Data protection information according to Art. 13 and 21 GDPR for the website of cekom

1. General

We, cekom GmbH, take the protection of your personal data and the legal obligations that serve to ensure this protection very seriously. The legal provisions require comprehensive transparency in all issues regarding the processing of personal data. Only when the processing is traceable for you as the person concerned (data subject), you can be deemed to be sufficiently informed about the intention, purpose and scope of the processing. That is why our Privacy Policy explains to you in detail which so-called personal data (see definition below 2.1.) we process when you use the website www.cekom.de or any other Internet pages that refer to it (see definition below 2.2.).

“Controller” in terms of the General Data Protection Regulation (GDPR), the Bundesdatenschutzgesetz – German Federal Data Protection Act (BDSG) and other data protection regulations is

cekom GmbH
Jülicher Str. 26, 50674 Köln
+49 221 973062-0
message@cekom.de
www.cekom.de

referred to hereinafter as “controller” or “we”.

The responsible data protection officer is:

Manfred Finette
Jülicher Str. 26
50670 Köln
+49 221 973062-0
finette@cekom.de
www.cekom.de

Please be aware that you may be redirected to other Internet pages via links on our website which other pages are not operated by use but by third parties. We either clearly mark such links or you can recognise them by the change of the address line of your browser. We are not responsible for compliance with the applicable data protection regulations and secure handling of your personal data by third parties operating such other Internet pages.

2. Definitions

2.1. According to the GDPR

This Privacy Policy uses the terms used in the wording of the GPPR. The definitions (Art. 4 GDPR) are available for instance at https://dejure.org/gesetze/DSGVO/4.html .

2.2. Cookies

Cookies are text files which a website places on your terminal or which are read out there. They contain letters and combinations of numbers to enable, for instance when a connection is again established with the website that places the cookies, the recognition of the user and his settings, to enable you to stay logged in to a customer account or to conduct statistical analyses of a certain user behaviour. Edit Cookie & Privacy Setting.

3. General information about data processing

We only process personal data to the extent this is permitted by law. Disclosure or transfer to third parties takes place only in the cases described below (see sec. 4 below).

The personal data is deleted or protected by technical and organisational measures (e.g. pseudonymisation, encryption) as soon as the data processing purpose ceases to exist. This is also the case as soon as a prescribed storage period expires unless continued storage of the personal data is necessary for the purpose of conclusion or performance of a contract.

Unless we are obliged by law to ensure extended storage or disclose or transfer personal data to third parties (including but not limited to criminal prosecution authorities), the decision which personal data is collected by us, how long it is stored and to which extent you may be required to disclose your data depends on which functions and features of the website you use from time to time.

4. Data processing in connection with the use of the website

Using the website and its functions and features, as a rule, requires the processing of certain personal data.

4.1. Use of the website for information purposes

When you access our website and use it for mere information purposes, e.g. without using additional functions or features such as contact forms or social media plugins, we automatically collect personal data. We thereby collect the following information: IP address of your terminal as well as date and time of your access to the website. This information is transferred by your browser unless you have configured it such that the information transfer is prevented.

The personal data is processed for purposes of functionality and optimisation of the website and to ensure the security of our information technology systems. This is at the same time our legitimate interest which renders the processing permissible according to Art. 6 subs. 1 f) GDPR.

The personal data is stored during a period of 4 weeks. We do not combine the personal data with other data sources. We do not disclose or transfer the personal data to third parties. It is not intended to transfer personal data to a third country or an international organisation.

4.2. Google Maps

Parts of our website use Google maps features to integrate maps data. These contents are made available by Google Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA (“Google”). When you access our website, your browser loads the Google code required for this. For such purpose, the browser you use must establish a connection to the Google servers. Google thereby becomes aware that our website was accessed from your IP address. At the same time, Google can place cookies on your terminal unless you have forbidden the use of cookies in your browser settings, or Google can read out cookies. Also location or geo-tracking data can be collected if you allow this in your browser settings.

We use Google Maps to ensure an appealing and comfortable design of our website; Google Maps helps to find the locations which we refer to in our website. This is a legitimate interest in terms of Art. 6 subs. 1 f) GDPR. Data transfer to the USA is made in accordance with the EU Commission Implementing Decision (EU) 2016/1250 (EU-U.S. Privacy Shield).

We collect your IP address to enable data transfer to Google. You are not obliged to provide this personal data; however, if you do not provide this data, you will not be able to use certain parts of our website.

Further information is contained in the Google Privacy Policy which is available at https://www.google.com/policies/privacy/.

4.3. Google Analytics

On our websites we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

In this context, pseudonymized user profiles are created and cookies are used, which are stored on your device. The information generated by the cookie about your use of this website may include, but is not limited to

• short-term collection of the IP address without permanent storage,
• location data,
• browser type/version,
• operating system,
• referrer URL (previously visited page),
• time of the server request.

