We process personal data (hereinafter usually referred to simply as “data”) only to the extent necessary and for the purpose of providing a functional and user-friendly website, including its content and the services offered there.
Pursuant to Art. 4 (1) of Regulation (EU) 2016/679, that is the General Data Protection Regulation (hereinafter referred to only as the “GDPR”), “processing” means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
In the privacy policy below we inform you in particular about the nature, scope, purpose, duration and legal basis of the processing of personal data, in so far as we decide on the purposes and means of the processing either alone or jointly with others. In addition, we inform you below about the third-party components we use for optimisation purposes and to improve the quality of use, in so far as third parties thereby process data under their own responsibility.
Our privacy policy is structured as follows:
- Information about us as the controller
- Rights of users and data subjects
III. Information on data processing
I. Information about us as the controller
The provider responsible for this website within the meaning of data protection law is:
Adam Wainwright, Sunmin Wainwright
OPAL Associates Holding AG
Motorenstrasse 116
CH-8620 Wetzikon
Email: info@opal-holding.com
Phone: +41 (0)44 931 12 22
You can reach our data protection officer at datenschutz@opal-holding.com or via our postal address marked “the data protection officer”.
II. Rights of users and data subjects
With regard to the data processing described in more detail below, users and data subjects have the right
- to confirmation as to whether data concerning them is being processed, to information about the data processed, to further information about the data processing and to copies of the data (see also Art. 15 GDPR);
- to rectification or completion of inaccurate or incomplete data (see also Art. 16 GDPR);
- to the immediate erasure of data concerning them (see also Art. 17 GDPR) or, alternatively, where further processing is necessary pursuant to Art. 17 (3) GDPR, to restriction of processing in accordance with Art. 18 GDPR;
- to receive the data concerning them which they have provided and to have this data transmitted to other providers or controllers (see also Art. 20 GDPR);
- to lodge a complaint with the supervisory authority if they believe that data concerning them is being processed by the provider in breach of data protection law (see also Art. 77 GDPR).
In addition, the provider is obliged to inform all recipients to whom it has disclosed data of any rectification or erasure of data, or any restriction of processing, carried out pursuant to Articles 16, 17 (1) and 18 GDPR. This obligation does not apply where such notification is impossible or involves disproportionate effort. Notwithstanding this, the user has a right to information about these recipients.
Users and data subjects also have the right under Art. 21 GDPR to object to the future processing of data concerning them where the data is processed by the provider pursuant to Art. 6 (1) (f) GDPR. In particular, an objection to data processing for the purpose of direct marketing is permissible.
III. Information on data processing
Data processed when you use our website is erased or blocked as soon as the purpose of storage ceases to apply, no statutory retention obligations prevent erasure, and no different information is provided below in relation to individual processing operations.
Server data
For technical reasons, in particular to ensure a secure and stable website, data is transmitted by your internet browser to us or to our web space provider. These so-called server log files record, among other things, the type and version of your internet browser, the operating system, the website from which you switched to our website (referrer URL), the page(s) of our website that you visit, the date and time of the respective access, and the IP address of the internet connection from which our website is used.
The data collected in this way is stored temporarily, but not together with any other data relating to you.
This storage takes place on the legal basis of Art. 6 (1) (f) GDPR. Our legitimate interest lies in the improvement, stability, functionality and security of our website.
The data is erased after seven days at the latest, unless further retention is required for evidentiary purposes. Otherwise the data is exempt from erasure in whole or in part until an incident has been finally clarified.
Cookies
a) Session cookies
Our website uses so-called cookies. Cookies are small text files or other storage technologies that the internet browser you use places and stores on your device. These cookies process certain information about you to an individual extent, such as your browser or location data or your IP address.
This processing makes our website more user-friendly, more effective and more secure, because it enables, for example, the display of our website in different languages or the provision of a shopping basket function.
The legal basis for this processing is Art. 6 (1) (b) GDPR where these cookies process data for the initiation or performance of a contract. If the processing does not serve the initiation or performance of a contract, our legitimate interest lies in improving the functionality of our website. The legal basis is then Art. 6 (1) (f) GDPR.
This website uses the following types of cookies, whose scope and functioning are explained below:
Transient cookies (see b)
Persistent cookies (see c)
- b) Transient cookies are deleted automatically when you close your browser. These include, in particular, session cookies. They store a so-called session ID, which allows different requests from your browser to be assigned to the shared session. This makes it possible to recognise your computer when you return to our website. Session cookies are deleted when you log out or close your browser.
