1.1. Data protection

We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations (in particular the EU General Data Protection Regulation, hereinafter: GDPR) and this privacy policy.

As changes to this privacy policy may be made through new technologies and the further development of this website, we encourage you to review the privacy policy periodically.

If you use this website, various personal data will be collected. Personal data are basically data with which you can be personally identified. For more information, see Article 4 (1) GDPR. This privacy policy explains what information we collect and what we use it for. It also explains how and for what purpose this happens.

We would like to point out in advance that the transmission of data via the internet (for example, when communicating by email) may have security vulnerabilities. Protecting data completely against access by third parties is not possible. However, we take measures to protect data in accordance with recognised technological standards, e.g. TLS or SSL encryption.

The information provided in this Section 1 – General information and mandatory disclosures – applies to all cases of data collection on our website described in Section 3 below, even if we no longer specifically address them there. However, more detailed explanations in a specific case of data collection shown in no. 3 shall primarily apply. 

1.2. Note on the controller

The controller for data processing on this website is the Maltese company:

NetXBetting Ltd, 170, Pater House, Level 1 (Suite A168) Psaila Street, Birkirkara BKR9077 Malta; represented by the managing director Claudia Deguara, 

(Registry number: C36534 Registrar of Companies, Malta) 

Contact: Telephone in Germany +49 211 781782-0

Email: hotline @ netxbetting.com

The controller, as defined in more detail in Article 4 (7) GDPR, is the natural person or legal entity who, alone or in concert with others, decides on the purposes and means of processing personal data (such as names, email addresses or similar). 

1.3. Revocation of any consent to data processing

You may revoke any consent granted in the past or in the future at any time, see for instance Article 7 (3) GDPR. To this end, an informal message to us is sufficient, e.g. by email to the above-mentioned address. However, the legality of the data processing carried out until the revocation shall remain unaffected by any revocation. See also at the end of this privacy policy under no. 4 (rights of the data subject). 

Right to object to data collection in special cases and to direct mail (Article 21 GDPR)

If data are processed on the basis of Article 6 (1) e) or f) GDPR, you have the right at any time to object to the processing of your personal data for reasons that arise from your particular situation; this also applies to profiling based on these provisions. The respective legal basis on which a processing is based can be found in this privacy policy. If you make an objection, we will no longer process your personal information unless we can establish compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or processing for the purpose of establishing, exercising or defending legal claims (objection pursuant to Article 21 (1) GDPR).

If your personal data are processed to operate direct mail advertising, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct mail. If you object, your personal data will then no longer be used for the purpose of direct advertising (objection under Article 21 (2) GDPR).

1.4. Right to lodge a complaint with the relevant supervisory authority

In the case of violations of the GDPR, you, the data subject, have a right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged violation. The right to lodge a complaint is without prejudice to any other administrative or judicial remedies.

A list of all data protection officers in Germany as well as their contact data can be found via the following official link:

https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

See also at the end of this privacy policy under no. 4 (rights of the data subject).

1.5. SSL or TLS encryption

This site uses SSL or TLS encryption for security purposes and to protect the transmission of sensitive content, such as orders or enquiries or anything else that you send to us as a website operator. An encrypted connection can be recognised by the fact that the address line of the browser changes from “http: //” to “https: //” and to the lock symbol in your browser line immediately before the named address line.

If SSL or TLS encryption is enabled, the data you submit to us cannot be read by third parties.

1.6. Encrypted payments on this website

Payment services: If you provide us with account, credit card or other data for the settlement of payments, these will be collected for the purpose of processing the payment and may be transmitted to payment service providers. 

The payment transactions via the means of payment which we use on our website (credit cards, etc. see below) are made exclusively via an encrypted SSL or TLS connection. An encrypted connection is indicated by the browser's address bar switching from “http: //” to “https: //” and the lock icon in your browser line, see above for SSL or TLS encryption.

