Data Protection Declaration

The following company is the controller for processing your personal data as described in this privacy notice:

Conditorei Coppenrath & Wiese KG
Hansastraße 10
49497 Mettingen
Germany

E-Mail: datenschutz@coppenrath-wiese.de

The privacy notice contains the following terms set forth in the EU General Data Protection Regulation 2016/679 (“GDPR”).

a)     Personal data

Personal data means any information relating to an identified or identifiable natural person (hereinafter: “You”). A natural person is considered to be identifiable who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

b)     Processing

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

c)     Pseudonymisation

Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.

d)     Controller

The controller is the natural or legal person, public authority, agency or any other body which alone or jointly with others decides on the purposes and means of processing personal data. Where the purposes and means of processing are determined by Union or Member State law, the controller or the specific criteria for his nomination may be designated by Union or Member State law.

e)     Processor

The processor is a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller.

f)      Consent

Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

g)     Supervisory Authority

Supervisory authority means an independent public authority which is established by a Member State pursuant to Article 51 GDPR.

In all cases of data processing, We observe the principle of data avoidance and data economy. This means that We process as little personal data as possible.

a) We process Your personal data if and insofar as this is necessary for the establishment, implementation or termination of a contractual or quasi- contractual relationship.

The legal basis for the processing of personal data relating to a contractual or quasi-contractual relationship is Art. 6 (1) sentence 1 b GDPR. This also applies to processing operations that are necessary to carry out pre-contractual measures.

The personal data will be erased after the termination of the contractual or quasi-contractual relationships in compliance with the statutory storage requirements.

Within the framework of the contractual relationships, Your personal data may be transmitted to third parties, which process this data solely for the purpose of performance of the contractual purpose. This applies in particular to postal delivery services for the purpose of delivering goods and payment services in order to fulfil Your payment obligations.

b) In other respects, We process Your personal data if and insofar as You have given Your consent. In doing so, this data is used only for the purpose and scope stated in the declaration of consent; for instance, We will inform You about Our products and services only in accordance with Your consent.

The legal basis for the processing of data on the basis of Your consent is Art. 6 (1) sentence 1 a GDPR, whereby in this case You have the right to revocation for the future. You may address the revocation by letter or e-mail to the contact details of the controller mentioned under section 1. above. The legality of the data processing carried out until the assertion of Your rights remains unaffected.

The personal data is erased in compliance with the legal preservation obligations after completion of the purpose pursued with the consent.

Within the scope of consent given, Your personal data may be transferred to third parties who process this data solely for the purpose of obtaining Your consent.

c) In other respects, We process Your personal data in a pseudonymised form.

If the Processing is necessary for the protection of a legitimate interest of Us or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh the former interest, Art. 6 (1) sentence 1 f GDPR serves as the legal basis, whereby in principle the possibility of objecting to this data processing exists for the future. You may address the objection by letter or e-mail to the contact details of the controller mentioned under section 1. above.

The legality of data processing carried out until the assertion of Your rights remains unaffected.

The personal data will be erased in compliance with the statutory preservation requirements after reaching the legitimate interests or after an objection has been raised.

In the context of legitimate interests, Your personal data may be transmitted to third parties who process this data solely for the purpose of fulfilling Your interests.

Our website may provide the option of registering or signing up (e.g. for the newsletter) by providing personal information. The type of personal data transmitted to the controller results from the respective registration mask. The data You enter will be processed solely for the purposes stated in connection with the registration.

If You contact us by e-mail, through a contact form or in a similar form (for example, inquiries about our products or services), the personal data provided by You will also be processed. However, this data processing is limited to the purpose of processing the inquiries or contacting You.

As part of the registration and sign-up process, the IP address assigned to You at the date of registration, signing up or establishing contact will be processed as well as the date and time. This data processing is necessary in order to prevent the misuse of Our services, as this data could be used to solve any crime committed. This results in the legitimate interests in data processing.

The legal basis for this processing is the presence of consent in accordance with Art. 6 (1) sentence 1 a GDPR, in which case You have the right to revocation for the future. You may address the revocation by letter or e-mail to the contact details of the controller mentioned under section 1. above. The legality of the data processing carried out until the assertion of Your rights remains unaffected.

In the context of contractual or quasi-contractual relationships, the legal basis results from Art. 6 (1) sentence 1 b GDPR. This applies, for instance, to contact established for the purpose of concluding a contract.