The pseudonymized data may be transmitted by Google to a server in the USA and stored there.

The information is used to evaluate the use of the website, to compile reports on website activity and to provide other services relating to website activity and internet usage for the purposes of market research and the needs-based design of this website. This information may also be transferred to third parties if this is required by law or if third parties process this data on our behalf.

These processing operations are only carried out with your consent in accordance with Art. 6 (1) a) GDPR. Your consent extends to the storage of cookies on your device, the subsequent use of your personal data for the aforementioned purposes by us and Google, as well as the transfer to the USA. You can revoke your consent at any time without giving reasons with effect for the future, e.g. in the cookie settings on our website.

Google's default data storage period is 14 months. Otherwise, the personal data is stored for as long as it is required to fulfill the purpose of the processing. The data is deleted as soon as it is no longer required to achieve the purpose.

The parent company Google LLC is certified as a US company under the EU-US Data Privacy Framework. This constitutes an adequacy decision pursuant to Art. 45 GDPR, meaning that personal data may be transferred without further guarantees or additional measures.

Further information on data protection when using GA4 can be found at: https://support.google.com/analytics/answer/12017362?hl=en

Under the Digital Markets Act, Google is required to obtain user consent before processing user data for personalized advertising. Google meets this requirement with the "Consent Mode". As a user, we are obliged to implement this and thus prove that we have obtained the consent of website visitors.

Google offers two implementation modes, the simple and the advanced implementation.

We use the simple implementation method of Google Consent Mode. Only if you give your consent to the use of Google Analytics (see above) will a connection to Google be established, a Google code executed, and the processing described above carried out. If you refuse consent, Google will only receive information that consent has not been given. The Google code is not executed and no Google Analytics cookies are set.

4.4. Google Ads (AdWords) remarketing/retargeting

We have integrated Google Ads on this website. The operating company of the Google Ads services is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

This allows us to advertise this website in Google search results and on third-party websites. For this purpose, Google places a cookie in the browser of your end device, which automatically enables interest-based advertising by means of a pseudonymous cookie ID and based on the pages you visit.

Any further data processing will only take place if you have consented to Google linking your internet and app browsing history to your Google account and using information from your Google account to personalize ads that you view on the internet. In this case, if you are logged in to Google while visiting our website, Google will use your data together with Google Analytics data to create and define target group lists for cross-device remarketing. For this purpose, Google temporarily links your personal data with Google Analytics data to create target groups.

If you reach our website via a Google ad, a so-called conversion cookie is stored on device by Google. A conversion cookie loses its validity after thirty days and is not used to identify you. If the cookie has not yet expired, the conversion cookie is used to track whether certain sub-pages, such as the shopping cart from an online store system, have been accessed on our website. The conversion cookie enables both us and Google to track whether a user who has reached our website via an AdWords ad has generated sales, i.e. completed, or canceled a purchase.

The data and information collected using the conversion cookie is used by Google to compile visit statistics for our website. These visit statistics are in turn used by us to determine the total number of users who were referred to us via Google Ads ads, i.e. to determine the success or failure of the respective Ads ad and to optimize our Google Ads ads for the future. Neither our company nor other Google Ads advertisers receive information from Google that could be used to identify you.

The conversion cookie is used to store personal information, such as the websites you have visited. This personal data is stored by Google in the United States of America. Google may pass on this personal data collected via the technical process to third parties.

These processing operations are only carried out with your express consent in accordance with Art. 6 (1) a) GDPR. Your consent extends to the storage of cookies on your device, the subsequent use of your personal data for the aforementioned purposes by us and Google, as well as the transfer to the USA. You can revoke your consent at any time without giving reasons with effect for the future, e.g. in the cookie settings on our website.

You can view Google Ads' privacy policy and further information at: https://www.google.com/policies/technologies/ads/

Under the Digital Markets Act, Google is required to obtain user consent before processing user data for personalized advertising. Google meets this requirement with the "Consent Mode". Users are obliged to implement this and thus prove that they have obtained the consent of website visitors.

Google offers two implementation modes, the simple and the advanced implementation.

We use the simple implementation method of Google Consent Mode. Only if you give your consent to the use of Google Ads (see above) will a connection to Google be established, a Google code executed, and the processing described above carried out. If you refuse consent, Google will only receive information that consent has not been given. The Google code is not executed, and no Google Ads cookies are set.

4.5. YouTube

Parts of our website use the services provided by YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (“YouTube”) to display video contents. When you access the relevant pages, your browser loads the YouTube code required for displaying the video. For such purpose, the browser you use must establish a connection to the YouTube servers. YouTube thereby becomes aware that our website was accessed from your IP address. At the same time, YouTube can place cookies on your terminal unless you have forbidden the use of cookies in your browser settings, or YouTube can read out cookies.

