Privacy Policy

• Data Protection Information for Customers and Suppliers
• Privacy Notice for Facebook
• Privacy Notice for Instagram
• Privacy notice for LinkedIn

 

Content

This privacy policy applies to Akkuplanet GmbH (hereinafter referred to as ‘Akkuplanet’).

The protection of your personal data during the collection, processing and use of personal data in connection with your visit to our website is of great importance to us. Your data is protected in accordance with statutory provisions. We would like to inform you below about the nature and scope of the processing of personal data via this website in accordance with Article 13 of the General Data Protection Regulation (GDPR).

I. Details of the data controller

Akkuplanet GmbH
Berta-Benz-Str. 18
D-40670 Meerbusch

Tel. +49 (0)2159 922 40 00
Fax +49 (0)2159 922 40 44
info@akkuplanet.de

 

II. Details of the Data Protection Officer

If you have any questions regarding data protection, our external data protection officer will be happy to assist you:

Mr Arndt Halbach of GINDAT GmbH
Wetterauer Str. 6, 42897 Remscheid
Tel.: 02191-909 430
Email: datenschutz@akkuplanet.de

 

III. Data processing via this website

Your visit to our websites is logged. Initially, the following data – which your browser transmits to us – is primarily collected:

• the IP address currently being used by your PC or router
• Date and time
• Browser type and version
• the operating system of your PC
• the pages you have viewed
• Name and size of the requested file(s)
• as well as, where applicable, the URL of the referring website.

This data is collected solely for the purposes of data security, to improve our website and for error analysis on the basis of Article 6(1)(f) of the GDPR. The log file is deleted after 7 days, unless it is required to investigate or provide evidence of specific legal infringements that have come to light within the retention period.

IV. Legal basis
The General Data Protection Regulation permits us to process personal data in accordance with Article 6(1) of the GDPR, in particular in the following cases:

• The data subject has given their consent to the processing of their personal data for one or more specific purposes (Article 6(1)(a) of the GDPR).
• The processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of pre-contractual measures taken at the data subject’s request (Article 6(1)(b) of the GDPR).
• The processing is necessary for compliance with a legal obligation to which the controller is subject (Article 6(1)(c) of the GDPR).
• The processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child (Article 6(1)(f) of the GDPR).

 Incidentally, you may visit our website without providing any personal details.

Personal data (e.g. your name, address details or contact details) which you voluntarily provide to us, for example in the context of an enquiry by email to the contact persons listed on our website, will be stored by us and processed solely for the purpose of corresponding with you and only for the purpose for which you have provided us with this data. The processing of this data is based on Articles 6(1)(a) and 6(1)(f) of the GDPR.

Please note that data transmission over the internet (e.g. when communicating by email) may be subject to security vulnerabilities. It is not possible to guarantee complete protection of data against access by third parties. You should therefore send us confidential data by other means, e.g. by post.

Online Shop

If you wish to purchase goods via our shop, you must register on the relevant page. There are a number of mandatory fields here, which are marked with an asterisk (*), such as your name, gender, address details, email address and a password. This data is transmitted in encrypted form (indicated by the ‘https’ protocol, to which the connection switches automatically) and stored in a profile. You can then log in personally using a unique password and an email address to order goods.

The personal data you provide to us during registration will be processed solely for the purpose of corresponding with you and only for the purpose for which you have provided this data to us, such as processing the orders you have placed.

In the event of a business relationship that is likely to be of long duration, we may carry out a credit check (Creditreform).

The legal basis for the processing of your personal data is Article 6(1)(b) and Article 6(1)(f) of the GDPR.

Contact form

Personal data (e.g. your name, address details or contact details) that you voluntarily provide to us via one of our contact forms will be stored by us and processed solely for the purpose of corresponding with you and only for the purpose for which you have provided us with this data. By submitting the form, you expressly consent to us collecting and using your personal data as set out above. You may withdraw your consent at any time with future effect. The processing of this data is based on Article 6(1)(a) of the GDPR.

