Privacy Notice

 

1. Controller

GvW is the Controller for the purposes of Art. 4(7) of the EU General Data Protection Regulation (GDPR). For further information about us, please refer to our imprint. Our Data Protection Officer can be contacted at datenschutz@gvw.com.

2. General

This Privacy Notice gives you an overview of the kind of Personal Data we collect, why we collect them and on what basis. Personal Data means any information that can be linked to you personally, e.g. your name, address, email address and user behaviour. It also describes what rights you have towards us in our capacity as Controller.

3. Data processing on this website

If you use this website for information purposes only, GvW automatically stores information that your browser transmits to us in the server log files. The following data are technically necessary for us to display this website to you and to ensure it is stable and secure (the legal basis for this being Sec. 25 Para. 2 No. 2 of the German Teleservices Data Protection Act [Teledienstedatenschutzgesetz – TDDSG] in conjunction with point (f) of Art. 6(1) Sentence 1 GDPR):

  • (an anonymised version of) your IP address
  • the date and time of the request
  • the time zone difference to Greenwich Mean Time (GMT)
  • the subject of your request (the exact page you viewed)
  • access status/http status code
  • data volumes transmitted
  • the referring website (i.e. the website you came from before visiting our website)
  • your browser, operating system and interface
  • the language and version of your browser software.

GvW will not use this information to identify any individual user and will not combine it with data from other sources. This information will only be stored on servers in Germany. After being used for the purposes referred to above, it will be erased by GvW within seven days.

4. Newsletters

If you give your consent to receive one of our newsletters, you can subscribe for them on the GvW website. The legal basis for sending you our newsletters is point (a) of Art. 6(1) Sentence 1 GDPR. You can choose from the following two newsletters that are distributed on a regular basis:

  • GvW Newsletter
  • GvW International

We use a double opt-in process for our newsletter registrations. This means that after your registration, we send an email to the email address specified by you, asking you to confirm that you wish to receive our newsletter. If you do not confirm your registration within 24 hours, your information will be blocked and automatically erased after one month. Furthermore, we will store the IP address you used and the time and date of your registration and confirmation. The purpose of this process is to prove your registration and to be able to investigate any suspected misuse of your Personal Data. The legal basis for our processing of this information is point (f) of Art. 6(1) Sentence 1 GDPR.

Providing a valid email address is mandatory if you wish to receive our newsletter. Once you have confirmed your email address, it will be stored for the purpose of sending you the newsletter. This processing of your email address is necessary to deliver the requested service (newsletter) to you. The legal basis for this is point (b) of Art. 6(1) Sentence 1 GDPR.

You can withdraw your consent and unsubscribe from our newsletter at any time by clicking the link provided in each newsletter email, or by sending an email to datenschutz@gvw.com or by contacting us through any of the channels provided in the imprint of this website. If you withdraw your consent, the information stored for the purpose of sending you our newsletter will be erased in compliance with applicable data protection laws.

Our newsletters are mailed from a mailing platform provided by CleverReach GmbH & Co. KG of Schafjückenweg 2 in D-26180 Rastede, Germany.

For further details about the privacy policy of our mailing provider, please refer to https://www.cleverreach.com/de/datenschutz/[IR1] 

We have a data processing agreement pursuant to Art. 28 GDPR in place with this provider.

5. Contacting you

If you contact us with an inquiry or request, we will ask you to provide your name, contact details and further information we require from you to be able to process your request. We use the information you provide to respond to your inquiry or request. The legal basis for this is Art. 6(1)(b) and (f) GDPR.

6. Cookies

 

 

 

7. Google Analytics

Google Analytics is a web analytics service provided by Google Inc. (“Google”). Google Analytics uses what is known as “cookies”, text files which are stored on your computer to allow us to analyse your use of the websites. The information generated by the cookie regarding your use of this website will, as a rule, be transmitted to and stored on a server of Google in the US. However, if IP anonymization is activated on this website, your IP address will first be truncated by Google in Member States of the European Union or in other signatory States to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a server of Google in the US and truncated there. Google will use this information on behalf of the operator of this website to analyse your use of the website and to compile reports on website activity.

You can block cookies by changing the settings of your browser to stop it from accepting cookies. You can also prevent data generated by the cookie on the use of your website (including your IP address) from being transferred to and processed by Google by downloading and installing the browser plug-in at this link: http://tools.google.com/dlpage/gaoptout?hl=de.

We use Google Analytics with the extension “_anonymizeIp()”. This extension shortens IP addresses before they are further processed to prevent data from being linked to an individual.