- c) Persistent cookies are deleted automatically after a defined period, which may vary depending on the cookie. You can delete cookies at any time in the security settings of your browser.
For the management of the cookies and comparable technologies used (tracking pixels, web beacons etc.) and the consents required for them we use the consent tool “Real Cookie Banner”. Details on how “Real Cookie Banner” works are available at <a href=”https://devowl.io/de/rcb/datenverarbeitung/” rel=”noreferrer” target=”_blank”>https://devowl.io/de/rcb/datenverarbeitung/</a>.
The legal bases for the processing of personal data in this context are Art. 6 (1) (c) GDPR and Art. 6 (1) (f) GDPR. Our legitimate interest is the management of the cookies and comparable technologies used and of the consents required for them.
The provision of the personal data is neither required by contract nor necessary for the conclusion of a contract. You are not obliged to provide the personal data. If you do not provide the personal data, we cannot manage your consents.
b) Third-party cookies
Where applicable, our website also uses cookies from partner companies with which we cooperate for the purposes of advertising, analysis or the functionalities of our website.
For details, in particular on the purposes and the legal bases for the processing of such third-party cookies, please refer to the information set out below.
c) How to remove cookies
You can prevent or restrict the installation of cookies through a setting in your internet browser. You can also delete cookies that have already been stored at any time. However, the steps and measures required for this depend on the specific internet browser you use. If you have any questions, please use the help function or documentation of your internet browser or contact its manufacturer or support. In the case of so-called Flash cookies, however, the processing cannot be prevented via the browser settings. Instead, you must change the settings of your Flash player. The steps and measures required for this also depend on the specific Flash player you use. If you have any questions, please likewise use the help function or documentation of your Flash player or contact the manufacturer or user support.
If you prevent or restrict the installation of cookies, this may mean that not all functions of our website can be used to their full extent.
Contract processing
The data you transmit in order to make use of our range of goods and/or services is processed by us for the purpose of contract processing and is necessary for that purpose. Conclusion and performance of the contract are not possible without the provision of your data.
The legal basis for the processing is Art. 6 (1) (b) GDPR.
We erase the data upon complete performance of the contract, but must observe the retention periods required by tax and commercial law.
As part of contract processing, we pass your data on to the transport company commissioned to deliver the goods, or to the financial services provider, where such disclosure is necessary for the delivery of the goods or for payment purposes.
The legal basis for the disclosure of the data is then Art. 6 (1) (b) GDPR.
Customer account / registration function
If you create a customer account with us via our website, we will collect and process the data you enter during registration (for example your name, your address or your e-mail address) exclusively for pre-contractual services, for the performance of the contract or for the purpose of customer care (for example in order to provide you with an overview of your previous orders with us, or to be able to offer you the so-called wish list function). At the same time we store the IP address and the date and time of your registration. This data is of course not passed on to third parties.
In the course of the further registration process your consent to this processing is obtained and reference is made to this privacy policy. The data collected by us in this context is used exclusively for the provision of the customer account.
Where you consent to this processing, Art. 6 (1) (a) GDPR is the legal basis for the processing.
Where the opening of the customer account additionally serves pre-contractual measures or the performance of the contract, the legal basis for this processing is also Art. 6 (1) (b) GDPR.
You may withdraw the consent you have given us for the opening and maintenance of the customer account at any time with effect for the future in accordance with Art. 7 (3) GDPR. To do so, you only need to inform us of your withdrawal.
The data collected in this context is erased as soon as the processing is no longer necessary. In doing so, however, we must observe the retention periods required by tax and commercial law.
Credit and scoring checks
Where, within the scope of our range of goods or services, we offer you the basic option of payment by invoice and you make use of it, we reserve the right to obtain a credit report from a credit agency (such as Creditreform, Schufa, Bürgel or infoscore) on the basis of mathematical and statistical procedures. For this purpose we forward your data to the credit agency, to the extent that it is relevant to the contract, such as your name and your address. We use the resulting information on the statistical probability of a payment default for our decision as to whether we offer you payment by invoice.
The legal basis for this processing is our legitimate interest in protecting ourselves against payment defaults pursuant to Art. 6 (1) (f) GDPR.