Customer satisfaction survey

The purpose of this time-limited survey of existing customers is to gather information to improve Akkuplanet’s products and services. Participation is voluntary. The legal basis for data processing is your consent under Article 6(1)(a) of the GDPR and our legitimate interest in improving our services pursuant to Article 6(1)(f) of the GDPR.

The personal data entered in the survey (name of authority/company, name and email address of the respondent) will be stored and used by Akkuplanet GmbH solely for the purpose of analysing customer feedback and providing a response for a period of 6 months, but no longer than until you have objected to this use by contacting Akkuplanet GmbH. You may withdraw your consent under Article 6(1)(a) of the GDPR at any time by emailing info@akkuplanet.de. The data will not be passed on to third parties.

Information on the use of cookies

Our website uses so-called cookies. Cookies are small text files that are stored by your browser and saved on your computer. The use of cookies serves to make the website more user-friendly. For example, this makes it possible to recognise the user for the duration of the session without them having to constantly re-enter their username and password. The cookies do not cause any damage to your computer and are deleted once your session ends. The legal basis for data processing is Article 6(1)(f) of the GDPR.

Some of the cookies we use are deleted immediately after you close your browser (so-called session cookies).

Other cookies remain on your device and enable us to recognise your browser on your next visit (persistent cookies).

Data processing in connection with cookies, which serve solely to ensure the functionality of our online offering, is carried out on the basis of our legitimate interest in accordance with Article 6(1)(f) of the GDPR. In all other cases, we only use cookies with your consent. The legal basis is therefore Article 6(1)(a) of the GDPR. You may withdraw your consent at any time by changing your cookie settings. If you do not wish to accept the use of cookies, you can set your browser to prevent cookies from being stored. Please note, however, that in this case you may not be able to use all the features of our websites.

The cookies used on our website:

Use of social media

Facebook

A button from the social network Facebook, 1601 South California Avenue, Palo Alto, CA 94304, USA, is integrated into our website. You can recognise the button by the corresponding logo (F).
When you visit our website, the relevant button is disabled or merely linked, so that no personal data, such as your IP address, is sent to the social network unless you click on the button. Once activated, a direct connection is established with the social network. If you are logged in to Facebook, this provider may associate your visit to our website with your account. If you do not wish this to happen, we recommend that you log out of your account beforehand.
Akkuplanet has no influence over the purpose and scope of data collection, nor over the further processing and use of the data by the social network. You can find information on data protection regulations and your rights in this regard in Facebook’s current privacy policy.

Instagram

Functions from the Instagram service are integrated into our website. These functions are provided by Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA. If you are logged into your Instagram account, you can link the content of our pages to your Instagram profile by clicking the Instagram button. This enables Instagram to associate your visit to our pages with your user account. Please note that, as the provider of this website, we have no knowledge of the content of the data transmitted or how it is used by Instagram.
Further information on this can be found in Instagram’s Privacy Policy:
http://instagram.com/about/legal/privacy/

LinkedIn

WhatsApp (contact via WhatsApp Business)

We offer you the option of contacting us via WhatsApp Business. This service is provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter “WhatsApp”), a company within the Meta group.

Data processing by WhatsApp:
If you communicate with us via WhatsApp, WhatsApp, as the provider of the communication service, processes personal data. In particular, the following data may be processed:
• Your telephone number,
• Profile name and, where applicable, profile picture,
• The content of your messages and any attachments,
• Communication and usage metadata (e.g. time, device information, IP address).

It cannot be ruled out that data may also be processed in third countries (in particular the USA). WhatsApp provides the relevant data protection and data transfer conditions for the use of WhatsApp Business (including data processing terms and standard contractual clauses, as well as, where applicable, a transfer based on an adequacy decision).

Data processing by us:
If you contact us via WhatsApp, we will process your personal data solely for the purpose of handling your enquiry and communicating with you. This includes, in particular, your telephone number, your name/profile name and the content of your message.

Please do not send us any sensitive data (e.g. health data) or other confidential information via WhatsApp that requires special security measures to ensure its protection.

