Data Protection

Data Protection Statement of CONCEPT-BOX GmbH, Brunnenstraße 30, D-58256 Ennepetal, Phone 0049 2333 6090-0, info@concept-box.de, May 2018

Data protection is important both for you and for us. Please take note of the following information:

To carry out the services of CONCEPT-BOX GmbH it is necessary for us to collect, process, use and store personal data relating to you. We take personal data protection extremely seriously. All data that we collect when you visit our website is in principle collected, processed, used and stored according to the applicable legal provisions. By agreeing to the following data protection statement you are consenting to the collection, processing, use and storage of your personal data according to the purpose described below.

General information
Personal data (e.g. name, address, date of birth) that you enter via our website shall be collected, processed, used and stored by CONCEPT-BOX GmbH. The latter is the
controller within the meaning of the European General Data Protection Regulation (GDPR) as well as other data protection laws and other provisions of a data protection law nature that are applicable in the Member States of the European Union.

CONCEPT-BOX GmbH can be contacted as follows:
CONCEPT-BOX GmbH, Claudia Möllney, Brunnenstraße 30, D-58256 Ennepetal, Phone 0049 2333 6090-0, info@concept-box.de

Definitions
The data protection statement is based on terminology used by the European directive and regulatory body when adopting the European General Data Protection Regulation (GDPR). Our data protection statement should be easily readable and comprehensible for both the public and our customers and business partners. In order to ensure this, we would like to first define the terminology used.

We use the following terms (among others) in the data protection statement:

Personal data
Personal data shall mean any information that relates to an identified or identifiable natural person (referred to hereafter as the ‘data subject’). A natural person shall be regarded as identifiable if they can be identified directly or indirectly, particularly through assignment to an identifier such as a name, to a code, to location data, to an online identifier or to one or more special features
which are an expression of the physical, physiological, genetic, psychological, economic, cultural or social identity of this natural person.

Data subject
The data subject shall mean every identified or identifiable natural person whose personal data is being processed by the controller.

Processing
Processing shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.

Restriction of processing
The restriction of processing shall mean the marking of stored personal data with the aim of restricting its future processing.

Pseudonymisation
Pseudonymisation shall mean the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information, provided that this additional information is stored separately and the technical and organisational measures are in place to ensure that the personal data cannot be attributed to an identified or identifiable natural person.

Controller
Controller shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data. If the purposes and means of this processing are stipulated in EU law or the law of Member States, the controller, or rather the specific criteria he outlines, can be laid down in accordance with EU or Member State law.

Processor
Processor shall mean a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller.

Recipient
Recipient shall mean a natural or legal person, public authority, agency or any other body to whom data are disclosed, whether a third party or not. Public authorities who receive personal data as part of a particular investigation mandate in accordance with EU or Member State law do not however qualify as recipients.

Third party
Third party shall mean a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or the processor, are authorised to process the personal data.

Consent
Consent shall mean any declaration of intent freely submitted by the data subject in an informed way and without ambiguity for a specific instance, submitted in the form of a declaration or other clear act of confirmation, with which the data subject makes clear that they are in agreement with the processing of their personal data.

Collection and use of your data

Non-personal data
Non-personal data is data via which we cannot make any reference to your person. When visiting our website, the web servers we use store by default the name of your Internet service provider, the website from which you were referred to our site, and the date and duration of your visit. None of this data is personal data as no reference to your person can be made with this data. The data is stored exclusively for internal purposes such as the provision and improvement of the service and the monitoring of functionality.

Voluntary personal data
When we request personal data, we expressly indicate to you what data can be given voluntarily. The entering of such data is therefore not required and may be omitted. If you then share your personal data with us voluntarily, for example in questionnaires, competitions, etc., we will store this data electronically and treat it as strictly confidential. This data shall be used exclusively for our own purposes, for example, to improve our services. With your prior express consent, this data will be used for our own advertising purposes. It will not be forwarded to third parties. You may withdraw your consent at any time. To do this there is an option of revoke your consent in every e-mail.

Your e-mail address
Your e-mail address is also personal data. For this reason, we shall also only use your email address for the purpose for which you provided it to us. That is for the complete processing of contracts and, if necessary, other organisational contact.

Routine deletion and blocking of personal data
The controller processes and stores personal data from the data subject only for the period necessary to achieve the purpose of the storage or as provided for by the European directive and regulatory body or any other legislator in laws or regulations to which we are subject. If the storage purpose ceases to apply or a storage period prescribed by the European directive and regulatory body or any other relevant legislator expires, the personal data is routinely blocked or deleted in accordance with the statutory provisions.

