Privacy Policy - Information on processing of personal data

Data protection law obliges us, as the entity responsible for data processing, to ensure the protection of your personal data through a variety of measures. One of these obligations is to inform you transparently about the type, scope, purpose, duration and legal basis of the data processing (cf. Art. 13 and 14 EU-DSGVO). In the following, we also address you as the person affected by the data processing with "customer", "user", "you" or "data subject". In this privacy policy, we inform you about how your personal data is processed by us.

Our privacy policy has a modular structure. It consists of a general part for any processing of personal data and processing situations that come into play and a special part, the content of which relates in each case only to the processing situation specified there. It is possible that we will use this online document to also inform you about processing operations that do not primarily take place on the website. You will find these in the special section of the document. If you wish to navigate quickly in the document, many browsers offer a search function via the key combination "CTRL key+f".

"Personal data" (Art. 4 No. 1 EU GDPR) means any information relating to an identified or identifiable natural person ("data subject"). A person is identifiable if he or she can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, an online identifier, location data or by means of information relating to his or her physical, physiological, genetic, mental, economic, cultural or social identity characteristics. The identifiability can also be given by means of a linkage of such information or other additional knowledge. The origin, form or embodiment of the information is irrelevant (photographs, video or audio recordings may also contain personal data).

"Processing" (Art. 4 No. 2 EU GDPR) means any operation which involves the handling of personal data, whether or not by means of automated (i.e. technology-based) processes. This includes, in particular, collection (i.e., acquisition), recording, organization, arrangement, storage, adaption or modification, readout, query, use, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, deletion or destruction of personal data, as well as the change of a purpose or intended use on which a data processing was originally based.

 "Controller" (Art. 4 No. 7 EU GDPR) means the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data.

"Third party" (Art. 4 No. 10 EU GDPR) means any natural or legal person, public authority, agency or other body other than the data subject, the controller, the processor and the persons who are authorized to process the personal data under the direct responsibility of the controller or processor."

Processor" (Art. 4 No. 8 EU GDPR) is a natural or legal person, authority, institution or other body that processes personal data on behalf of the controller, in particular in accordance with the controller's instructions (e.g. IT service provider). In particular, a processor is not a third party in the sense of data protection law.

"Consent" (Art. 4 No. 11 EU GDPR) of the data subject means any freely given, specific, informed and unambiguous indication of his or her wishes in the form of a statement or other unambiguous affirmative act by which the data subject signifies his or her agreement to the processing of personal data relating to him or her.

You can reach the data protection team

- By mail at our address given in the imprint with the addition "data protection team".

- By e-mail at datenschutz@boso.de

Art. 6 para. 1 lit. a EU GDPR ("consent"): If the data subject has voluntarily, in an informed manner and unambiguously indicated by means of a statement or other unambiguous affirmative act that he or she consents to the processing of personal data concerning him or her for one or more specific purposes;

Art. 6 para. 1 lit. b EU GDPR ("Contract"): if the processing is necessary for the fufillment of a contract to which the data subject is party or for the performance of pre-contractual measures taken at the data subject's request;

Art. 6 para. 1 lit. c EU GDPR ("legal obligation"): If processing is necessary for compliance with a legal obligation to which the controller is subject (e.g. a legal obligation to keep records);

Art. 6 para 1 lit. d EU GDPR: When processing is necessary to protect the vital interests of the data subject or another natural person;

Art. 6 para. 1 lit. e EU GDPR: Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; or

Art. 6 para. 1 lit. f EU GDPR ("Legitimate Interests"): If the processing is necessary to protect the legitimate (in particular legal or economic) interests of the controller or a third party, unless the conflicting interests or rights of the data subject override (in particular if the data subject is a minor). Insofar as the processing of personal data is based on Art. 6 para. 1 lit. f EU GDPR, the aforementioned purposes also constitute our legitimate interests.

For secure data transmission on the Internet, we use the hybrid encryption protocol Transport Layer Security (TLS), more widely known by its predecessor name Secure Sockets Layer Software (SSL). This software encrypts the information that is transmitted by you. All information relevant to data protection is stored in encrypted form in a protected database.

