PRIVACY POLICY

Introduction

With the following privacy policy, we would like to inform you which types of your personal data (hereinafter also referred to simply as “data”) we process, for which purposes and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and, in particular, on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as the “online offering”).

The terms used are not gender-specific.

Status: 16 November 2020

Contents

• Introduction
• Controller
• Overview of processing activities
• Relevant legal bases
• Security measures
• Transfer and disclosure of personal data
• Data processing in third countries
• Use of cookies
• Provision of the online offering and web hosting
• Contacting us
• Online marketing
• Plugins and embedded functions and content
• Deletion of data
• Amendments and updates to this privacy policy
• Rights of data subjects
• Definitions

Controller

Virobuster International GmbH
Eduard-Rhein-Straße 52
53639 Königswinter (Oberpleis)
Telephone: +49 (0) 2244 8440 300

Authorised representatives: Thomas Rous, Fahmi Yigit, Herman Nanninga

Email address: info@virobuster.com

Overview of processing activities

Types of data processed

• Inventory data (e.g. names, addresses)
• Content data (e.g. entries in online forms)
• Contact data (e.g. email, telephone numbers)
• Meta/communication data (e.g. device information, IP addresses)
• Usage data (e.g. websites visited, interest in content, access times)
• Location data (information on the geographical position of a device or a person)

Categories of data subjects

• Prospective customers
• Communication partners
• Users (e.g. website visitors, users of online services)

Purposes of processing

• Provision of our online offering and user-friendliness
• Conversion measurement (measuring the effectiveness of marketing measures)
• Content Delivery Network (CDN)
• Interest-based and behavioural marketing
• Enquiries and communication
• Profiling (creating user profiles)
• Remarketing
• Reach measurement (e.g. access statistics, recognition of returning visitors)
• Security measures
• Tracking (e.g. interest-/behaviour-based profiling, use of cookies)
• Performance of contractual services and customer service
• Administration and response to enquiries

Relevant legal bases

Below we inform you of the legal bases of the General Data Protection Regulation (GDPR) on which we process personal data. Please note that, in addition to the provisions of the GDPR, the national data protection provisions in your or our country of residence and registered office may also apply. If, in individual cases, more specific legal bases are relevant, we will inform you of these in this privacy policy.

• Consent (Art. 6 (1) sentence 1 (a) GDPR): The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Performance of a contract and pre-contractual enquiries (Art. 6 (1) sentence 1 (b) GDPR): Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.
• Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR): Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.

Security measures

We take appropriate technical and organisational measures in accordance with the legal requirements, taking into account the state of the art, implementation costs and the nature, scope, circumstances and purposes of processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, in order to ensure a level of security appropriate to the risk.

Measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access, input, transfer, availability safeguards and separation of the data. Furthermore, we have established procedures that ensure the exercise of data subjects’ rights, the deletion of data and responses to data threats. We also take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design and by default.

Transfer and disclosure of personal data

In the course of our processing of personal data, it may happen that data is transferred to other entities, companies, legally independent organisational units or persons, or disclosed to them. Recipients of this data may include, for example, payment institutions in the context of payment transactions, service providers commissioned with IT tasks, or providers of services and content that are integrated into a website.

In such cases, we comply with the legal requirements and, in particular, conclude corresponding contracts or agreements with the recipients of your data that serve to protect your data.

Data processing in third countries

If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if processing takes place in the context of the use of services of third parties or the disclosure or transfer of data to other persons, bodies or companies, this is done only in accordance with legal requirements.

Subject to explicit consent or transfer required by contract or law, we process or have the data processed only in third countries with a recognised level of data protection, on the basis of contractual obligations through so-called standard contractual clauses of the EU Commission, where certifications are in place, or on the basis of binding corporate rules.

