Information obligation according to Article 13 GDPR
- Legal bases
- Contact details of the data protection controller
- Storage Period
- Rights in accordance with the General Data Protection Regulation
- Data transfer to third countries
- Security of data processing operations
- TLS encryption
- Data Processing Agreement (DPA)
- Web hosting
- Payment providers
- Survey- and Poll Systems Overview
- Review Platforms Overview
In short: We provide you with comprehensive information about any personal data we process about you.
If you still have questions, we would like to ask you to contact the responsible body named below or in the imprint, to follow the existing links and to look at further information on third-party sites. You can of course also find our contact details in the imprint.
- all online presences (websites, online shops) that we operate
- Social media presences and email communication
- mobile apps for smartphones and other devices
Whenever EU law is concerned, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016. You can of course access the General Data Protection Regulation of the EU online at EUR-Lex, the gateway to EU law, at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679.
We only process your data if at least one of the following conditions applies:
- Consent (Article 6 para. 1 lit. a GDPR): You have given us your consent to process data for a specific purpose. An example would be the storage of data you entered into a contact form.
- Contract (Article 6 para. 1 lit. b GDPR): We process your data in order to fulfill a contract or pre-contractual obligations with you. For example, if we conclude a sales contract with you, we need personal information in advance.
- Legal obligation (Article 6 para. 1 lit. c GDPR): If we are subject to a legal obligation, we will process your data. For example, we are legally required to keep invoices for our bookkeeping. These usually contain personal data.
- Legitimate interests (Article 6 para. 1 lit. f GDPR): In the case of legitimate interests that do not restrict your basic rights, we reserve the right to process personal data. For example, we have to process certain data in order to be able to operate our website securely and economically. Therefore, the processing is a legitimate interest.
Other conditions such as making recordings in the interest of the public, the exercise of official authority as well as the protection of vital interests do not usually occur with us. Should such a legal basis be relevant, it will be disclosed in the appropriate place.
In addition to the EU regulation, national laws also apply:
- In Germany this is the Federal Data Protection Act (Bundesdatenschutzgesetz), in short BDSG.
Should other regional or national laws apply, we will inform you about them in the following sections.
Contact details of the data protection controller
If you have any questions about data protection, you will find the contact details of the responsible person or controller below:
Bornwiese 2, 21391 Reppenstedt, Germany
Phone: +49(0) 172 4333354
Legal Notice: https://marcelschaar.com/impressum/
It is a general criterion for us to store personal data only for as long as is absolutely necessary for the provision of our services and products. This means that we delete personal data as soon as any reason for the data processing no longer exists. In some cases, we are legally obliged to keep certain data stored even after the original purpose no longer exists, such as for accounting purposes.
If you want your data to be deleted or if you want to revoke your consent to data processing, the data will be deleted as soon as possible, provided there is no obligation to continue its storage.
We will inform you below about the specific duration of the respective data processing, provided we have further information.
Rights in accordance with the General Data Protection Regulation
In accordance with Articles 13, 14 of the GDPR, we inform you about the following rights you have to ensure fair and transparent processing of data:
- According to Article 15 DSGVO, you have the right to information about whether we are processing data about you. If this is the case, you have the right to receive a copy of the data and to know the following information:
- for what purpose we are processing;
- the categories, i.e. the types of data that are processed;
- who receives this data and if the data is transferred to third countries, how security can be guaranteed;
- how long the data will be stored;
- the existence of the right to rectification, erasure or restriction of processing and the right to object to processing;
- that you can lodge a complaint with a supervisory authority (links to these authorities can be found below);
- the origin of the data if we have not collected it from you;
- whether profiling is carried out, i.e. whether data is automatically evaluated to arrive at a personal profile of you.
- You have a right to rectification of data according to Article 16 GDPR, which means that we must correct data if you find errors.
- You have the right to erasure (“right to be forgotten”) according to Article 17 GDPR, which specifically means that you may request the deletion of your data.
- According to Article 18 of the GDPR, you have the right to restriction of processing, which means that we may only store the data but not use it further.
- According to Article 20 of the GDPR, you have the right to data portability, which means that we will provide you with your data in a standard format upon request.
- According to Article 21 DSGVO, you have the right to object, which entails a change in processing after enforcement.
