Data privacy

Privacy Notice in accordance with Art. 13 GDPR

This Privacy Notice explains the purposes for which we process the personal data we collect from you. “Personal data” means any information relating to an identified or identifiable natural person. The General Data Protection Regulation (GDPR) refers to this person as the “data subject”.

Controller
below1 GbR, An der Alster 1, 20099 Hamburg, Germany is responsible for the processing of your personal data.

Data privacy contact
Please contact us any time at the following e-mail address for any questions regarding data privacy: datenschutz@below1.de. Questions regarding data privacy may also be sent to the above business address.

Purposes of the data processing

Contacting us
You have the option of contacting us via the e-mail address provided in our legal notice. In this case, contact is made exclusively via the e-mail program used by you. The personal data you provide to us when making contact in this way will be processed by us for the purpose communicated by you in your message.

Use of Google Analytics
Subject to your consent when visiting our website, we make use of Google Analytics for our online presence. This is a web analysis service provided by Google Inc. (“Google”) to statistically evaluate the use made of our site by our visitors. Google Analytics uses “cookies”, which are text files that are saved on your computer and make it possible to analyze how you use the website. The information collected by the cookies regarding your use of the website is generally transferred to a Google server in the USA, where it is saved. If IP anonymization is activated on this website, however, your IP address is first shortened by Google within European Union Member States or other states that are party to the Agreement on the European Economic Area. Only in exceptional cases, the full IP address is transferred to a Google server in the USA and shortened there. At the request of the website operator, Google uses this information to evaluate your use of the website, compile reports on website activity, and to provide further services to the website operator in relation to the use of the website and the Internet. The IP address provided by your browser in connection with the use of Google Analytics is not pooled with other Google data. You can prevent cookies being saved through corresponding settings in your browser software. Please note, however, that in this case you may not be able to make full use of all of the website’s functions. In addition, you can prevent the data created by the cookies and related to your use of the website (incl. your IP address) being recorded and processed by Google by downloading and installing the bowser plugin available at the following link. The current link is: http://tools.google.com/dlpage/gaoptout?hl=de

Legal basis for the above processing
Art. 6(1)(1)(a) GDPR for data processing to which you have given your consent.
Art. 6(1)(1)(b) GDPR for data processing necessary for the performance of contracts entered into with you, or – if you have made contact with us – in order to take any steps at your request prior to entering into a contract.
Art. 6(1)(1)(c) GDPR for data processing that is necessary for compliance with a legal obligation to which below1 is subject – for example, data retention obligations under commercial and tax law.
Art. 6(1)(1)(f) GDPR for data processing in which we have a legitimate interest. In accordance with this provision, the processing of personal data is lawful if required to protect the legitimate interests of the controller, namely below1, or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, namely you.

Storage duration/storage criteria
below1 stores your personal data until the purpose for which it is being processed (see → Purposes of the data processing) no longer applies. If below1 is legally required to store your personal data, the data will be stored for the duration of the legal requirement. For commercial documents, which include accounts and records (including invoices), this period is ten years (Section 257(4) of the German Commercial Code, Handelsgesetzbuch). Where appropriate, your data will be made inaccessible for day-to-day operations during this period, provided that there is no other purpose for the processing.

Rights of the data subject

Rights under Art. 15–18 and 20 GDPR
You have the right, at reasonable intervals, to obtain information from us about your stored personal data (Art. 15 GDPR). This information relates to whether or not below1 has stored your personal data and, among other things, the specific data concerned and the purposes for which the data is processed. On request, below1 will provide you with a copy of the data undergoing processing.

Furthermore, you have the right to obtain from below1 rectification of inaccurate personal data (Art. 16 GDPR).

You also have the right to obtain from below1 erasure of your personal data (Art. 17 GDPR). We are obliged to erase your personal data if, among other reasons, the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed, you withdraw previously granted consent, or the data has been unlawfully processed.

In certain circumstances, you have the right to restrict the processing of your personal data (Art. 18 GDPR). This applies if you have contested the accuracy of your personal data and we need to verify the legitimacy of your objection. In such cases, with the exception of data storage, we will refrain from further processing your personal data until the question of accuracy has been resolved.

Should you wish to change to another advertising agency, you have the right to receive the data we have obtained from you with your consent or based on a contractual relationship with you or – should you wish – to have such data transmitted to a third party in machine-readable format (Right to data portability, Art. 20 GDPR).

No contractual or legal requirement to provide data/consequences of not providing data
You are under no contractual or legal obligation to provide us with your personal data. Please be aware, however, that you cannot enter into any contract for our services if we are not able to collect and process the data we require for the specified purposes (see → Purposes of the data processing).

Right to object at any time under Art. 21 GDPR
If the processing of your data by below1 relates to the performance of a task that is in the public interest or carried out in the exercise of official authority (Art. 6(1)(1)(e) GDPR), or if the data processing is carried out in the legitimate interests of below1, you have the right to object to the processing of your personal data at any time on grounds relating to your particular situation. below1 will then cease processing your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests in terminating processing. You may object to the processing of your personal data for direct marketing purposes at any time without restriction.

Right to withdraw consent at any time
If the processing of data by below1 is based on your consent, you have the right to withdraw the consent granted to us at any time. The withdrawal of consent does not affect the lawfulness of the processing carried out based on consent until the time of withdrawal.

Right to complain to the competent supervisory authority
You have the right to lodge a complaint with a supervisory authority. The competent supervisory authority for below1 can be reached at the following address:

Der Hamburgische Beauftragte für den Datenschutz (Hamburg Data Protection Commissioner)
Klosterwall 6
20095 Hamburg, Germany
Tel.: +49 40 428544040

Version: May 2018