Privacy policy pursuant to Article 13, 14 GDPR
This privacy policy contains information about which personal data concerning you we process and for which purposes. Personal data in this context are any information on an identified or identifiable natural person. The law refers to this person as the "data subject".
Controller
The party responsible for the processing of your data is List & Beisler GmbH, Pickhuben 6, 20457 Hamburg (hereinafter "we" or "us").
Data protection contact
If you have questions related to data protection, you may contact us at any time at the following email address: datenschutz@list-beisler.de. You may further contact us about data protection requests at the above business address.
Type of data
We process the following categories of data:
Master data: these include your company name and address as well as the contact persons assig-ned to us.
Communication data: these are your telephone number, your mobile number as well as your email address(es).
Financial data: these include your bank details and billing data.
The legal bases for the above processing are
Article 6(1)(a) GDPR for data processing based on your consent.
Article 6(1)(b) GDPR for data processing for the purpose of performance of contracts with you as well as, when you contact us, where applicable, for the implementation of measures at your request prior to entering into a contract.
Article 6(1)(c) GDPR for data processing necessary for compliance with a legal obligation, to which we are subject, e.g. obligation to preserve records under commercial and tax law.
Article 6(1)(f) GDPR for data processing necessary for the protection of our legitimate interests or the legitimate interests of a third party except where these interests for processing are over-ridden by your interests or fundamental rights and freedoms.
Purposes of data processing
1. Pre-contractual inquiries
To process pre-contractual inquiries, we process the data provided by you. This is typically mas-ter data and/or communication data. The purpose of processing is to respond to the inquiries submitted by you through our websites or directly to us.
The legal basis for processing is Article 6(1)(b) GDPR.
2. Web shop registration
You must register to use our webshop. As part of this registration we process the data provided by you to provide you with access to the webshop. The requested mandatory information is necessary for registration, as you will be able to order from the webshop once registered. The requested mandatory information is a prerequisite for fulfilling orders which have been placed.
The legal basis for this processing is Article 6(1)(a) GDPR.
3. Contract performance
When you place an order through our web shop, we process your master data, your communica-tion data and your financial data for the purpose of performance of the contact concluded with you.
The legal basis for processing is Article 6(1)(b) GDPR.
4. Advertising
We occasionally use your master data to send you advertising about our product range or special sales by post. This does not apply to email or telephone advertising. We use your data for this advertising only with your express prior consent.
The legal basis for using your data for advertising purposes by post is Article 6(1)(f) GDPR. Our legitimate interest in using your data to send you advertising related to our product range is informing you about our product range.
5. Newsletter
You can subscribe to a free newsletter on our website. When subscribing to the newsletter, you provide the email address for dispatch of the newsletter. You may unsubscribe from the newsletter at any time. Each newsletter contains the respective link for this purpose.
The legal basis for processing data collected in relation to newsletter subscription is Article 6(1)(a) GDPR.
You can object to your data being processed or used for the purposes of direct marketing (e.g. of the newsletter) at any time without incurring any costs other than those normally applicable to data transmission (e.g. internet connection costs, postage). Please send any objections to: shop (at) list-beisler.de or List & Beisler GmbH, Pickhuben 6, 20457 Hamburg, Germany.
6. Google Analytics
If you expressly agree when visiting our website, we use Google Analytics, a web analysis service of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland ("Google") for our web-site for statistics on its use by our visitors. Google Analytics uses so-called "cookies", small text files stored on your computer, which enable an analysis of your use of the website.
The information about your use of the website generated by the cookie is typically transmitted to a Google server in the USA and stored there. Your IP address is collected by Google. Google uses this information to analyse the use of our website on our behalf, generate reports on web-site activity for us, and to provide us with additional services related to website and internet use.
The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. You can prevent the storage of cookies by configuring your browser software accordingly; however, please note that in this case you may not be able to make full use of all functions of this website. You can further prevent Google from collecting the data generated by the cookie related to your use of this website (including your IP address) and this data being processed by Google by downloading and installing the browser plug-in using the following link. The current link is: https://tools.google.com/dlpage/gaoptout.
