Data Privacy Declaration

Data protection is important to us, and we immensely value the protection of your data and the maintenance of your privacy. In the following section, we present how we use which data, when, and for what purpose, as well as our legal basis for doing so.

According to our informational obligations under the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the Telemedia Act (TMG), this information is intended to provide you with the best possible understanding of the function of services we offer, as well as how we ensure your personal data is protected while we provide our services.

1. Controller

The controller in the sense of Art. 4 clause 7 GDPR responsible for processing personal data is:

schwa-medico Medizinische Apparate Vertriebsgesellschaft mbH
Wetzlarer Straße 41-43
35630 Ehringshausen
Germany

Managing Director: Dr. Roger Pierenkemper

Telephone: +49 6443 8333 - 0
Fax: : +49 6443 8333 - 155

2. Contact partner for data protection

If you have questions about how your personal data is processed, or about your rights related to data protection, please contact:

schwa-medico Medizinische Apparate Vertriebsgesellschaft mbH
- Legal department and data protection -
Wetzlarer Straße 41-43
35630 Ehringshausen
Germany

Data Protection Officer: Sibylle Wirth

Email: datenschutz@schwa-medico.de
Fax: +49 6443 8333 - 136

3. What is personal data?

In accordance with Art. 4 clause 1 of the GDPR, personal data includes all information that relates to an identified or identifiable natural person. A natural person is considered identifiable if they can be identified either directly or indirectly, in particular by being associated with an identifier such as a name, an ID number, location data, an online ID or other features.

The GDPR calls such individuals “data subjects.” Further information is available, for instance, in Art. 4 clause 1 of the GDPR.

4. Data when visiting this page

4.1 Hosting and log files

When you access our website, our web server automatically records data and information from your device’s system and stores this data in server log files. This data is automatically transmitted by your browser when you access our website:

Time stamp for the page access by request to the web server
URL of the accessed website
Browser type and version used by you
The operating system transmitted to us by your browser
IP address of your computer, masked, for instance by zeroing out the last octet.
The purpose of this processing is to ensure accessibility to the page from the device you are using, and to ensure the best possible display through adaptation. In addition, we use this data to optimize the website and ensure system security. This data is never evaluated for marketing purposes.

Art. 6 para. 1 lit. f) GDPR serves as the legal basis for processing. We have a legitimate interest in presenting a website that is optimized for your browser, and facilitating communication for you between our server and your device. Your IP address, in particular, must be processed to ensure the latter.

Data is stored for 10 days, and older logs are overwritten automatically.
The recipient of the data is our server host, which works on our behalf under a contract processing agreement:

Platform.sh GmbH
Marienstr. 90
50825 Cologne
Germany

Further information on data protection by Platform.sh is available at https://platform.sh/privacy-policy/. You have the right to object. You can exercise this right using the contact information provided for our company.

4.2 Content Delivery Network (CDN)

We use the CDN service “Fastly” in order to provide this website in an optimal manner. Fastly operates servers worldwide for distributing traffic, ensuring fast and secure delivery of this website (Content Delivery Network). this is linked to our web hoster via DNS. The flow of information between your browser and our website is managed via the Fastly network. This allows the page to be delivered more quickly through traffic analysis and filtering out malicious traffic. Fastly uses cookies or other technologies to recognize internet users. This information is not used for any purpose beyond what is described.

Art. 6 para. 1 lit. f) GDPR serves as the legal basis for processing. We have a legitimate interest in delivering our website as quickly and securely as possible, in the most error-free manner possible.

The recipient of the data is the operator of the CDN, which works on our behalf under a contract processing agreement:

Fastly, Inc.
475 Brannan St. #300
San Francisco, CA 94107
USA

Fastly, Inc. is Privacy Shield certified. Further information on security and data protection at Fastly is available at: https://www.fastly.com/privacy

You have the right to object. You can exercise this right using the contact information provided for our company.

4.3 Cookies

Our website uses cookies. These are small text files stored on your device to make the use of a website more convenient. These may include functions such as storing settings or recognizing a user's device, and they use a cookie ID to do so. Cookies help us make our website as user-friendly and customized as possible for you as the website visitor. We use both our own cookies and cookies from third-party providers.