- If the processing of your data is based on Art. 6 para. 1 lit. e (public interest, exercise of official authority) or Art. 6 para. 1 lit. f (legitimate interest), you may object to the processing. We will then check as soon as possible whether we can legally comply with this objection.
- If data is used to conduct direct advertising, you may object to this type of data processing at any time. We may then no longer use your data for direct marketing.
- If data is used to conduct profiling, you may object to this type of data processing at any time. We may no longer use your data for profiling thereafter.
- According to Article 22 of the GDPR, you may have the right not to be subject to a decision based solely on automated processing (for example, profiling).
- You have the right to lodge a complaint under Article 77 of the GDPR. This means that you can complain to the data protection authority at any time if you believe that the data processing of personal data violates the GDPR.
In short: you have rights – do not hesitate to contact the responsible party listed above with us!
If you believe that the processing of your data violates data protection law or your data protection rights have been violated in any other way, you can complain to the supervisory authority. In Germany, each federal state has its own data protection officer. For more information, you can contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI). The following local data protection authority is responsible for our company:
Lower Saxony Data protection authority
State Commissioner for Data Protection: Barbara Thiel
Address: Prinzenstraße 5, 30159 Hanover, Germany
Phone: 0511 / 120 - 45 00
Data transfer to third countries
We only transfer or process data to countries outside the EU (third countries) if you consent to this processing, if this is required by law or if it is contractually necessary. In any case, we generally only do so to the permitted extent. In most cases, your consent is the most important reason for data being processed in third countries. When personal data is being processed in third countries such as the USA, where many software manufacturers offer their services and have their servers located, your personal data may be processed and stored in unexpected ways.
We want to expressly point out, that according to the European Court of Justice, there is currently no adequate level of protection for data transfer to the USA. Data processing by US services (such as Google Analytics) may result in data processing and retention without the data having undergone anonymisation processes. Furthermore, US government authorities may be able to access individual data. The collected data may also get linked to data from other services of the same provider, should you have a user account with the respective provider. We try to use server locations within the EU, whenever this is offered and possible.
Security of data processing operations
In order to protect personal data, we have implemented both technical and organisational measures. We encrypt or pseudonymise personal data wherever this is possible. Thus, we make it as difficult as we can for third parties to extract personal information from our data.
Article 25 of the GDPR refers to “data protection by technical design and by data protection-friendly default” which means that both software (e.g. forms) and hardware (e.g. access to server rooms) appropriate safeguards and security measures shall always be placed. If applicable, we will outline the specific measures below.
TLS encryption with https
The terms TLS, encryption and https sound very technical, which they are indeed. We use HTTPS (Hypertext Transfer Protocol Secure) to securely transfer data on the Internet.
This means that the entire transmission of all data from your browser to our web server is secured – nobody can “listen in”.
We have thus introduced an additional layer of security and meet privacy requirements through technology design Art. 25 para. 1 GDPR). With the use of TLS (Transport Layer Security), which is an encryption protocol for safe data transfer on the internet, we can ensure the protection of confidential information.
You can recognise the use of this safeguarding tool by the little lock-symbol , which is situated in your browser’s top left corner in the left of the internet address (e.g. marcelschaar.com), as well as by the display of the letters “https” (instead of “http”) as a part of our web address.
If you want to know more about encryption, we recommend you to do a Google search for “Hypertext Transfer Protocol Secure wiki” to find good links to further information.
👥 Affected parties: Anyone who communicates with us via phone, email or online form
📓 Processed data: e. g. telephone number, name, email address or data entered in forms. You can find more details on this under the respective form of contact
🤝🏻 Purpose: handling communication with customers, business partners, etc.
📅 Storage duration: for the duration of the business case and the legal requirements
⚖️ Legal bases: Art. 6 para. 1 lit. a GDPR (consent), Art. 6 para. 1 lit. b GDPR (contract), Art. 6 para. 1 lit. f GDPR (legitimate interests)
If you contact us and communicate with us via phone, email or online form, your personal data may be processed.
The data will be processed for handling and processing your request and for the related business transaction. The data is stored for this period of time or for as long as is legally required.
The above-mentioned processes affect all those who seek contact with us via the communication channels we provide.
When you call us, the call data is stored in a pseudonymised form on the respective terminal device, as well as by the telecommunications provider that is being used. In addition, data such as your name and telephone number may be sent via email and stored for answering your inquiries. The data will be erased as soon as the business case has ended and the legal requirements allow for its erasure.
