Privacy policy

Privacy policy

Q-Certified > Privacy policy

We, Forum Brandrauchprävention e.V., take the protection of your personal data very seriously. In this privacy policy we would like to provide you with information about how your data is recorded in accordance with the new EU General Data Protection Regulation.

Name and address of your data controller

The controller in the meaning of the General Data Protection Regulation (EU-GDPR) and other data protection laws applicable in the Member States of the European Union and other data protection regulations is:

Forum Brandrauchprävention e.V.
Immanuelkirchstr. 3-4
10405 Berlin

Tel. +49 (0) 30 / 44 03 19 86

email: info@q-certified.eu
Website: www.q-certified.eu

Executive Board of Forum Brandrauchprävention:
Norbert Schaaf (Chair), Christian Rudolph (Deputy Chair)

Handling of data

Your data will be stored and processed within the limits of the applicable data protection laws exclusively for the purpose of managing the enquiry that you have submitted to us.

You can visit our website and obtain information from it without providing us with any personal data. You provide personal information voluntarily if, for example, you send an enquiry to info@q-certified.eu or request our newsletter. That personal information may include: first and second name, e-mail address and telephone number. We use that personal data to respond to your enquiry.

Only data which is necessary to make contact with you will be collected and processed. We exclude any disclosure of that data to third parties which do not provide any services for us, Forum Brandrauchprävention e.V., and which we have not specifically contractually obligated to maintain confidentiality, particularly any disclosure of the data for general advertising purposes or for the purposes of market research and opinion polling.

Facebook

Within our website we use the “visitor activity pixel” of
Facebook Inc.
1601 S. California Ave,
Palo Alto, CA 94304, USA
(“Facebook”)

This enables the behaviour of users to a site to be tracked after they have been directed to the provider’s website by clicking on a Facebook advertisement. This process serves the purpose of analysing the effectiveness of the Facebook advertisements for statistical and market research purposes and can help to optimise future advertising activities.
The data collected is anonymous for us and thus does not enable us to draw any inferences regarding the identity of the user. However, the data is stored and processed by Facebook, so that a connection with the respective user profile is possible and Facebook may use the data for its own advertising purposes in accordance with the Facebook data policy. As a result, Facebook and its partners can display advertisements on Facebook and also outside Facebook. For these purposes, a cookie may also be stored on your computer.

Google Analytics

This website uses Google Analytics, a web analysis service provided by Google Inc. (“Google”). Google Analytics uses so-called “cookies”, i.e. text files which are stored on your computer and make it possible to analyse your use of the website. The information generated by the cookies on your use of this website is generally transferred to and stored on a Google server in the USA.

However, if IP anonymisation is activated on this website, Google will first truncate your IP address in Member States of the European Union or in other contracting states of the Treaty on the European Economic Area. In exceptional cases, only the full IP address is transferred to a Google server in the USA and truncated there. On behalf of the operator of this website, Google uses that information to assess your use of the website, in order to prepare reports on the website activities and to provide other services to the website operator associated with use of the website and use of the Internet. The IP address provided by your browser within the framework of Google Analytics will not be combined with any other Google data.

You can prevent the storage of the cookies by setting your browser software accordingly. However, please note that if you do so you may not be able to use all the functions of this website to their full extent. You can also prevent the recording of the data generated by the cookie that relates to your use of the website (including your IP address) to Google, as well as the processing of that data by Google, by downloading and installing the browser plug-in available via the following link.

You can find more detailed information on terms of use and data protection at:
https://marketingplatform.google.com/about/analytics/terms/us/ or https://policies.google.com/

MailChimp

Our newsletter is mailed via “MailChimp”, a platform operated by US provider Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA.

The collected e-mail addresses and further requested data such as second name and first name are stored on MailChimp’s servers in the USA. MailChimp uses that information to mail and evaluate the newsletter on our behalf. However, MailChimp does not use that data to write to users itself or to pass it on to third parties.