Use of cookies
Cookies are small text files that are stored on the hard drive of computers of visitors to the platform, i.e. on your computer. According to the settings of the website, a temporary cookie is placed on your hard drive, which stores certain information during your visit, e.g. language, duration of the visit. In addition, a more permanent cookie is placed, which among other things enables functionality, but also counts the number of your visits, without, however, automatically connecting your PC with your personal data. The information contained in cookies makes navigation easier for you and enables the correct display of our web pages. Our cookies are not capable of identifying you as a person. We use the information stored by the cookies to analyse the use of the portal and to improve our offering.
You can, however, prevent cookies being stored, even permanently, by changing your browser settings. In addition, cookies already set can be deleted at any time via an Internet browser or other software programs. This is possible in all common internet browsers. If you deactivate the setting of cookies in your Internet browser, it is possible that not all functions of our website will be fully usable.

Your rights regarding your data
You can delete your account at any time and request the data we have stored on you. However, we do have to store and archive your data even after deleting your account for legal (e.g. tax ) reasons. This data shall, however, then be blocked for any use. All data for which we have no legal archiving obligation shall be deleted by us immediately after you have requested the deletion. You can at any time obtain information on all data that we have stored on you. Your rights in detail:

Right to confirmation
Every data subject has the right as granted by the European directive and regulatory body to demand from the controller confirmation of whether their personal data is being processed. If a data subject would like to exercise this right to confirmation, they can contact us and our employees regarding this at any time via the above contact details.

Right to information
Every person affected by the processing of personal data has the right, granted by the European directive and regulatory body, to request at any time free information about the personal data stored about them from the controller and to obtain a copy of this information. In addition, the European directive and regulatory body has granted the data subject information on the following:
- the purposes of processing
- the categories of personal data that are being processed
- the recipients or the categories of recipients to whom the personal data has been or will be disclosed, in particular also in the case of recipients in third countries or international organisations
- where possible the planned duration for which the personal data will be saved, or where this is not possible, the criteria for the determining the duration
- the existence of a right to correct or delete the personal data pertaining to them, or to restrict the processing thereof by the controller, or the right to object to such processing
- the existence of a right of appeal to a supervisory authority
- where the personal data have not been obtained from the data subject: all available information about the origin of the data
- the existence of automated decision making including profiling in accordance with Art. 22 (1) and (4) of the GDPR and — at least in these cases — meaningful information on the logic involved as well as the scope and envisaged effects of such processing for the data subject.
In addition, the data subject has the right to information on whether personal data has been transferred to a third country or international organisation. If this is the case, the data subject also has the right to receive information on the appropriate safeguards in connection with the transfer.
If a data subject would like to exercise this right to information, they can contact us and our employees regarding this at any time via the above contact details.

Right to rectification
Every person affected by the processing of personal data has the right, granted by the European directive and regulatory body, to demand the immediate correction of incorrect personal data relating to them. In addition, the data subject also has the right, in consideration of the purposes of the processing, to demand the completion of incomplete personal data - also by means of a supplementary explanation. If a data subject would like to exercise this right to rectification, they can contact us and our employees regarding this at any time via the above contact details.

Right to deletion (Right to be forgotten)
Every person affected by the processing of personal data has the right, granted by the European directive and regulatory body, to demand from the controller the immediate deletion of personal data relating to them, provided one of the following reasons applies and as long as the processing is not necessary:
- The personal data has been collected or otherwise processed for such purposes for which it is no longer necessary.
- The data subject revokes their consent, on which the processing was based in accordance with Art. 6 (1) a) GDPR or Art. 9 (2) a) GDPR, and there is no other legal basis for the processing.
- The data subject submits an objection to the processing in accordance with Art. 21 (1) GDPR, and there are no legitimate reasons for the processing, or the data subject objects to the processing in accordance with Art. 21 (2) GDPR.
- The personal data was processed unlawfully.
- The erasure of personal data is necessary to fulfil a legal obligation under the European Union or national law to which the controller is subject.
- The personal data was collected in relation to information society services offered in accordance with Art. 8 (1) GDPR.
If any of the above reasons apply and a data subject wishes to arrange the deletion of personal data stored by CONCEPT-BOX GmbH, they can contact us

Right to restriction of processing
Every person affected by the processing of personal data has the right, granted by the European directive and regulatory body, to demand that the controller restricts processing if one of the following conditions applies:
- The accuracy of the personal data is contested by the data subject; the restriction in this case shall be for a period of time that enables the controller to verify the accuracy of the personal data.
- The processing is unlawful; the data subject has not consented to the deletion of the personal data and demands instead that the use of the data be restricted.
- The controller no longer requires the personal data for processing purposes, but the data subject needs it to enforce, exercise or defend their rights.
- The data subject has contested the processing in accordance with Art. 21 (1) GDPR and it has not yet been ascertained whether the justification given by the controller will outweigh that of the data subject.
If any of the above conditions apply and a data subject wishes to request the restriction of the processing of personal data stored by CONCEPT-BOX GmbH, they can contact us and our employees regarding this at any time via the above contact details. The employees of CONCEPT-BOX GmbH will arrange the restriction of the processing immediately.