If you communicate with us via email, your data is stored on the respective terminal device (computer, laptop, smartphone, ...) as well as on the email server. The data will be deleted as soon as the business case has ended and the legal requirements allow for its erasure.
If you communicate with us using an online form, your data is stored on our web server and, if necessary, forwarded to our email address. The data will be erased as soon as the business case has ended and the legal requirements allow for its erasure.
Data processing is based on the following legal bases:
- Art. 6 para. 1 lit. a GDPR (consent): You give us your consent to store your data and to continue to use it for the purposes of the business case;
- Art. 6 para. 1 lit. b GDPR (contract): For the performance of a contract with you or a processor such as a telephone provider, or if we have to process the data for pre-contractual activities, such as preparing an offer;
- Art. 6 para. 1 lit. f GDPR (legitimate interests): We want to conduct our customer inquiries and business communication in a professional manner. Thus, certain technical facilities such email programs, Exchange servers and mobile network operators are necessary to efficiently operate our communications.
Data Processing Agreement (DPA)
In this section, we would like to explain what a Data Processing Agreement is and why it is needed. As the term “Data Processing Agreement” is quite lengthy, we will often only use the acronym DPA here in this text. Like most companies, we do not work alone, but also use the services of other companies or individuals. By involving different companies or service providers, we may pass on personal data for processing. These partners then act as processors with whom we conclude a contract, the so-called Data Processing Agreement (DPA). Most importantly for you to know is that any processing of your personal data takes place exclusively according to our instructions and must be regulated by the DPA.
Who are the processors?
As a company and website owner, we are responsible for any of your data that is processed by us. In addition to the controller, there may also be so-called processors involved. This includes any company or person who processes your personal data. More precisely and according to the GDPR’s definition, this means: Any natural or legal person, authority, institution or other entity that processes your personal data is considered a processor. Processors can therefore be service providers such as hosting or cloud providers, payment or newsletter providers or large companies such as Google or Microsoft.
To make the terminology easier to comprehend, here is an overview of the GDPR’s three roles:
Data subject (you as a customer or interested party) → Controller (we as a company and contracting entity) → Processors (service providers such as web hosts or cloud providers)
Contents of a Data Processing Agreement
As mentioned above, we have concluded a DPA with our partners who act as processors. First and foremost, it states that the processor processes the data exclusively in accordance with the GDPR. The contract must be concluded in writing, although an electronic contract completion is also considered a “written contract”. Any processing of personal data only takes place after this contract is concluded. The contract must contain the following:
- indication to us as the controller
- obligations and rights of the controller
- categories of data subjects
- type of personal data
- type and purpose of data processing
- subject and duration of data processing
- location of data processing
Furthermore, the contract contains all obligations of the processor. The most important obligations are:
- ensuring data security measures
- taking possible technical and organisational measures to protect the rights of the data subject
- maintaining a data processing record
- cooperation with the data protection authority upon request
- performing a risk analysis for any received personal data
- subprocessors may only be appointed with the written consent of the controller
You can see an example of what a DPA looks like at https://www.wko.at/service/wirtschaftsrecht-gewerberecht/eu-dsgvo-mustervertrag-auftragsverarbeitung.html. This link shows a sample contract.
Web hosting Overview
👥 Affected parties: visitors to the website
🤝🏻 Purpose: professional hosting of the website and security of operations
📓 Processed data: IP address, time of website visit, browser used and other data. You can find more details on this below or at the respective web hosting provider.
📅 Storage period: dependent on the respective provider, but usually 2 weeks
⚖️ Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interests)
What is web hosting?
Every time you visit a website nowadays, certain information – including personal data – is automatically created and stored, including on this website. This data should be processed as sparingly as possible, and only with good reason. By website, we mean the entirety of all websites on your domain, i.e. everything from the homepage to the very last subpage (like this one here). By domain we mean example.uk or examplepage.com.
When you want to view a website on a screen, you use a program called a web browser. You probably know the names of some web browsers: Google Chrome, Microsoft Edge, Mozilla Firefox, and Apple Safari.
The web browser has to connect to another computer which stores the website’s code: the web server. Operating a web server is complicated and time-consuming, which is why this is usually done by professional providers. They offer web hosting and thus ensure the reliable and flawless storage of website data.