In the case of encrypted communication, the payment details that you submit to us cannot be read by third parties. For details on payment services, see below. 

1.7. Information, blocking, erasure

Within the scope of the valid legal regulations, above all according to GDPR, you have at any time the right to free information about your stored personal data, origin and recipient thereof and the purpose of data processing (see in particular Article 15 GDPR) and, if applicable, a right to rectification (see in particular Article 16 GDPR), blocking or erasure of these data (for more details, see in particular Article 17 GDPR), and a right to restriction of processing (see in particular Article 18 GDPR), a right to object within the limits of Article 21 GDPR, and a right not to be subjected to a decision based solely on automated processing, including profiling, which has legal effect on you or otherwise affects you in a similar manner (see in particular Article 22 GDPR). 

For further information on personal data, please contact us at any time at the address above or at the address given in the legal notice of this website.

See also at the end of this privacy policy under no. 4 (rights of the data subject).

1.8. Erasure of data and duration of retention

Personal data will be deleted or blocked as soon as the purpose of the retention no longer exists. In addition, such storage may be provided for by the European or national legislator in EU regulations, laws or other regulations to which the controller is subject. Data will also be blocked or deleted if a retention period prescribed by the standards mentioned expires, unless there is a need to further store the data to conclude or fulfil a contract, or consent has been given.

See also at the end of this privacy policy under no. 4 (rights of the data subject).

1.9. Data processing (including transfer) to/by “processor”

To enable an effective visit to our website and use of the related features, it is sometimes necessary to involve independent “processors” (see also Article 4 (8) GDPR), as for example by the service provider who designed this website according to the purposes determined by us alone (preparation, execution and fulfilment of betting contracts) and corresponding specifications regarding the means used for this purpose (Pferdewetten-Service.de GmbH, Kaistraße 4, 40221 Dusseldorf/Germany, as well as (potential sub-)contracted data centre operators, shipping service providers and/or other parties involved in the fulfilment of the contract.

External service providers who process data for us on our behalf are carefully selected by us and contractually obligated in strict accordance with the specifications of the DSGVO (see above all Article 28 et seq. GDPR – order data processing). Of course, this applies in particular with respect to said Pferdewetten-Service.de GmbH, as well as to all other relevant service providers as well. 

All of these processors work according to our instructions, which is ensured by strict contractual arrangements, which also include technical and organisational measures and supplementary controls.

The transfer of your data, for example to third parties who are not contract processors or subcontractors, is otherwise only possible if you have given us your express consent or in view of a legal regulation/justification.

Transmission to third countries outside the EU/EEA or to an international organisation will not take place under any circumstances unless adequate guarantees are available. These include, in particular, an agreement (by us with the recipients) by means of EU standard contractual clauses, or an adequacy decision by the European Commission.

Said disclosure in the context of (sub-)processor takes place in addition to the (superordinate) order processing by the above-named Pferdewetten-service.de GmbH in particular to the host provider of our website, being in the case of ordering and confirming newsletters to a shipping service provider (Evalanche, see below).

1.10. Data protection officer

Statutory data protection officer

We have appointed a data protection officer in Germany for our company.

Linda Lüppe, c/o pferdewetten.de AG, Kaistr. 4, 40221 Düsseldorf

Tel:  +49 211 781782-10

Fax: +49 211 781782-19

Email: datenschutz @ pferdewetten.de

2.1. Cookies

We sometimes use so-called cookies. Cookies do not harm your computer and in particular do not contain any viruses. Cookies serve to make our offer more user-friendly, effective and secure. Cookies are small text files that are stored on your computer and stored by your browser.

When you visit our website, you expressly consented to our use of cookies, including through analysis programmes (see above). In this context, we have already informed you about which cookies are technically required for the use of the website. 

You can of course view this information again at any time, even now, using the link: https://www.pferdewetten.de/info/cookies/ 

Most of the cookies we use are so-called “session cookies”. They are automatically deleted after your visit. Other cookies remain stored on your device until you delete them. These cookies allow us, for example, to recognise your browser on the next visit.