Further information: EU Commission – International dimension of data protection

Use of cookies

Cookies are text files that contain data from visited websites or domains and are stored by a browser on the user’s computer. A cookie primarily serves to store information about a user during or after their visit within an online offering. The information stored may include, for example, language settings on a website, login status, a shopping basket or the position at which a video was watched. We also include other technologies that fulfil the same functions as cookies (e.g. user IDs) under the term cookies.

Types of cookies and functions

• Temporary cookies (session cookies): Deleted at the latest after a user has left an online offering and closed their browser.
• Permanent cookies: Remain stored even after the browser is closed (e.g. login status, preferred content).
• First-party cookies: Set by us.
• Third-party cookies: Mainly used by third parties (e.g. advertisers).
• Necessary cookies: Absolutely essential for the operation of a website (e.g. logins, security).
• Statistics, marketing and personalisation cookies: Used for reach measurement or tracking users’ interests.

Notes on legal bases

The processing of personal data by means of cookies is based either on your consent (Art. 6 (1) sentence 1 (a) GDPR) or on our legitimate interests (Art. 6 (1) sentence 1 (f) GDPR), for example to improve our online offering or to fulfil a contract.

Storage duration

Unless specific information is provided, the storage period for permanent cookies is up to two years.

Withdrawal and objection (opt-out)

You can withdraw your consent at any time or object to processing. This is possible via your browser settings (e.g. disabling cookies) or via the following opt-out pages:

• https://optout.aboutads.info
• https://www.youronlinechoices.com/

Cookie processing with consent

Before using non-essential cookies, we request your explicit consent, which you may withdraw at any time. Without your consent, we use only technically necessary cookies.

Types of data processed

• Usage data (e.g. websites visited, interest in content, access times)
• Meta/communication data (e.g. device information, IP addresses)

Data subjects

• Users (e.g. website visitors, users of online services)

Legal bases

• Consent (Art. 6 (1) sentence 1 (a) GDPR)
• Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR)

Provision of the online offering and web hosting

To provide our online offering securely and efficiently, we use the services of one or more web hosting providers. These provide infrastructure, platform, storage, database, security and maintenance services.

In this context, all user data that arises in the course of use and communication may be processed, in particular IP addresses, in order to display content in the browser.

Email dispatch and hosting

Our hosting services also include the sending, receiving and storage of emails. Recipient and sender addresses, technical transmission information and content are processed. This data may also be processed for SPAM detection.

Please note that emails are not always transmitted in encrypted form on the internet. Full protection exists only with end-to-end encryption. We accept no responsibility for transmission between the sender and our server.

Collection of access data and log files

Our web hosting provider collects data about every access to the server (so-called server log files). These include:

• Address and name of the web pages and files accessed
• Date and time of access
• Transferred data volumes
• Notification of successful retrieval
• Browser type and version
• User’s operating system
• Referrer URL
• IP addresses
• Requesting provider

Server log files

The server log files may be used, firstly, for security purposes, e.g. to avoid overloading the servers (in particular in the case of abusive attacks, so-called DDoS attacks) and, secondly, to ensure the utilisation and stability of the servers.

Content Delivery Network (CDN)

We use a content delivery network (CDN). A CDN is a service that helps deliver the content of an online offering—particularly large media files such as graphics or programme scripts—more quickly and securely using regionally distributed servers connected via the internet.

Types of data processed

• Content data (e.g. entries in online forms)
• Usage data (e.g. websites visited, interest in content, access times)
• Meta/communication data (e.g. device information, IP addresses)

Data subjects

• Users (e.g. website visitors, users of online services)

Purposes of processing

• Content Delivery Network (CDN)

Legal bases

• Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR)

Contacting us

When you contact us (e.g. via contact form, email, telephone or via social media), the details provided by the requesting persons are processed to the extent necessary to respond to the enquiries and any requested measures.

Responses to contact enquiries within the framework of contractual or pre-contractual relationships are provided for the performance of our contractual obligations or to respond to (pre-)contractual enquiries and, in all other respects, on the basis of legitimate interests in responding to the enquiries.

