwarding of personal data

 

If we forward personal data, then we exclusively forward this data to service companies that support us in the fulfillment of the noted purposes. These companies may only use your personal data for order processing in order to fulfill their tasks within the scope of our order. They are obligated to adhere to the pertinent Data Protection Regulations. The third-party order processors used by us are:

 

Denkwerk GmbH

Vogelsanger Str. 66

50823 Cologne

 

 

Google Analytics, Google Inc.,

1600 Amphitheatre Parkway

Mountain View, CA 94043 USA

 

 

For the purposes of processing the prize draws appearing on our website from time to time, we will occasionally forward your personal data to our cooperation partners. We have diligently selected our cooperation partners. In particular, our cooperation partners are not permitted to forward our users’ data to third parties for advertising purposes. The data forwarded in this way is only used by our cooperation partners for purposes of order fulfillment (e.g., transferring the winnings to the prize draw winner).

 

Apart from that, however, no personal data is forwarded to third parties.

 

5. Location of data processing

 

We process your personal data in countries located within the European Economic Area. In terms of the data processing as it relates to Google Analytics, No. IV applies. 2.

 

II. Processing of personal data on the website

 

1. Provisioning of the website and creating log files

 

a) Description of the data processing

 

Each time our website is accessed, our system automatically records data and information from the computer system of the device (computer) accessing the website.

 

The following data is collected:

 

·       Information about the type of browser and the version used

 

·       The user’s operating system

 

·       The user’s IP address

 

·       Date and time of the access

 

·       Websites from which the user’s system has accessed our website

 

 

 

The data is also saved in log files stored on our computer systems. This data is not combined with any other personal user data.

 

b) Legal basis for data processing

 

The legal basis for the temporary storage of data and the log files is Art. 6, Sec. 1 (f) GDPR.

 

c) Purpose of data processing

 

The data is stored in log files in order to ensure the website’s functionality. In addition, the data serves to optimize the website and to secure our information technology systems. In this regard, the data is not analyzed for marketing-related purposes. This is where our justified interest in the data processing lies, in accordance with Art. 6, Sec. 1 (f) GDPR.

 

d) Duration of storage

 

The data is deleted as soon as it is no longer required for the originally intended purpose.   Access logs (without an IP address) are automatically deleted after 7 days. Error logs (with IP address) are automatically deleted after 2 days.

 

e) Possibility of objection and elimination

 

The collection of the data for the provisioning of the website and the storage of the data in log files is mandatory for the operation of the website. Therefore, the user does not have the ability to object.

 

2. Contact form and e-mail contact

 

a) Description of the data processing

 

Our website includes a contact form that can be used for contacting us electronically. If a user takes advantage of this, then the data in the form is transferred to us and stored. This data is:

 

·       First and last name

 

·       E-mail address

 

·       If necessary, some additional information

 

 

 

Alternatively, contacting us via the provided e-mail address is also possible. In this case, the personal user data transferred with the e-mail is stored.

 

In this regard, there will be no forwarding of data to third parties. The data is exclusively used for the processing of the conversation.

 

b) Legal basis for data processing

 

The legal basis for the processing of data is Art. 6, Sec. 1 (f) GDPR. If the e-mail contact is aimed at the conclusion of a contract or a similar contractual obligation, then the legal basis for the processing is Art. 6, Sec. 1 (b) GDPR.

 

c) Purpose of data processing

 

The processing of the personalized data from the input screen only serves to process your contact request. If you contact us, the required justified interest in the processing of the data is also served.

 

d) Duration of storage

 

The data is deleted as soon as it is no longer required for the originally intended purpose. For the personal data taken from the input mask of the contact form, and for the data transferred by e-mail, this applies once the respective conversation has been concluded with the user. The conversation is also terminated if it can be inferred from the circumstances that the issue at stake has been remedied.

 

e) Possibility of objection and elimination

 

If the user contacts us via the contact form or by e-mail, then they may object to the storage of their personal data at any time. The objection can be sent to the contact person noted at the end of our data protection information. In case of an objection, the conversation with the user cannot be continued and all personal data that was stored within the scope of the initial contact will be deleted.

