Privacy Policy
Thank you for your interest in our company. Protecting your personal data is a high priority for the management of BuddyBerlin. You can generally use our website without providing personal data. However, if you wish to use particular services through our website, we may need to process personal data. Where processing is necessary and there is no other legal basis for it, we generally obtain your consent.
We process personal data, such as names, addresses, email addresses and telephone numbers, in accordance with the General Data Protection Regulation (GDPR) and the country-specific data protection provisions applicable to BuddyBerlin. This privacy policy explains the nature, scope and purposes of the personal data we collect, use and process. It also explains the rights available to data subjects.
As the controller, we have implemented numerous technical and organisational measures to protect personal data processed through this website as comprehensively as possible. Nevertheless, internet-based data transmissions may have security vulnerabilities, so absolute protection cannot be guaranteed. You may therefore provide personal data to us by alternative means, such as by telephone.
- Definitions
BuddyBerlin’s privacy policy uses the terminology adopted by the European legislator in the General Data Protection Regulation (GDPR). We want this policy to be easy to read and understand for the public, our customers, business partners and Buddies. We therefore explain the terms used below.
This privacy policy uses the following terms, among others:- Personal data
Personal data means any information relating to an identified or identifiable natural person (the data subject). An identifiable natural person is someone who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity. - Data subject
A data subject is any identified or identifiable natural person whose personal data is processed by the controller. - Processing
Processing means any operation or set of operations performed on personal data, whether or not by automated means. This includes collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making data available, alignment or combination, restriction, erasure or destruction. - Restriction of processing
Restriction of processing means marking stored personal data with the aim of limiting its processing in the future. - Profiling
Profiling means any form of automated processing of personal data that uses such data to evaluate certain personal aspects relating to a natural person. In particular, it includes analysing or predicting aspects of a person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. - Pseudonymisation
Pseudonymisation means processing personal data so that it can no longer be attributed to a specific data subject without additional information. That additional information must be kept separately and protected by technical and organisational measures to ensure that the personal data cannot be attributed to an identified or identifiable natural person. - Controller
The controller is the natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of processing personal data. Where those purposes and means are determined by European Union or Member State law, that law may also specify the controller or the criteria for appointing the controller. - Processor
A processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller. - Recipient
A recipient is a natural or legal person, public authority, agency or other body to which personal data is disclosed, whether or not it is a third party. However, public authorities that may receive personal data in the context of a particular inquiry under European Union or Member State law are not considered recipients. - Third party
A third party is a natural or legal person, public authority, agency or other body other than the data subject, controller, processor and persons authorised to process personal data under the direct authority of the controller or processor. - Consent
Consent means a freely given, specific, informed and unambiguous indication of the data subject’s wishes, expressed by a statement or clear affirmative action, agreeing to the processing of their personal data.
- Personal data
- Name and address of the controller
The controller for the purposes of the GDPR, other data protection laws applicable in European Union Member States and other data protection provisions is: tri-KOM Vermittlungs GmbH, Ostpreußendamm 180, 12207 Berlin, Germany. Phone: +49 30 – 607 42 29 Email: hallo@buddyberlin.de Website: www.buddyberlin.de
BuddyBerlin is a brand of tri-KOM Vermittlungs GmbH.
- Cookies
BuddyBerlin’s website uses cookies. Cookies are text files placed and stored on a computer system through an internet browser.
Many websites and servers use cookies. Many cookies contain a cookie ID, which is a unique identifier consisting of a string of characters. It allows websites and servers to identify the particular browser in which a cookie is stored and distinguish it from other browsers containing different cookies. A browser can be recognised and identified using this unique cookie ID.
Cookies allow BuddyBerlin to provide more user-friendly services that would not be possible without them. They help us optimise the information and offers on our website for users. As explained above, cookies allow us to recognise users and make the website easier to use. For example, users do not have to enter their login details every time they visit because the website and the cookie stored on their computer remember them. Another example is an online shop’s cart cookie, which remembers the items a customer has placed in their virtual cart.
You can prevent our website from setting cookies at any time by changing the settings in your browser, thereby permanently objecting to cookies being set. You can also delete existing cookies at any time through your browser or other software. All commonly used browsers support this. If you disable cookies, some website functions may not be fully available. - Collection of general data and information
Each time a person or an automated system accesses BuddyBerlin’s website, it collects general data and information and stores it in server log files. This may include: (1) browser types and versions; (2) the operating system used; (3) the website from which the accessing system reached our website (the referrer); (4) the pages accessed on our website; (5) the date and time of access; (6) an internet protocol address (IP address); (7) the internet service provider of the accessing system; and (8) similar data and information used to protect against attacks on our information technology systems.