Types of data processed

• Inventory data (e.g. names, addresses)
• Contact data (e.g. email, telephone numbers)
• Content data (e.g. entries in online forms)

Data subjects

• Communication partners

Purposes of processing

• Enquiries and communication

Legal bases

• Performance of a contract and pre-contractual enquiries (Art. 6 (1) sentence 1 (b) GDPR)
• Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR)

Online marketing

We process personal data for the purposes of online marketing, which may include, in particular, the marketing of advertising space or the display of advertising and other content (collectively referred to as “content”) based on potential interests of users, as well as measuring their effectiveness.

For these purposes, so-called user profiles are created and stored in a file (a “cookie”) or similar procedures are used by means of which information relevant to the display of the aforementioned content is stored about the user. Such information may include, for example, viewed content, visited websites, online networks used, but also communication partners and technical details such as the browser used, the computer system used and information on usage times. If users have consented to the collection of their location data, this may also be processed.

Users’ IP addresses are also stored. However, to protect users, we use available IP masking procedures (i.e. pseudonymisation by shortening the IP address). As a rule, no clear data (such as email addresses or names) of users are stored within the framework of online marketing procedures, but pseudonyms. That is, neither we nor the providers of the online marketing procedures know the actual identity of the users, only the information stored in their profiles.

The information in the profiles is usually stored in cookies or by similar procedures. These cookies can generally be read later on other websites that use the same online marketing procedure and analysed for the purposes of displaying content, and can be supplemented with further data and stored on the server of the provider of the online marketing procedure.

In exceptional cases, clear data may be assigned to the profiles. This is the case if users are, for example, members of a social network whose online marketing procedure we use and the network links the users’ profiles with the aforementioned information. Please note that users may enter into additional agreements with the providers, for example by giving consent as part of registration.

We generally only have access to aggregated information about the success of our advertisements. However, as part of so-called conversion measurements, we can check which of our online marketing procedures has led to a so-called conversion, i.e. for example to the conclusion of a contract with us. Conversion measurement is used solely to analyse the success of our marketing measures.

Unless otherwise stated, please assume that cookies used are stored for a period of two years.

Notes on legal bases

If we ask users for their consent to use third-party providers, the legal basis for the processing of data is consent. Otherwise, users’ data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

Types of data processed

• Usage data (e.g. websites visited, interest in content, access times)
• Meta/communication data (e.g. device information, IP addresses)

Data subjects

• Users (e.g. website visitors, users of online services)
• Prospective customers

Purposes of processing

• Tracking (e.g. interest-/behaviour-based profiling, use of cookies)
• Remarketing
• Conversion measurement (measuring the effectiveness of marketing measures)
• Interest-based and behavioural marketing
• Profiling (creating user profiles)
• Reach measurement (e.g. access statistics, recognition of returning visitors)

Security measures

• IP masking (pseudonymisation of the IP address)

Legal bases

• Consent (Art. 6 (1) sentence 1 (a) GDPR)
• Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR)

Right to object (opt-out)

We refer to the data protection notices of the respective providers and the opt-out options provided by the providers. If no explicit opt-out option is provided, you can disable cookies in your browser settings. However, this may restrict functions of our online offering.

We therefore additionally recommend the following opt-out options:

• Europe: https://www.youronlinechoices.eu
• Canada: https://www.youradchoices.ca/choices
• USA: https://www.aboutads.info/choices
• Cross-territory: https://optout.aboutads.info

Services and service providers used

Google Analytics: Online marketing and web analytics
Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Website: https://marketingplatform.google.com/intl/de/about/analytics/
Privacy policy: https://policies.google.com/privacy
Opt-out: Opt-out plugin, Ad settings

Plugins and embedded functions and content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include, for example, graphics, videos or social media buttons as well as posts (hereinafter uniformly referred to as “content”).

Integration always requires that the third-party providers of this content process users’ IP addresses, since without the IP address they could not send the content to their browsers. The IP address is therefore required for the display of this content or functions. We endeavour to use only content whose respective providers use the IP address solely for the delivery of the content.