You can configure the ways in which cookies are stored at any time. You can restrict the storage of cookies in your browser settings, prevent all cookies from being stored, or set your browser to delete all cookies when you close your browser window. In addition, you can configure cookies using the pop-up window at the bottom of the page. We differentiate between the following categories of cookies:

Technically necessary cookies: These are required to ensure the smooth functioning of the website. We use these in accordance with Art. 6 para. 1 lit. c) GDPR.
Analytic cookies: These measure the range of our website and are used to optimize it according to Art. 6 para. 1 lit. a) GDPR.
Cookies for marketing purposes (not currently implemented): These allow us to advertise for our services through interest-based advertising. The user must agree to this option, which is delivered in accordance with Art. 6 para. 1 lit. a) GDPR.

5. Our services on this page

5.1 Contact form

There is a contact form on our page. You can use this to get in touch with us electronically. If you want to use the form to get in contactwith us, then the data you enter into the input fields will be processed by us, and includes the following:

Salutation
Complete name
Any company affiliation
Contact information (phone, e-mail)
Customer category
Information entered under “Message.”

When you send the form, your IP address (see “log files”) and the time of sending are also stored. We treat mandatory and voluntary information the same. Mandatory information is required to get in touch with you and process your inquiry.

The purpose of processing personal data provided as mandatory information and voluntary information is to process the contact inquiry, and to get in touch with you. The legal basis for processing the personal data you provide for the purpose of contacting us is Art. 6 para. 1 lit. b) GDPR.

Further personal data is collected during submission to prevent misuse of our contact form. The legal basis for doing so is our legitimate interest in accordance with Art. 6 para. 1 lit. f) GDPR in preventing misuse of the contact form or providing evidence of such misuse.

Data is deleted once it is no longer necessary to achieve the purpose for which it was collected. The recipient of the data is our email host, which works on our behalf under a contract processing agreement.

5.2 Contact

You can contact us via mail, phone, fax, or email. Depending on the data you provide when you contact us, we will get in touch with you via phone, fax, or email as you request. We may call or write you back if necessary.

If you get in touch with us via mail, we may, in particular, process your address data (such as your first and last name, street, city, zip code), the date and time at which the letter was received and all data stated in your letter.
If you contact us via phone, we may, in particular, process your telephone number and your name, e-mail address, the time of your call and details on your inquiry collected on request during the discussion.
If you contact us by fax, we may, in particular, process the fax number and sender recognition, as well as any data included in the fax.
If you contact us via e-mail, we may, in particular, process your e-mail address, the time of your e-mail as well as any data included in the text of the message (as well as any attachments).
The purpose of processing the above data is to process your contact inquiry and to get in touch with the inquiring party in order to handle their concern or question.

Art. 6 para. 1 lit. f) GDPR forms the legal basis for the described processing of personal data. We have a legitimate interest in offering you the opportunity to contact us at all times, and to have your inquiries answered. Your personal data is processed for as long as necessary to complete your contact inquiry, and is received or processed by the following companies:

1. Email hoster (Microsoft Azure)

After you submit the contact form or your e-mail to us, it is received and processed by our email host. The host works on our behalf under a contract data processing agreement.

Microsoft Ireland Operations Limited
South County Business Park, Leopardstown
Dublin 18
Irland

Further information on data protection by Microsoft is available at the following link: https://privacy.microsoft.com/de-de/privacystatement

2. Customer Relationship Management (“CRM”) Hubspot

We use Hubspot CRM to serve as an interface between our back office and sales, in order to answer inquiries from our customers in the most efficient and targeted way possible. Inquiries submitted to us via e-mail or using the contact form are processed via Hubspot, then answered by our employees. The host works on our behalf under a contract data processing agreement.

HubSpot Ireland Limited
Ground Floor, Two Dockland Central
Guild Street, Dublin 1
Irland

Further information on data protection by HubSpot is available at the following link: https://legal.hubspot.com/privacy-policy

6. Integrated services on this page

6.1 Google services

On this page, we use a variety of services from Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. Due to the integration of Google services, Google may be able to collect and process information that could include personal data. The possibility that Google may transmit this information to servers in third countries cannot be excluded.