We use Google Analytics to analyse how our website is used and how to improve it. The statistics gathered allow us to enhance our Internet presence and increase your user experience. The legal basis for our use of Google Analytics is Sec. 25 Para. 1 TTDSG in conjunction with point (a) of Art. 6(1) Sentence 1 GDPR.

Third-party provider information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Terms of Service: http://www.google.com/analytics/terms/de.html, Privacy Overview: http://www.google.com/intl/de/analytics/learn/privacy.html, and Privacy Policy: http://www.google.de/intl/de/policies/privacy.

8. etracker

Our website uses the etracker analytics service. This service is provided by etracker GmbH of Erste Brunnenstrasse 1 in D-20459 Hamburg, Germany.

We use etracker to analyse how our website is used and how to improve it. The statistics gathered allow us to enhance our Internet presence and increase your user experience. The legal basis for our use of etracker is your consent under Sec. 25 Para. 1 TTDSG in conjunction with point (a) of Art. 6(1) Sentence 1 GDPR.

The data obtained can be used to create pseudonymous usage profiles. The data collected using etracker technologies will not be used to personally identify visitors to our website.

You can object to this processing of your data at any time with effect for the future. You can do so by setting an opt-out cookie from etracker (available at the following link) that will prevent etracker from collecting data from your browser: http://www.etracker.de/privacy?et=V23Jbb

For further information about etracker, please refer to the etracker data protection statement: http://www.etracker.com/de/datenschutz.html

9. Google Ads

We use the Google Ads service to serve advertising (known as “ads”) on our behalf on third-party websites. We may measure the success of each ad in relation to campaign data. We do this as it is in our interest to deliver relevant advertising to you, to make our website more interesting for you and to achieve a fair calculation of advertising costs.

Advertising is delivered by Google via “ad servers”. In addition, we use ad server cookies, which allow us to measure certain success metrics, such as the number of views or clicks. If you are transferred to our website through a Google ad, Google Ads will place a cookie on your computer. These cookies usually expire after 30 days and are not intended to personally identify you. The unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions) and opt-out information (marker indicating that the user no longer wishes to be targeted) are usually stored as analysis values for these cookies.

These cookies allow Google to recognise your Internet browser. If a user visits certain pages of an Ads customer’s website and the cookie stored on their computer has not yet expired, Google and the customer can recognise that the user has previously clicked on the ad and was transferred to the customer’s website. Each Ads customer is assigned a different cookie. Thus, cookies cannot be tracked through the websites of Ads customers. We do not collect or process any Personal Data ourselves in the ads referred to above. We only receive statistical analyses from Google. Based on these analyses, we are able to determine which of our ads are the most effective. We do not receive any further data from the use of advertising; in particular, we are not able to use this information to identify users personally.

Through the marketing tools used, your browser automatically connects directly to the Google server. We have no control over the scope and further use of the data Google collects through this tool and therefore inform you according to our knowledge: By the integration of Ads Conversion, Google receives the information that you accessed the relevant section of our Internet presence or clicked on one of our ads. If you are registered with any service provided by Google, Google may link your visit to your account. Even if you are not registered with Google or are not logged into your account, it is still possible that the provider will recognise and store your IP address.

There are different ways to prevent websites from tracking you on the Internet: a) you can change the settings of your browser to stop it from accepting cookies – in particular, if you block third-party cookies, you will not receive advertising from third parties; b) you can deactivate cookies for conversion tracking by setting your browser to block cookies from the domain www.googleadservices.com (see https://www.google.de/settings/ads), however, this setting will be deleted when you delete your cookies; c) you can disable interest-based advertising from providers who are part of the “About Ads” campaign using the link http://www.aboutads.info/choices, however, this setting will be deleted when you delete your cookies; d) you can permanently disable tracking in your Firefox, Internet Explorer or Google Chrome browser using the link http://www.google.com/settings/ads/plugin. However, please note that if you do this, you may not be able to use the full functionality of our Internet presence.

The legal basis for our use of AdServer cookies is your consent under Sec. 25 Para. 1 TTDSG. The legal basis for the processing of your data following the placement of the cookie on your device is your consent under point (a) of Art. 6(1) Sentence 1 GDPR.

For further information about Google’s privacy policy, please refer to http://www.google.com/intl/de/policies/privacy and https://services.google.com/sitestats/de.html. Alternatively, you can visit the website of the Network Advertising Initiative (NAI) at http://www.networkadvertising.org.

10. Google Maps

Our website uses Google Maps to display interactive maps directly on the website and allow you convenient use of the mapping feature. The legal basis for our use of Google Maps is your consent under Sec. 25 Para. 1 TTDSG and point (a) of Art. 6(1) Sentence 1 GDPR.