You can set your browser so that you are informed about the setting of cookies and that you only allow cookies in individual cases, rule out the acceptance of cookies for certain cases or generally and activate the automatic deletion of cookies when closing the browser. However, disabling cookies that we have just listed as “required” will limit the functionality of this site.

Cookies that are required to carry out the electronic communication process or to provide certain functions that you require are stored on the basis of Article 6 (1) f) GDPR. The website operator has a legitimate interest in the storage of cookies for the technically correct and optimised provision of its services, as well as you, as you express it by using our website and its functionalities. 

Insofar as other cookies (such as cookies for analysing your surfing behaviour) are stored, they will also be treated separately in this privacy policy, also with regard to their legal basis, see below in Google Analytics.

2.2. Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. This includes:

• Browser type and browser version

• Operating system used

• Referring URL (website from which you accessed our website)

• Host name of the accessing computer

• Time of the server request

• IP address

These data are not merged with other data sources. The IP address is then anonymised after 7 days – it is then no longer possible with reasonable technical and/or commercial effort to reconstruct a personal link to all the data stated here, see the respective list. Personal data in the sense of Article 4 (1) GDPR are no longer available. If data must be retained for reasons of proof, they shall not be deleted until the incident has been definitively clarified.

The remaining data may only be deleted after one year due to statutory retention periods.

Said storage occurs on the one hand to ensure the functionality of our website you are visiting. In addition, the data are used to optimise the website and to ensure the security of our information technology systems. An analysis of personal data takes place only insofar as a report on visits to our website is compiled, without any link to individuals, also in order to improve our service continuously and according to the user’s wishes and habits. Data are stored for security reasons, for example, to identify cases of abuse.

It is for these purposes that our legitimate interest lies in the processing of data according to Article 6 (1) (f) GDPR.

We also collect, process and use personal data on the use of our websites (usage data) insofar as this is necessary in order to bill the user for the use of our services/functionalities, of course only to the extent that these are not free of charge. 

The basis for data processing is basically Article 6 (1) (b) GDPR, which permits the processing of data to fulfil a contract or precontractual measures.

The basis for the data storage during the above-mentioned one year is furthermore, and also basically, the statutory retention period, see above, and thus Article 6 (1) (c) GDPR

We would like to point out here (see above “basically”) that with the above-mentioned anonymisation after seven days, a legal basis for data processing is not necessary (anymore) because no “personal data” as defined by the GDPR is available (any more). 

2.3. Contact form

If you send us enquiries via the contact form, your details from the enquiry form, including the contact details you provided there, will be stored in order to process the request and in case of follow-up questions. We will not share this information without your consent.

The legal basis for the processing of the data transmitted to us as a result of your use of the contact form is Article 6 (1) (f) GDPR. If the contact is aimed at concluding a contract, the additional legal basis for processing is Article 6 (1) (b) GDPR.

The information you provide in the contact form will remain with us until you ask us to delete it, you object to the processing or the purpose for storing the data (for example, after completing your request) no longer exists. Mandatory statutory provisions – especially retention periods – remain unaffected.

2.4. Live chat

You may enter into a live chat on our website via the field on the right-hand side entitled “Support”. 

The data transferred to us via the chat will be stored, as well as personal data such as names, if necessary. Since a technical problem described in the chat or a question described in the chat regarding the correct use of our website may happen again after a solution is found in the specific chat situation, the storage of personal data, in particular names, is also required. 

Being able to find a quick solution by the accessing to the recent experiences (chat history), even if the problem does not directly relate to you “again”, represents a legitimate interest on our part, the consideration of which is also in the interest of other users. 

The personal identification of a chat is also justified because we are legally obliged to keep such communication histories in a comprehensible way in order to support the relevant authorities in asserting any state claims. Since claimants are then individuals on the user side, they must be kept identifiable. 