Under the Privacy Shield certification, Google is obligated to comply with the EU-US Privacy Shield Framework and the Swiss-US Privacy Shield Framework. This relates to the collection, use and storage of personal data from EU member states and Switzerland. Google, including Google LLC and its wholly owned subsidiaries in the USA have declared under the certification that they will comply with the principles of the Privacy Shield.

Registration for the Privacy Shield certificate is available at the following link: https://www.privacyshield.gov/list. Information on compliance by Google is available at the following link: https://policies.google.com/privacy/frameworks

We have no way to influence what data Google actually collects, processes and saves. Google itself has indicated that it processes the following information, among other kinds (including personal data):

Log data, in particular IP address
Location-specific information
Unique application numbers
Cookies and similar technologies.

If you are logged into your Google account, Google can add the processed information to your account and treat it like personal data.

This is dependent on your account settings; please see in particular https://policies.google.com/technologies/partner-sites

You can prevent this data from being added directly to your account by logging out of your Google account or by changing your account settings accordingly. In addition, you can also change your cookie settings (delete or block cookies, etc.). Further information and instructions are provided in the “Cookies” section.

Information on the Google Data Privacy Notice is available at the following link: https://policies.google.com/privacy
Information on your privacy settings on Google is available at the following link: https://safety.google/

Google Ads (previously AdWords)

This website uses Google Ads (previously: AdWords), as well as conversion tracking under Google AdWords, an online advertising service of Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads and Google Conversion Tracking is an analytic service provided by Google. When you click an ad displayed by Google, then a so-called “cookie” (a text file) is stored on your device. This allows analysis of the pages you visit on our website. This information (including your IP address) is transmitted to a Google server and stored there; these may include servers in the USA or in third countries. These cookies cease to be valid after 30 days; during this time, we and Google can detect if you click on one of our ads and are forwarded to our website. Since each page visitor receives an individual cookie, cookies can be tracked via website access by AdWords customers; this may be restricted by changing the cookie guidelines. Further information is provided in the “Cookies” section.

Information on Google's Privacy Shield certification is available in the introduction to this section above.
Information on the Google Data Privacy Notice is available at the following link: https://policies.google.com/privacy
Information on Google's privacy settings is available at https://safety.google/

Art. 6 para. 1 lit. a) GDPR forms the legal basis for the described processing of personal data. You have the right to object. You can exercise this right using the contact information provided for our company.

Google Analytics

We use a variety of services from Google Analytics, a web analytics service of Google Ireland Limited (“Google“), Gordon House, Barrow Street, Dublin 4, Ireland on our website.

Google Analytics uses cookies to facilitate analysis of the websites you visit. In addition, Google Analytics may also use “web beacons” (invisible graphics). These web beacons can be used to evaluate information such as visitor traffic on websites. The information generated by the cookies and web beacons regarding use of our website (including the user’s IP address) is transmitted to a Google server and stored there. This server may be located in the USA or in another third state, and according to the Google SLA the information may also be transmitted to other contractual partners of Google.

Google processes the following types of data in this context:

Online identifiers (including cookie IDs)
IP address
Device IDs

Detailed information on the processed data is available at: https://policies.google.com/privacy?hl=de#infocollect
We only use Google Analytics with IP anonymization activated (“anonymize IP”). This function causes Google to truncate your IP address within a member state of the European Union, or in another contracting state to the Agreement on the European Economic Area. The IP address is truncated and transmitted on a Google server in the USA only in exceptional cases.

Furthermore, we have concluded a contract processing agreement with Google for the use of Google Analytics (Art. 28 GDPR). Google processes the data on our behalf in order to analyze use of our website, put together reports on activity on our page, and perform associated services. Google can transmit this information to third parties if this is required by law or if these third parties process this data on behalf of Google.

Integrating Google Analytics allows us to analyze user behavior on our website, which can help us improve our site in a targeted fashion. Art. 6 para. 1 lit. a) GDPR forms the legal basis for the described processing of personal data. As part of this contract processing, Google is entitled to commission subcontractors. A list of these subcontractors is available at https://privacy.google.com/businesses/subprocessors/. The processed information is stored for as long as necessary for the purpose described, or for as long as is required by law.