We would like to point out that the confidentiality of e-mail cannot be proven. Although we offer transport encryption (TLS) via our mail servers, confidentiality may depend on various mail relay servers over which we have no control: Whether these also use TLS and whether they evaluate the emails is beyond our control.

When you send us a fax, the transmission takes place via the Internet Protocol (FoIP). The transmission is technically identical to sending an e-mail or web page data. We do not know if an IP-based service encrypts data accordingly the confidentiality of the sent data is not guaranteed. We do not recommend sending sensitive data by fax.

Your data will only be processed for as long as is necessary to achieve the above-mentioned processing purposes; the legal bases stated in the context of the processing purposes apply accordingly. Third parties engaged by us will store your data on their system for as long as is necessary in connection with the provision of the services for us in accordance with the respective order.

The following categories of recipients, which are usually processors, may receive access to your personal data:

Service providers for the operation of our website and the processing of data stored or transmitted by the systems (e.g. for data center services, payment processing, IT security). The legal basis for the transfer is then Art. 6 para. 1 lit. b or lit. f EU GDPR, insofar as they are not order processors;

Government agencies/authorities, insofar as this is necessary to fulfill a legal obligation. The legal basis for the disclosure is then Art. 6 para. 1 lit. c EU GDPR;

Persons employed to carry out our business operations (e.g. auditors, banks, insurance companies, legal advisors, supervisory authorities, parties involved in company acquisitions or the establishment of joint ventures). The legal basis for the disclosure is then Art. 6 para. 1 lit. b or lit. f EU GDPR.

In addition, we will only disclose your personal data to third parties if you have given your express consent to do so in accordance with Art. 6 (1) a EU-DSGVO.

- the page from which the page was requested (so-called referrer URL)

- the name and URL of the requested page

- the date and time of the request

- the description of the type, language and version of the web browser used

- the IP address of the requesting computer

- the amount of data transferred

- the operating system

- the message whether the call was successful (access status/HTTP status code)

- the GMT time zone difference

The processing of the log data serves statistical purposes and the improvement of the quality of our website, in particular the stability and security of the connection (legal basis is Art. 6 para. 1 lit. f EU GDPR).

Cookies and other services may contain data that make it possible to recognize the device used. In some cases, cookies and other technologies only contain information about certain settings, which are not personally identifiable.

You can reject or technically prevent some services, provided that your browser allows this. However, we would like to point out that in this case you will not be able to use all functions of our website to their full extent.

The help function in the menu bar of most web browsers explains, for example, how to prevent your browser from accepting new cookies, how to let your browser know when you receive a new cookie, or even how to delete all received cookies. You can also change your browser so that special technologies are not executed in your browser (e.g. JavaScript), which require the services. Insofar as the services on our websites process personal data on the basis of Art. 6 para. 1 lit. f EU GDPR; the objection can thus be implemented technically via these browser functions and technologies.

With regard to their function, services are again distinguished between:

Technical services: these are mandatory to move around the website, use basic functions and ensure the security of the website; they do not collect information about you for marketing purposes, nor do they store which web pages you have visited;

Performance Service: these collect information about how you use our website, which pages you visit and, for example, whether errors occur during website use; they do not collect information that could identify you - all information collected is anonymous and is used only to improve our website and to find out what interests our users;

Advertising, Targeting & Sharing services, social media plugins: These are used to offer website users tailored advertising on the website or third-party offers and to measure the effectiveness of these offers. These services may also serve to improve the interactivity of our website with other services (e.g. social networks).

Common to all services is that they store information on your terminal device and/or access information that is already stored on your terminal device.

In contrast to the functional distinction of services, the legislation distinguishes only between two purposes of services:

1. Services necessary to carry out the transmission of a message via a public telecommunications network and/or absolutely necessary for the provider of a telemedia service to be able to provide a telemedia service expressly requested by the user. Necessity may be based on technical, legal, economic, operational and/or contractual agreements.