MailChimp is certified under the US-EU “Privacy Shield” data protection agreement.
We have also signed a “data processing agreement” with MailChimp. The contract thus signed obliges MailChimp to protect the users’ data, process it according to the order and, in particular, refrain from passing it on to third parties. You can access MailChimp’s privacy policy here.

Registration data

It is sufficient to provide us with your e-mail address to register for our newsletter.
However, we also request that you state your first and second name. That information merely serves the purpose of personalising the newsletter.

Statistical surveys and analyses

The newsletters that we send out via the MailChimp tool are equipped with a so-called “web beacon”, i.e. a file which can be accessed by the MailChimp server when the newsletter is opened. Technical information such as information on the browser, the IP address and the time of the access is thus collected. That information is used to improve the service

The statistical surveys also include determining whether the newsletter is opened, when it is opened and what links are clicked on. That information enables us to identify our users’ reading habits and adjust our content according to their interests.

Online access and data management

Our newsletters contain links that refer to MailChimp’s website. For example, our newsletters contain a link with which the newsletter recipients can access the newsletter online (for example, in the event of display problems in the e-mail program). MailChimp’s privacy policy can also be accessed on its website.

We explicitly advise you that on MailChimp’s website cookies are used and thus personal data is collected by MailChimp and its partners and service providers. We have no influence on that collection of data.

Termination and revocation

You may terminate the receipt of the newsletter at any time, i.e. withdraw your consent. Unsubscribing is possible here. You will also find a link for termination at the end of each newsletter.

Legal basis 

In accordance with the requirements of the General Data Protection Regulation (GDPR) we inform you that consent to the receipt of the newsletter is granted on the basis of Article 6(1) lit. a) GDPR and Article 7 (2) / (3) of the German Unfair Competition Act (Gesetz gegen den unlauteren Wettbewerb). The use of the mailing service provider MailChimp, the performance of statistical surveys and analyses and the logging of the registration procedure occur on the basis of our legitimate interests in accordance with Article 6(1) lit. f) GDPR.

Making contact by e-mail

If you contact us through an e-mail address provided by us, the personal data transmitted by you and the technical transmission data of the e-mail (in the header) is stored automatically. The storage serves the sole purpose of processing your e-mail and your matter and/or making contact with you. The data will not be passed on to third parties for use by them for their own purposes.

Please note that it is not generally possible to rule unencrypted e-mails being read by unauthorised persons while they are being sent from you to us. We therefore advise you not to send us unencrypted e-mails if you wish to provide us with personal or sensitive data. In case of doubt send it by post or call us on +49 (0)30 440201-30.

Routine erasure and blocking of personal data

We only process and store your personal data as long as it is necessary to achieve the purpose of the storage, in particular for the purpose of performing agreements entered into with you. We may also store data insofar as it is required by European or national laws in EU directives, laws or other regulations to which we are subject as the processing controller. This is the case, in particular, if we assert our own legal claims against you due to a possible infringement of our trademark rights by you.

As soon as the purpose of the storage ceases to apply or a storage period prescribed by the above-mentioned regulations ends, the personal data is routinely blocked or erased.

Your rights as a data subject

If your personal data is processed by us, you are a “data subject” in the meaning of the General Data Protection Regulation of the European Union (EU-GDPR) and you are entitled to the rights specified below with respect to us as the controller for the processing of your data. In accordance with our obligation under the EU-GDPR we notify you below of your rights also with regard to use and processing of your data that we do not carry out ourselves and do not have carried out by third parties, e.g. profiling.

Right to information

You may demand a confirmation from us as to whether personal data concerning you is processed by us. If such processing occurs, you may demand the following information from us:

  • the purposes for which the personal data is processed;
  • the categories of personal data which are processed;
  • the recipients/categories of recipients to which the personal data relating to you has already been disclosed at the time of your request for information or will yet be disclosed;
  • the planned duration of the storage of the personal data relating to you or, if specific information in this respect cannot be provided, criteria for determining the storage period;
  • the existence of a right to the rectification or erasure of the personal data relating to you, a right to the restriction of processing by the controller or a right to object to that processing;
  • the existence of a right to lodge a complaint with a supervisory authority;
  • all available information on the origin of the data if the personal data is not collected from you;
  • the existence of an automated decision-making process including profiling in accordance with Article 22(1) and (4) EU-GDPR and, at least in those cases, meaningful information on the logic involved as well as the consequences and the desired effects of such processing for the data subject.