Otherwise, the legal basis ensues from Article 6 (1) sentence 1 f GDPR. The legitimate interests result from the reasons described above. There is the possibility to object to this data processing in future. You may address the objection by letter or e-mail to the contact details of the controller mentioned under section 1. above. The legality of the data processing carried out until the assertion of Your rights remains unaffected.

The personal data will be erased in compliance with the statutory preservation requirements after reaching the legitimate interests or after an objection has been raised. If contact is established, Your data will be erased as soon as the respective request is completed or You object to the data processing; in the latter case, correspondence is discontinued.

Every time You visit our website, log files automatically process data that originates from Your terminal and may also include personal data. This applies to the following data:

- The operation system running on Your terminal

- The browser type used by You

- Name of Your Provider

- Your IP address

- Date and time of the visit

- The websites visited including any search words

- The websites from which You have reached Our website

We do not process this data together with other personal data about You, i.e. We do not assign the aforementioned data to Your person.

The legal basis for the Processing of the automatically generated data is Art. 6 (1) sentence 1 f GDPR. The Processing is required to ensure the functionality of the website, to optimise the content of Our websites and to display them correctly and to provide prosecuting authorities with the information necessary for prosecution in the event of a cyberattack. This is also the legitimate interest in data processing.

The automatically generated data will be erased as soon as it is no longer required for the achievement of the aforementioned purposes, i.e. when the respective website visit is finished. If Your IP address is processed, the data is erased after 7 days at the latest.

Processing the aforementioned data for the provision of the website and any storage in log files is essential for the operation of the website. As a result, there is no possibility of making an objection.

The different types of cookies and similar technologies used on Our website are described below.

a)      Description and scope of data processing

Our websites use cookies. Cookies are text files that are generated and stored in Your Internet browser the first time You visit Our website. The next time the website is accessed using the same terminal, the usage data stored therein is either returned to the website that created it (first-party cookie) or sent to another website to which it belongs (third-party cookie).

Thus, the website recognises during later visits of the user whether or that it has been called up with this browser before. As a result, the website can be adapted to the needs of the user in a new call, the use of the website can be statistically evaluated and the display of the content displayed can be varied.

The term ‘cookies’ is used below for all technologies that store user data locally and, if necessary, transfer it to us or third-party providers as part of Your website visit.

b)      Cookie categories

The cookies are subject to different storage periods. Our website use both "permanent cookies" and "session cookies":

aa)    Session cookies are stored only during Your current visit to Our website and serve to enable You to use Our services without restriction and to make the most comfortable use of Our website for the current visit to Our site. Disabling session cookies will not guarantee that You will be able to use all of Our services without restriction.

bb)    Permanent cookies remain temporarily stored even after Your visit to Our website (temporary cookies) and serve to allow You to use Our website as comfortably as possible beyond the current visit and are used by Us only for this purpose. Disabling these cookies will mostly not affect the usability of Our website.

Depending on their function and purpose, cookies can be grouped into the following categories:

aa)    Necessary Cookies (type 1)

These cookies are mandatory for our website and its functions to work properly.

These cookies enable the improvement of the comfort and performance of websites and the provision of various functions. Thereby, e.g. information already provided (such as username, language selection or the location where You are) can be stored to save You re-entering information.

bb)    Functional Cookies (type 2)

These cookies are used to obtain information about Your use of Our website. For instance, they allow the identification of particularly popular areas of Our website in order to better tailor the contents of Our website to Your needs.

Further information on these cookies and their individual deletion can also be found under section 6 e).

cc)    Marketing and Third Party Cookies (type 3)

These cookies are used to display more targeted advertising relevant to the user and adapted to his interests. This information may be shared with third parties, e.g. advertisers. Cookies to improve targeting and advertising are often linked to third-party website functions.

Further information on marketing cookies and their individual deletion can also be found under section 6 e).

Our website may also contain third-party content, such as Facebook services or YouTube videos. These third parties may set cookies while You use Our website and receive information through this website usage. The cookies are primarily used to integrate social media content such as social plug-ins on our website.

Further information on third-party cookies can be found under section 8. and on the third-party websites.

c)      Legal basis and further information

The cookies only process anonymised and pseudonymised data (data processing). The provision of this data is neither legally nor contractually required nor is it required for the conclusion of a contract.

