of Paul Elsdörfer & Söhne GbR, Managing Director: Paul Elsdörfer, Fröttmaningerstraße 2, 80805 Munich, Germany.
1. Name and contact details of the controller
This privacy information applies to us,
Paul Elsdörfer & Söhne GbR
Managing Director: Paul Elsdörfer
Fröttmaningerstraße 2
80805 Munich, Germany
Phone: +49 89 365947
Fax: +49 89 36102315
E-mail: blumen@elsdoerfer.com
as the controller.
2. General information on data processing
I. Scope of the processing of personal data
As a matter of principle, we process the personal data of our users only to the extent necessary to provide a functional website as well as our content and services. The processing of our users' personal data takes place regularly only with the user's consent. An exception applies in cases where obtaining prior consent is not possible for practical reasons and the processing of the data is permitted by statutory provisions.
II. Legal basis for the processing of personal data
Insofar as we obtain the consent of the data subject for processing operations involving personal data, Art. 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.
For the processing of personal data necessary for the performance of a contract to which the data subject is a party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary to carry out pre-contractual measures.
Insofar as the processing of personal data is necessary to comply with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.
In the event that vital interests of the data subject or of another natural person make the processing of personal data necessary, Art. 6(1)(d) GDPR serves as the legal basis.
If the processing is necessary to safeguard a legitimate interest of our company or a third party, and if the interests, fundamental rights and freedoms of the data subject do not override the former interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing.
III. Data erasure and storage period
The data subject's personal data is erased or blocked as soon as the purpose of storage no longer applies. Storage may also take place if this has been provided for by European or national legislators in Union regulations, laws or other provisions to which the controller is subject. Data is also blocked or erased when a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or performance of a contract.
3. Collection and storage of personal data; type, purpose and use
When you place an order with us, the following information is collected:
- Salutation, title, first name, surname
- Address
- E-mail address
- Telephone number (landline and/or mobile)
- Fax number where applicable (if available & desired)
- Account details where applicable
- Date of birth where applicable
In addition, all information necessary for the performance of the contract with you is collected.
Personal data is collected,
- to be able to identify you as a customer;
- to be able to advise you appropriately;
- to be able to fulfil our contractual obligations towards you;
- to be able to comply with our legal obligations;
- for correspondence with you;
- for invoicing and, where applicable, in the context of dunning;
- for purposes of permissible direct advertising;
- to assert any claims against you.
The processing of personal data takes place on the occasion of your enquiry to us and is necessary for the stated purposes in order to process your order and to fulfil obligations arising from the underlying contract.
The personal data collected is stored until the expiry of the statutory retention obligation for merchants (6, 8 or 10 years after the end of the calendar year in which the contractual relationship ended) and is then erased. By way of exception, this does not apply if we are obliged to store the data for longer due to retention obligations under tax or commercial law (pursuant to the German Commercial Code, Criminal Code or Fiscal Code) or if you have consented to storage beyond this period.
4. Disclosure of data to third parties
As a matter of principle, your personal data is not transmitted to third parties. Exceptions apply only insofar as this is necessary for the handling of contractual relationships with you. This includes in particular the disclosure to service providers commissioned by us (so-called processors) or other third parties whose activity is necessary for the performance of the contract (e.g. shipping companies or banks). The data disclosed may be used by the third parties exclusively for the stated purposes.
5. Your rights as a data subject
As a person affected by data processing, you have various rights:
Right of withdrawal
You can withdraw consent you have given at any time with effect towards us. The data processing based on the withdrawn consent may then no longer be continued for the future. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the withdrawal.
Right of access
You can request information about your personal data processed by us. This applies in particular to the purposes of the data processing, the categories of personal data, where applicable the categories of recipients, the storage period, where applicable the origin of your data, as well as where applicable the existence of automated decision-making including profiling and, where applicable, meaningful information about its details.
You can request confirmation from the controller as to whether personal data concerning you is processed by us. If such processing is taking place, you can request information about the following: the purposes of the processing; the categories of data processed; the recipients or categories of recipients; the planned storage period or the criteria for it; the existence of a right to rectification, erasure, restriction or objection; the existence of a right to lodge a complaint with a supervisory authority; all available information about the origin of the data if it was not collected from you; as well as the existence of automated decision-making including profiling pursuant to Art. 22(1) and (4) GDPR.
You also have the right to request information about whether your personal data is transferred to a third country or to an international organisation and, in this context, to be informed about the appropriate safeguards pursuant to Art. 46 GDPR.
Right to rectification
You can request the rectification of inaccurate or the completion of your personal data stored by us, insofar as it is inaccurate or incomplete. The controller must carry out the rectification without undue delay.
Right to erasure
You can request the erasure of your personal data stored by us, insofar as its processing is not necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims. The right to erasure exists in particular if the data is no longer necessary for the purposes for which it was collected, if you withdraw consent and there is no other legal basis, if you object and there are no overriding legitimate grounds, if the data was processed unlawfully, or if there is a legal obligation to erase it.