You also have the right to request information from us as to whether the personal data relating to you stored by us and/or collected by us is transmitted to a third country or an international organization. In this context you may demand to be notified of the appropriate safeguards in accordance with Article 46 EU-GDPR in connection with the transmission.

Right to rectification

You have the right to the rectification and/or completion of your data with respect to us as the data controller if the processed personal data relating to you is incorrect or incomplete, in which case we will promptly carry out the necessary rectification.

Right to restriction of processing

Subject to the following conditions, you may demand that processing of the personal data relating to you be restricted:

  • if you dispute the accuracy of the personal data relating to you for a period that enables us to verify the accuracy of the personal data;
  • the processing is unlawful, and you refuse the erasure of the personal data and instead demand use of the personal data be restricted;
  • the controller no longer needs the personal data for the purposes of the processing, but you need it for the purpose of establishing, exercising or defending legal claims or if you have submitted an objection to processing in accordance with Article 21(1) EU-GDPR, and it has not yet been established whether the legitimate grounds of the controller for the data processing override your grounds.

If the processing of personal data relating to you has been restricted, with the exception of storage thereof that data may only be processed with your consent or for the purpose of establishing, exercising or defending legal claims or in order to protect the rights of another natural or legal person or for reasons of important public interest of the EU or a Member State.

If the restriction of processing in accordance with the above requirements has been limited, you will be notified by us as the data controller before the restriction is lifted.

Right to erasure

You may demand from us as the data controller that the personal data relating to you be promptly erased, in which case we shall be obliged to promptly erase that data, provided that one or more or the following reasons apply:

  • the personal data relating to you is no longer necessary for the purposes for which it was collected or otherwise processed;
  • you withdraw your consent on which the processing is based in accordance with Article 6(1) lit. a) or Article 9(2) lit. a) EU-GDPR, and there is no other legal basis for processing;
  • you submit an objection to the processing of personal data relating to you in accordance with Article 21(1) EU-GDPR and there are no overriding legitimate grounds for the processing, or you submit an objection to the processing in accordance with Article 21(2) EU-GDPR;
  • the personal data relating to you has been unlawfully processed;
  • the personal data relating to you must be erased for compliance with a legal obligation under EU law or Member State law to which we, as the controller for the processing of your data, are subject;
  • the personal data relating to you was collected in relation to an offer of information society services in accordance with Article 8(1) EU-GDPR.

If, as the controller for the processing of personal data relating to you, we have made the personal data relating to you public and are therefore obliged to erase it under Article 17(1) EU-GDPR, taking into account the available technology and the implementation costs we shall take appropriate measures, also of a technical nature, to inform third parties responsible for the data processing which process your data as transmitted by us, that you as the data subject have demanded that they erase all links to that personal data or copies or replications of that personal data.

The right to erasure does not exist insofar as the processing is necessary:

  • for the exercise of the right to freedom of expression and information;
  • for the fulfilment of a legal obligation which requires the processing under the laws of the EU or the Member States to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  • for reasons of public interest in the area of public health in accordance with Article 9(2) lit. h) and i) and Article 9(3) EU-GDPR;
  • for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) EU-GDPR, insofar as the right to erasure is expected to prevent or seriously hamper the achievement of the objectives of that processing; or
  • for the purpose of establishing, exercising or defending legal claims.

Right to notification

If you have asserted the right to rectification, erasure or restriction of processing with respect to us as the controller for the processing of your personal data, we are obliged to notify all the recipients to which the personal data relating to you has been disclosed of that rectification or erasure of the data or the restriction of processing, unless this proves to be impossible or involves disproportionate expense

Ihnen steht uns gegenüber als dem für die Verarbeitung Ihrer personenbezogenen Daten Verantwortlichen das Recht zu, über diese Empfänger unterrichtet zu werden.