If you visit our website, Google receives the information that you accessed the relevant page. In addition, the information referred to in section 3 of this Notice is transmitted. This happens regardless of whether Google provides a user account you are logged into or whether there is no such user account. If you are logged into your Google account, your data will be directly linked to your account. If you do not wish your data to be linked to your profile with Google, you have to log out of your Google account before accessing a Google Maps map. Google stores your data as usage profiles and uses them for advertising and market research purposes and/or to tailor its website to suit users’ needs. The purpose of this analysis is in particular (even for users who are not logged on) to deliver tailored advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of such user profiles, however, you have to contact Google to exercise this right.

For further information about the purpose and scope of the collection and processing of data by Google, please refer to the Google Privacy Policy. The Google Privacy Policy also contains further information about your rights in this regard and about settings you can use to protect your privacy: http://www.google.de/intl/de/policies/privacy.

11. YouTube embeds

We embed YouTube-Videos on our website that are stored on http://www.YouTube.com and can be played directly on our website. These videos are embedded on our website in “enhanced data protection mode”, i.e. no data about you as user are transmitted to YouTube as long as you do not play the videos. Only if you play the videos will the data referred to in the following paragraph be transmitted. We have no control over this transmission of data.

If you visit our website, YouTube receives the information that you accessed the relevant page. In addition, the information referred to in section 3 of this Notice is transmitted. This happens regardless of whether YouTube provides a user account you are logged into or whether there is no such user account. If you are logged into your Google account, your data will be directly linked to your account. If you do not wish your data to be linked to your profile with YouTube, you have to log out before activating the button. YouTube stores your data as usage profiles and uses them for advertising and market research purposes and/or to tailor its website to suit users’ needs. The purpose of this analysis is in particular (even for users who are not logged on) to deliver tailored advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of such user profiles, however, you have to contact YouTube to exercise this right.

For further information about the purpose and scope of the collection and processing of data by YouTube, please refer to the YouTube (Google) Privacy Policy. The YouTube (Google) Privacy Policy also contains further information about your rights and about settings you can use to protect your privacy: www.google.de/intl/de/policies/privacy.

12. GvW on social media

In addition to our website, we also have a presence on various social media platforms. We are currently on Twitter, YouTube, LinkedIn and Xing. In addition, we provide links to the profiles of our lawyers.

All images taken from Instagram have been downloaded directly to our webserver. Users of our website are transferred to Instagram only when they click on one of those images. In this case, Personal Data may be processed by Instagram, over which we have no control.

For further information about the purpose and scope of the collection of data and the provisions governing the use of your data by each platform, please refer to the privacy policy of the respective operator.

 

13. Routine erasure and blocking of Personal Data

Data will be processed and stored for as long as necessary to achieve the purpose of storage. Thereafter they will be erased as soon as lawfully possible.

14. Your rights

14.1. Right of access

You have the right to obtain confirmation from us as to whether or not Personal Data concerning you are being processed, and, where that is the case, the following information:

  1. the purposes for which Personal Data are processed;
  2. the categories of Personal Data that are processed;
  3. the recipients or categories of recipients to whom the Personal Data relating to you have been or will be disclosed;
  4. where possible, the envisaged period for which the Personal Data relating to you will be stored, or, if not possible, the criteria to determine that period;
  5. the existence of the right to request from us rectification or erasure of Personal Data or restriction of processing of Personal Data relating to you by the Controller or to object to such processing;
  6. the right to lodge a complaint with a supervisory authority;
  7. where the Personal Data are not collected from the Data Subject, any available information as to their source;
  8. the existence of automated decision-making, including profiling, referred to in Art. 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the Data Subject.

You have the right to be informed whether Personal Data relating to you are transferred to a third country or to an international organisation. In this context, you have the right to be informed of the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.

14.2. Right to rectification

You have the right to obtain from us without undue delay the rectification of inaccurate Personal Data relating to you and/or to have incomplete Personal Data relating to you completed.

14.3. Right to restriction of processing

You have the right to obtain from us the restriction of processing of Personal Data relating to you where one of the following applies:

  1. you contest the accuracy of the Personal Data relating to you, for a period enabling us to verify the accuracy of the Personal Data;
  2. the processing is unlawful and you oppose the erasure of the Personal Data and request the restriction of their use instead;
  3. we no longer need the Personal Data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims, or
  1. you have objected to processing pursuant to Art. 21(1) GDPR pending the verification whether our legitimate grounds override yours.