 

3. Prize draws / Events

 

a) Description of the data processing

 

From time to time, we conduct prize draws and/or events on our website. If a user takes advantage of this, then the data in the prize draw form is transferred to us and stored. This data usually consists of:

 

·       First and last name

·       E-mail address

·       Address

·       If necessary, other details that are marked as mandatory or optional information

 

 

b) Legal basis for data processing

 

The legal basis for the processing of data is Art. 6, Sec. 1 (b) GDPR.

 

c) Purpose of data processing

 

The processing of the personalized data from the input screen only serves to process and manage of the prize draw or the event.

 

d) Duration of storage

 

The data is deleted as soon as it is no longer required for the originally intended purpose. This is regularly the case if the winner has been determined and the winnings have been paid out, provided that no legal or contractual retention periods prevent the data from being deleted. Further information regarding the prize draws can be found in the respective conditions for participation.

 

e) Possibility of objection and elimination

 

In general, the user can object to the storage of their personal data at any time, however the continued participation in the prize draws is then no longer possible. The objection can be sent to the contact person noted at the end of our data protection information.

 

III. Use of cookies

 

1. Description of the data processing

 

We use cookies in order to make your visit to our website as attractive as possible and to enable certain functionalities. Cookies are small text files that are stored in the browser or by the browser on the user’s end device. When a user accesses a website, a cookie can be stored on the user’s operating system. This cookie contains a characteristic string of characters that enable a definite indication of the browser when you reload the website.

 

a) Technically required cookies

 

We use cookies in order to make our website more user-friendly. Some elements of our website make it necessary for the accessing browser to be identified, even after leaving the website. The following data is stored and transferred in the cookies:

 

·       Cookie_accepted (in case the user accepts the cookie notification)

·       NSC_mc (technically required session cookie that is required by the preceding load balancer:        (Netscaler)).

·       php-session ID and Session_Cookie (intro video)

 

 

b) Technically non-required cookies, third-party cookies

 

Beyond this, on our website, we use technically non-required cookies, which mainly allow us to analyze the surfing behavior of our users.

 

The following technically non-required cookies and/or third-party cookies are used by us:

 

·       Cookies set by Google Analytics (also see No. IV of our Data Protection Information)

 

When accessing our website, the user is informed about the use of analysis cookies and the consent for the processing of their personal data in this regard is attained. In this connection, there is also a reference to this Data Protection Information.

 

c) Note on changing the browser settings

 

Most browsers are set up so that they automatically accept cookies. However, the user can prevent the storage of cookies on their device by making the corresponding browser settings, whereby the functional scope of our website can, however, be severely limited.

 

2. Legal basis for data processing

 

The legal basis for the processing of personal data under application of technically required cookies is Art. 6 Sec. 1 (f) GDPR.

 

The legal basis for the processing of personal data through the aforementioned analysis cookies is – upon presentation of related user consent – Art. 6, Sec. 1 (a) GDPR.

 

3. Purpose of data processing

 

The purpose of the use of technically required cookies is to simplify the use of the website for the user. Some of the functions of this website cannot be offered without the use of cookies. For these cookies, it is required that the browser can also be recognized after leaving a website. Our justified interest in the processing of personal data as per Art. 6, Sec. 1 (f) GDPR also lies within this purpose.

 

The cookies analysis lets us know how the website is being used and enables us to continuously optimize our online offer.

 

The collection of user data on our website is not used for creating user profiles.

 

4. Duration of the storage, possibility of objection and elimination

 

Cookies are stored on the user’s computer or device and transferred to our website through these. Therefore, as a user you also have full control of the use of cookies. By changing the settings in your browser, you can either deactivate or limit the transfer of cookies. Cookies that have already been saved can be deleted at all times. This can also be completed automatically. If cookies are deactivated for our website, then it’s possible that not all of the website’s functions will be available.

 

IV. Use of web analysis tools

 

1. General overview

 

On our website, we use the web analysis tool “Google Analytics”. The analysis of the user's online behavior is important, since in this way the requests can be analyzed by content and the online offer can be optimized.

 

When accessing our website, the user is informed about the use of Google Analytics and the consent for the processing of the data in this regard is attained. In this connection, there is also a reference to this Data Protection Information.

 

The legal basis for use of Google Analytics is – upon presentation of related user consent – Art. 6, Sec. 1 (a) GDPR.