BuddyBerlin does not use this general data and information to draw conclusions about individual data subjects. Instead, it is needed to: (1) deliver our website content correctly; (2) optimise our website content and advertising; (3) maintain the functionality of our information technology systems and website technology; and (4) provide law enforcement authorities with the information needed to investigate a cyberattack.
BuddyBerlin analyses this anonymously collected data and information statistically and to improve data protection and security within our company, with the aim of providing the best possible protection for the personal data we process. Anonymous server log data is stored separately from personal data provided by a data subject. - Routine erasure and blocking of personal data
The controller processes and stores personal data only for as long as necessary to fulfil the purpose of storage, or for the period specified by the European legislator or another legislator in laws or regulations to which the controller is subject. When the purpose of storage no longer applies, or a statutory retention period expires, the personal data is routinely blocked or erased in accordance with legal requirements. - Rights of the data subject
-
- Right to confirmation
Every data subject has the right, granted by the European legislator, to obtain confirmation from the controller as to whether their personal data is being processed. To exercise this right, you may contact an employee of the controller at any time. - Right of access
Every data subject has the right, granted by the European legislator, to obtain information about the personal data stored about them and a copy of that information from the controller, free of charge, at any time. This right also covers the following information:
The purposes of processing.
The categories of personal data being processed.
The recipients or categories of recipients to whom personal data has been or will be disclosed, particularly recipients in third countries or international organisations.
Where possible, the intended storage period, or, if this cannot be specified, the criteria used to determine it.
The existence of a right to request rectification or erasure of personal data, restriction of processing by the controller, or to object to processing.
The right to lodge a complaint with a supervisory authority.
Where personal data was not collected from the data subject, all available information about its source.
The existence of automated decision-making, including profiling, under Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved and the significance and intended consequences of the processing for the data subject.
You also have the right to know whether your personal data has been transferred to a third country or an international organisation. If it has, you have the right to information about the appropriate safeguards relating to the transfer. To exercise your right of access, you may contact an employee of the controller at any time. - Right to rectification
Every data subject has the right, granted by the European legislator, to have inaccurate personal data about them corrected without undue delay. Taking account of the purposes of processing, you also have the right to have incomplete personal data completed, including by providing a supplementary statement. To exercise this right, you may contact an employee of the controller at any time. - Right to erasure (right to be forgotten)
Every data subject has the right, granted by the European legislator, to require the controller to erase their personal data without undue delay where one of the following grounds applies and processing is not necessary:
The personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
The data subject withdraws consent on which processing was based under Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal basis for processing.
The data subject objects to processing under Article 21(1) GDPR and there are no overriding legitimate grounds for processing, or objects under Article 21(2) GDPR.
The personal data has been processed unlawfully.
The personal data must be erased to comply with a legal obligation under European Union or Member State law to which the controller is subject.
The personal data was collected in relation to the offer of information society services referred to in Article 8(1) GDPR.
If any of these grounds applies and you wish to have personal data held by BuddyBerlin erased, you may contact an employee of the controller at any time. The employee will arrange for the erasure request to be fulfilled without undue delay.
Where BuddyBerlin has made personal data public and is obliged to erase it under Article 17(1) GDPR, we take reasonable steps, including technical measures, taking account of available technology and implementation costs, to inform other controllers processing that data that the data subject has requested the erasure of all links to, copies of or replications of it, insofar as processing is not necessary. A BuddyBerlin employee will arrange the necessary steps in each case. - Right to restriction of processing
Every data subject has the right, granted by the European legislator, to require the controller to restrict processing where one of the following conditions applies:
The data subject contests the accuracy of the personal data, for a period enabling the controller to verify its accuracy.
Processing is unlawful, but the data subject opposes erasure and requests restriction of use instead.
The controller no longer needs the personal data for processing purposes, but the data subject requires it to establish, exercise or defend legal claims.
The data subject has objected to processing under Article 21(1) GDPR, and verification of whether the controller’s legitimate grounds override those of the data subject is still pending.
If any of these conditions applies and you wish to restrict the processing of personal data held by BuddyBerlin, you may contact an employee of the controller at any time. The employee will arrange the restriction of processing. - Right to data portability
Every data subject has the right, granted by the European legislator, to receive the personal data they have provided to a controller in a structured, commonly used and machine-readable format. They also have the right to transmit it to another controller without hindrance from the controller to which it was provided, where processing is based on consent under Article 6(1)(a) or Article 9(2)(a) GDPR or a contract under Article 6(1)(b) GDPR, and is carried out by automated means. This applies insofar as processing is not necessary to perform a task in the public interest or to exercise official authority vested in the controller.