The legal basis for the processing of data described in the live chat is therefore also Article 6 (1) (f) GDPR. Insofar as we are subject to legal obligations, the legal basis is found in Article 6 (1) (c) GDPR.

2.5. Registration on this website

You may register on our website to make use of additional features that can only be offered in a separate login area. This includes in particular

- Establishing and using a player account; 

- Placing bets

- The newsletter with additional consent

After entering your details 

a. Salutation

b. Title

b. First name 

c. Surname

d. Date of birth;

e. Telephone no. (including mobile no.)

f. Email address (with confirmation line) 

g. Address details (specific details left out here for space reasons)

h. Country

i. Nationality

j. Place of birth 

and clicking on the required consent of general terms and conditions including information about age (must be over 18), and to confirm acknowledgement of the privacy policy. You will receive a 4-digit verification code from us electronically. Please enter/continue to use it to confirm and conclude your registration as requested by us – only then will your account be activated for you. 

All the data mentioned are mandatory without which we cannot complete registration. 

Without registration, you will not be able to use the above-mentioned main features of our website, in particular, betting with/through us. Only after registration are further data required for this purpose, in particular for payment transactions such as, for example, credit card data (without verification code) for payments and the bank data for the payout request 

All this is also for your protection, as participation here should only be possible after consideration and positive decision to do so. Furthermore, the data collected by us during registration serve to fulfil customer identification obligations, also on our part, to combat fraud and to remedy faults and/or maintain functionality. 

If you should forget your password or username for this area, you may have this information sent to you again after having entered your email address. The data collected as part of the function “Forgot username or password” will only be used to resend forgotten login information. 

The data entered for this purpose, including credit and/or bank data, will only be used for the purpose of using the above-mentioned additional functions, see above, including their fulfilment/settlement, as well as payment of any profits/bonuses or similar to you in the context of the purpose exclusively stipulated by us. We continue to use it, under statutory obligations (such as the Money Laundering Act), to identify you, in particular for the purposes of the statutory retention and processing obligations in the public interest, and to be able to present cash flows accordingly in a verifiable way, including if requested to do so by the authorities.

The mandatory information requested during registration must be given in full. Otherwise, as we are subject to STRICT legal obligations, we will and must reject the registration.

Data entered during registration are processed on the legal basis of Article 6 (1) (b) GDPR, since the data are required to be able to place bets with us, as well as in order to pay out winnings. Furthermore, most of the processing takes place at the same time on the basis of Article 6 (1) (c), since we are obliged to collect, store and otherwise process these data accordingly.  The processing of the data entered during registration is based on the legal basis of Article 6 (1) (b) GDPR, as the data are required to process your registration, set up and maintain a player/betting account, to be able to fulfil customer identification obligations in order to make the games available, to inform you when you have won a bet, to fight fraud and to remedy faults or maintain functionality. Furthermore, most of the processing takes place at the same time on the basis of Article 6 (1) (c), since we are obliged to collect, store and otherwise process these data accordingly. 

You can stop the registration at any time. An informal message to us by email is sufficient. The legality of any data processing already completed remains unaffected. 

The data collected during registration will be stored by us as long as you are registered on our website and will subsequently be deleted (for example after the registration has been completed, see above). Storage due to legal retention periods, however, remains unaffected.

2.6. Information about compulsory data collection

The collection of your personal data is essential for the conclusion of a contract and for the fulfilment of contractual obligations and services. If you do not provide us with the requested information, it will not be possible to successfully conclude a contract or perform further contractual services.

2.7. Analysis tools and advertising – Google Analytics

This website uses functions of the web analytics service Google Analytics. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Analytics also uses so-called “cookies”, which are, as described, small text files that are stored on your computer and thus allow an analysis of the use of the website by you.