The legal basis for the above data processing using Google Analytics when personal data is pro-cessed is Article 6(1)(a) GDPR (consent).
7. Social networks
Instagram
Our websites contain our business accounts on Instagram, a service of Facebook Ireland Ltd., 4 Grand Canal Square Grand Canal Harbour, Dublin 2, Ireland. Use of the Instagram pages and their functions is at your own risk. We have no control over the collection and processing of data by Facebook via Instagram. This particularly applies to interactive functions (e.g. comment, share, rating).
When you visit our business account on Instagram, Facebook collects your IP address as well as other information, among other things, which Facebook stores on your PC by means of cookies. This information is also used to provide us as the owner of the business account with anonymous statistical information about how the pages are use. If personal data is collected during pro-cessing, the legal basis is Article 6(1)(a) GDPR if you have given your consent. Otherwise, the legal basis is Article 6(1)(f) GDPR. This processing serves our legitimate interest in obtaining in-formation about how our Instagram account is used. Since we are jointly liable together with Facebook for this processing, we have entered into a data processing agreement as joint control-lers which defines how the data protection obligations are shared between us and Facebook. For more information please visit Facebook at the following link: facebook.com/help/pages/insights. The agreement with Facebook can be viewed at: face-book.com/legal/terms/page_controller_addendum. You can also contact us at any time using the specified contact information to exercise your rights. In this case, we will forward your request to Facebook.
If you are logged into your Instagram account and visit our company pages, Facebook can match this with your account. Please note, Facebook saves your data (e.g. personal information, IP ad-dress, etc.) and may also use this for its business purposes. According to information provided by Facebook, the IP address is anonymised (German IP addresses) and erased after 90 days. Face-book further saves information about user devices (e.g. as part of the "login notification" func-tion); Facebook may therefore be able to match IP addresses with specific users. How Facebook uses the data collected from Instagram accounts for its own purposes, the extent to which activ-ity can be matched with specific users, how long Facebook saves this data, and whether it is disclosed to third parties, is not fully and clearly disclosed by Facebook and therefore unknown to us. Facebook may transmit the personal data collected concerning you to countries outside the European Union. For Instagram privacy policy, please visit https://help.instagram.com/519522125107875. There you will also find information about how to contact Facebook and settings related to advertising. For information on how to manage or erase existing information, please visit the following Facebook pag-es: facebook.com/about/privacy#.
LinkedIn
In addition, we have a LinkedIn account, which we have linked on our website. LinkedIn is a service of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (hereinafter: LinkedIn). Use of the LinkedIn pages and their functions is at your own risk. This particularly ap-plies to the use of interactive functions such as Share.
LinkedIn is in principle the sole controller when you visit our LinkedIn page. For more infor-mation about how personal data is processed by LinkedIn, please vis-it https://www.linkedin.com/legal/privacy-policy.
When you visit , follow or interact with our LinkedIn page, LinkedIn processes personal data to provide us with anonymous statistics and insight. This information is also used to provide us as the owner of the business accounts with anonymous statistical information about how the pages are used. If personal data is collected during processing, the legal basis is Article 6(1)(a) GDPR if you have given your consent. Otherwise the legal basis is Article 6(1)(f) GDPR. Processing serves our legitimate interest in gaining knowledge about how our LinkedIn page is used. Since we are jointly liable together with LinkedIn for this processing, we have entered into a data processing agreement as joint controllers which defines how the data protection obligations are shared between us and LinkedIn. This agreement is available at: https://legal.linkedin.com/pages-joint-controller-addendum. You can exercise your rights under the GDPR with LinkedIn online by us-ing the following link (https://www.linkedin.com/help/linkedin/ask/PPQ) or by using the contact information in the LinkedIn privacy policy. You can also contact us at any time using the spe-cified contact information to exercise your rights. In this case we will forward your request to LinkedIn. Under the joint controller agreement, the Irish Data Protection Commission is the general supervisory authority which monitors processing for Page Insights.