Further information on how data is handled in conjunction with Google Analytics is available in the Google Data Privacy Declaration:
https://support.google.com/analytics/answer/6004245
Information on Google's privacy settings is available at https://safety.google

You have the right to object. You can exercise this right using the contact information provided for our company.

Provision of personal data is not required either by law or contract, and is not required in order to conclude a contract. You are likewise not obligated to provide your personal data. However, in some circumstances not providing personal data may make it impossible for you to use our website, or to fully utilize all of its functions.

Google Tag Manager

We use the Google Tag Manager on our website. The Google Tag Manager is a service of Google Ireland Limited (“Google“), Gordon House, Barrow Street, Dublin 4, Ireland.

The Google Tag Manager allows us to organize different codes and services, and integrate these on our website in a simplified manner. The Google Tag Manager implements or segregates the tags. In some cases, Google may process information (including personal data). The possibility that this data may be transmitted to a server in the USA or a third country cannot be excluded. In particular, the Google Tag Manager processes the following personal data:

Online identifiers (including cookie IDs)
IP address.

Detailed information on the integration of the Google Tag Manager is available at the following link https://www.google.de/tagmanager/use-policy.html

Furthermore, we have concluded a contract processing agreement with Google for the use of the Google Tag Manager (Art. 28 GDPR). Google processes the data on our behalf in order to trigger the saved tags and display the services on our website. Google can transmit this information to third parties if this is required by law or if these third parties process this data on behalf of Google.

If you have deactivated individual tracking services, the deactivation will remain valid for all tracking tags integrated by the Google Tag Manager. This may be done using the opt-out option for cookies or third-party provider tools.

The purpose of integrating the Google Tag Manager is to integrate a variety of services in a simplified, easy to understand manner. In addition, integrating the Google Tag Manager optimizes the loading times for the different services.

Art. 6 para. 1 lit. a) GDPR forms the legal basis for the described processing of personal data.

The processed information is stored for as long as necessary for the purpose described, or for as long as is required by law. You have the right to object. You can exercise this right using the contact information provided for our company.

Provision of personal data is not required either by law or contract, and is not required in order to conclude a contract. You are likewise not obligated to provide your personal data. However, in some circumstances not providing personal data may make it impossible for you to use our website, or to fully utilize all of its functions.

Use of YouTube

We use videos from YouTube and YouTube plug-ins on our website. YouTube is a service of YouTube LLC (“YouTube”), 901 Cherry Ave., San Bruno, CA 94066, USA and is provided by this entity. YouTube LLC is a subsidiary of Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

YouTube is integrated by embedding the service on our website via a so-called “iFrame.” When you load this iFrame, YouTube or Google may collect information (including personal data) and process this information. The possibility that YouTube or Google may transmit this information to servers in third countries cannot be excluded.

The purpose of integrating YouTube is to present a variety of videos to you on our website, so that you can view them directly on the website.

Art. 6 para. 1 lit. f) GDPR forms the legal basis for the described processing of personal data. We have a legitimate interest in the benefits YouTube offers via its platform. By integrating external videos from YouTube, we reduce traffic on our server and increase loading speed through automatic provision of different playback quality levels. YouTube and Google furthermore have a legitimate interest in using the collected (personal) data to improve their own services.

Further information is available in the YouTube and Google Data Privacy Notices, which are available at the following link: www.google.com/policies/privacy
Information on Google's privacy settings is available at https://safety.google

6.2 Facebook services

We use various services from Facebook on our website. “Facebook” is operated by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.

Facebook Pixel

We have installed Facebook Pixel on the website via the Google Tag Manager. It is accessed from a Facebook server when a user calls up a page, and registers access to the page you have visited. This allows us to use the “Facebook Custom Audience.” According to statements by Facebook, the following information may be collected (including personal data):

Browser information
Websites visited
Hashed Facebook ID of the website user

Further information on Facebook Pixel is available at: https://www.facebook.com/business/help/651294705016616.

Custom Audiences

The marketing tool is a targeting option that compares visitor data on our website with individuals on Facebook, based on the integrated Facebook Pixel. This allows us to appeal to groups of visitors with targeted ads displayed on the Facebook platform. In addition, this service helps reduce scatter losses in the framework of marketing.