Whenever the browser on your computer establishes a connection (desktop, laptop, smartphone) and whenever data is being transferred to and from the web server, personal data may be processed. After all, your computer stores data, and the web server also has to retain the data for a period of time in order to ensure it can operate properly.
Why do we process personal data?
The purposes of data processing are the following:
- Professional hosting of the website and operational security
- To maintain the operational as well as IT security
- Anonymous evaluation of access patterns to improve our offer, and if necessary, for prosecution or the pursuit of claims
Which data are processed?
Even while you are visiting our website, our web server, that is the computer on which this website is saved, usually automatically saves data such as
- the full address (URL) of the accessed website
- browser and browser version (e.g. Chrome 87)
- the operating system used (e.g. Windows 10)
- the address (URL) of the previously visited page (referrer URL) (e. g. https://www.examplepage.uk/icamefromhere.html/)
- the host name and the IP address of the device from the website is being accessed from (e.g. COMPUTERNAME and 184.108.40.206)
- date and time
- in so-called web server log files
How long is the data stored?
Generally, the data mentioned above are stored for two weeks and are then automatically deleted. We do not pass these data on to others, but we cannot rule out the possibility that this data may be viewed by the authorities in the event of illegal conduct.
In short: Your visit is logged by our provider (company that runs our website on special computers (servers)), but we do not pass on your data without your consent!
The lawfulness of processing personal data in the context of web hosting is justified in Art. 6 para. 1 lit. f GDPR (safeguarding of legitimate interests), as the use of professional hosting with a provider is necessary to present the company in a safe and user-friendly manner on the internet, as well as to have the ability to track any attacks and claims, if necessary.
Data Processing Agreement (DPA) STRATO
In accordance with Article 28 of the General Data Protection Regulation (GDPR), we have entered into a Data Processing Agreement (DPA) with STRATO. What exactly a DPA is and especially what must be included in a DPA, you can read in our general section “Data Processing Agreement (DPA)”.
This contract is required by law because STRATO processes personal data on our behalf. It clarifies that STRATO may only process data they receive from us according to our instructions and must comply with the GDPR.
👥 Affected parties: visitors to the website
🤝🏻 Purpose: To enable and optimise the payment process on our website
📓 Processed data: data such as name, address, bank details (account number, credit card number, passwords, TANs, etc.), IP address and contract data.
You can find more details on this directly from the payment provider tool that is being used.
📅 Storage period: depending on the payment provider that is being used
⚖️ Legal basis: Art. 6 para. 1 lit. b GDPR (performance of a contract)
What is a payment provider?
On our website we use online payment systems, which enable us as well as you to have a secure and smooth payment process available. Among other things, personal data may also be sent to the respective payment provider, where it may also be stored and processed. Payment providers are online payment systems that enable you to place an order via online banking. The payment processing is carried out by the payment provider of your choice. We will then receive information about the payment. This method can be used by any user who has an active online banking account with a PIN and TAN. There are hardly any banks that do not offer or accept such payment methods.
Why do we use payment providers on our website?
With both our website and our embedded online shop, we of course want to offer you the best possible service, so you can feel comfortable on our site and take advantage of our offers. We know that your time is valuable and that payment processing in particular has to work quickly and smoothly. Thus, we offer various payment providers. You can choose your preferred payment provider and pay in the usual way.
Which data are processed?
What exact data that is processed of course depends on the respective payment provider. However, generally data such as name, address, bank details (account number, credit card number, passwords, TANs, etc.) do get stored. This data is necessary for carrying out any transactions. In addition, any contract data and user data, such as when you have visited our website, what content you are interested in or which sub-pages you have clicked, may also be stored. Most payment providers also store your IP address and information about the computer you are using.
Duration of data processing
Provided we have further information on this, we will inform you below about the duration of the processing of your data. In general, we only process personal data for as long as is absolutely necessary for providing our services and products. This storage period may be exceeded however, if it is required by law, for example for accounting purposes. We keep any accounting documents of contracts (invoices, contract documents, account statements, etc.) for 10 years (Section 147 AO) and other relevant business documents for 6 years (Section 247 HGB).
Right to object
You can erase, deactivate or manage cookies in your browser, that payment providers use for their functions. How this works differs a little depending on which browser you are using. Please note, however, that the payment process may then no longer work.
Provided it is available, you can find information on the special payment providers in the following sections.