2. Services for all other purposes.

The service sets a necessary cookie. The following information is stored there:

When you enter our website, the following personal data is transmitted to Consent Management: consent(s) or the revocation of consent(s), IP address, information about the browser and the end device, time of the visit to the website. Furthermore, Consent Management stores a cookie in order to be able to assign the consents given or their revocation. The data collected in this way is stored until we are requested to delete it or the Typo3 Extension Cookie Consent cookies are deleted by the user or the purpose for data storage no longer applies.

Processing will only take place if you have given your consent in accordance with Art. 6 (1) a EU-DSGVO. Additional information on this possible processing can be found in the consent query within the consent management tool.

Provided consent is given, we can be reloaded with the Google Tag Manager JavaScript instructions and other servicee. In the process, information is transferred to Google servers and stored there. Server locations are also in the USA. Google may pass this information on to contractual partners. More information about the Google Tag Manager can be found at https://www.google.com/analytics/terms/tag-manager/ 

The legal basis for this is Article 6 Paragraph 1 Letter f EU GDPR. Our legitimate interest lies in the technically error-free presentation and optimization of the website.

The service provides tools that enable us to create surveys and forms and integrate them on our website. These tools are used to conduct surveys on various topics on our website. We can use the forms to create inquiries and information on any topic and integrate them into the website. These forms and surveys can be filled out resp. answered by you as a website visitor. In the course of visiting the website and filling out or answering the surveys or forms, personal data of you as a website visitor will be processed. In particular, this involves your IP address and other data entered by you as a website visitor in the forms or as part of surveys. This personal data is processed by the website operator and by the provider of the survey or form tool.

easyfeedback is a processor for us (see section "Cooperation with processors") and uses the legal basis of the controller.

The legal basis for this processing is consent (Art. 6 para. 1 lit. a EU GDPR). Additional information on this possible processing can be found in the consent query in the consent management tool or before participating in surveys.

When you contact us by phone, we collect caller identification information (caller ID). So, if your phone number is not suppressed or withheld, we will see the phone number from which you call us. The phone number, call date and call time are automatically stored by our phone system and are only used to call you back if you have requested us to do so or if your call is dropped due to technical problems. This data is deleted after 4 weeks at the latest. We do not record calls.

If you contact us by e-mail, this will be stored and used for the purpose you have communicated to us in the e-mail (e.g. product order).

The same applies to contact by fax.

If you order products from us or request information material, we will create a customer account for you. The customer account contains the following data:

- The name and contact details of the company for which you are placing the order

- Your first and last name as contact person

- For each order processed through this customer account we store:

- Date of order and delivery

- ordered products

- current order status

The operation of the app can be implemented autonomously from the application on the end device or in combination with a background system (cloud computing). It can be a native app that is tailored to a platform and operating system (e.g. Android or iOS) or a web application as well as a combination of both (hybrid apps). Web applications, usually websites, are operated on a local system without installation. Such websites are usually programmed in such a way that they look like a native application and behave in a similar way (also known as a "progressive web app"). They are typically programmed with HTML5, CSS3 and JavaScript.

Irrespective of the app's functions and technical processing procedures, users' personal data is regularly transferred to the app store operator when the app is downloaded from the app store (e.g. Apple App Store or Google Play). The app store operator is responsible under data protection law for the transfer of this data, in particular payment and purchase data.

When the app establishes an Internet connection and accesses a server, a comparable log data record (so-called server log files) is created as for a website, see section "Processed personal data on the website/log data".

Mobile devices have a device identification number with which they can be uniquely identified (e.g. UDID for Apple, DeviceID for Android). The app can also collect information such as the IMEI, which is unique worldwide and can be assigned to connections by network operators.

When using an app with an internet connection, further data is typically transmitted, which can vary greatly depending on the function. This data is set out below for each app. There are also many apps that do not require an internet connection, apart from being obtained via an app store or a website. Such an app does not establish any contact with servers and therefore does not transmit any data. If this feature applies, this is noted in the information on the respective app.