1) Information about the collection of personal data and contact details of the controller 1.1 Below, we inform you about how your personal data is handled. Personal data means all data by which you can be personally identified. Please carefully review which personal data you share with us via Facebook. As long as you are logged into your Facebook account and visit our Facebook profile, Facebook may associate this with your Facebook profile. We expressly point out that Facebook stores its users’ data (e.g. personal information, IP address, etc.) and may also use it for business purposes. Further information on Facebook’s data processing can be found in Facebook’s Privacy Policy at https://de-de.facebook.com/policy.php. We have no influence over the collection of data and its further processing by Facebook. Furthermore, we are unable to determine to what extent, in which location, and for how long Facebook stores the data, to what extent Facebook complies with existing deletion obligations, which analyses and links are created by Facebook using the data, and to whom Facebook discloses the data. If you wish to avoid Facebook processing personal data transmitted by you to us, please contact us by other means. You can find our full contact details in our legal notice on Facebook. 1.2 The controller for data processing within the meaning of the General Data Protection Regulation (GDPR) is Acqua Alpes GmbH, Dr. Gustav-Markt-Weg 16, 6401 Inzing, Austria, Tel.: +43 512 327788, Fax: +43 512 32778840, E-Mail: parfum@acquaalpes.com, insofar as we exclusively process the data transmitted to us by you via Facebook ourselves. Insofar as the data transmitted to us by you via Facebook is also or exclusively processed by Facebook (Insights data), Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland, is also a controller for data processing within the meaning of the General Data Protection Regulation (GDPR), alongside us. In this respect, the data processing is carried out on the basis of an agreement between joint controllers pursuant to Art. 26 GDPR, which you can view here: https://www.facebook.com/legal/terms/page_controller_addendum. The controller responsible for the processing of personal data is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data. 2) Data Protection Officer You can contact Facebook’s Data Protection Officer via the online contact form provided by Facebook at https://www.facebook.com/help/contact/540977946302970. 3) Data processing when contacting us 3.1 We ourselves collect personal data when you contact us, for example via the contact form or Messenger. Which data we collect when you contact us via the contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of responding to your request or for contacting you and the associated technical administration. The legal basis for processing the data is our legitimate interest in responding to your request in accordance with Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, then additional Legal basis for processing: Art. 6(1)(b) GDPR. Your data will be deleted once your inquiry has been fully processed, provided there are no statutory retention obligations to the contrary. We assume that processing has been fully completed when the circumstances indicate that the matter in question has been conclusively clarified. 3.2 WhatsApp Business We offer visitors to our Facebook page the opportunity to contact us via the WhatsApp messaging service provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For this purpose, we use the so-called “Business version” of WhatsApp. If you contact us via WhatsApp in connection with a specific business matter (for example, an order you have placed), we store and use the mobile phone number you use on WhatsApp and—if provided—your first and last name in accordance with Art. 6(1)(b) GDPR in order to process and respond to your request. On the basis of the same legal ground, we may also ask you via WhatsApp to provide further data (order number, customer number, address or email address) in order to assign your inquiry to a specific transaction. If you use our WhatsApp contact for general inquiries (for example, regarding our range of services, availability, or our website), we store and use the mobile phone number you use on WhatsApp and—if provided—your first and last name in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in providing the requested information efficiently and promptly. Your data will only ever be used to respond to your request via WhatsApp. It will not be shared with third parties. Please note that WhatsApp Business has access to the address book of the mobile device we use for this purpose and automatically transmits telephone numbers stored in the address book to a server of its parent company, Facebook Inc., in the USA. For the operation of our WhatsApp Business account, we use a mobile device whose address book stores only the WhatsApp contact data of users who have also contacted us via WhatsApp. This ensures that every person whose WhatsApp contact data is stored in our address book has already consented, upon first using the app on their device by accepting the WhatsApp Terms of Use, to the transfer of their WhatsApp telephone number from the address books of their chat contacts in accordance with Art. 6(1)(a) GDPR. The transfer of data of users who do not use WhatsApp and/or have not contacted us via WhatsApp is therefore excluded. For the purpose and scope of data collection and the further processing and use of the data by WhatsApp, as well as your related rights and settings options for protecting your privacy, please refer to WhatsApp’s privacy policy: https://www.whatsapp.com/legal/?eea=1#privacy-policy 4) Data processing for contract performance If your contact via Facebook serves as the basis for a contract with us for the delivery of goods and/or the provision of services, we will additionally process the data you have transmitted to us in this context as follows in the event that a contract is concluded: 4.1 We transmit your payment data to the commissioned credit institution within the scope of payment processing, insofar as this is necessary for is required for payment processing. The legal basis for the transfer of the data is Art. 6(1)(b) GDPR. 4.2 In contracts for the delivery of goods, we pass on the personal data collected by us to the transport company commissioned with the delivery as part of the contract processing, insofar as this is necessary for the delivery of the goods. 4.3 In contracts for the delivery of goods, we work with external shipping partners (dropshipping) to fulfil our contractual obligations towards our customers. We pass on your name and your delivery address exclusively for the purpose of delivering the goods to a shipping partner selected by us in accordance with Art. 6(1)(b) GDPR. 5) Data processing for direct advertising 5.1 Advertising by post Based on our legitimate interest in personalised direct advertising, we reserve the right to store your first and last name, your postal address and—provided that we have received this additional information from you within the scope of the contractual relationship—your title, academic degree, year of birth, and your professional, industry, or business designation in accordance with Art. 6(1)(f) GDPR and to use this information to send you interesting offers and information about our products by post. You may object at any time to the storage and use of your data for this purpose by sending a corresponding message to the controller. 