Newsletter
If you subscribe to our free newsletter, the data requested from you for this purpose, i.e. your e-mail address and — optionally — your name and your address, is transmitted to us. At the same time we store the IP address of the internet connection from which you access our website as well as the date and time of your registration. In the course of the further registration process we will obtain your consent to the sending of the newsletter, describe its content specifically and refer to this privacy policy. We use the data collected in this context exclusively for sending the newsletter — it is therefore in particular not passed on to third parties.
You may withdraw your consent to the sending of the newsletter at any time with effect for the future in accordance with Art. 7 (3) GDPR. To do so, you only need to inform us of your withdrawal or use the unsubscribe link contained in every newsletter.
We use Sendinblue to send our newsletter. Sendinblue is a service provided by Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, hereinafter referred to only as “Sendinblue”.
If you subscribe to our newsletter, the data requested during the registration process (your e-mail address) is processed by Sendinblue. In addition, your IP address and the date and time of your registration are stored. In the course of the further registration process your consent to the sending of the newsletter is obtained, its content is described specifically and reference is made to this privacy policy.
Sendinblue also provides further data protection information at the following addresses:
The newsletters sent by Sendinblue contain technologies that allow us to identify in the analyses whether and when an e-mail was opened and whether and which links contained in the newsletter were followed. We store this data alongside the technical data (system data and IP address) so that the respective newsletter can be tailored optimally to your wishes and interests. The data collected in this way is therefore used to continuously improve the quality of our newsletters.
The legal basis for sending the newsletter and for the analysis is Art. 6 (1) (a) GDPR.
You may withdraw your consent to the sending of the newsletter at any time with effect for the future in accordance with Art. 7 (3) GDPR. To do so, you only need to inform us of your withdrawal or use the unsubscribe link contained in every newsletter.
If you have provided us with your e-mail address when purchasing goods or services, we reserve the right to send you topic-specific information by e-mail in the future. We do not need to obtain separate consent from you for this. The data processing in this respect takes place solely on the basis of our legitimate interest in personalised direct advertising pursuant to Art. 6 (1) (f) GDPR. If you objected to the use of your e-mail address for this purpose at the outset, we will not send you any e-mails. You are entitled to object to the use of your e-mail address for the aforementioned advertising purpose at any time with effect for the future by notifying the controller named at the beginning. Upon receipt of your objection, the use of your e-mail address for advertising purposes will cease immediately.
Contact requests / how to contact us
If you contact us via the contact form or by e-mail, the data you provide is used to process your enquiry. Providing this data is necessary in order to process and answer your enquiry — without it we cannot answer your enquiry, or can do so only to a limited extent.
The legal basis for this processing is Art. 6 (1) (b) GDPR.
Your data is erased once your enquiry has been answered conclusively and no statutory retention obligations prevent erasure, as may be the case where contract processing follows.
Online job applications / publication of job advertisements
We offer you the possibility of applying to us via our website. In the case of these digital applications, your applicant and application data is collected and processed by us electronically for the purpose of conducting the application procedure.
The legal basis for this processing is Sec. 26 (1) sentence 1 BDSG in conjunction with Art. 88 (1) GDPR.
If an employment contract is concluded following the application procedure, we store the data you submitted with your application in your personnel file for the purposes of the usual organisational and administrative process — observing, of course, the further legal obligations.
The legal basis for this processing is likewise Sec. 26 (1) sentence 1 BDSG in conjunction with Art. 88 (1) GDPR.
If an application is rejected, we automatically erase the data submitted to us two months after notification of the rejection. Erasure does not take place, however, where statutory provisions require longer storage of up to four months or until the conclusion of court proceedings, for example because of the burden of proof under the German General Equal Treatment Act (AGG).
The legal basis in this case is Art. 6 (1) (f) GDPR and Sec. 24 (1) no. 2 BDSG. Our legitimate interest lies in legal defence and the enforcement of legal claims.
If you expressly consent to longer storage of your data, for example in order to be included in an applicant or talent pool, the data will be processed further on the basis of your consent. The legal basis is then Art. 6 (1) (a) GDPR. You may of course withdraw your consent at any time in accordance with Art. 7 (3) GDPR by informing us, with effect for the future.
etracker
Some of our web pages use services provided by etracker GmbH, Hamburg, Germany. By default we do not use cookies for web analytics. Where we do use analytics and optimisation cookies, we obtain your explicit consent separately in advance. If that is the case and you agree, cookies are used that enable a statistical reach analysis of this website, a measurement of the success of our online marketing activities and testing procedures, for example to test and optimise different versions of our online offering or its components. Cookies are small text files stored by the internet browser on the user’s device. etracker cookies do not contain any information that would allow a user to be identified.