Further information on Facebook Custom Audiences is available at the following links:

Facebook Conversations

This service allows us to maintain easier communication via Facebook Chat, and it is integrated into “Hubspot CRM.” Further information is provided in the “Contact“ section.

With respect to services used by Facebook, the possibility that Facebook may transmit information to a server in the USA or a third country cannot be excluded.

Under the Privacy Shield certification, Facebook, Inc. obligated to comply with the EU-US Privacy Shield Framework and the Swiss-US Privacy Shield Framework. This relates to the collection, use and storage of personal data from EU member states and Switzerland. Facebook, Inc. has declared that it will comply with Privacy Shield principles in its certification.

Registration for the Privacy Shield certificate is available at the following link: https://www.privacyshield.gov/list
Information on compliance by Facebook, Inc. is available at: https://de-de.facebook.com/about/privacyshield. Art. 6 para. 1 lit. a) GDPR forms the legal basis for the described processing of personal data. Facebook indicates that information is stored for as long as necessary to provide you or others with products and services.

Further information and contact options are available at the following link: https://de-de.facebook.com/about/privacy/ and the following addresses.

If you live in the USA or Canada:

Facebook, Inc.
1601 Willow Road
Menlo Park, CA 94025

If you live in the rest of the world:

Facebook Ireland Ltd.
4 Grand Canal Square
Grand Canal Harbour, Dublin 2
Ireland

Data Privacy Notices for our Facebook Fanpage Insights

Facebook Ireland Ltd (“Facebook”) provides us with so-called “Facebook-Insights” (“Insights”) as the Facebook Fanpage operator. These Insights are various statistics that provide us with information on how our Facebook Fanpage is used. Detailed information is also available at https://www.facebook.com/business/a/page/page-insights.

To create these statistics, Facebook processes a variety of information provided by you (including personal data). We and Facebook jointly process the personal data as joint controllers in the sense of Art. 26 GDPR. The following section provides important information on the agreement we have concluded with Facebook (https://www.facebook.com/legal/terms/page_controller_addendum) in accordance with Art. 26 GDPR.

Information on the joint controller agreement concluded between ourselves and Facebook

I. Identity of the joint controller

The following parties are jointly responsible for processing

Facebook Ireland Ltd
4 Grand Canal Square
Dublin 2
Irland

und

schwa-medico Medizinische Apparate Vertriebsgesellschaft mbH
Wetzlarer Str. 41-43
35630 Ehringshausen
Germany

Telephone: +49 6443 8333 - 0
Email: info@schwa-medico.de
Fax: +49 6443 8333 - 119

II. Responsibility for processing Insights data

Facebook has accepted the primary responsibility (accepting all obligations under the GDPR) for data processing. This means, in particular:

Facebook undertakes the necessary informational obligations (e.g. Art. 13 GDPR)
Data subjects can assert their rights against Facebook (such as rights to information or deletion, objecting to data processing or revoking any consent after it is granted; cf. also section “V. Rights of data subjects”)
ensuring technical and organizational measures related to data processing. Facebook provides comprehensive information on data processing at www.facebook.com (Art. 13 GDPR). To provide you with an overview of the most important information, we refer in this Data Privacy Notice to the content provided by Facebook.

Regardless of the agreed primary responsibility of Facebook, you are of course also entitled to assert your rights under the GDPR directly against us. We will promptly forward this inquiry to Facebook via a form available for this purpose.

1. Legal basis for processing

The legal bases and purpose of processing by Facebook are available at https://www.facebook.com/
about/privacy/legal_bases and at https://de-de.facebook.com/policy.php. Our legitimate interest according to Art. 6 para. 1 lit. f GDPR serves as the legal basis for processing the Insights data. We have a legitimate interest in tracking user behavior on our Facebook Fanpage. In doing so, in particular, we can track the range and effectiveness of our campaigns, posts and other activities via prepared statistics. This allows us to optimize our website and services on an ongoing basis, according to our needs. This also represents the purpose of processing for our company.

