Privacy Policy (DSGVO)

DATA PROTECTION DECLARATION

Controller:

GVW Raumdekor GmbH
Karl-Carstens Strasse 17
52146 Würselen

Contact details of our Data Protection Officer:
Email: datenschutz@gvw-group.com

Supervisory authority:
State Data Protection and Freedom-of-Information Officer
for North Rhine-Westphalia
Ms Helga Block
Kavalleriestr. 2-4
40213 Düsseldorf
Phone: +49 211 38424-0
Fax: +49 211 38424-10
Email: poststelle@ldi.nrw.de

Without prejudice to any administrative or legal action, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes this Regulation.
The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.

I. Data collected when visiting the website
 
Your personal data (e.g. title, name, address, email address, phone number) are processed by us exclusively in accordance with the provisions of the German Data Protection Act and the Data Protection Regulation of the European Union (EU). The provisions set out below will inform you about the nature, scope and purpose of the collection, processing and use of your personal data. This data protection declaration refers only to our webpages. If you are forwarded to other websites via links, you will need to inform yourself directly on these websites about the respective handling of your data.

In general, you can use our website without disclosing information on your personal identity. When accessing the website, the browser used on your device will automatically send data to the server of our website. This data will be temporarily stored in a so-called logfile.

In doing so, the following data will be collected without any action on your part until it is automatically deleted:

IP address of the accessing computer, date and time of the access, name and URL of the retrieved file, browser used and – where applicable – the operating system of your device and the name of your access provider.

The above data are processed by us for the following purposes:
ensure a connection to the website, ensure the optimal use of the website, analyse the stability of the system and for additional administrative purposes.

The legal basis for the processing of the data is Art. 6 (1) S. 1 lit. f GDPR. Our legitimate interest is based on the above listed purposes for data collection. Under no circumstances will we use the collected data for the purpose of drawing conclusions on you.
 
II. Data protection for contract performance
 
The personal data provided by you within the scope of the order process are required for entering into a contract with us. You are not obligated to provide your personal data. Without the disclosure of your address, we will however not be able to send you the ordered goods. For certain payment methods, we need the required payment data in order to forward these to a payment service provider commissioned by us. This means that the processing of the data entered by you within the scope of the order process is done for the purpose of contract performance.

If you send us a request by email or via a contact form prior to contract conclusion, we will process the data received in this process for the implementation of pre-contractual measures and will for instance answer your questions regarding our products. In this case, the legal basis for the processing is Art. 6 (1) b) GDPR.

The recipients of the collected data may be: Hosting providers, where applicable a merchandise management system.

Where you provide us with data within the scope of the contact conclusion, we will process the received data for the implementation of contractual measures. In this case, the legal basis for the processing is Art. 6 (1) b) GDPR.

The recipients of the data may be: Payment service providers, shipping providers, hosting providers, where applicable a merchandise management system, where applicable suppliers (drop-shipping).


The data processed for the implementation of pre-contractual measures are deleted as soon as the measures have been completed and it is clear that a contact conclusion will not occur.


The personal data collected by us for contract performance are stored by us until the expiration of the statutory retention obligations and then deleted, unless we are obligated to store the data for a longer period in accordance with Article 6 (1) S. 1 lit. c GDPR due to retention and documentation obligations under tax and commercial law (for example based on Section 257 German Commercial Code (HGB), Section 147 Tax Code (AO)) or if you have consented to a longer storage period in accordance with Art. 6 (1) S. 1 lit. a GDPR.

RIGHT TO OBJECT
You have the right to object to the processing of data based on Art. 6 (1) f) GDPR and not serving the purpose of direct marketing on grounds relating to your particular situation at any time.
In case of direct marketing, you have the right to object at any time to the processing of personal data.

III Information on cookies

General information
On this website, we use cookies required for technical purposes. Cookies are small text files which are stored in or by your Internet browser on your computer system. These cookies for instance enable you to place several products in your shopping cart.

The legal basis for this processing is Art. 6 (1) f) GDPR.
Our legitimate interest is the proper functioning of our website. The user data collected by the cookies required for technical reasons are not used to create user profiles. This preserves your interests within the scope of data protection.

In general, the cookies required for technical reasons are deleted when you close your browser. The life of permanently stored cookies varies from between a few minutes to several years.

RIGHT TO OBJECT
If you do not want these cookies to be stored on your device, please deactivate the acceptance of these cookies in your Internet browser. This may however mean that not all functions of our website will work properly. You can also delete the permanently stored cookies via your browser at any time.
Use of cookies
a) Description and scope of data processing
Our website uses cookies. Cookies are text files which are stored in the Internet browser or by the Internet browser on the computer system of the user. When a user calls up a website, a cookie can be stored on the operating system of the user. This cookie contains a distinctive string which enables the definite identification of the browser when the website is re-accessed.

We use cookies in order to make our website more user-friendly. Some elements of our website make it necessary that the requesting browser can also be identified after you switch to another website.
Hereby the following data are stored and transmitted in the cookies:
IP address, data and time of your request, language settings.