When exercising the right to data portability under Article 20(1) GDPR, you also have the right to have personal data transmitted directly from one controller to another where technically feasible, provided this does not adversely affect the rights and freedoms of others. You may contact a BuddyBerlin employee at any time to exercise this right. - Right to object
Every data subject has the right, granted by the European legislator, to object at any time, on grounds relating to their particular situation, to the processing of their personal data based on Article 6(1)(e) or (f) GDPR. This also applies to profiling based on those provisions.
If you object, BuddyBerlin will no longer process your personal data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or processing serves to establish, exercise or defend legal claims.
Where BuddyBerlin processes personal data for direct marketing, you have the right to object at any time to processing for that purpose, including profiling related to direct marketing. If you object to processing for direct marketing, BuddyBerlin will no longer process your personal data for those purposes.
You also have the right, on grounds relating to your particular situation, to object to BuddyBerlin’s processing of your personal data for scientific or historical research or statistical purposes under Article 89(1) GDPR, unless it is necessary to perform a task in the public interest.
To exercise the right to object, you may contact a BuddyBerlin employee. When using information society services, and notwithstanding Directive 2002/58/EC, you may also exercise this right by automated means using technical specifications. - Automated individual decision-making, including profiling
Every data subject has the right, granted by the European legislator, not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision: (1) is necessary to enter into or perform a contract between the data subject and the controller; (2) is authorised by European Union or Member State law applicable to the controller and that law provides suitable safeguards for the data subject’s rights, freedoms and legitimate interests; or (3) is based on the data subject’s explicit consent.
If the decision is necessary to enter into or perform a contract, or is based on explicit consent, BuddyBerlin implements appropriate measures to safeguard the data subject’s rights, freedoms and legitimate interests. These include at least the right to human intervention by the controller, to express their point of view and to contest the decision. To exercise rights relating to automated decisions, you may contact an employee of the controller at any time. - Right to withdraw consent
Every data subject has the right, granted by the European legislator, to withdraw consent to the processing of their personal data at any time. To exercise this right, you may contact an employee of the controller at any time.
- Right to confirmation
- Privacy provisions on the use of Google Analytics (with anonymisation)
The controller has integrated Google Analytics, with its anonymisation function, into this website. Google Analytics is a web analytics service. Web analytics involves collecting and analysing data about visitors’ behaviour on websites, including which website they came from (the referrer), which pages they access and how often and for how long they view them. Web analytics is mainly used to optimise websites and analyse the costs and benefits of online advertising.
The operator of Google Analytics is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.
For Google Analytics, the controller uses the extension “_gat._anonymizeIp”. Google uses this extension to shorten and anonymise the IP address of the data subject’s internet connection when our website is accessed from a European Union Member State or another state party to the Agreement on the European Economic Area.
Google Analytics analyses traffic to our website. Google uses the data and information it collects to evaluate use of our website, compile online reports on website activity for us and provide other services connected with website use.
Google Analytics places a cookie on the data subject’s information technology system. Cookies are explained above. The cookie enables Google to analyse use of our website. Whenever a page containing Google Analytics is accessed, the component automatically causes the browser to transmit data to Google for online analysis. In this process, Google obtains personal data, such as the data subject’s IP address, which it uses, among other things, to track the origin of visitors and clicks and subsequently calculate commissions.
The cookie stores personal information such as the time of access, the location from which access originated and the frequency of visits. Each time our website is visited, this personal data, including the IP address of the visitor’s internet connection, is transferred to Google in the United States of America and stored there. Google may pass the personal data collected through this technical process to third parties.
As explained above, you can prevent our website from setting cookies at any time through your browser settings, thereby permanently objecting to cookies being set. This would also prevent Google from placing a cookie on your system. You can delete cookies already set by Google Analytics through your browser or other software.
You can also object to and prevent the collection of data generated by Google Analytics relating to your use of this website and its processing by Google. To do so, download and install the browser add-on at https://tools.google.com/dlpage/gaoptout. The add-on uses JavaScript to tell Google Analytics that no data or information about website visits may be transmitted to it. Google treats installation of the add-on as an objection. If your system is subsequently erased, formatted or reinstalled, you must reinstall the add-on to disable Google Analytics. If you or someone acting within your sphere of responsibility uninstalls or disables the add-on, you can reinstall or reactivate it.