The information generated by these cookies, for more information here, see the cookies listed in the above mentioned link https://www.pferdewetten.de/info/cookies/ that end in _gid, _ga or _gat such as the time, location and frequency of your website visit, including your IP address, is transmitted to Google in the United States and stored there. Google is certified under the so-called Privacy Shield Agreement and thus offers a guarantee to comply with European data protection law. For more information, see the link: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active.

We use Google Analytics on our website with the addition “_gat._anonymizeIp”. In this case, your IP address will already be shortened and thus anonymised by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area.

Google will use this information to evaluate your use of our site, to compile reports on the website activity for us, and to provide us with other services related to website activity and internet usage. Google may also transfer this information to third parties if required by law or as far as third parties process this data on behalf of Google.

Google will, according to its own information, in no case connect your, potentially anonymised (see above), IP address with other data from Google. 

You can prevent the installation of cookies by setting your browser software accordingly; however, please note that if you do this, you may not be able to use all the features of our website to the fullest extent possible. Furthermore, Google also offers a deactivation add-on (browser plug-in) for the most popular browsers, which gives you more control over what data Google collects about the websites you visit. The add-on informs the JavaScript (ga.js) of Google Analytics that no information about website visits should be transmitted to Google Analytics. However, the Google Analytics Disable Add-on does not prevent information from being transmitted to us or any other web analytics services we may use. For more information about installing this special browser add-on, please visit the following link: https://tools.google.com/dlpage/gaoptout?hl=en 

We would like to point out, however, that in this case you may not be able to use all functions of our website in full. Google Analytics cookies are stored on the basis of Article 6 (1) (f) GDPR. We as website operators have a legitimate interest in analysing user behaviour in order to optimise both out website and our advertising. We are also interested in increasing the efficiency of our website – in the field of betting in particular it is important to have exact and fast functionalities that the user should be able to rely on. This means that any of your potentially conflicting interests do not prevail, especially as you still have the option to disable cookies as described here. 

2.8. Opt out

You can prevent the collection of your data by Google Analytics by clicking on the following link. An opt-out cookie will be set to prevent your data from being collected on future visits to this site: Please click on the following link: Deactivate Google Analytics.

Further information on handling user data in Google Analytics can also be found in the corresponding privacy policy of Google: https://support.google.com/analytics/answer/6004245?hl=en.

2.9. Google Web Fonts

This site uses so-called web fonts, provided by Google, for the uniform representation of fonts. When you open a page, your browser loads the required web fonts into your browser cache to display texts and fonts correctly.

To do this, the browser you use must connect to Google’s servers. As a result, Google learns that our website has been accessed via your IP address. The use of Google Web Fonts is in the interest of a consistent and attractive presentation of our online services. This constitutes a legitimate interest within the meaning of Article 6 (1) (f) GDPR.

If your browser does not support web fonts, a default font will be used by your computer.

For more information about Google Web Fonts, visit https://developers.google.com/fonts/faq and Google’s Privacy Policy: https://www.google.com/policies/privacy/.

3.1. Newsletter data

If you would like to receive our newsletter that is offered on our website after registration, we will need not only the email address provided by you when registering, but also your specific order of the newsletter – e.g. by clicking on it via your customer account. You may revoke or activate your consent (checkbox) by means of your customer account or via the unsubscribe function of a received newsletter at any time.

Further data are not collected or only done so on a voluntary basis. We only use these data to send the requested information and do not pass it on to other third parties (see below for order processing, no. 1 i)), but only to Evalanche for the technical implementation of the shipment. Evalanche is naturally committed to respecting your privacy interests by means of an express agreement with us; more details below under “Evalanche”.

Data entered into the newsletter registration form are processed exclusively on the basis of your consent (Article 6 (1) (a) GDPR). The consent granted to process data for sending the newsletter may be revoked at any time, for example via the “unsubscribe” link in the newsletter; you can also deactivate the corresponding check in the customer account. 

The legality of any data processing already completed remains unaffected by the revocation.