2. Data processing on a Facebook Fanpage

Facebook may, in particular, process the following data:

User interaction (click behavior, posts, likes, video views, page access, etc.)
Cookies
Demographic features (age, gender, German federal state, etc.)
IP address
System and device information (such as browser type, operating system, etc.).
The exact manner in which your data is processed when you visit our Facebook Fanpage depends on whether you have a Facebook account or not:
If you have a Facebook account, then Facebook can permanently associate the data with your account in order to learn more about you.
If you do not have a Facebook account, then Facebook can store your data. It may do so by using cookies. These are generally small text files saved on your device. These text files contain a variety of information that can be read out again at a later time. This allows Facebook to store and process information on you, even if you do not have a Facebook account. Further, detailed information on Facebook cookies is available at
https://de-de.facebook.com/policies/cookies/.

In the course of using Insights, we receive only anonymized statistics from Facebook on the use of our Fanpage. The only thing we can determine is how many users completed certain interactions, not which users carried out a specific action. We are not able to associate Insights statistics with any individual person.

3. Rights of data subjects

In general, you have the following rights:

The right to information (Art. 15 GDPR)
The right to rectification (Art. 16 GDPR)
The right to object (Art. 21 GDPR)
The right to deletion (Art. 17 GDPR)
The right to restrict data processing (Art. 18 f. GDPR)
The right to data portability (Art. 20 GDPR).

You have the right to revoke consent you have granted at any time with future effect, without this affecting the legality of processing carried out by us up to the point of revocation.

You can assert these rights directly against Facebook or against us (cf. Section “II. Responsibility for processing Insights data“). If you would like to assert your rights against us, please contact us at the e-mail address datenschutz@schwa-medico.de and describe your specific concern in as much detail as possible.

You have a right to object to processing using cookies. You may exercise this right, for instance, as follows:

You can restrict or prevent all cookies from being saved using your browser settings. You can also initiate automatic deletion of cookies when you close your browser window. Further information and instructions are provided in the “Cookies” section.
You can also change your cookie settings under https://de-de.facebook.com/policies/cookies/ The sections “If you have a Facebook account” and “Public” (no Facebook account) provide information on how you can object to processing by Facebook.

You can define how long cookies are stored for using your browser by displaying cookies (usually by clicking the “i” beside the address bar, for instance in Firefox or Google Chrome).

7. General information on the provision of data

8. Social networks and external links

In addition to this website, we also maintain a presence on a variety of social media, which you can access via the buttons on our website. If you visit such a social media page, personal data may be transmitted to the provider of the social network.

Please note that information (including personal data) may be transmitted to a server in a third country during this process, and that data may be processed outside of the European Union. US providers, certified under the Privacy Shield, have undertaken to comply with the data protection standards of the EU. Further information is available at https://www.privacyshield.gov/Program-Overview.

Furthermore, it is possible that further information may be processed by the provider of the social network in addition to the specific data that you enter in the social media yourself. This includes, for example, important data on your computer system used to visit the page (IP address, processor type used, browser version and plug-ins used). If you are logged into a user account on the specific network during your visit, then the page can associate this visit with your account.

Please see the provisions of the respective controllers for the purpose, scope and further processing of your data, as well as your related rights.

Also, please note that our website does contain other links to external third-party websites; we have no influence over the way data is processed on these external websites.

9. Data security

We secure our website and all other associated systems via technical and organizational measures against loss, destruction, access, modification or distribution of your data by unauthorized persons. Despite regular controlling, however, complete protection against all hazards cannot be provided.

10. Revocation

You have the right to revoke consent you have granted at any time with future effect, without this affecting the legality of processing carried out by us up to the point of revocation.

11. Rights of data subjects

In general, you have the following rights:

The right to information (Art. 15 GDPR)
The right to rectification (Art. 16 GDPR)
The right to object (Art. 21 GDPR)
The right to deletion (Art. 17 GDPR)
The right to restrict data processing (Art. 18 et seq. GDPR)
The right to data portability (Art. 20 GDPR).

For inquiries of this kind, please contact datenschutz@schwa-medico.de. Please note that, when such inquiries are sent, we must ensure that the inquiry actually comes from the data subject.

Regardless of any other legal remedies under administrative law or court order, you also have the right to submit a complaint to a data protection supervisory authority. Our website does not use any automated decision-making processes (“profiling”).

schwa-medico Medizinische Apparate Vertriebsgesellschaft mbH
Last updated: November 2020 / The German version applies.