Further information and Google’s applicable privacy provisions are available at https://www.google.de/intl/de/policies/privacy/ and http://www.google.com/analytics/terms/de.html. More information about Google Analytics is available at https://www.google.com/intl/de_de/analytics/. - Privacy provisions on the use of Google AdWords
The controller has integrated Google AdWords into this website. Google AdWords is an online advertising service that allows advertisers to display advertisements in Google search results and across the Google advertising network. Advertisers can specify keywords in advance so that an advertisement appears in search results only when a user’s search is relevant to those keywords. Within the Google advertising network, an automated algorithm places advertisements on relevant websites based on the selected keywords.
The operator of Google AdWords is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.
We use Google AdWords to promote our website through interest-based advertisements on third-party websites and in Google search results, and to display third-party advertisements on our website.
If you reach our website through a Google advertisement, Google places a conversion cookie on your system. Cookies are explained above. A conversion cookie expires after thirty days and is not used to identify you. Until it expires, it records whether certain pages, such as an online shop’s cart, have been accessed. The conversion cookie enables both us and Google to determine whether a person who reached our website through an AdWords advertisement generated a sale, completed a purchase or abandoned it.
Google uses the data and information collected through conversion cookies to compile visitor statistics for our website. We use those statistics to determine the total number of users referred through AdWords advertisements, assess the success or failure of individual advertisements and optimise future advertisements. Neither our company nor other Google AdWords advertisers receive information from Google that would enable us to identify the data subject.
Conversion cookies store personal information, such as the websites visited. Each time our website is visited, personal data, including the IP address of the visitor’s internet connection, is transferred to Google in the United States of America and stored there. Google may pass personal data collected through this technical process to third parties.
As explained above, you can prevent our website from setting cookies at any time through your browser settings, thereby permanently objecting to cookies being set. This would also prevent Google from placing a conversion cookie on your system. You can delete cookies already set by Google AdWords through your browser or other software.
You can also object to Google’s interest-based advertising by visiting www.google.de/settings/ads in each browser you use and selecting your preferred settings. Further information and Google’s applicable privacy provisions are available at https://www.google.de/intl/de/policies/privacy/. - Legal basis for processing
Article 6(1)(a) GDPR is the legal basis for processing where we obtain consent for a particular purpose. Where processing is necessary to perform a contract with the data subject, such as supplying goods or providing another service or consideration, processing is based on Article 6(1)(b) GDPR. The same applies to processing necessary for steps before entering into a contract, such as inquiries about our products or services.
Where our company is subject to a legal obligation requiring personal data to be processed, such as fulfilling tax obligations, processing is based on Article 6(1)(c) GDPR. In rare cases, processing may be necessary to protect the vital interests of the data subject or another natural person. For example, if a visitor were injured at our premises, we might need to pass their name, age, health insurance details or other vital information to a doctor, hospital or other third party. In that case, processing would be based on Article 6(1)(d) GDPR.
Processing may also be based on Article 6(1)(f) GDPR. This applies where none of the above legal bases applies and processing is necessary for the legitimate interests of our company or a third party, provided these are not overridden by the data subject’s interests, fundamental rights or freedoms. Such processing is specifically recognised by the European legislator, which considered that a legitimate interest may exist where the data subject is a customer of the controller (Recital 47, second sentence, GDPR). - Legitimate interests pursued by the controller or a third party
Where processing is based on Article 6(1)(f) GDPR, our legitimate interest is conducting our business for the well-being of our employees and shareholders. - Retention period for personal data
The relevant statutory retention period determines how long personal data is stored. Once that period has expired, the data is routinely erased unless it is still needed to perform or enter into a contract. - Statutory or contractual requirements to provide personal data; necessity for entering into a contract; the data subject’s obligation to provide personal data; possible consequences of not providing it
Providing personal data may be required by law, such as tax provisions, or by contractual arrangements, such as information about a contracting party. In some cases, entering into a contract may require you to provide personal data that we must subsequently process. For example, you are required to provide personal data if our company enters into a contract with you. Without that data, we would be unable to conclude the contract.
Before providing personal data, you should contact one of our employees. They will explain, in your particular case, whether providing the data is required by law or contract or is necessary to enter into a contract, whether you are obliged to provide it and the consequences of not doing so. - Existence of automated decision-making
No formal legal warning without prior contact
If any content or design element of this website infringes third-party rights or legal provisions, or otherwise raises issues under competition law, we ask, with reference to Section 8(4) of the German Act Against Unfair Competition (UWG), that you send us a prompt, sufficiently detailed and reasonable notification without a demand for costs.
We guarantee that any passages or parts of this website that are legitimately challenged will be removed or brought fully into line with legal requirements within a reasonable period, without the need for you to instruct legal counsel.
We will reject in full any costs incurred without prior contact and, where appropriate, bring a counterclaim for a breach of the provisions referred to above.