The data stored by you for the purpose of acquiring our newsletter from us or Evalanche – see below – will be stored by us until you are removed from the newsletter and deleted after cancelling the newsletter. 

3.2. Evalanche

This website uses Evalanche’s newsletters to send you newsletters, as well as to track user behaviour when acquiring/reading newsletters, after you have confirmed your subscription to the newsletter. The provider is SC-Networks, GmbH, Enzianstraße 2, 82319 Starnberg, Germany.

Evalanche is thus primarily used to organise and analyse the sending of newsletters. If you enter data for the purpose of newsletter subscription (for example, email address), these will be stored on Evalanche’s servers in Germany.

With the help of Evalanche, we can analyse our newsletter campaigns with the aim of improving the quality and the informational content. When you open an email sent with Evalanche, a file included in the email (a so-called web-beacon) connects to Evalanche’s servers in Germany. This way, it can be determined if a newsletter message has been opened and which links have been clicked on. In addition, technical information is collected (e.g. time of retrieval, IP address, browser type and operating system). This information is for the statistical analysis of newsletter campaigns only. The results of these analyses can be used to better tailor future newsletters to the interests of the recipient.

If you do not want to be analysed by Evalanche, you have to unsubscribe from the newsletter, see above for revocation. To this end, we provide a link in every newsletter message. Furthermore, you can unsubscribe from the newsletter directly on the website.

This data processing is based on Article 6 (1) (f) GDPR, since it is our legitimate interest to optimise the services of our newsletter by analysing user behaviour - and we assume it is in your interest as well. 

The data stored with us for the purpose of subscribing to the newsletter will be stored by us until you are removed from the newsletter and deleted from the servers of Evalanche after the newsletter subscription is cancelled. 

For more information about how Evalanche handles data, you can also refer to the privacy policy of SC-Networks, see the link: https://www.sc-networks.de/unternehmen/datenschutz/.

Conclusion of a data processing agreement

We have a so-called “Data Processing Agreement” with Evalanche in which we obligate Evalanche to protect the data of our customers and not to pass them on to third parties. This contract can be viewed via the following link: 

https://www.pferdewetten.de/assets/public/doc/evalanche_2018_05_25.pdf

4.1. Data processing through social networks

We maintain publicly available profiles in social networks. The individual social networks we use can be found below.

Social networks such as Facebook, Google+ etc. can generally analyse your user behaviour comprehensively if you visit their website or a website with integrated social media content (e.g. like buttons or banner ads). When you visit our social media pages, numerous data protection-relevant processing operations are triggered.

In detail: If you are logged in to your social media account and visit our social media page, the operator of the social media portal can assign this visit to your user account. Under certain circumstances, your personal data may also be recorded if you are not logged in or do not have an account with the respective social media portal. In this case, this data is collected, for example, via cookies stored on your device or by recording your IP address.

Using the data collected in this way, the operators of the social media portals can create user profiles in which their preferences and interests are stored. This way you can see interest-based advertising inside and outside of your social media presence. If you have an account with the social network, interest-based advertising can be displayed on any device you are logged in to or have logged in to.

Please also note that we cannot retrace all processing operations on the social media portals. Depending on the provider, additional processing operations may therefore be carried out by the operators of the social media portals. Details can be found in the terms of use and privacy policy of the respective social media portals.

Legal basis

Our social media appearances should ensure the widest possible presence on the Internet. This is a legitimate interest within the meaning of Art. 6 (1) lit. f GDPR. The analysis processes initiated by the social networks may be based on divergent legal bases to be specified by the operators of the social networks (e.g. consent within the meaning of Art. 6 (1) (a) GDPR).

Responsibility and assertion of rights

If you visit one of our social media sites (e.g., Facebook), we, together with the operator of the social media platform, are responsible for the data processing operations triggered during this visit. You can in principle protect your rights (information, correction, deletion, limitation of processing, data portability and complaint) vis-à-vis us as well as vis-à-vis the operator of the respective social media portal (e.g. Facebook).