Legal basis:
The use of WhatsApp as a contact channel is based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR, in order to offer you an additional, voluntary means of communication and to respond to enquiries efficiently.
Other communication channels (e.g. email, telephone, contact form) remain available to you.
If your enquiry relates to the conclusion or performance of a contract, the processing is also carried out on the basis of Article 6(1)(b) of the GDPR.

Further information:
Further details on how WhatsApp handles your data can be found in WhatsApp’s privacy policy and in the terms and conditions for WhatsApp Business:
https://www.whatsapp.com/legal/privacy-policy
https://www.whatsapp.com/legal/business-terms
https://www.whatsapp.com/legal/business-data-processing-terms

Integration of the Trusted Shops Trustbadge / other widgets

Trusted Shops widgets are integrated into this website to display Trusted Shops services (e.g. the Trusted Shops seal of approval, collected reviews) and to offer Trusted Shops products to buyers following an order.

This serves to safeguard our legitimate interests, which prevail following a balancing of interests, in optimal marketing by enabling a secure shopping experience in accordance with Article 6(1), first sentence, point (f) of the GDPR. The Trustbadge and the services advertised through it are provided by Trusted Shops GmbH, Subbelrather Str. 15C, 50823 Cologne, with whom we are joint data controllers under Article 26 of the GDPR. In the context of this privacy notice, we provide you with the following information on the key terms of the agreement in accordance with Article 26(2) of the GDPR.

The Trustbadge is provided by a US-based CDN (Content-Delivery-Network) provider under a joint controller arrangement. An adequate level of data protection is ensured through standard data protection clauses and further contractual measures. Further information on data protection at Trusted Shops GmbH can be found in their privacy policy.

When the Trustbadge is accessed, the web server automatically stores a so-called server log file, which also contains your IP address, the date and time of access, the volume of data transferred and the requesting provider (access data), and documents the access. The IP address is anonymised immediately after collection, so that the stored data cannot be linked to you personally. The anonymised data is used in particular for statistical purposes and for error analysis.

Once your order has been completed, your email address – hashed using a cryptographic one-way function – will be transmitted to Trusted Shops GmbH. The legal basis for this is Article 6(1), first sentence, point (f) of the GDPR. This serves to verify whether you are already registered for services with Trusted Shops GmbH and is therefore necessary for the fulfilment of our and Trusted Shops‘ overriding legitimate interests in providing the buyer protection and transactional review services linked to the specific order in question, in accordance with Article 6(1), first sentence, point (f) of the GDPR. If this is the case, further processing takes place in accordance with the contractual agreement between you and Trusted Shops. If you are not yet registered for the services, you will subsequently be given the opportunity to do so for the first time. Any further processing after registration is also governed by the contractual agreement with Trusted Shops GmbH. If you do not register, all transmitted data will be automatically deleted by Trusted Shops GmbH, and it will no longer be possible to link the data to a specific individual.

Trusted Shops uses service providers in the areas of hosting, monitoring and logging. The legal basis for this is Article 6 (1)(f) of the GDPR for the purpose of ensuring trouble-free operation. In doing so, processing may take place in third countries (the USA and Israel). An adequate level of data protection is ensured in the case of the USA through standard data protection clauses and further contractual measures, and in the case of Israel through an adequacy decision.

Within the framework of the joint responsibility arrangement between us and Trusted Shops GmbH, please contact Trusted Shops GmbH as a matter of priority regarding data protection issues and to exercise your rights, using the contact details provided in the privacy policy linked above. Irrespective of this, however, you may always contact the data controller of your choice. Your enquiry will then, if necessary, be forwarded to the other data controller for a response.

Google Analytics

Where you have given your consent, this website uses Google Analytics 4, a web analytics service provided by Google LLC. The data controller for users in the EU/ the EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).

Nature and purpose of the processing

Google Analytics uses cookies that enable an analysis of your use of our websites. The information collected via the cookies regarding your use of this website is generally transmitted to a Google server in the USA and stored there.

In Google Analytics 4, IP address anonymisation is enabled by default. As a result of IP anonymisation, your IP address is truncated by Google within Member States of the European Union or in other States party to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. According to Google, the IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google.
During your visit to the website, your user behaviour is recorded in the form of ‘events’.