We use the YouTube plug-in to ensure an appealing design of our website and enable the display of video contents. This is a legitimate interest in terms of Art. 6 subs. 1 f) GDPR. Data transfer to the USA is made in accordance with the EU Commission Implementing Decision (EU) 2016/1250 (EU-U.S. Privacy Shield).

We collect your IP address to enable data transfer to YouTube. You are not obliged to provide this personal data; however, if you do not provide this data, you will not be able to use certain parts of our website.

If you do not want YouTube to allocate the personal data collected via our website to your YouTube account, you have to log out from YouTube before you visit our website. Further information about YouTube is available at https://www.youtube.com/intl/de/yt/about/. The YouTube Privacy Policy is included in the Google Privacy Policy which is available at https://www.google.com/policies/privacy/.

4.6. Contact form / Email contact

When you use the contact form available on our website or write us an email, we will process the personal data you have provided thereby. This information is transmitted by your browser or email client and stored in our information technology systems. The processing of this personal data is necessary to answer your request. In addition, your IP address as well as the data and time of your request will be stored if you write us an email.

Date processing serves to answer your request.

These processing acitivities are lawful because answering your request is a legitimate interest in terms of Art. 6 subs. 1f) GDPR.

The personal data is stored as long as this is required for answering your request. If your request should bring about subsequent contract conclusion, the data is stored as long as this is required for taking steps prior to entering into a contract or for the performance of the contract. Thereafter, the personal data is deleted routinely every 4 weeks. We do not combine this personal data with other data sources. The data is not disclosed or transferred to third parties. It is not intended to transfer the data to a third country or an international organisation. You are not obliged to provide this personal data; however, if you do not provide this data, you cannot use the contact form or send an email.

4.6. Subscription to a newsletter

You can subscribe to a newsletter on our website. If you do so. Your browser will transfer to us the personal data which have entered upon subscription and we will store this data in our information technology system. Your IP address and the time of subscription will be stored, too.

The processing of the data which you have entered serves to enable customized design and the sending of the newsletter. These processing activities are lawful because you have consented to them according to Art. 6 subs. 1 a) GDPR. The storage of your IP address and the time of subscription serves to ensure the security of our information technology systems. This is at the same time our legitimate interest which renders the processing permissible according to Art. 6 subs. 1 f) GDPR.

We will store the personal data you have entered until you unsubscribe. The IP address and the time of subscription will be stored during a period of 4 weeks. We do not combine this personal data with other data sources. We do not disclose or transfer the data to third parties. It is not intended to transfer the data to a third country or an international organisation. You are not obliged to provide this personal data; however, if you do not provide this data, you cannot subscribe to our newsletter.

5. Rights of data subjects

You as the person concerned (hereinafter “data subject”) are entitled to a right to information according to Art. 15 GDPR, a right to rectification according to Art. 16 GDPR, a right to erasure according to Art. 17 GDPR, a right to restriction of processing according to Art. 18 GDPR as well as a right to data portability according to Art. 20 GDPR. The right to information as well as the right to erasure are subject to the restrictions under §§ 34, 35 BDGS (German Federal Data Protection Act). In addition, you are entitled to lodge a complaint with a supervisory authority (Art. 77 GDPR in combination with § 19 BDSG).

6. Automated case-by-case decisions including profiling

No automated case-by-case decisions are taken, including profiling.

7. Controller’s duty to inform

We will inform all recipients to whom your personal data was disclosed of any rectification or erasure of your personal data or any restriction of processing according to Art. 16, Art. 17 subs. 1 and Art. 18 GDPR unless it is impossible or requires unreasonable effort to inform them.

We will also inform you about the identity of the recipients at your request.

8. Right to oppose

You are entitled for reasons arising from your specific situation to oppose at any time the processing of your personal data which is carried out according to Art. 6 subs. 1 e) or f) GDPR. Where personal data is processed for the purpose of direct marketing, you are entitled at any time to oppose the processing of your personal data for such direct marketing purposes.

9. Right to withdraw your consent to personal data processing

You are entitled under Art. 7 subs. 3 sentence 4 GDPR at any time to withdraw your consent. However, the withdrawal will leave the lawfulness of the processing that has taken place with your consent before the withdrawal unimpaired. Thus, the withdrawal only takes effect for the processing intended for the time after the withdrawal. The withdrawal can be made informally, by posted letter or email. If you oppose the processing, we will no longer process your personal data unless this is permitted by another (legal) basis. If you oppose the processing and there is no other legal basis which permits continued processing, we are obliged under Art. 17 subs. 2 b) GDPR to erase your personal data without undue delay (“unverzüglich”) upon your request.

The withdrawal can be made informally and is to be addressed to:

cekom GmbH
Jülicher Str. 26, 50674 Köln
message@cekom.de