Insofar as personal data is also processed in the form of pseudonymised data, the legal basis for this is the consent given by You when You access Our website (Article 6 (1) sentence 1 a GDPR). or Our legitimate interests or the legitimate interests of third-party providers in direct advertising (Art. 6 (1) sentence 1 f GDPR).[SJ1] 

d)      Deletion of cookies

However, You may visit our website without cookies. The prevention of new cookies and the deletion of cookies already set can be achieved by the following measures:

If You consent to data processing (Art. 6 (1) sentence 1 a GDPR), We will erase Your data after revocation or elimination of the purpose for which You have given Your consent with effect for the future. You may address the revocation to the controller mentioned under section 1 as follows: …

In the case of data processing on the basis of legitimate interests (Article 6 (1) sentence 1 GDPR), objections may be raised for all cookies or only certain types of cookies by selecting *do not accept cookies* in Your browser settings or object to data processing with future effect at any time here[SJ2] . Cookies already saved can be removed by deleting temporary websites. Please note that even Your objection may be stored in a cookie. If You delete this cookie, You must make an objection again.

It may not be possible to fully use all functions of the website if all or individual cookies have been deactivated for Our website. 

For information on the automatic deletion of cookies, please refer to the instructions of Your browser or terminal manufacturer:

Additional information on Functional Cookies and Marketing Cookies (type 2 and type 3) and their individual deletion vis-à-vis specifically designated third parties can be found below.

(i) Google Analytics: Google Analytics uses temporary cookies that allow an analysis of Your use of the website. The stored data on the use of Our website including Your IP address ("Usage Data") is usually transmitted to and stored by Google on a server in the United States. Please note that on Our websites Google Analytics has been extended by the code "gat._anonymizeIp();;" in order to ensure an anonymised collection of IP addresses (so-called IP masking). By activating the IP anonymisation on Our website, Your IP address will be shortened beforehand by Google within Member States of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the U.S. and shortened there.
Google will use the above-mentioned information to evaluate Your use of Our website, to compile reports on the website activities for US and to render further services related to the use of the website and the Internet to us. Google transmits this data to third parties only on account of statutory provisions. 

You may prevent the storage of cookies by a corresponding setting of Your browser software; however, We would like to point out that in this case You may not be able to use all the functions of our website in full. You may also prevent the collection of the data generated by the cookie and related to Your use of these web pages (including Your IP address) to Google and the Processing of this data by Google by downloading and installing the browser plug-in available under the following link: https://tools.google.com/dlpage/gaoptout?hl=de

Further information on Google Analytics is available under this link: https://support.google.com/analytics/answer/6004245?hl=de

Our website contains links to external social networks such as Facebook (“Social Plug-ins”). The functions assigned to the links, in particular the transmission of information and user data, are not activated by visiting Our website, but by clicking on the links. After clicking on these links, the plug-ins of the corresponding networks are activated and Your browser establishes a direct connection to their servers.

If You click on the links while visiting Our website, Your user data may be transmitted to the relevant network and processed by the network. If You click on the links while visiting Our website and at the same time You are logged into the network through Your personal account, the information that You have visited our website can be forwarded to the network and stored there in connection with Your account. In order to prevent an assignment to Your account with the corresponding network, You must log out of Your account before clicking on the link.

For the purpose and scope of data collection through the social networks as well as the further processing and use of Your data there as well as Your related rights and setting options to protect Your privacy, please refer to the privacy policy of the respective network. For the data processing, which starts with clicking on the link, only the respective social network is responsible.

a)     Right to revoke a data protection consent

You have the right to revoke Your consent to the processing of personal data at any time.

The legality of data processing carried out until the revocation remains unaffected by the revocation.

b)     Right to objection

You have the right to object at any time to the processing of personal data concerning You pursuant to Article 6 (1) sentence 1 e or f GDPR (Article 21 (1) GDPR). The legality of data processing carried out until the revocation remains unaffected by the revocation.

In the event of an objection, We will no longer process the personal data unless We can prove compelling legitimate reasons for the processing that outweigh Your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

If Your personal data is used to operate direct advertising, You have the right to object hereto at any time (Article 21 (2) GDPR).

If Your raise an objection, We will no longer process the personal data. The legality of data processing carried out until the revocation remains unaffected by the revocation.