Events may include:

• Page views
• First visit to the website
• Start of session
• Websites visited
• Your ‘click path’, interaction with the website
• Scrolls (whenever a user scrolls to the bottom of the page (90%))
• Clicks on external links 
• internal search queries
• Interaction with videos
• File downloads
• Advertisements viewed / clicked on
• Language settings

The following data is also collected:

• Your approximate location (region)
• Date and time of the visit
• Your IP address (in truncated form)
• technical information about your browser and the devices you use (e.g. language settings, screen resolution)
• Your internet service provider
• the referrer URL (the website/ the advertising material via which you arrived at this website)
  

Purposes of processing

On behalf of the operator of this website, Google will use this information to evaluate your use of the website and to compile reports on website activity. The reports provided by Google Analytics are used to analyse the performance of our website and the success of our marketing campaigns.

Recipients

The recipients of the data are/may be

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as a data processor pursuant to Article 28 of the GDPR)
• Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
• Alphabet Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

Transfers to third countries

For the USA, the European Commission adopted its adequacy decision on 10 July 2023. Google LLC is certified under the EU-US Privacy Framework. As Google servers are distributed worldwide and a transfer to third countries (for example, to Singapore) cannot be entirely ruled out, we have also entered into the EU Standard Contractual Clauses with the provider.

Retention period

The data we send that is linked to cookies is automatically deleted after 2 months. The maximum lifespan of Google Analytics cookies is 2 years. Data for which the retention period has expired is automatically deleted once a month.

Legal basis

The legal basis for this data processing is your consent in accordance with Article 6(1), first sentence, point (a) of the GDPR and Section 25(1), first sentence of the TTDSG.

Withdrawal

You may withdraw your consent at any time with future effect by accessing the cookie settings and changing your selection there. The lawfulness of the processing carried out on the basis of your consent up until its withdrawal remains unaffected.

You can also prevent the storage of cookies from the outset by adjusting your browser settings accordingly. However, if you configure your browser to reject all cookies, this may result in restricted functionality on this and other websites. Furthermore, you can prevent the collection of data generated by the cookie and relating to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by

a. not giving your consent to the setting of the cookie, or
b. downloading and installing the browser add-on to disable Google Analytics HERE .

Further information on the terms of use for Google Analytics and Google’s data protection policy can be found at https://marketingplatform.google.com/about/analytics/terms/de/ and at https://policies.google.com/?hl=de.

Google Ads Conversion Tracking

We use the online advertising programme ‘Google Ads’ and, as part of this, conversion tracking provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (‘Google’).

If you access our website via a Google advert, Google will set a cookie on your device. These cookies generally expire after 30 days and are not used for personal identification. If the user visits certain pages on this website whilst the cookie is still valid, both Google and we can recognise that the user clicked on the advert and was redirected to that page.

Each Google Ads customer is assigned a different cookie. Cookies cannot therefore be tracked across the websites of Google Ads customers.
The information collected using the conversion cookie is used to generate conversion statistics for Google Ads customers who have opted for conversion tracking. This provides us with the total number of users who clicked on our advert and were redirected to a page tagged with a conversion tracking tag. However, we do not receive any information that can be used to personally identify users.

The use of Google Ads conversion tracking takes place only with your consent in accordance with Article 6(1)(a) of the GDPR as well as Section 25(1) of the TDDDG. Data collected in connection with the use of Google services may be transferred to the USA.
Google bases the transfer of data to the USA on the European Commission’s Standard Contractual Clauses and on certification under the EU-U.S. Data Privacy Framework.

Further information on data protection at Google can be found at:
https://policies.google.com/privacy
https://business.safety.google/adsservices/

You may withdraw your consent at any time via our consent management tool or prevent the storage of cookies by adjusting the settings in your browser software accordingly.

etracker

The provider of this website uses services provided by etracker GmbH, based in Hamburg, Germany (www.etracker.com) to analyse usage data. By default, we do not use cookies for web analytics. Where we do use analytics and optimisation cookies, we will obtain your explicit consent separately in advance. If this is the case and you give your consent, cookies will be used to enable statistical analysis of this website’s reach, to measure the effectiveness of our online marketing activities, and to carry out tests – for example, to test and optimise different versions of our online offering or its components. Cookies are small text files stored by the web browser on the user’s device. etracker cookies do not contain any information that would enable a user to be identified.