 

The user data collected on our website in the scope of Google Analytics is not used for compiling user profiles.

 

2. Additional information regarding the use of Google Analytics

 

This website uses Google Analytics, a web analysis service provided by Google Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA (“Google”). Google Analytics uses so-called "cookies", text files that are stored on the user’s computer and through which the use of the website can be tracked and analyzed. The information generated by the cookie regarding the use of this website by the user is usually sent to and stored on a server operated by Google and located in the USA. However, in case of the activation of the IP anonymisation function on this website, your IP address is first truncated by Google within the member states of the European Union or in other states that are parties to the Agreement on the European Economic Area. Only in exceptional cases will the entire IP address be sent to a Google server in the USA and then truncated there. The IP address transferred by Google Analytics from your browser is not – according to Google – combined with other Google data.

 

Per the order of the operator, Google will use this information to analyze the use of the website by the users, to compile reports on the website activities, and to provide additional services to the website operator related to the use of the website or the Internet. Our legitimate interest in data processing also lies in these purposes.

 

Based on our settings, the data will automatically be deleted by Google after 26 months.

 

However, we do note that on this website, Google Analytics has been extended by the code “ga('set', 'anonymizeIp', true);” in order to ensure an anonymised collection of IP addresses.

 

More information regarding the terms of use and data protection can be found at www.google.com/analytics/terms/de.html or at www.google.de/intl/de/policies/

 

Possibility of revocation and removal:

You can revoke your consent for web analysis by clicking on the following link:

 

Consent web analysis

 

Withdrawal web analysis

 

You can also prevent the storing of cookies by making the appropriate settings in your browser; however, we would like to point out that by doing so you may not be able to use the full functionality of our website. Beyond this, you can prevent the recording of the data compiled by the cookie and related to your use of the website (incl. your IP address) and its transmission to Google as well as the further processing of this data by Google by installing the browser plug-in available at the following link: The current link is: tools.google.com/dlpage/gaoptout.

 

V. Links to social networks

 

1. Social media

 

Our website is complemented through our official presences in the following social networks:

 

Facebook

Twitter

Pinterest

Instagram

Google+

YouTube

The links are recognizable by the respective logo of the social network; no social plugins of the mentioned social networks are used.

 

Insofar as you click on a link for a social network, please note that the processing and use of personal data is subject to the respective social network and that we neither have nor receive any information about the actual scope of the collection or use of your personal data from the respective service provider. Information about the scope of the processing of your personal data by social network providers, as well as settings for protecting your personal data, can be obtained from the respective provider.

 

2. Inclusion of YouTube videos

 

Occasionally, we will use YouTube to integrate videos into our website. YouTube is a service provided by Google Inc. located in 901 Cherry Avenue, San Bruno, CA 94066, USA. We use integrated YouTube videos in the so-called expanded data protection modus, i.e., YouTube does not store any information about the user of our website unless the user is watching our video. Once the YouTube video is accessed, this may initiate further data processing procedures (i.e., the storage of cookies by YouTube), upon which we have no influence. More information regarding the purpose and scope of the data collection and use through Google and your rights and configuration options for protection as a YouTube customer, please consult the data protection notification of YouTube and/or Google (http://www.youtube.com/t/privacy).

 

VI. Rights of those affected

 

If your personal data is processed, then you are an affected party in terms of GDPR, and you have the following rights towards the responsible party:

 

1. Right to information

 

You can demand confirmation from the responsible party about whether or not we process your personal data.

 

If we do process your personal data, you can request the following information from the responsible party:

 

The purpose for which the personal data is being collected.

The categories of the personal data that are being processed.

The recipients and/or the categories of recipients towards which your personal data has been divulged or will be divulged;

The planned duration of the storage of the personal data or, if no specific information about this is possible, the criteria for the determination of the storage period;

The right to correct or delete your personal data, a right to the limitation of the processing by the responsible party, or a right of objection against this processing;

The existence of a right of appeal with the supervisory agency;

All available information about the origin of the data, if the personal data was not collected from the affected person;

The existence of an automatic decision-making process including profiling as per Art. 22, Sec. 1 and 4 GDPR and – at least in these cases – revealing information about the involved logic as well as the scope and the aspired effects of this type of processing for the affected person.