Please note, in accordance with the LinkedIn privacy policy, LinkedIn also processes personal data in the USA or other third countries. According to LinkedIn, the company only transmits personal data to countries with an adequacy decision of the European Commission pursuant to Article 45 GDPR or subject to appropriate safeguards pursuant to Article 46 GDPR.
YouTube
We use YouTube plug-ins on our website for integration and to show video contents. The provi-der of the video portal is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ire-land. When you open a page with embedded YouTube plug-in, a connection to YouTube servers is established.
This provides YouTube with information on which of our pages you have opened.
YouTube can match your browsing behaviour directly with your personal profile if you are logged into your YouTube account. You can prevent this by first logging out. For details about how user data is handled, please refer to the YouTube privacy policy at: https://policies.google.com/privacy.
Categories of data recipients
Recipients of your data include in particular our service providers. These include e.g. the IT ser-vice provider maintaining our website. We have entered into the necessary contracts pursuant to Article 28 GDPR
Retention period / criteria for retention period
We store your personal data until the purpose for processing (see → Purposes of data proces-sing) no longer exists. If we are legally obligated to store personal data, the data will be stored for the duration of our legal obligation. For commercial documents, which includes account books and receipts (including invoices), this is 10 years (§ 257(4) German Commercial Code). If necessary, your data will be blocked for ongoing operations during this time if there is no other purpose for processing.
Transmission to third countries
Your personal data will be transmitted into third countries only if this is necessary to perform the contract concluded with you. Third countries are all countries outside the European Econo-mic Area. The European Economic Area includes all the countries of the European Union, as well as the countries of the area known as the European Free Trade Area, which are Norway, Iceland and Liechtenstein.
Transmission to third countries is based on an adequacy decision of the European Commission. If there is no adequacy decision of the European Commission for the respective third country, transmission to a third country will be based on our appropriate safeguards as defined by Article 46(2) GDPR. You may request copies of these safeguards from the above address (see → Control-ler, data protection contact).
Rights of the data subjects
Rights pursuant to Articles 15 to 18, and 20 GDPR
You have the right to request at reasonable intervals information about the personal data we have stored concerning you (Article 15 GDPR). On request we will provide you with a copy of the data subject to processing.
Furthermore you have the right to request the correction of data, which has been incorrectly stored (Article 16 GDPR).
You have the further right to request the erasure of your personal data (Article 17 GDPR). We are obligated, inter alia, to erase your personal data, if they are no longer required for the pur-poses for which they were collected or otherwise processed, if you have withdrawn your consent, or if the data is being processed unlawfully.
Under certain circumstances you have the right to restrict processing of your personal data (Ar-ticle 18 GDPR). This includes if you are contesting the accuracy of your personal data and we need to reveiw your objection. In this case, we are no longer permitted to process your data, apart from storage, until the matter has been resolved.
Furthermore, you have the right to receive the data you provided to us based on your consent or a contractual relationship with you or, at your discretion, have it transmitted to a third party, in both cases in a machine readable format (Right to data portability, Article 20 GDPR).
No contractual or legal obligation to provide data / consequences of failing to provi-de data
You have no contractual or legal obligation to provide us with your personal data. However, please note that you will be unable to conclude contracts with us if we are not permitted to collect and process the data which we also need for performance of a contract (see → Purposes of data processing).
Right to object pursuant to Article 21 GDPR
If our processing of your data is based on performance of a task in the public interest or in exer-cising official authority (Article 6(1)(e) GDPR) or data processsing is based on our legitimate inte-rest, you have the right to object to the processing of your personal data at any time on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling grounds for processing which override your interest in the termination of the pro-cessing.
You may object to the processing of your personal data for the purpose of direct advertising at any time without restriction.
Right at any time to withdraw consent
If data processing by us is based on your consent, you have the right to withdraw your consent at any time. However, this does not affect the lawfulness of processing carried out based on consent prior to consent being withdrawn.
Right to lodge a complaint with a Supervisory Authority
You have the right to lodge a complaint with a supervisory authority. The supervisory authority with competence for us is:
Hamburg Commissioner for Data Protection
Klosterwall 6
20095 Hamburg
Phone: +49 40 428544040
Version: May 2021