On our website we use the online payment service PayPal. The provider of this service is the American company PayPal Inc. The responsible entity for the European region is the company PayPal Europe (S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg).
PayPal also processes data in the USA, among other countries. We would like to note, that according to the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. This can be associated with various risks to the legality and security of data processing.
PayPal uses standard contractual clauses approved by the EU Commission as basis for data processing by recipients based in third countries (outside the European Union, Iceland, Liechtenstein, Norway and especially in the USA) or data transfer there (= Art. 46, paragraphs 2 and 3 of the GDPR). These clauses oblige PayPal to comply with the EU level of data protection when processing relevant data outside the EU. These clauses are based on an implementing order by the EU Commission. You can find the order and the clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=en.
Survey- and Poll Systems Overview
Survey- and Poll Systems Overview
👥 Affected parties: website visitors
🤝🏻 Purpose: Evaluation of surveys on the site
📓 Processed data: contact details, device data, access duration and time, IP addresses. You can find more details directly at the respective survey and poll systems.
📅 Storage duration: depending on the tool that is used
⚖️ Legal bases: Art. 6 para. 1 lit. a GDPR (consent), Art. 6 para. 1 lit. f GDPR (legitimate interests)
What are survey and poll systems?
We are eager to conduct various surveys and polls via our website. These are always evaluated anonymously. A survey or poll system is a tool embedded on our website that can ask you questions (e.g. about our products or services) which you can answer if you would like to participate. Your answers will always be evaluated anonymously. However, after your consent to data processing, your personal data may also be stored and processed.
Why do we use survey and poll systems?
We aim to offer you the best products and services in our industry. With the help of surveys, we can get your valuable feedback and find out what you expect from us and our services. Based on these anonymous evaluations, we can adapt our products and services to your wishes and ideas. Furthermore, the information also helps us to direct our advertising and marketing measures towards people who are really interested in our offer.
Which data is processed?
First of all, your personal data will only be processed if it is either necessary for the technical implementation, or if you have consented to your data being processed. In the instance of your data being processed, e.g. your IP address will be stored, which enables the survey to be displayed in your browser. Cookies may also be used so you can easily continue your survey at a later point in time.
If you have consented to the data processing, your contact data such as email address or telephone number may be processed in addition to your IP address. Any data that you enter in an online form is also stored and processed for example. Some providers also store information about the web pages you visited (on our website), when you started and ended the survey, along with various technical information about your computer.
How long is data stored?
How long your data is processed and stored depends primarily on the tools we use. Below you can find out more about the data processing of individual tools. The Privacy Policies of the providers usually state exactly which data is stored and processed and for how long. In principle, personal data is only processed for as long as is necessary to provide our services. When data is stored in cookies, the storage period varies greatly. This data could be deleted immediately after leaving a website, but it could also be stored for several years. Therefore, if you want to know more about data storage, you should look at each individual cookie in detail. In most cases, you will also find information on the individual cookies in the respective provider’s Privacy Policies.
Right to object
You should read the Privacy Policies of the respective tools to find out exactly which of your data is stored and processed.
The use of survey systems requires your consent, which we have obtained with our cookie pop-up. According to Art. 6 para. 1 lit. a GDPR (consent) this consent represents the legal basis for the processing of personal data, as it may occur when collected by survey and poll systems.
In addition to consent, we have a legitimate interest in conducting surveys on our theme. The legal basis for this is Art. 6 para. 1 lit. f GDPR (legitimate interests). However, we only use thesetools if you have given your consent.
You can find information on the individual survey systems – if available – in the following sections.
We use Google Forms for our website, which is a service for Google Cloud Forms. The provider of this service is the American company Google Inc. The responsible entity for all Google services in the European area is Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland).
Google also processes data in the USA, among other countries. We would like to note, that according to the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. This can be associated with various risks to the legality and security of data processing.
Google uses standard contractual clauses approved by the EU Commission as the basis for data processing by recipients based in third countries (i. e. outside the European Union, Iceland, Liechtenstein, Norway, and thus especially in the USA) or data transfer there (= Art. 46, paragraphs 2 and 3 of the GDPR). Standard Contractual Clauses (SCC) are legal templates provided by the EU Commission. Their purpose is to ensure that your data complies with European data privacy standards, even if your data is transferred to and stored in third countries (such as the USA). With these clauses, Google commits to comply with the EU level of data protection when processing relevant data, even if it is stored, processed and managed in the USA. These clauses are based on an implementing order by the EU Commission. You can find the order and the standard contractual clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=en
You can find Google Ads Data Processing Terms, which correspond to the standard contractual clauses as well as to Google Forms at https://business.safety.google/adsprocessorterms/.