You have the right to demand information about whether or not your personal data has been transferred to a third-party country or to an international organization. In this regard, you can demand to be informed about the suitable guarantees as per Art. 46 GDPR in connection with the transferring of the data.

 

2. Right to correction

 

You have a right to correction and/or completion towards the responsible party, insofar as the processed personal data that relates to you is incorrect or incomplete. The responsible party must make the correction immediately.

 

3. Right to restriction of processing

 

Under the following conditions, you can demand the restriction of the processing of your personal data:

 

If you dispute the accuracy of your personal data for a particular period of time, which enables the responsible party to verify the correctness of the personal data;

If the processing is illegal and you refuse the deletion of your personal data and instead demand that the use of the personal data is restricted;

The responsibility of the personal data for the purposes of the processing is no longer required, however you need these for the enforcement, exercising or defense of your legal demands, or

If you have entered an objection as per Art. 21, Sec. 1 GDPR and it has not yet been established if the justified reasons of the responsible party outweigh yours.

If the processing of your personal data has been limited, then this data – apart from its storage – can only be processed with your consent or for the purposes of asserting, exercising, or defending legal claims, or for the protection of the rights of another natural or legal person, or for an important reason of the public interest of the EU or one of its member states.

 

If the restriction of the processing was limited in accordance with the above-noted prerequisites, then you will be informed by the responsible party prior to the restriction being lifted.

 

4. Right to deletion

 

a) Deletion obligation

 

You can demand from the responsible party that your personal data is deleted immediately, and the responsible party is obligated to immediately delete this data, insofar as one of the following reasons applies:

 

Your personal data is no longer required for the purposes it was originally collected or otherwise processed.

You retract your consent upon which the processing of your data as per Art. 6, Sec. 1 (a) or Art. 9 Sec. 2 (a) GDPR was based, and a separate proper legal basis for the processing does not exist.

You object to the processing of your data as per Art. 21, Sec. 1 GDPR and there are no overriding authorized reasons for the processing, or you submit your objection with the processing as per Art. 21, Sec. 2 GDPR.

Your personal data was illegally processed.

The deletion of your personal data is required in order to fulfill a legal obligation in accordance with European Union law or the laws of its member states to which the responsible party is subjected.

Your personal data was collected in connection with the offered services of the information society as per Art. 8, Sec. 1 GDPR.

b) Information to third parties

 

If the responsible party has published your personal data, and if the responsible party is obligated to the deletion of this data in accordance with Art. 17, Sec. 1 GDPR, they must take suitable measures (including technology-related measures) to ensure – under consideration of the available technology and the implementation costs – that the parties responsible for the processing of your personal data are made aware that you, as the affected party, have demanded the deletion of all links to this personal data or of copies or duplicates of this personal data.

 

c) Exemptions from the obligation to delete

 

The right to deletion does not exist if the processing is required:

 

To exercise the right to free opinion and information;

For the fulfillment of a legal obligation that is subject to the laws of the European Union or a member state to which the responsible party is subject, or for the performing of a task that lies within the public interest, or in the execution of official authority that was transferred to the responsible party;

For reasons of public interest in the area of public health as per Art. 9, Sec. 2 (h) and (i) as well as Art. 9, Sec. 3 GDPR;

For archiving purposes that lie in the public interest, or for scientific or historical research purposes, or for statistical purposes in accordance with Art. 89, Sec. 1 GDPR, insofar as the right listed in Section a) is likely to render impossible or seriously impair the attainment of the objectives of such processing, or

For enforcing, exercising or defending legal claims.

 

5. Right to instruction

 

If you have exercised your right to correction, deletion or restriction of the processing towards the responsible party, then this party is obligated to inform all recipients who have been given your personal data, to process this correction or deletion of the data or correction or deletion of the data, unless this turns out to be impossible or is only possible with an unjustified amount of effort.

 

You have the right – towards the responsible party – to be informed about who the recipients are.

 

6. Right to data transferability

 

You have the right to receive your personal data, which you have provided to the responsible party, in a structured, standard, and machine-readable format. Furthermore, you have the right to transfer this data to another responsible party without being impeded by the responsible party for whom the personal data was provided, provided that

 

the processing is based a consent as per Art. 6, Sec. 1 (a) GDPR or Art. 9, Sec. 2 (a) GDPR or on a contract as per Art. 6, Sec. 1 (b) GDPR , and

the processing is completed with the assistance of an automated procedure.