Third-party providers may also use so-called pixel tags (invisible graphics, also referred to as “web beacons”) for statistical or marketing purposes. “Pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on users’ devices and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit and other information on the use of our online offering, and may also be combined with such information from other sources.

Notes on legal bases

If we ask users for their consent to use third-party providers, the legal basis for the processing of data is consent. Otherwise, users’ data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

Types of data processed

• Usage data (e.g. websites visited, interest in content, access times)
• Meta/communication data (e.g. device information, IP addresses)
• Location data (information on the geographical position of a device or a person)
• Inventory data (e.g. names, addresses)
• Contact data (e.g. email, telephone numbers)
• Content data (e.g. entries in online forms)

Data subjects

Users (e.g. website visitors, users of online services).

Purposes of processing

• Provision of our online offering and user-friendliness
• Performance of contractual services and customer service
• Security measures
• Administration and response to enquiries

Legal bases

• Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR)
• Consent (Art. 6 (1) sentence 1 (a) GDPR)
• Performance of a contract and pre-contractual enquiries (Art. 6 (1) sentence 1 (b) GDPR)

Services and service providers used

• Google Fonts: Fonts from Google for display in the browser.
  Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
  Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
  Website: https://fonts.google.com/
  Privacy policy: https://policies.google.com/privacy
• Google Maps: Mapping service with IP and location processing (only with consent).
  Service provider: Google Ireland Limited, Dublin, Ireland.
  Website: https://cloud.google.com/maps-platform
  Privacy policy: https://policies.google.com/privacy
  Opt-out: Opt-out plugin, Ad settings
• YouTube videos: Video content from Google / YouTube.
  Service provider: Google Ireland Limited, Dublin, Ireland.
  Website: https://www.youtube.com
  Privacy policy: https://policies.google.com/privacy
  Opt-out: Opt-out plugin, Ad settings

Deletion of data

The data we process will be deleted in accordance with legal requirements as soon as consents permitting processing are withdrawn or other permissions lapse (e.g. if the purpose of processing this data no longer applies or they are no longer necessary for the purpose).

If the data is not deleted because it is required for other and legally permissible purposes, its processing will be restricted to these purposes. That is, the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons or whose storage is necessary for the establishment, exercise or defence of legal claims, or to protect the rights of another natural or legal person.

Further notes on the deletion of personal data may also be provided within the individual data protection notices of this privacy policy.

Amendments and updates to this privacy policy

Please inform yourself regularly about the content of our privacy policy. We will adapt the privacy policy as soon as changes in our data processing make this necessary. We will inform you when such changes require action on your part (e.g. consent) or other individual notification.

If we provide addresses and contact information of companies and organisations in this privacy policy, please note that addresses may change over time and check the details before contacting them.

Rights of data subjects

As a data subject, you have various rights under the GDPR, in particular those set out in Articles 15 to 21 GDPR:

• Right to object: You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Article 6 (1) (e) or (f) GDPR; this also applies to profiling based on those provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
• Right to withdraw consent: You have the right to withdraw consent you have given at any time.
• Right of access: You have the right to obtain confirmation as to whether or not data concerning you is being processed and to obtain access to this data as well as further information and a copy of the data in accordance with legal requirements.
• Right to rectification: You have the right, in accordance with legal requirements, to request the completion of data concerning you or the rectification of inaccurate data concerning you.
• Right to erasure and restriction of processing: You have the right, in accordance with legal requirements, to request that data concerning you be erased without undue delay or, alternatively, to request restriction of processing of the data in accordance with legal requirements.
• Right to data portability: You have the right to receive the data concerning you that you have provided to us in a structured, commonly used and machine-readable format in accordance with legal requirements, or to request its transmission to another controller.
• Right to lodge a complaint with a supervisory authority: You also have the right, in accordance with legal requirements, to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.