Review Platforms Overview
Review Platforms Overview
👥 Affected parties: Website or rating platform visitors
🤝🏻 Purpose: Feedback on our products and/or services
📓 Processed data: IP address, email address and name, among other things. You can find more details below or directly on the respective review platforms.
📅 Storage duration: depends on the respective platform
⚖️ Legal bases: Art. 6 para. 1 lit. a GDPR (consent), Art. 6 para. 1 lit. f GDPR (legitimate interests)
What are review platforms?
Many of these integrated programs work on a similar principle. After you have ordered one of our products or used one of our services, you will be asked to submit a review via email or on the website. You will usually be redirected to a review page via a link, where you can quickly and easily create a review. Some review systems also offer an interface to various social media channels in order to make the feedback accessible to more people.
Why do we use review platforms?
Review platforms collect feedback and ratings about our offer. Your ratings help us to quickly receive appropriate feedback. We can use this valuable input to improve our products and/or services much more efficiently. Therefore, on the one hand, ratings help us to optimise our offers. On the other hand, they give you and all our future customers a good overview of the quality of our products and services.
Which data is processed?
If we have your consent, we transmit information about you and the services you have used to the relevant review platform. We do this to ensure that you have genuinely used one of our services. Only then can you give real feedback. The transmitted data is only used to identify the user. The exact data that is stored and processed of course depends on the providers used. Personal data such as IP address, email address or your name are usually also made available to the rating platforms. Specific order information such as the order number of a purchased item will also be forwarded to the appropriate platform after you have submitted your review. If your email address is transmitted, this is done in a form that allows the review platform to send you an email after purchasing a product. In order to integrate your review to our website as well, we also inform the providers that you have accessed our site. The respective review platform that is used is responsible for any personal data collected.
How long and where is the data stored?
Right to object
If you have agreed that an evaluation platform may be used, the legal basis for the corresponding data processing is this consent. According to Art. 6 para. 1 lit. a of the GDPR (consent) represents the legal basis for the processing of personal data, as may occur when it is collected by a review portal.
We also have a legitimate interest in using a review platform to optimise our online service. The corresponding legal basis for this is Art. 6 para. 1 lit. f GDPR (legitimate interests). However, we only use any given review platform if you have consented to it.
On our website we use Google Fonts, by the company Google Inc. The responsible entity for the European area is Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland). We have integrated Google fonts locally, i.e. on our web server and not on Google’s servers. This means that no connection to Google’s servers and therefore no data transfer or retention take place.
What are Google Fonts?
Google Fonts was previously called Google Web Fonts. It is an interactive list with over 1.400 fonts which Google offer for free use. With the use of Google Fonts, it is possible to utilise fonts without uploading them to your own server. In order to prevent any transfer of information to Google’s servers, we downloaded the fonts to our own server. This way we can comply with data privacy and do not transmit any data to Google Fonts.
We use Calendly, a planning and organization tool, for our website. The service provider is the American company Calendly LCC, 271 17th St NW, Ste 1000, Atlanta, Georgia, 30363, USA.
Calendly also processes data in the USA, among other countries. We would like to note, that according to the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. This can be associated with various risks to the legality and security of data processing.
Calendly uses standard contractual clauses approved by the EU Commission as the basis for data processing by recipients based in third countries (i. e. outside the European Union, Iceland, Liechtenstein, Norway, and thus especially in the USA) or data transfer there (= Art. 46, paragraphs 2 and 3 of the GDPR). Standard Contractual Clauses (SCC) are legal templates provided by the EU Commission. Their purpose is to ensure that your data complies with European data privacy standards, even if your data is transferred to and stored in third countries (such as the USA). With these clauses, Calendly commits to comply with the EU level of data protection when processing relevant data, even if it is stored, processed and managed in the USA. These clauses are based on an implementing order by the EU Commission. You can find the order and the standard contractual clauses here: https://germany.representation.ec.europa.eu/index_de?etrans=en
All texts are copyrighted.