Privacy Policy

§ 1 Information on the collection of personal data, legal basis

(1) In the following, we provide information about the collection of personal data when using our website. Personal data is any information relating to an identified or identifiable natural person (hereinafter “data subject”), e.g. name, address, e-mail addresses, telephone number, user behavior.

(2) Controller acc. to Art. 4 Nr. 7 General Data Protection Regulation (GDPR) is Bahlsen GmbH & Co. KG, Podbielskistraße 11, 30163 Hannover (see our Imprint). You can reach our Data Protection Officer under: volker.wodianka@privacy-legal.de or our postal address with the addition “the data protection officer”.

(3) When you contact us by e-mail or via a contact form, the data you provide (your e-mail address, your name and telephone number if applicable) will be stored by us in order to answer your questions. We delete the data arising in this context after six months, after the storage is no longer necessary, or restrict the processing if there are legal storage obligations. This personal data is processed to fulfill pre-contractual measures and/or to process the contract (Art. 6 para. 1 lit. b GDPR) or to protect our legitimate interests or the legitimate interests of third parties (Art. 6 para. 1 lit. f GDPR).

(4) If we use contracted service providers for individual functions of our offer or would like to use your data for advertising purposes, we will inform you in detail below about the respective processes. We will also state the specified criteria for the storage period.

§ 2 Your rights

(1) You have the following rights towards us with regard to your personal data, which you can assert via e-mail to datenschutz@Bahlsen.com:

• Right to information (Art 15 GDPR),

• Right to correction or deletion (Art 16, 17 GDPR),

• Right to restriction of processing (Art 18 GDPR),

• Right to refusal of processing (Art 21 GDPR),

• Right to data portability (Art 20 GDPR),

• Right to withdraw given consent (Art 7 para 3 GDPR; see § 5)

(2) You also have the right to complain to a data protection supervisory authority about the processing of your personal data by us (Art 77 GDPR).

§ 3 Collection of personal data when you visit our website

(1) When using the website for informational purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security (legal basis is Art. 6 para. 1 lit. f) GDPR):

• Date and time of the enquiry

• Web browser type and version and operating system used

• Hostname (IP address) of the requesting provider (visitor)

(2) In addition to the aforementioned data, technically necessary and, optionally, technically unnecessary cookies are stored on your computer if you give your consent. Cookies are small text files that are stored on your hard disk assigned to the browser you are using and through which certain information flows to the place that sets the cookie (here by us). They are used to make the website more user-friendly and effective overall.

(3) If cookies are set on our website that require your consent, we will inform you about this separately within this privacy policy. If you have given your consent to this, you can revoke it at any time via the cookie banner on our website.

(4) We use SSIL-encryption to protect your data. You can recognize this by the prefix https:// in the address bar of your browser.

(5) Statistics cookies collect information anonymously. This information helps us to understand how our visitors use our website in order to constantly improve it. This includes Matomo Analytics in particular (see point 6).

(6) Matomo Analytics

In addition, after you have given your consent, we use a cookie that enables an analysis of your surfing behavior, which allows us to constantly optimize our website in terms of its quality, content and user-friendliness. We use the open-source software tool Matomo for this purpose, a service of the InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand, NZBN 6106769 (hereinafter “Matomo”).

The legal basis for the processing of your personal data is your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR and § 25 para. 1 sentence 1 TDDDG.

Matomo does not transmit any data to servers that are outside our control. The data processing takes place exclusively on the servers of our website. We use Matomo with the addition “anonymized-IP”, whereby your IP address is shortened by Matomo so that it is then not possible to assign the data to you.

If you consent to web analysis using Matomo, the following data will be collected and processed:

• Your IP address (which is shortened by Matomo and then does not allow any conclusions to be drawn about your person)

• The website accessed

• The website from which you arrived at the accessed website

• The subpages that are accessed 

• The time spent on the website

• The frequency with which the website is accessed

The data is deleted as soon as it is no longer required for our analysis purposes. The storage period depends on the type of cookie:

• Visitor Cookie: 13 months

• Referral Cookie: 6 months

• Session Cookie: 30 minutes

You can revoke your consent at any time with effect for the future here.

§ 4 Other functions and offers on our website

(1) In addition to the purely informational use of our website, we offer various services that you can use if you are interested. To do so, you must generally provide further personal data, which we use to provide the respective service and to which the aforementioned data processing principles apply. The data processing is either necessary for the provision of the service in accordance with Art. 6 para. 1 lit. b GDPR or we inform you about the possibility of giving voluntary consent to the use of your personal data in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 sentence 1 TDDDG (for the revocation of consent to the processing of personal data see § 5).

(2) In some cases, we use external service providers (“processors” within the meaning of Art. 28 GDPR) to process your data. These have been carefully selected and commissioned by us, are bound by our instructions and are regularly monitored.

(3) Furthermore, we may pass on your personal data to third parties if we offer participation in promotions, competitions, contracts or similar services together with partners. You will receive more detailed information on this when you provide your personal data or in the respective conditions of use or participation.

(4) If our service providers or partners are based in a country outside the European Economic Area (EEA), we will inform you of the consequences of this circumstance in the description of the offer. Unless they are subject to an adequacy decision by the EU Commission, service providers in third countries are commissioned in accordance with the EU standard contractual clauses and the requirements of Art. 49 GDPR. Appropriate additional security measures are agreed depending on the protection requirements of the data.