The data generated with etracker is processed and stored by etracker exclusively in Germany on behalf of the provider of this website and is therefore subject to strict German and European data protection laws and standards. etracker has been independently audited and certified in this respect and awarded the data protection seal of approval.
The data processing takes place on the basis of the statutory provisions of Art. 6 (1) (f) (legitimate interest) of the General Data Protection Regulation (GDPR). Our concern within the meaning of the GDPR (legitimate interest) is the optimisation of our online offering and our website. As the privacy of our visitors matters to us, data that could potentially be related to an individual, such as the IP address, log-in or device identifiers, is anonymised or pseudonymised at the earliest possible stage. The data is not used for any other purpose, combined with other data or passed on to third parties. You can find more information at https://www.etracker.com/datenschutz/.
Use of Google Tag Manager
- Description and scope of the data processing
We use Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Tag Manager is used to manage website tags that integrate tracking and analytics tools (e.g. Google Ads, Google Analytics). The Tag Manager itself does not collect personal data; it controls the firing of other tags which may, under certain circumstances, collect data such as IP addresses, click IDs or conversion data (e.g. order values). - Legal basis for the data processing
Google Tag Manager and the associated tags are used only after your express consent pursuant to Art. 6 (1) (a) GDPR. You may withdraw your consent at any time (see the section “Withdrawing your consent”). - Purpose of the data processing
Google Tag Manager is used to manage tracking and analytics tools efficiently and to optimise our website and our advertising. The integrated tags serve to analyse user behaviour (e.g. page views) and to measure conversions (e.g. purchases or form submissions) in order to assess the effectiveness of our advertising campaigns. - Consent and Google Consent Mode
We use Google Consent Mode v2 to ensure that tracking tags are only loaded after your consent. Without your consent, no personal data is processed via tracking tags. You can adjust your preferences via our consent management tool, which allows you to consent to or reject advertising, analytics and other purposes separately. - Transfer of data to third countries
When Google Tag Manager is used, data (e.g. IP addresses, conversion data) may be transferred to Google servers in the USA. Google is certified under the EU-US Data Privacy Framework (DPF), which governs the transfer of personal data to the USA. In addition, we have concluded a data processing agreement (DPA) with Google that includes standard contractual clauses (SCC) in order to ensure the protection of your data in accordance with the GDPR. - Storage period
Google Tag Manager itself does not store any personal data. The storage period for data collected by integrated tags (e.g. Google Ads or Analytics) depends on the settings of the respective services. You will find further information in the sections of our privacy policy relating to those services. - Withdrawing your consentYou may withdraw your consent to the use of tracking tags at any time with effect for the future. To do so, please use our consent management tool, which you can find via the “Cookie settings” link on our website. Alternatively, you can disable tracking by activating the corresponding browser settings (e.g. Do Not Track) or by rejecting cookies.
- Further information
If you have questions about data protection or about the use of Google Tag Manager, you can contact us at datenschutz@opal-holding.com or via our contact form. Further details on data processing by Google can be found in Google’s privacy policy: https://policies.google.com/privacy.
Data processing by social networks
We maintain publicly accessible profiles on social networks. The individual social networks we use are listed below.
Social networks such as Facebook, Twitter and others are generally able to analyse your user behaviour comprehensively when you visit their website or a website with integrated social media content (for example like buttons or advertising banners). Visiting our social media presences triggers numerous processing operations that are relevant to data protection. In detail:
If you are logged into your social media account and visit our social media presence, the operator of the social media portal can assign this visit to your user account. Under certain circumstances, however, your personal data may also be recorded if you are not logged in or do not have an account with the respective social media portal. In this case the data is collected, for example, via cookies stored on your device or by recording your IP address.
With the help of the data collected in this way, the operators of the social media portals can create user profiles in which your preferences and interests are stored. In this way, interest-based advertising can be displayed to you both inside and outside the respective social media presence. If you have an account with the respective social network, interest-based advertising can be displayed on all devices on which you are logged in or have been logged in.