Right to be informed
If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to notify all recipients to whom your personal data has been disclosed of this rectification, erasure or restriction, unless this proves impossible or involves disproportionate effort. You have the right to be informed about these recipients.
Right to restriction of processing
You can request the restriction of the processing of your personal data, insofar as the accuracy of the data is contested by you, the processing is unlawful but you refuse its erasure, we no longer need the data but you require it for the establishment, exercise or defence of legal claims, or you have objected to the processing.
Right to data portability
You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller or to have it transmitted directly, insofar as this is technically feasible and the processing is based on consent or a contract and is carried out by automated means.
Right to lodge a complaint
You can lodge a complaint with the supervisory authority responsible for us, for example if you are of the opinion that we are processing your personal data unlawfully. The authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27
91522 Ansbach, Germany
Phone: +49 (0) 981 53 1300
Fax: +49 (0) 981 53 98 1300
E-mail: poststelle@lda.bayern.de
6. Your right to object
Insofar as we process your personal data on the basis of a legitimate interest, you have the right to object to this processing. If you wish to exercise your right to object, a notification in text form is sufficient. You are therefore welcome to write to us, send a fax, or contact us by e-mail. You can find our contact details under point 1 of this privacy information.
You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. If your data is processed for the purpose of direct advertising, you have the right to object at any time; after that, your data will no longer be processed for these purposes.
7. Provision of the website and creation of log files
Certain personal data is also processed via our website, including the IP address of website visitors. Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected in this process:
- information about the browser type and version used
- the user's operating system
- the user's internet service provider
- the user's IP address
- date and time of access
- websites from which the user's system reaches our website
- websites accessed by the user's system via our website
The data is also stored in our system's log files. This data is not stored together with other personal data of the user.
Legal basis: The legal basis for the temporary storage of the data and the log files is Art. 6(1)(f) GDPR.
Purpose: The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's device. Storage in log files takes place to ensure the functionality of the website and to optimise and ensure the security of our information technology systems. The data is not evaluated for marketing purposes.
Storage period: The data is erased as soon as it is no longer necessary to achieve the purpose for which it was collected. In the case of data collected to provide the website, this is the case when the respective session has ended. In the case of storage in log files, this is after seven days at the latest; in the case of longer storage, the IP addresses are erased or anonymised.
8. Use of cookies
Our website uses cookies. Cookies are text files that are stored in or by the internet browser on the user's computer system. We use cookies to make our website more user-friendly. Among other things, the following data is stored in the cookies: language settings, items in the shopping cart, log-in information. In addition, cookies may be used that enable an analysis of browsing behaviour (e.g. search terms entered, frequency of page views, use of functions); this data is pseudonymised.
Legal basis: For technically necessary cookies, Art. 6(1)(f) GDPR; for analysis cookies, where consent is given, Art. 6(1)(a) GDPR.
Purpose: Technically necessary cookies make the use of the website easier (e.g. shopping cart, language settings, remembering search terms). Analysis cookies serve to improve the quality of our website and its content.
Control: Cookies are stored on your device; you have full control. Through your browser settings you can disable or restrict the transmission of cookies and delete cookies that have already been stored. If cookies are disabled, it may no longer be possible to use all functions of the website to their full extent.
9. Registration
On our website we offer users the opportunity to register by providing personal data. The data is entered into an input mask, transmitted to us and stored. The data is not passed on to third parties. At the time of registration, the user's IP address as well as the date and time of registration are also stored.
Legal basis: where consent is given, Art. 6(1)(a) GDPR; if registration serves the performance of a contract or pre-contractual measures, additionally Art. 6(1)(b) GDPR.
Purpose and duration: Registration is necessary to provide certain content and services or to perform a contract. The data is erased as soon as it is no longer necessary to achieve the purpose. As a user, you have the option at any time to cancel your registration and to have your data changed; please contact us for this using the contact options stated under point 1.
10. Contact form and e-mail contact
A contact form can be used on our website for making electronic contact. If a user takes advantage of this option, the data entered in the input mask (name, possibly telephone number, possibly e-mail address, possibly address) is transmitted to us and stored. At the time of sending, the IP address as well as the date and time are also stored. Alternatively, contact is possible via the e-mail address provided; in this case, the personal data transmitted with the e-mail is stored. It is not passed on to third parties.
Legal basis: where consent is given, Art. 6(1)(a) GDPR; for the data transmitted by e-mail, Art. 6(1)(f) GDPR, and where it is aimed at concluding a contract, additionally Art. 6(1)(b) GDPR.
Purpose and duration: The processing serves solely to handle the contact. The data is erased as soon as the respective conversation has ended; the additional data collected when sending is erased after seven days at the latest. The user has the option at any time to withdraw their consent or object to the storage.