Right to data portability
Every person affected by the processing of personal data has the right, granted by the European directive and regulatory body, to obtain the personal data they provided to the controller in a structured, common and machine-readable format. They also have the right to transfer this data to another controller, without being hindered by the controller to whom they made the data available, provided that the processing is based on the consent pursuant to Art. 6 (1) a) GDPR or Art. 9 (2) (a) GDPR or on a contract pursuant to Art. 6 (1) b) GDPR and the processing is performed by automated procedures, unless the processing is necessary for the performance of a task that is in the public interest or for the exercise of official authority which has been assigned to the controller.
In addition, when exercising their right to transfer the data in accordance with Art. 20 (1) GDPR, the data subject has the right to demand that their personal data be transmitted directly from one controller to another controller, provided that the technical requirements for this are available and this does not affect the rights and freedoms of other persons.
In order to assert the right to data portability, the data subject can contact us and our employees at any time via the above contact details.

Right of objection
Every person affected by the processing of personal data has the right, granted by the European directive and regulatory body, for reasons related to their particular situation to raise objection at any time to the processing of their data being carried out under Art. 6 (1) e) or f) of GDPR. This also applies for any profiling based on these provisions.
In the case of an objection, CONCEPT-BOX GmbH will no longer process the personal data, unless there are compelling and legitimate grounds for processing which outweigh the interests, rights and freedoms of the data subject, or processing serves to assert, exercise or defend legal claims. If CONCEPT-BOX GmbH processes data for the purposes of direct advertising, the data subject has the right to object to the processing of their personal data for such advertising at any time. This also applies for profiling, provided it is connected with such direct marketing. If the data subject objects to CONCEPTBOX GmbH processing data for the purposes of direct advertising, CONCEPTBOX GmbH shall no longer process the personal data for these purposes.
In order to assert the right of objection, the data subject can contact us and our employees at any time via the above contact details. Notwithstanding Directive 2002/58/EC, the data subject is also entitled in the context of the use of information society services to exercise their right of objection by means of automated procedures for which technical specifications are used.

Automated individual decision-making, including profiling
Every person affected by the processing of personal data has the right, granted by the European directive and regulatory body, to object to being subject to an exclusively automated decision which has a legal impact on them or adversely affects them in a similar manner, provided that the decision (1) is not necessary to fulfil a contract between the data subject and controller, or (2) is permissible on the grounds of EU legislation or Member State law to which the controller is subject, and this legislation contains reasonable measures to protect the rights and freedoms as well as legitimate interests of the data subject, or (3) it occurs with the express consent of the data subject.
If the decision is (1) necessary for the fulfilment of a contract between the data subject and the controller or (2) it occurs with the express consent of the data subject, CONCEPT-BOX GmbH shall take reasonable measures to protects the right and freedoms as well as the legitimate interests of the data subject, which will at the very least include the right to seek the involvement of the data subject on the part of the controller, the right to express their own viewpoint and to challenge the decision.
If a data subject would like to exercise rights in respect of automated decisionmaking, they can contact us and our employees regarding this at any time via the above contact details.

Right to revoke consent in relation to data protection
Every person affected by the processing of personal data has the right, granted by the European directive and regulatory body, to revoke consent for the processing of personal data relating to them at any time. If a data subject would like to exercise their right to revoke their consent, they can contact us and our employees regarding this at any time via the above contact details.

Protection of your data
We take the protection of your personal data extremely seriously. When collecting your sensitive data we use SSL (=Secure Socket Layer) technology. We use generally accepted industry standards to secure sensitive data and to protect it against unauthorised access or unlawful use. Legal or contractual regulations for the provision of personal data; Necessity for the conclusion of the contract; Obligation of data subject to provide personal data; Possible consequences of non-provision We hereby inform you that the provision of personal data is in part prescribed by law (e.g. tax regulations) or may arise from contractual regulations (e.g. details of the contracting party). It may, for example for the conclusion of a contract, be necessary for the data subject to provide us with personal data that we must subsequently process. The data subject is for example obliged to provide us with personal data, if our company concludes a contract with them. Non-provision of personal data could result in the contract with the data subject failing to be concluded. Before the data subject provides personal data, they must contact us via the above contact details. Our data protection officer will explain to the data subject on an individual case basis whether the provision of personal data is legally or contractually prescribed or necessary for the conclusion of the contract, whether there is an obligation to provide personal data; and what the consequences of non-provision of personal data would be.

Changes
The operator reserves the right to update this data protection statement. In the case of changes that could be disadvantageous to you, we will inform you with appropriate notice, and where this is necessary, obtain a new declaration of consent. Please send the revocation to: info@concept-box.de.

PDF Download of our Data Protection Statement [117 KB]