The data generated by etracker is processed and stored exclusively in Germany by etracker on behalf of the provider of this website and is therefore subject to strict German and European data protection laws and standards. etracker has been independently audited and certified in this regard and has been awarded the ePrivacyseal data protection seal of approval.

Data processing is carried out on the basis of the legal provisions of Article 6(1)(f) (legitimate interest) of the General Data Protection Regulation (GDPR). Our legitimate interest within the meaning of the GDPR is the optimisation of our online services and our website. As the privacy of our visitors is important to us, any data that could potentially be linked to an individual, such as the IP address, login or device identifiers, is anonymised or pseudonymised as soon as possible. The data will not be used for any other purpose, combined with other data or disclosed to third parties.

You may object to the data processing described above at any time by clicking on the slider or by sending an email to the info@akkuplanet.de object. The objection will not result in any adverse consequences. If no slider is displayed, data collection has already been prevented by other blocking measures.



Further information on data protection at etracker can be found here.

3CX Live Chat

To handle user enquiries, we offer a live chat service on our website based on the software 3CX The 3CX telephone system used for this purpose is hosted on a dedicated server at our company’s premises.

The live chat will only load once you have selected the ‘Convenience’ via our Consent Manager. Your consent decision is stored by our Consent Manager. The legal basis for this is your consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG. Consent may be withdrawn at any time via the settings in our Consent Manager, with effect for the future.

Once you have given your consent, the 3CX software required for the live chat will be loaded. When you use the chat, we process, in particular, the name you have provided, the content of your messages, and technically necessary connection data such as your IP address, browser information and the time of the communication.

The processing of chat content is carried out for the purpose of handling your enquiry. Insofar as your enquiry serves to initiate or perform a contract, the legal basis is Article 6(1)(b) of the GDPR. In all other respects, processing is carried out on the basis of our legitimate interest in swift and efficient customer communication in accordance with Article 6(1)(f) of the GDPR.

According to 3CX, it does not use cookies for this function. However, information may be stored in the browser’s local storage for technical purposes. The communication and storage of chat data takes place via our self-hosted 3CX instance.

The data will be deleted as soon as it is no longer required for the processing of your enquiry and there are no statutory retention obligations to the contrary.

Further information on data protection at 3CX can be found in the 3CX Privacy Policy of 3CX.

Newsletter

We offer you the option of subscribing to a newsletter via our website. When you subscribe, we will collect personal data from you. To ensure that the newsletter has actually been requested by you or from your email address, you will first receive a confirmation email. Only once you have clicked on the activation link contained therein will you be added to our email distribution list and receive the newsletter. Your subscription to the newsletter is logged for verification purposes (IP address, date, time).

You may unsubscribe from the newsletter at any time by notifying us; to do so, you may, in particular, use the link at the end of each newsletter to unsubscribe, or you may unsubscribe via our email info@akkuplanet.de. The legal basis for the processing of data is Article 6(1)(a) of the GDPR.

Brevo

Use of Brevo (Sendinblue GmbH) for email newsletters 

We use the Brevo service provided by Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin (“Brevo”) to send email newsletters and transactional emails (e.g. order or registration confirmations). 

Processing and types of data

When using Brevo, the following personal data in particular may be processed:

Email newsletters/transactional emails:

Name, email address, and, where applicable, any further data provided in the form (e.g. company name), transmission and usage data (time of registration, IP address, open and click-through rates, unsubscriptions).

Consent and legal basis

Newsletters/Email marketing:

We only send out newsletters if you have given your consent (Art. 6(1)(a) GDPR in conjunction with Section 7(2)(3) of the German Unfair Competition Act (UWG)) or if there is a legitimate interest (Article 6(1)(f) of the GDPR in conjunction with Section 7(3) of the UWG). We use the double opt-in procedure for registration, whereby we log both the registration and the confirmation.