Right to technical portability of your personal data

Insofar as you have a right with respect to us to information in accordance with the above provisions, you have the right to be provided, at any time, with the personal data relating to you that you have provided to us or that we have stored in a structured, commonly used, and machine-readable format. You also have the right to send that data to another controller without obstruction by us as the controller for the processing of your personal data that was originally provided with your personal data, if:

  • the processing is based on a consent pursuant to Article 6(1) lit. a) EU-GDPR or Article 9(2) lit. a) EU-GDPR or on a contract pursuant to Article 6(1) lit. b) EU-GDPR, and
  • the processing is carried out by means of an automated procedure.

In the exercise of that right you also have the right to have the personal data relating to you sent directly from one controller to another, where technically feasible. Freedoms and rights of third parties must not be adversely affected as a result.

The right to data portability does not apply to processing of personal data which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of the personal data relating to you that occurs on the basis of Article 6(1) lit. e) or f) GDPR. This also applies to profiling based on those provisions.

After you have exercised your right to object we, as the controller for the processing of your personal data collected by us and/or stored by us, will no longer process the personal data relating to you unless we can provide proof of compelling grounds meriting protection for the processing that override your interests, rights and freedoms, or the processing of your personal data serves the purpose of establishing, exercising or defending legal claims.

If the personal data relating to you is processed in order to conduct direct marketing, you have the right to object at any time to the processing of personal data relating to you for the purposes of such marketing. This also applies for profiling to the extent it is related to such direct marketing.

If you object to processing for the purposes of direct marketing, the personal data relating to you will no longer be processed for those purposes.

You have the possibility, in the context of the use of information society services and notwithstanding Directive 2002/58/EC, of exercising your right to object by automated means using technical specifications.

Right to revoke the declaration of consent under data protection laws

You have the right to revoke your declaration of consent under data protection laws at any time. The revocation of consent will not affect the legality of the processing that occurred previously on the basis of your consent up until the receipt of the revocation.

Automated individual decision-making including profiling

You have the right not to be subject to a decision based solely on automated processing of your personal data, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision:

  1. is necessary for entering into or the performance of a contract between you and us as the controller for the processing of your personal data;
  2. is authorised by EU or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or
  3. is based on your explicit consent.

However, those decisions must not be based on special categories of personal data referred to in Article 9(1) EU-GDPR, unless Article 9(2) points a) or g) applies and suitable measures have been taken to safeguard your rights and freedoms and legitimate interests.

With regard to the cases referred to in items a. and c., we shall take suitable measures to safeguard your rights and freedoms and legitimate interests, which include at least the right to obtain human intervention on our part, to express your point of view and to contest the decision.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence or place of work or the place of the alleged infringement, if you consider that the processing of the personal data relating to you infringes the provisions of the EU-GDPR.

The supervisory authority with which the complaint was lodged will notify the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 EU-GDPR.

The legal basis for the processing

Insofar as we obtain your consent for personal data processing operations, the legal basis is Article 6(1) lit. a) EU-GDPR..

Where processing of your personal data is necessary for the performance of a contract to which you are party, the legal basis is Article 6(1) lit. b) EU-GDPR. This also applies to processing operations which are necessary for the purpose of implementing pre-contractual measures.

Where it is necessary to process personal data for the purpose of fulfilling a legal obligation to which our company is subject, the legal basis is Article 6(1) lit. c) EU-GDPR.

In the event that vital interests of the data subject or another natural person require personal data to be processed, the legal basis is Article 6(1) lit. d) EU-GDPR.

If the processing is necessary for the protection of a legitimate interest of our association or that of a third party and your interests, basic rights and basic freedoms do not override such interest, the legal basis for the processing is Article 6(1) lit. f) EU-GDPR. The legitimate interest of our association lies in the performance of our business activities. The legitimate interest of third parties which perform services for us lies in the performance of the activities contractually agreed between the respective third party and ourselves.

Personal data storage period

Personal data is stored for the duration of the respective statutory storage period. After the end of the time limit the data is routinely erased unless it is required for the initiation of a contract or the performance of a contract.