Please note that despite the shared responsibility with the social media portal operators, we do not have full influence on the data processing operations of the social media portals. Our options are determined by the company policy of the respective provider.

Storage time

The data collected directly from us via the social media presence will be deleted from our systems as soon as the purpose for their storage lapses, you ask us to delete it, you revoke your consent to the storage or the purpose for the data storage lapses. Stored cookies remain on your device until you delete them. Mandatory statutory provisions – in particular, retention periods – remain unaffected.

We have no control over the storage duration of your data that are stored by the social network operators for their own purposes. For details, please contact the social network operators directly (e.g. in their privacy policy, see below).

4.1.1. Facebook

We have a profile on Facebook. The provider is Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA. Facebook is certified under the EU-US Privacy Shield.

If you provide us with account, credit card or other data for the settlement of payments, these will be collected for the purpose of processing the payment and may be transmitted to payment service providers. Additional terms may apply. We will delete this information as soon as you delete your user account. Mandatory statutory provisions – especially retention periods – remain unaffected.

The legal basis for this processing is Article 6 (1) (b) GDPR.

Named external service providers are currently: 

- Credit card: Wirecard Bank AG, Einsteinring 35, D-85609 Aschheim, Germany

- Paysafecard: MAC Limited, Unit3.01, World Trade Center, Bayside Road, GX11 1AA Gibraltar

- Skrill: Skrill Ltd, 25, Canada Square, London E14 5LQ, UK

- Sofort/Ideal: Sofort GmbH, A Klarna Group Company, Theresienhöhe 12, 80339 Munich, Germany 

- Klarna: Klarna AB, Sveavägen 46, 111 34 Stockholm, Sweden

If your personal data are processed by us, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis us:

a. Right to information

You may request confirmation from us as to whether personal information concerning you is processed by us. If such processing is required, you may request from us the information specified in Article 15 of the GDPR. 

We reserve the right to refer to this privacy policy if it already contains the relevant information. 

b. Right to rectification 

According to Article 16 GDPR, you have the right to rectification and/or completion vis-à-vis the controller if the processed personal data concerning you are incorrect or incomplete. We will make the correction without delay.

c. Right to a restriction of processing

In particular, under the following conditions, see also other conditions including Article 18 GDPR, you can demand the restriction of the processing of personal data concerning you:

(1) if you contest the accuracy of your personal information for a period of time that enables us to verify the accuracy of your personal information;

(2) our processing is unlawful and you refuse deletion of the personal data and instead demand the restriction of the use of your personal data; or

(3) if you have objected to the processing pursuant to Article 21 (1) GDPR and it is not yet certain whether, in the context of the balancing of interests which is then to be undertaken, our legitimate reasons prevail over your reasons.

If you have the right to restrict the processing of personal data concerning you, these data may only be processed – with the exception of their storage – with your consent or for the establishment, exercise or defence of legal claims or to protect the rights of another natural person or legal entity or for reasons of significant public interest of the Union or of a Member State.

If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by us before the restriction is lifted.

d. Right to erasure

(1) Obligation to erase, Article 17 GDPR

You may request that the personal data relating to you be deleted immediately if one of the following is true:

- Your personal data are no longer required for the purposes for which they were collected or otherwise processed.

- You revoke your consent on which processing under Article 6 (1) (a) or Article 9 (2) (a) GDPR was based, and there is no other legal basis for processing. 

- In accordance with Article 21 (1) GDPR, you object to processing and there are no prior justifiable grounds for processing, or you object to the processing pursuant to Article 21 (2) GDPR. 

- Your personal data has been processed unlawfully. 

- The deletion of personal data concerning you is required to fulfil a legal obligation under Union law or under the law of one of the Member States to which the controller is subject (usually: Germany). 

- The personal data concerning you were collected in relation to information society services offered pursuant to Article 8 (1) GDPR.