The revocation and the objection may be addressed to the contact details of the controller mentioned under section 1. above at any time by letter or by e-mail.

a)     Right to confirmation
You have the right to request information from Us as to whether We process personal data of You.

b)     Right to information
You have the right to obtain information on Your personal data processed and a copy hereof at any time free of charge.
You also have the right to receive information on whether personal data has been transmitted to a third country or to an international organisation. If this is the case, You are otherwise entitled to receive information about the appropriate guarantees in connection with the transmission.

c)     Right to correction
You have the right to demand the immediate correction of incorrect personal data concerning You. You also have the right, under consideration of the purposes of processing, to request the completion of incomplete personal data, including by means of a supplementary statement.

d)     Right of deletion (right to be forgotten)
The GDPR provides for a right of deletion. Accordingly, You may request that the personal data concerning You be erased immediately if any of the following reasons apply and to the extent Processing is not required

• The personal data has been collected for such purposes or otherwise processed for which it is no longer necessary.
• You revoke Your consent, on which the Processing was based in accordance with Art. 6 (1) a GDPR or Art. 9 (2) (a) GDPR, and there is no other legal basis for the Processing.
• You object to the Processing within the meaning of Art. 21 (1) GDPR and there are no superior legitimate reasons for the Processing.
• You object to the Processing within the meaning of Art. 21 (2) GDPR.
• The personal data was processed illegally.
• The erasure of personal data is required to fulfil a legal obligation under Union or Member State law.
• The personal data was collected in relation to information society services offered pursuant to Art. 8 (1) GDPR.

e)     Right to restriction of Processing
You have the right to demand that We restrict Processing if any of the following conditions is met:

• The accuracy of Your personal data is contested by You for a period of time that enables the controller to verify the accuracy of the personal data.
• The processing is illegal, You refuse the erasure of personal data and instead require the restriction of use of personal data.
• We no longer need Your personal data for Processing purposes, but You need it to assert, exercise or defend any legal claims.
• You have objected to the Processing pursuant to Art. 21 (1) GDPR and it is not yet clear whether the legitimate reasons prevail over those stated by You.

f)      Right to data portability
You have the right to receive the personal information You provide Us in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance by Us, provided that the Processing is based on the consent to be given pursuant to Art. 6 (1) sentence 1 a GDPR or on a contract pursuant to Art. 6 (1) sentence 1 b GDPR and data is processed using automated means, provided that the Processing is not necessary for the performance of a task of public interest or it is effected in the exercise of public authority delegated to the controller.

In addition, when exercising Your right to data portability, You have the right to effect that personal data be transmitted directly from one controller to another, as far as technically feasible and provided that this does not affect the rights and freedoms of others.

In addition to these rights, You have a right to file complaints with the supervisory authority in charge of data protection (North Rhine-Westphalia: North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information, Düsseldorf.

The data is processed by Ourselves and, as far as We have not expressly excluded, by service providers commissioned by Us and in case of Your respective consent or for the fulfilment of agreed contractual duties by third parties and in the case of pseudonymised data also by third parties subject to legitimate interests.

In other respects, third parties do not have access to Your personal data. In particular, We will not sell or otherwise use it. We will process the data only on official or legal requests as well as in the event of legal disclosure requirements, in particular transmit it to state authorities.

In the event that Your personal data is transferred to third-country non-EU/EEA sites, this will only be done if the EU Commission has decided that the third country, territory or multiple specific sectors in that third country provide an adequate level of protection or adequate or appropriate data protection guarantees have been provided within the meaning of Art. 46 or Art. 47 or Art. 49 GDPR.

We do not process personal data of persons who have not reached the age of 16 years. If We become aware that such information has been transmitted to Us without the consent of the parents or other guardians, We will promptly delete it. In doing so, We are dependent on relevant information from You as parents or legal guardians.

We process Your personal data only for the period required to achieve the purpose of the storage or if this is provided for by the relevant statutory regulations. If the purpose of storage does not apply or if a storage period prescribed by the relevant statutory regulations expires, the personal data will be erased or restricted/blocked routinely and in accordance with the statutory provisions. In case of contractual relationships, these principles apply accordingly until the expiry of statutory limitation periods.

The provision of Your personal data is partly required by law (such as tax regulations) or is also the result of contractual arrangements (such as details of the contracting party).

Also for a contract conclusion it may be necessary that You provide us with personal data, which must be subsequently processed by Us. Failure to provide Your personal data would mean that the contract could not be concluded with You. If You do not wish to provide personal data in these cases, You may contact the controller mentioned in section 1. above by mail or e-mail. We clarify on a case-by-case basis whether the provision of the personal data is required by law or contract or is required for the conclusion of the contract, whether there is an obligation to provide the personal data and what would be the consequence of non-provision of the personal data.

We always keep this data protection up to date. Therefore, it may be necessary to adapt the privacy notice to changing outline conditions of actual or statutory nature. These adaptations are accepted by using our website.

If You have any questions regarding the processing of Your personal data, please contact Our data protection officer:

E-mail: coppenrath-wiese@corporate-data-protection.com
or
Conditorei Coppenrath & Wiese KG
Data protection officer
Hansastraße 10
49497 Mettingen
GERMANY