Please also note that we cannot trace all processing operations on the social media portals. Depending on the provider, further processing operations may therefore be carried out by the operators of the social media portals. For details, please refer to the terms of use and privacy policies of the respective social media portals.
Legal basis
Our social media presences are intended to ensure the broadest possible presence on the internet. This constitutes a legitimate interest within the meaning of Art. 6 (1) (f) GDPR. The analysis processes initiated by the social networks may be based on different legal bases, which must be stated by the operators of the social networks (for example consent within the meaning of Art. 6 (1) (a) GDPR).
Controller and exercising rights
If you visit one of our social media presences (for example Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered during this visit. In principle you can exercise your rights (access, rectification, erasure, restriction of processing, data portability and complaint) both against us and against the operator of the respective social media portal (for example against Facebook).
Please note that, despite the joint responsibility with the social media portal operators, we do not have full influence over the data processing operations of the social media portals. Our options depend largely on the corporate policy of the respective provider.
Storage period
The data collected directly by us via the social media presence is deleted from our systems as soon as the purpose for storing it ceases to apply, you ask us to delete it, you withdraw your consent to storage, or the purpose for storing the data no longer applies. Stored cookies remain on your device until you delete them. Mandatory statutory provisions – in particular retention periods – remain unaffected.
We have no influence on the storage period of your data that is stored by the operators of the social networks for their own purposes. For details, please contact the operators of the social networks directly (for example in their privacy policy, see below).
Social networks in detail
We maintain a profile on Facebook. The provider of this service is Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. According to Facebook, the data collected is also transferred to the USA and to other third countries.
We have concluded a joint processing agreement (Controller Addendum) with Facebook. This agreement sets out which data processing operations we and Facebook respectively are responsible for when you visit our Facebook page. You can view this agreement at the following link: https://www.facebook.com/legal/terms/page_controller_addendum.
You can adjust your advertising settings yourself in your user account. To do so, click the following link and log in: https://www.facebook.com/settings?tab=ads. For details, please refer to the privacy policy of Facebook: https://www.facebook.com/about/privacy/.
We use the microblogging service Twitter. The provider is Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland.
You can adjust your Twitter privacy settings yourself in your user account. To do so, click the following link and log in: https://twitter.com/personalization. For details, please refer to the privacy policy of Twitter: https://twitter.com/de/privacy.
We maintain a profile on Instagram. The provider is Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA. For details on how they handle your personal data, please refer to the privacy policy of Instagram: https://help.instagram.com/519522125107875.
We maintain a profile on Pinterest. The operator is Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. For details on how they handle your personal data, please refer to the privacy policy of Pinterest: https://policy.pinterest.com/de/privacy-policy.
We maintain a profile on XING. The provider is New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany. For details on how they handle your personal data, please refer to the privacy policy of XING: https://privacy.xing.com/de/datenschutzerklaerung.
We maintain a profile on LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Irland. LinkedIn uses advertising cookies.
If you would like to deactivate LinkedIn advertising cookies, please use the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
For details on how they handle your personal data, please refer to the privacy policy of LinkedIn: https://www.linkedin.com/legal/privacy-policy.
Tumblr
We maintain a profile on Tumblr. The provider is Tumblr, Inc., 35 East 21st St, 10th Floor, New York, NY 10010, USA. For details on how they handle your personal data, please refer to the privacy policy of Tumblr: https://www.tumblr.com/privacy/de.
Vimeo
We maintain a profile on Vimeo. The provider is Vimeo, Inc., 555 West 18th Street, New York 10011, USA. For details on how they handle your personal data, please refer to the privacy policy of Vimeo: https://vimeo.com/privacy.
YouTube
We maintain a profile on YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For details on how they handle your personal data, please refer to the privacy policy of YouTube: https://policies.google.com/privacy?hl=de.
Note on data transfers to the USA
Our website incorporates, among other things, tools from companies based in the USA. When these tools are active, your personal data may be passed on to the US servers of the respective companies. We point out that the USA is not a safe third country within the meaning of EU data protection law. US companies are obliged to hand over personal data to security authorities without you, as the data subject, being able to take legal action against this. It can therefore not be ruled out that US authorities (for example intelligence services) process, evaluate and permanently store your data held on US servers for surveillance purposes. We have no influence on these processing activities. Please send all requests for information, access requests or objections to the data processing by e-mail to: datenschutz@opal-holding.com
Based on the model privacy policy of the law firm Weiß & Partner and er-secure.de