§ 5 Withdrawal of consent or objection against the processing of your data

(1) If you have given your consent to the processing of your data (Art. 6 para. 1 lit. a GDPR and § 25 para. 1 sentence 1 TDDDG), you can revoke this at any time. Such a revocation affects the permissibility of the processing of your personal data after you have given it to us. However, we would like to point out that any revocation has no influence on the permissibility of the processing of personal data on the basis of other permissions in accordance with Art. 6 para. 1 GDPR.

(2) Insofar as we base the processing of your personal data on legitimate interests (Art. 6 para. 1 lit. f GDPR), you can object to the processing. This is the case if, in particular, the processing is not necessary for the performance of a contract with you, which is described by us in the following description of the functions. When exercising such an objection, we ask you to explain the reasons why we should not process your personal data as we have done. In the event of your justified objection, we will examine the situation and will either discontinue or adapt the data processing or show you our compelling reasons worthy of protection on the basis of which we will continue the processing.

(3) Of course, you can object to the processing of your personal data for advertising and data analysis purposes at any time. You can inform us of your objection to advertising using the following contact details: Datenschutz@Bahlsen.com.

§ 6 Conditions for the transfer of personal data to third countries

(1) For the exceptional cases in which personal data is transferred to countries outside the European Economic Area (EEA), i.e. to third countries, this is done under the conditions of Art. 44 et seq. GDPR. We will inform you about the respective details of the transfer at the relevant points below.

(2) The European Commission certifies that some third countries have a level of data protection comparable to the EEA standard by means of so-called adequacy decisions. However, in other third countries to which personal data may be transferred, there may not be a consistently high level of data protection due to a lack of legal provisions. If this is the case, we ensure that data protection is adequately guaranteed. This is possible via binding corporate rules, standard contractual clauses of the European Commission for the protection of personal data pursuant to Art. 46 para. 1, 2 lit. c) GDPR, certificates or recognized codes of conduct.

§ 7 Links to other websites

(1) Our websites contain links to other websites. We have no influence on the data collected there or the data processing procedures, nor do we know the full extent of the data collection, the purpose of the processing or the retention periods.

(2) We also have no information about the deletion of the data collected by the linked provider. In this respect, we are not responsible under data protection law for the data processing on the linked website.

(3) Further information on the purpose and scope of data collection and processing by the website operator can be found in the privacy policies of the respective websites. There you will also find further information on your rights in this regard and the setting options for protecting your privacy.

§ 8 Social media presence

(1) We maintain fan pages within various social networks and platforms with the aim of communicating with the customers, interested parties and users active there and informing them about our services. When operating the fan pages, we determine the means and purposes of processing user data together with the respective platform operator. In this respect, we and the social media providers are “joint controllers” in accordance with Art. 26 GDPR.

(2) We would like to point out that your personal data may also be processed outside the European Union, namely in the USA. The European Commission issued its adequacy decision for the USA on July 10, 2023.  It stipulates that the USA guarantees an adequate level of data protection for transfers within this framework. Meta and Google are certified under the EU-US Data Privacy Framework (DPF) and an adequate level of data protection can be assumed.

(3) As a rule, user data is processed for market research and advertising purposes. For example, usage profiles can be created from the usage behavior and the resulting interests of the users. These user profiles can in turn be used, for example, to place advertisements within and outside the platforms that presumably correspond to the interests of the users. For these purposes, cookies are generally stored on the user's computer, in which the user's usage behavior and interests are stored. Furthermore, data can also be stored in the user profiles independently of the devices used by the users (especially if the users are members of the respective platforms and are logged in to them).

(4) We have integrated YouTube videos into our website. No data about you as a user is transferred to YouTube if you do not play the videos. The data is only transferred when you play the videos. We have no influence on this data transfer.

(5) The processing of users' personal data is based on our legitimate interests in effectively informing users and communicating with users in accordance with Art. 6 para. 1 lit. f) GDPR. If users are asked by the respective providers to consent to data processing (i.e. to give their consent, e.g. by ticking a checkbox or confirming a button), the legal basis for processing is Art. 6 (1) (a) GDPR.

(6) Further information on the processing of your personal data and on your options for objection or revocation can be found under the links of the respective provider listed below. The assertion of information and other rights of the data subjects can also be made against the providers, as only they have direct access to the data of the users and have the corresponding information. We are of course available to answer any questions you may have and will support you if you need help. The providers for our social media presences are:

Facebook

Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA

Privacy Policy

Instagram

Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA

Privacy Policy

Google and YouTube

Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Privacy Policy 

§ 9 Data erasure and storage duration

Your personal data will be deleted or blocked as soon as the purpose of storage no longer applies. Data may also be stored if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which we are subject. The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfillment of a contract.

§ 10 Categories of recipients of personal data

(1) To process our business transactions, we use external domestic and foreign service providers (e.g. for IT, logistics, telecommunications, sales and marketing) who may also gain knowledge of your personal data. We have concluded order processing contracts with these providers in accordance with Art. 28 GDPR, which ensure that data processing is carried out in a permissible manner.

(2) If your personal data is passed on by us to our subsidiaries or is passed on to us by our subsidiaries (e.g. for advertising purposes), this is also done on the basis of existing order processing relationships.

§ 11 Update of this privacy policy

We will amend this privacy policy from time to time if this is necessary due to changes in data processing. Please inform yourself regularly about the content of our privacy policy and also about the up-to-dateness of contact information from third parties.