Data privacy statement
We, The Lorenz Bahlsen Snack-World GmbH (hereinafter also referred to as „Controller“), take the protection of personal data very seriously and adhere to the pertinent data protection law provisions, in particular the provisions of the EU General Data Protection Regulation (GDPR). Below, we should like to inform you, in particular, what data we collect when in the context of using our website, and how we use it.
I. General remarks
1. Extent of data processing
It is, principally, only to the extent necessary for the provision of a functioning website and of our contents and services that we collect and use personal data of our users. The collection and use of the personal data of our users takes place only where the processing of data is permitted by statutory provisions or after consent has been granted by the user.
2. Legal bases for the processing of data
Where the consent of the user for processes in relation to the processing of personal data is obtained by us on our website, Art. 6 (1) lit. a GDPR serves as a legal basis for the processing of personal data.
Art. 6 (1) lit. b. GDPR serves as a legal basis for the processing of personal data required for performance of a contract of which the user is a contractual party. This applies also to processing processes necessary for the performance of a quasi contract obligation or for precontractual measures.
If and when the processing of personal data is required for the fulfilment of a legal obligation to which our company is subject, Art. 6 (1) lit. c GDPR serves as a legal basis.
Where processing is necessary for the protection of a legitimate interest of our company or a third party and the first-mentioned interest is not overridden by the interests, basic rights and the fundamental freedoms of the user concerned, Art. 6 (1) lit. f GDPR serves as a legal basis for processing of the data (so-called weighing of interests).
Apart from that, there are other statutory provisions for the processing of personal data, which – to the extent pertinent - are concretely specified by us below.
3. Duration of storage
The users’ personal data will be deleted or blocked as soon as the purpose of storage has ceased to exist. Apart from that, storage may be made where this has been provided for in regulations, laws or other provisions of the European Union to which our company is subject. Blocking or deletion of the data will also take place when a period for storing of the data prescribed by the above-mentioned norms has expired, unless there is a necessity for the continued storage of the data for the conclusion or fulfilment of a contract.
4. The passing on of personal data
If we pass on personal data, we do so exclusively to service providers supporting us with fulfilling the above-mentioned purposes. These companies, as so-called data processing companies, are not allowed to use your personal data except for fulfilling their tasks on our behalf and they are obligated to adhere to the pertinent data protection rules. The data processing companies employed by us are:
The Lorenz Bahlsen Snack-World GmbH & Co KG Germany
60329 Frankfurt am Main
Apart from that, there is no passing on of personal data to third parties.
5. Place where the data is processed
Processing of your personal data stored takes place in countries of the European Economic Area, exclusively.
II. Processing of personal data on the website
1. Provision of the website and creation of logfiles
a) Description of the data processing operation
Whenever our website is called up, our system automatically collects data and information from the system of the computer calling up the website.
At this, the following data are collected:
- Information on the type of browser and version used
- The user’s operating system
- The user’s IP address
- Date and time of access
- Websites from which the user’s system accesses our website
- Websites called up by the user’s system via our website
The data are also stored in the logfiles of our system. There is no storing of these data together with other personal data of the user.
b) Legal basis for the processing of data
Art. 6 (1) lit. f GDPR is the legal basis for the temporary storage of data and logfiles.
c) Purpose of the processing of data
The storage in logfiles is done to ensure the functionality of the website. In addition, the data is used to optimise the website and to ensure the security of our information technology systems. An evaluation of data for marketing purposes does not take place in this context. These are the purposes wherein our legitimate interest in the processing of data in accordance with Art. 6 (1) lit f GDPR lies.
d) Duration of storage
The data will be deleted as soon as it is no longer required for achieving the purpose for which it was collected. Where the data is stored in logfiles, deletion will take place after two days at the latest. Storage beyond this point is possible. In such case, the IP addresses of the user will be deleted or anonymised so that it is no longer possible to attribute the client calling up the website.
e) Possibility of objection and removal
The collection of data for the provision of the website and the storage of data in logfiles is absolutely necessary for operating of the website. Consequently, there is no possibility of objection on the part of the user.
2. Contact form and e-mail contact
a) Description of the data processing operation
There is a contact form on our website which can be used for making contact electronically. Where a user makes use of this possibility, the data entered in the form are transmitted to us and stored. These data are:
- First name and surname
- E-mail address
- Further optional information, as the case may be
Alternatively, contact may be made via the e-mail address made available by us. In this case, the user’s personal data transmitted together with the e-mail will be stored.
No passing on of data to third parties takes place in this context. The data is used for processing the conversation, exclusively.
b) Legal basis for processing of the data
The legal basis for processing of the data is Art. 6 (1) lit. f GDPR. Where the e-mail contact is aimed at the conclusion of a contract or serves a quasi contract obligation, Art. 6 (1) lit. b GDPR is an additional legal basis for the processing.
c) Purpose of the processing of data
The processing of personal data from the input mask serves us to process the communication, exclusively. This is also where the required legitimate interest in the processing of data lies in the event of contact.
d) Duration of storage
The data will be deleted as soon as it is no longer required for achieving the purpose for which it was collected. As regards personal data from the input mask of the contact form and those transmitted by e-mail, this is the case when the respective conversation with the user has been terminated. The conversation has been terminated when it can be inferred from the circumstances that the respective facts have been clarified conclusively.
e) Possibility of objection and removal
Where users contact us by contact form or e-mail, they may object to the storage of their data, at any time. The objection may be made by notifying the contact information at the end of our Data Privacy Statement. In the event of objection, the conversation with the user cannot be continued and all the personal data stored within the course of making the contact will be deleted by us.