(2) Information to third parties

If we have made the personal data relating to you public and if we are obliged to delete them pursuant to Article 17 (1) GDPR, we shall take appropriate measures, taking into account the available technology and the implementation costs, also of a technical nature, to inform data controllers who process the personal data that you, as the data subject, have requested the deletion of, any links to such personal data or copies or replications of such personal data. 

(3) Exceptions

The right to erasure does not exist if the processing is necessary

- to exercise the right to freedom of expression and information;

- to fulfil a legal obligation required by the law of the Union or of the Member States to which the controller is subject, or to carry out a task of public interest or in the exercise of official authority conferred to the controller;

- for reasons of public interest in the field of public health pursuant to Article 9 (2) (h) and (i) and Article 9 (3) GDPR;

- for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes pursuant to Article 89 (1) GDPR, to the extent that the law referred to in (a) is likely to render impossible or seriously affect the achievement of the objectives of said processing, or

- to establish, exercise or defend legal claims

e. Right to notification (Article 19 GDPR)

If you have the right to rectification, erasure and/or restriction of processing vis-à-vis us, we shall be obliged to notify all recipients to whom your personal data have been disclosed of this correction or deletion of the data or restriction of processing, unless this proves impossible or involves a disproportionate level of effort.

You have a right vis-à-vis the controller to be informed about these recipients.

f. Right to data portability (Article 20 GDPR)

In particular, you have the right –for more details see Article 20 GDPR – to obtain the personal data that you have provided to us in a structured, usual and machine-readable format. You also have the right to transfer this data to another controller without hindrance from us, who has been provided with the personal data, provided that

(1) the processing is based on consent pursuant to Article 6 (1) (a) GDPR or Article 9 (2) (a) GDPR or on a contract pursuant to Article 6 (1) (b) GDPR and

(2) the processing is done using automated procedures.

In exercising this right, you also have the right to obtain that your personal data relating to you are transmitted directly from one person to another, insofar as this is technically feasible. Freedoms and rights of other persons may not be affected here.

g. Right to object to data collection in special cases and direct mail (Article 21 GDPR)

If the personal data relating to you are processed for direct marketing purposes, for example in the case of newsletters, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling, insofar as it is connected with such direct mail, in which you revoke the consent (checkbox set by you) via your customer account or using the unsubscribe function of a received newsletter.

If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes.

You otherwise have the right, at any time for reasons arising from your particular situation, to object to the processing of your personal data relating to you under Article 6 (1) (e) or (f) GDPR; this also applies to profiling based on these provisions. 

We will no longer process personal data concerning you, unless we can prove that there are compelling legitimate reasons for further processing that outweigh your interests, rights and freedoms, or the processing serves the establishment, exercising or defence of legal claims.

Regardless of Directive 2002/58/EC, you have the option, in the context of the use of information society services, of exercising your right to object through automated procedures that use technical specifications.

h. Right to revoke the data protection consent declaration

You have the right to revoke your data protection consent declaration at any time. The revocation of consent does not affect the legality of the processing carried out on the basis of the consent until the revocation.

i. Automated decision on an individual basis including profiling

You have the right not to be subjected to a decision based solely on automated processing – including profiling – that will have legal effect on you or otherwise affect you in a similar manner. Nevertheless, we do not make such decisions/profiling. It is only for the sake of completeness that we refer to Article 22 GDPR, the validity of which we, of course, would accept if it were to be applicable. 

j. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your place of residence or the place of the alleged infringement, if you believe that the processing of your personal data is in violation of the GDPR. 

Since several places are conceivable, we provide you with an official list of all data protection officers including their contact details. You are welcome to use the following link of the Federal Commissioner for Information and Privacy, Bonn: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html. The supervisory authority to which the complaint has been submitted will then inform you as complainant of the status and results of the complaint, including the possibility of a judicial remedy pursuant to Article 78 GDPR.

Valid as of: 07/11/2018