5.2 WhatsApp newsletter If you sign up for our WhatsApp newsletter, we will regularly send you information about our offers via WhatsApp. The only mandatory information required for sending the newsletter is your mobile phone number. To receive the newsletter, please save the mobile number we have provided in the address book of your mobile device and send us the message “Start” via WhatsApp. By sending this WhatsApp message, you give us your consent to use your personal data in accordance with Art. 6(1)(a) GDPR for the purpose of sending the newsletter. We will then add you to our newsletter distribution list. The data we collect when you register for the newsletter is processed exclusively for promotional communication via the newsletter. You can unsubscribe from the newsletter at any time by sending us the message “Stop” via WhatsApp. After you unsubscribe, your email address will be deleted from our newsletter distribution list without undue delay, unless you have expressly consented to further use of your data or we reserve the right to use data beyond this where legally permitted and as explained in this statement. Please note that WhatsApp gains access to the address book of the mobile device we use for sending the newsletter and automatically transfers telephone numbers stored in the address book to a Facebook server in the USA. For the dispatch of our WhatsApp newsletter, we therefore use a mobile device in whose address book only the WhatsApp contact details of our newsletter recipients are stored. This ensures that every person whose WhatsApp contact details are stored in our address book has already consented, upon first use of the app on their device by accepting the WhatsApp terms of use, to the transfer of their WhatsApp phone number from the address books of their chat contacts in accordance with Art. 6(1)(a) GDPR. A transfer of data of such users who The use of WhatsApp and/or contact with us via WhatsApp is excluded in this respect if you do not use WhatsApp and/or have not contacted us via WhatsApp. Please refer to WhatsApp’s privacy policy for the purpose and scope of data collection and the further processing and use of data by WhatsApp, as well as your related rights and settings options for protecting your privacy: https://www.whatsapp.com/legal/?eea=1#privacy-policy 6) Data processing for statistical and marketing purposes 6.1 Page Insights Facebook provides us with so-called Page Insights for our Facebook page: https://www.facebook.com/business/a/page/page-insights. These are aggregated data that allow us to gain insights into how people interact with our page. Page Insights may be based on personal data collected in connection with a visit to or interaction by individuals on or with our page and its content. This serves, pursuant to Art. 6 para. 1 lit. f GDPR, to safeguard our legitimate interests, which prevail within the framework of a balancing of interests, in an optimized presentation of our offering and effective communication with customers and prospective customers. You may object to the processing of your data for the aforementioned purposes at any time by changing your advertising settings in your Facebook user account accordingly at https://www.facebook.com/settings?tab=ads. 6.2 Facebook Lead Ads We use the “Lead Ads” function of Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Facebook”), in order to collect and process certain personal data of interested parties—so-called leads—via a contact form displayed on Facebook websites (so-called “instant form”). The content and scope of the data requested in this form depend on the focus of the respective lead campaign. The processing of the data is strictly limited to the purposes pursued with the respective lead ad campaign. These purposes are clearly stated within the lead ad or on the provided form before the specified data are transmitted. Depending on the focus of the lead ad campaign, the legal basis for data processing is either your express consent pursuant to Art. 6 para. 1 lit. a GDPR (for example, for direct marketing measures such as registration for the email newsletter) or our legitimate interest in the optimal marketing of our offering pursuant to Art. 6 para. 1 lit. f GDPR. The data will not be disclosed to third parties. As part of the aforementioned services, data transmitted via instant forms may be stored on servers of Facebook Inc., 1601 Willow Rd, Menlo Park, CA 94025, USA. Further information on data processing via Facebook Lead Ads can be found in Facebook’s Data Policy at https://de-de.facebook.com/privacy/explanation 7) Rights of the data subject 7.1 The applicable data protection law grants you comprehensive rights as a data subject vis-à-vis the controller with regard to the processing of your personal data (rights of access and intervention), about which we inform you below: - Right of access pursuant to Art. 15 GDPR; - Right to rectification pursuant to Art. 16 GDPR; - Right to erasure pursuant to Art. 17 GDPR; - Right to restriction of processing pursuant to Art. 18 GDPR; - Right to be informed pursuant to Art. 19 GDPR; - Right to data portability pursuant to Art. 20 GDPR; - Right to withdraw consent granted pursuant to Art. 7 para. 3 GDPR; - Right to Complaint pursuant to Art. 77 GDPR. 7.2 RIGHT TO OBJECT IF, WITHIN THE FRAMEWORK OF A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME, FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE. IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FUNDAMENTAL FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS. IF YOUR PERSONAL DATA IS PROCESSED BY US FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE. IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES. 8) Duration of the storage of personal data The duration of the storage of personal data is determined by the respective legal basis, the purpose of processing and – where applicable – additionally by the respective statutory retention period (e.g. retention periods under commercial and tax law). When personal data is processed on the basis of express consent pursuant to Art. 6 para. 1 lit. a GDPR, this data is stored until the data subject withdraws their consent. If statutory retention periods exist for data processed within the framework of contractual or quasi-contractual obligations on the basis of Art. 6 para. 1 lit. b GDPR, this data is routinely deleted after expiry of the retention periods, provided it is no longer required for the performance or initiation of a contract and/or there is no longer any legitimate interest on our part in further storage. When personal data is processed on the basis of Art. 6 para. 1 lit. f GDPR, this data is stored until the data subject exercises their right to object pursuant to Art. 21 para. 1 GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims. When personal data is processed for the purpose of direct marketing on the basis of Art. 6 para. 1 lit. f GDPR, this data is stored until the data subject exercises their right to object pursuant to Art. 21 para. 2 GDPR. Unless otherwise stated in the other information in this declaration regarding specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.