Recipients and transfers to third countries

Brevo processes data on servers within the European Union. 

Deletion and retention period

Newsletter data:

We will retain your data until you withdraw your consent. Once you have unsubscribed from the newsletter, your data will be deleted from the mailing list. We may retain log data relating to your registration for up to three years (duty of proof pursuant to Article 5(2) of the GDPR and Article 7(1) of the GDPR).

Note regarding independent data processing by Brevo

In addition to processing on our behalf, Brevo may also process certain data under its own responsibility under data protection law. This applies in particular to contract and billing processing, measures to detect and prevent misuse (e.g. spam detection, IT security) and the assertion or defence of legal claims. For these processing activities, Brevo is the controller within the meaning of Article 4(7) of the GDPR.

Further information on data protection at Brevo can be found at: https://www.brevo.com/de/legal/privacypolicy/

Data processing on behalf of a controller

We have entered into a data processing agreement (DPA) for the use of the aforementioned service. This is a contract required under data protection law, which ensures that the service provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR. 

Recipients of personal data

Personal data will not, as a matter of principle, be disclosed to third parties without your consent.

We may engage service providers to carry out and manage data processing operations on a data processing contract basis. Specifically, we have engaged service providers for the distribution of the newsletter and for the hosting of our website.

Contractual relationships with our service providers are governed by the provisions of Article 28 of the GDPR, which set out the legally required requirements regarding data protection and data security.

Secure data transmission

To protect the security of your data during transmission, we use a state-of-the-art encryption method (SSL) via HTTPS.

V. Your rights

In accordance with Articles 15–21 of the GDPR, you may exercise the following rights in relation to the personal data we process, provided the conditions set out therein are met.

Right of access

You have the right to access the personal data relating to you that we process.

Right to rectification

You may request the rectification of any personal data that is incomplete or has been processed incorrectly.

Right to erasure

You have the right to have personal data concerning you erased, in particular where one of the following grounds applies

• Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
• You may withdraw your consent on which the processing of your data was based.
• You have exercised your right to object to the processing
• Your data has been processed unlawfully.

 

However, the right to erasure does not apply where this conflicts with the legitimate interests of the controller. These may include, for example:

• personal data are necessary for the establishment, exercise or defence of legal claims.
• deletion is not possible due to retention obligations

 

However, where data cannot be erased, there may be a right to restriction of processing (as set out below). 

Right to restriction of processing

You have the right to request that we restrict the processing of your personal data if

• you dispute the accuracy of the data and we are therefore verifying its accuracy,
• the processing is unlawful and you object to erasure and instead request that the use of the data be restricted
• If we no longer require the data, but you require it to establish, exercise or defend legal claims,
• you have lodged an objection to the processing of your data, and it has not yet been determined whether our legitimate grounds override your grounds.

 

Right to data portability

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and you have the right to transmit this data to another controller without hindrance from us, provided that the processing is based on consent or a contract and is carried out by us using automated means.

Right of withdrawal

The data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them carried out on the basis of Article 6(1)(e) or (f); This also applies to profiling based on these provisions. Where the processing of your personal data is based on consent, you have the right to withdraw this consent at any time. 

VI. Standard time limits for the erasure of data

In the absence of any statutory retention requirement, the data will be deleted or destroyed once it is no longer required to fulfil the purpose of the data processing. Different retention periods apply to the storage of personal data; for example, data relevant for tax purposes is generally retained for 10 years, whilst other data is generally retained for 6 years in accordance with commercial law. Finally, the retention period may also be determined by the statutory limitation periods, which, for example, under Sections 195 ff. of the German Civil Code (BGB), are generally three years, but may in certain cases be up to thirty years.

VII. Right to lodge a complaint with a supervisory authority

Under Article 77 of the GDPR, every data subject has the right to lodge a complaint with a supervisory authority if they believe that the processing of personal data relating to them infringes the GDPR. The competent supervisory authority for data protection matters is the State Data Protection Commissioner of the federal state in which our company is based; in our case, this is the State Commissioner for Data Protection and Freedom of Information in North Rhine-Westphalia.