In the exercising of this right, you also have the right to effect that your personal data is transferred directly from one responsible party to the other, insofar as this is technically feasible. Freedoms and rights of other persons may not be influenced or impaired by this.

 

The right to data transferability does not apply to a processing of personal data that is required for the performance of a task, that lies in the public interest, or that is performed within the exercising of official authority.

 

7. Right of objection

 

You have the right, for reasons resulting from your particular situation, to object to the processing of your personal data, which is processed in accordance with Art. 6, Sec. 1 (e) at any time; this also applies to profiling, which is also based on this provision.

 

The responsible party stops processing your personal data, unless they are able to demonstrate compelling reasons for processing your data, and if these reasons outweigh your interests, rights, and freedoms, or the processing serves the enforcement, exercising or defense of legal claims.

 

If your personal data is processed in order to conduct direct marketing, then you have the right to object to the processing of your personal data for this type of advertising at any time; this also applies to profiling, insofar as this is connected with this kind of direct advertising.

 

If you contradict the processing for the purposes of direct advertising, then the personal data may no longer be used for these purposes.

 

You have the possibility, in connection with the use of services of the information society – regardless of the provision 2002/58/EG – to exercise your right to obligation using an automated process for which technical specifications are used.

 

8. Right to revoke the data protection declaration of consent

 

You have the right to revoke your data protection declaration of consent at any time. Through the revocation of the declaration of consent, the legality of the processing of data based on the consent and up until its withdrawal is not affected.

 

9. Automated decision in individual cases, including profiling

 

You have the right to be subject to a decision that is not exclusively based on automated processing, including profiling, that has a legal effect on you, or that significantly hampers you in any similar way. This does not apply if the decision:

 

Is required for the conclusion or the fulfillment of a contract between you and the responsible party

Is admissible due to legal requirements of the European Union or the member states under which the responsible party is subject to and if these legal requirements contain suitable measures for the protection of your rights and freedoms as well as your legitimate interests or

Has been processed with your express consent.

However, these decisions must not be based on the special categories of personal data in accordance with Art. 9, Sec. 1 GDPR, insofar as Art. 9, Sec. 2 (a) or (g) apply and the suitable measures for the protection of the rights and freedoms as well as your legitimate interests were affected.

 

In terms of items (1) and (3) listed in the above cases, the responsible party takes suitable measures in order to ensure the rights and freedoms as well as your authorized interests, including at least the right to obtain the intervention of a person on behalf of the person responsible, to state his own position, and to challenge the decision.

 

10. Right to objection with the supervisory body

 

Regardless of a different administrative or judicial order, you have the right to lodge a complaint with a supervisory body, in particular in the member state of your place of residence, your place of work, or the place of the alleged breach if you are the opinion that the processing of your personal data infringes upon the provisions of the GDPR.

 

The supervisory board, where the complaint was lodged, informs the protesting party about the status of the results of the complaint including the possibility of a judicial remedy as per Art. 78 GDPR.

 

 

VII. External links

 

Our website may contain links that refer to third-party websites. Insofar as it is not clearly recognizable, we will inform you that the link is an external one. We have no influence on the content or the design of third-party websites. Therefore, this data protection notification cannot be applied to those sites.

 

VIII. Changes to this data protection notification

 

The continued evolution of the Internet and the related changes in the applicable legal standards, require us to regularly update this data protection information. We will inform you about any changes here.

 

IX. Responsible party

 

The responsible party in terms of GDPR and other national data protection information is the European Union with

The Lorenz Bahlsen Snack-World GmbH & Co KG Germany

Rathenaustr. 54

63263 Neu-Isenburg

 

Phone: +49 (0) 6102 - 2930

E-mail: snacks.info-line@lbsnacks.com

Website: www.lorenz-snackworld.de

 

The complete imprint can be found here: lorenz-snackworld.de/impressum

 

X. Contact data of data protection officer

 

The contact data of the data protection officer is:

 

Datenschutz@lbsnacks.com

 

Last update: May 2018