If processing of Personal Data relating to you has been restricted, such Personal Data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If you have obtained restriction of processing pursuant to the conditions set out above, you will be informed by us before the restriction of processing is lifted.

14.4. Right to erasure

You have the right to obtain from us the erasure of Personal Data relating to you without undue delay and we have the obligation to erase Personal Data without undue delay where one of the following grounds applies:

  1. the Personal Data relating to you are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
  2. you withdraw consent on which the processing is based according to point (a) of Art. 6(1) or point (a) of Art. 9(2) GDPR, and where there is no other legal ground for processing.
  3. you object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21(2) GDPR.
  4. the Personal Data have been unlawfully processed.
  5. the Personal Data relating to you have to be erased for compliance with a legal obligation in Union or Member State law to which we are subject.
  6. the Personal Data relating to you have been collected in relation to the offer of information society services referred to in Art. 8(1) GDPR.

Where we have made the Personal Data about you public and are obliged pursuant to Art. 17(1) GDPR to erase the Personal Data, we, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform Controllers which are processing the Personal Data that you in your capacity as Data Subject have requested the erasure by such Controllers of any links to, or copy or replication of, those Personal Data.

The right to erasure shall not apply to the extent that processing is necessary

  1. for exercising the right of freedom of expression and information;
  2. for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
  3. for reasons of public interest in the area of public health in accordance with points (h) and (i) of Art. 9(2) as well as Art. 9(3) GDPR;
  4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89(1) GDPR in so far as the right referred to in paragraph (1) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
  5. for the establishment, exercise or defence of legal claims.

14.5. Right to be informed

If you have exercised the right of rectification, erasure or restriction of processing in relation to us, we are under an obligation to communicate any rectification or erasure of Personal Data relating to you or restriction of processing to each recipient to whom the Personal Data relating to you have been disclosed, unless this proves impossible or involves disproportionate effort.

You have the right to be informed by us about those recipients.

14.6. Right to data portability

You have the right to receive the Personal Data relating to you, which you have provided to us, in a structured, commonly used and machine-readable format, and have the right to transfer those data to another Controller without hindrance from the Controller to which the Personal Data have been provided, where

  1. the processing is based on consent pursuant to point (a) of Art. 6(1) GDPR or point (a) of Art. 9(2) GDPR or on a contract pursuant to point (b) of Art. 6(1) GDPR; and
  2. the processing is carried out by automated means.

In exercising this right, you also have the right to have the Personal Data relating to you transmitted directly from one Controller to another, where technically feasible. This right must not adversely affect the rights and freedoms of others.

The right to data portability does not apply to processing of Personal Data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

14.7. Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of Personal Data relating to you which is based on point (e) or (f) of Art. 6(1) GDPR; including profiling based on those provisions.

We will no longer process the Personal Data relating to you, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

Where Personal Data relating to you are processed for direct marketing purposes, you have the right to object at any time to processing of Personal Data relating to you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Where you object to processing for direct marketing purposes, the Personal Data relating to you will no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

14.8. Right to withdraw consent under data protection law

You have the right to withdraw your consent under data protection law at any time. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

​​​​​​​14.9. Automated individual decision-making including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This shall not apply if the decision

  1. is necessary for entering into, or the performance of, a contract between you and us,
  2. is authorised by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
  3. is based on your explicit consent.

However, such decisions must not be based on special categories of Personal Data referred to in Art. 9(1) GDPR, unless point (a) or (g) of Art. 9(2) applies and suitable measures to safeguard your rights and freedoms and your legitimate interests are in place.

In the cases referred to in points (a) and (c) above, we will implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the Controller, to express your point of view and to contest the decision.

Automated decision-making including profiling pursuant to Art. 22(1) and (4) GDPR does not take place.

14.10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of Personal Data relating to you infringes the GDPR.

You also have the right to lodge a complaint with the supervisory authority competent for us:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
[Hamburg Commissioner for Data Protection and Freedom of Information]
Ludwig-Erhard-Str. 22, D-20459 Hamburg
Tel.: +49 40 42854-4040
E-Fax: +49 4042854-4000
Email: mailbox@datenschutz.hamburg.de

The supervisory authority with which the complaint has been lodged will inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

15. Data security

We use appropriate technical and organisational measures to protect our website and other systems against loss, destruction, access to, alteration or unauthorised disclosure of your data. You should treat your access credentials confidential at all times and close your browser window after ending your communication with us, particularly if you share your computer with others.

Last updated: February 2022

You can download our Privacy Notice here:

Download Privacy Notice