1. Description of the data processing operation
We use “cookies” to make your visit to our website more attractive and to enable the use of certain functions. Cookies are small text files stored in the browser or from the browser to the user’s terminal. When a website is called up by a user, a cookie may be stored on the user’s operating system. This cookie contains a characteristic character string which allows the browser to be identified unambiguously when the website is called up again.
a) Technically necessary cookies
- Language settings
- Log in information
b) Technically unnecessary cookies
Apart from that, we use technically unnecessary cookies on our website in order to improve the quality of our website and its contents. Thus, the following data may be transmitted:
- Frequency of site views
- Use of website functions
- Search keywords entered
c) Information on a change of the browser settings
Most browsers are set in a way that they automatically accept cookies. The user may, however, prevent the storing of cookies on his/her computer by adjusting the browser settings accordingly. This may, however, restrict the function scope of our website.
2. Legal basis for the processing of data
The legal basis for the processing of personal data is Art. 6 (1) lit. a GDPR, where the user has given his/her consent.
As for the rest, the legal basis for the processing of personal data using cookies is Art. 6 (1) lit. f GDPR.
3. Purpose of the processing of data
The purpose of the use of technically necessary cookies is to make it easier for the user to use the website. Some of the functions of our website cannot be offered without using cookies. For these functions it is necessary that the browser can be recognised again after a page change.
The purpose of the use of the technically unnecessary cookies is to improve the quality of our website and its contents.
The user data collected on our website using cookies are not used for the creation of user profiles.
The above-mentioned purposes are also the ones wherein our legitimate interest in the processing of data in accordance with Art. 6 (1) lit f GDPR lies.
4. Duration of storage, possibility of objection and removal
IV. References to social networks, links to Google Maps
1. Social media
Our website is supplemented through our official presences in the following social networks:
The references (links) are marked by the respective logo of the social network; no use is made of the social plugins of the above-mentioned social networks.
If following the links to the social networks, please be aware that the respective social network is responsible for the processing and use of personal data and that we have or get no knowledge whatsoever of the actual extent of use of your data by the respective provider. For information on the extent of processing of your personal data by the providers of the social networks and the possibilities of adjusting settings for the protection of your privacy, please see the data protection guidelines of the respective provider.
2. Links to Google Maps
V. Rights of the data subject
Where personal data from you are processed you are a data subject in the meaning of the GDPR and have the following rights towards the controller:
1. Right to information
You may request from the controller a confirmation on whether personal data concerning you are processed by us.
Where such processing takes place you may request from the controller information on the following issues:
- the purposes personal data are processed for;
- the categories of personal data processed;
- the recipients or categories of recipients towards which the data concerning you have been disclosed or will be disclosed;
- the intended period of storage of the personal data concerning you or, if it is not possible to provide exact information on that issue, the criteria used to determine the period of storage;
- the existence of a right to rectification or deletion of the personal data concerning you, a right of restriction of processing by the controller or a right of objection against this processing;
- the existence of a right to lodge a complaint with a supervisory authority;
- any and all available information on the source of the data, where personal data have not been obtained from the data subject;
- the existence of automated decision-making, including profiling, pursuant to Art. 22 (1) and (4) GDPR and – at least in those cases – meaningful information on the logic involved and the significance and the intended consequences of such processing for the data subject.
You are entitled to request information on whether the personal data concerning you is transferred to a third country or an international organisation. In this context, you may request to be informed about the appropriate safeguards in connection with the transfer in accordance with Art. 46 GDPR.
2. Right to rectification
You have a right to rectification and/or supplementation towards the controller, where the processed personal data concerning you are incorrect or incomplete. The controller shall perform the rectification, immediately.
3. Right to restriction of processing
You are entitled to request the restriction of processing of the personal data concerning you where the following conditions are fulfilled:
- where you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;
- the processing is unlawful and you oppose the deletion of the personal data and, instead, request restriction of the use of the personal data;
- the controller no longer needs the personal data for the purposes of processing, while you require it for the assertion, exercise or defence of legal claims, or
- where you have objected to the processing pursuant to Art. 21 (1) GDPR pending the verification whether the legitimate grounds of the controller override your reasons.
Where processing of the personal data concerning you has been restricted such data shall – with the exception of storage – only be processed with your consent or for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
Where processing has been restricted in accordance with the above-mentioned requirements, you will be informed by the controller before the restriction of processing is lifted.
4. Right to deletion
a) Obligation to delete
You may request from the controller that the personal data concerning you are deleted, immediately, and the controller is obligated to immediately delete such data where one of the following reasons applies:
- The personal data concerning you is no longer needed for the purposes for which it was collected or processed otherwise.
- You withdraw your consent on which the processing was based pursuant to Art. 6 (1) lit. a or Art. 9 (2) lit. a GDPR, and no other legal ground for processing exists.
- You object to the processing pursuant to Art. 21 (1) GDPR, and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 (2) GDPR.
- The personal data concerning you have been processed unlawfully.
- Deletion of the personal data concerning you is required for compliance with a legal obligation under the Union law or the law of the Member States the controller is subject to.
- The personal data concerning you have been collected in relation to the offer of information society services pursuant to Art. 8 (1) GDPR.
b) Information to third parties
Where the controller has made the personal data concerning you public and is obliged pursuant to Art. 17 (1) GDPR to delete it, the controller, taking account of available technology and the cost of implementation, shall take reasonable measures, including technical ones, to inform controllers processing the personal data that you as the data subject have requested from them the deletion of any and all links to such personal data or of copies or replications of such personal data.
c) Exceptions from the obligation of deletion
There is no right to deletion where processing is necessary
- for exercising the right of freedom of expression and information;
- for compliance with a legal obligation requiring processing under the Union law or the law of the Member States to which the controller is subject or for the performance of a task which is in the public interest, or in the exercise of official authority bestowed on the controller;
- for reasons of public interest in the area of public health pursuant to Art. 9 (2) lit. h and i, as well as Art. 9 (3) GDPR;
- for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 (1) GDPR, in so far as the right referred to under paragraph a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
- for the assertion, exercise or defence of legal claims.
5. Right to notification
Where you have asserted the right to rectification, deletion or the restriction of processing towards the controller, the controller shall be obligated to communicate such rectification or deletion of data or restriction of processing to the recipients to whom the personal data concerning you have been disclosed, unless this proves impossible or involves disproportionate effort.
You have a right towards the controller to be informed of such recipients.
6. Right to data portability
You have the right to receive the personal data concerning you, which you have made available to the controller, in a structured, commonly used and machine-readable format. In addition, you have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been made available, where:
- the processing is based on consent pursuant to Art. 6 (1) lit. a GDPR or Art. 9 (2) lit. a GDPR or on a contract pursuant to Art. 6 (1) lit. b GDPR, and
- processing is carried out using automated techniques.
In exercising this right you also have the right to obtain the transmission of the personal data concerning you from one controller to another directly, where technically feasible. Freedoms and rights of other persons must not be affected thereby.
The right to data portability shall not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority bestowed on the controller.
7. Right to object
You have the right to object, on grounds resulting from your particular situation, at any time to the processing of personal data concerning you which is based on Art. 6 (1) lit. e or f GDPR; this applies also to profiling based on such provisions.
The controller shall no longer process the personal data concerning you, unless the controller is able to demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing is for the purpose of asserting, exercising, or defending legal claims.
Where personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to the processing of the personal data concerning you for such marketing; this includes profiling to the extent that it is related to such direct marketing.
Where you object to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
In the context of the use of information society services – notwithstanding Directive 2002/58/EC - you may exercise your right to object by means of automated techniques using technical specifications.
8. Right to revoke the declaration of consent under data protection law
You have the right to revoke at any time your declaration of consent under data protection law. Revoking the consent does not affect the legitimacy of the processing based on the consent performed until the revocation.
9. Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing – including profiling -, which produces legal effects concerning you or similarly significantly affecting you. This shall not apply where the decision
- is necessary for concluding or fulfilling a contract between you and the controller,
- is permissible due to legal provisions of the Union or the Member States to which the controller is subject, and where such legal provisions also contain suitable measures to safeguard your legitimate interests, or
- is made with your explicit consent.
However, such decisions shall not be based on special categories of personal data referred to in Art. 9 (1) GDPR, unless Art. 9 (2) lit. a or g applies and suitable measures to protect the rights and freedoms and your legitimate interests have been taken.
As regards the cases referred to in the above points (1) and (3), the controller shall implement suitable measures to safeguard your rights and freedoms and your legitimate interests, including, at least, the right to obtain intervention by one person on the part of the controller, to express his/her point of view and to contest the decision.
10. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your place of residence, your place of work or place of the alleged infringement if you are of the opinion that processing of the personal data concerning you infringes the GDPR.
The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
VI. External links
Our website may contain links referring to the pages of third parties. Where this is not obvious we point out that these are external links. We have no influence on the contents and design of the pages of external providers. Insofar, this data protection statement does not apply there.
VII. Amendment of this data privacy statement
The continuous development of the internet and the related frequent amendments to the applicable legal norms require our Data Privacy Statement to be adjusted from time to time. We will keep you informed here about any corresponding alterations.
Controller in the meaning of the GDPR and other national data protection laws of the EU Member States, as well as other data protection law provisions is:
The Lorenz Bahlsen Snack-World GmbH
Telephone: +43 (0) 463 590659-0
For the full imprint see here.
IX. Contact details of the data protection officer
The contact details of the controller’s data protection officer are:
State: May 2018