In addition, we use cookies on our website to enable the analysis of the surfing behaviour of the user. Due to this, the following data can be provided: entered search terms, frequency of page impressions, use of website functions. The user data used in this connection are pseudonymised by means of technical measures. A connection of the data to the accessing user is then no longer possible. This data is not stored together with other personal data of the users.

b) Legal basis for data processing
The legal basis for the processing of personal data by means of cookies is Art. 6 (1) lit. f GDPR.
The legal basis for the processing of personal data by means of cookies required for technical reasons is Art. 6 (1) lit. f GDPR.

c) Purpose of the data processing
The purpose of the use of cookies required for technical reasons is to ensure a more convenient use of the website for the users. Some functions on our website cannot be provided without the use of cookies. These functions make it necessary that the browser is recognised also after the user switches to another website.
The user data collected by the cookies required for technical reasons are not used to create user profiles.
These purposes constitute our legitimate interest for the processing of personal data in accordance with Art. 6 (1) lit. f GDPR.


e) Duration of storage, objection and deletion options
Cookies are stored on the computer of the user and transmitted by the browser to our website. This means that you as the user have the full control over the use of the cookies. By changing the settings in your Internet browser, you can deactivate or restrict such transmission by the cookies. Any already stored cookies can be deleted at any time. This can also be carried out automatically. If cookies are deactivated for our website, it is possible that you will then be no longer able to use all functions of the website to their full extent.


Integration of Google Maps
(1) We use the services of Google Maps on this website. This enables us to provide you with interactive maps directly on our website and you benefit from the convenient map function.
(2) When visiting the website, Google will be provided with the information that you have called up the relevant subpage of our website. In addition, the data listed in Section 3 hereunder are transmitted. This occurs regardless of whether Google provides a user account via which you are signed in or whether no such user account exists. If you are signed into Google, your data will be directly linked to your account. If you do not want to be linked to your Google profile, you must sign out before activating the button. Google stores your data in form of user profiles and uses them for purposes of marketing, market research and/or the needs-based design of its website. Such an analysis will be carried out in particular (also for users who are not signed in) for the purpose of providing targeted advertising and to inform other uses in the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact Google for the assertion of these rights.
(3) Additional information on the purpose and scope of the collected data and the processing of such by the plug-in provider is available in the privacy statements of the provider. There you can also obtain further information on your rights and settings options for the protection of your privacy. http://www.google.de/intl/de/policies/privacy. Google also processes your personal data in the USA and has committed itself to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework

IV. Additional functions

Contract form/Enquiry form
In case of any questions, you have the possibility to contact us via the form provided on our website. This requires the specification of a valid email address so that we know who sent the enquiry and are able to answer it. Additional information can be provided on a voluntary basis. It is at your own discretion to decide whether you want to enter this data in the contact from.

The processing of data for the purpose of contacting us is based on Art. 6 (1) S. 1 lit. a GDPR on the basis of your voluntarily granted consent.
The personal data collected for the use of the contact form will be deleted automatically after the completion of your enquiry, unless it is necessary to continue to store the data for the further processing of the enquiry or where a legitimate interest for the storage of the data exists.

RIGHT TO OBJECT
You have the right to object to the processing of data based on Art. 6 (1) f) GDPR and not serving the purpose of direct marketing on grounds relating to your particular situation at any time.
In case of direct marketing, you have the right to object at any time to the processing of personal data.
 

VII Rights of the data subject
 
Whenever your personal data is processed, you are a data subject in terms of the GDPR and you are entitled to the following rights in your dealings with us:

1. Right of access
You have the right to obtain a confirmation from us as to whether personal data concerning you are being processed by us.
Where this is the case, you have the right to obtain the following information from us:
(1) the purposes of the processing;
(2) categories of personal data concerned;
(3) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
(4) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
(5) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
(6) the right to lodge a complaint with a supervisory authority;
(7) where the personal data are not collected from the data subject, any available information as to their source;
(8) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
You shall have the right to be informed, whether personal data are transferred to a third country or to an international organisation. In this connection you can request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.
 
2. Right to rectification
You have the right to obtain from us the rectification and/or completion where the processed personal data concerning you are inaccurate or incomplete. We are obligated to carry out the rectification without undue delay.
 
3. Right to restriction of processing
Under the following circumstances, you may obtain the restriction of processing of your personal data:
(1) where the accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data;
(2) where the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
(3) where we no longer need the personal data for the purposes of the processing, but they are required by us for the establishment, exercise or defence of legal claims, or
(4) where you have objected to processing pursuant to Article 21(1) pending the verification whether our legitimate grounds override yours.
Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
Where restriction of processing has been obtained in accordance with the above, you shall be informed by us before the restriction of processing is lifted.
 
4. Right to erasure
a) Obligation to erase
You shall have the right to obtain from us the erasure of your personal data without undue delay and we shall have the obligation to erase such personal data without undue delay where one of the following grounds applies:
(1) Your personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
(2) You withdraw your consent on which the processing is based according to point Art. 6 Abs. 1 lit. a or Art. 9 Abs. 2 lit. a GDPR and where there is no other legal ground for the processing;
(3) Pursuant to Article 21(1) GDPR you object to the processing and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) GDPR;
(4) Your personal data have been unlawfully processed;
(5) Your personal data have to be erased for compliance with a legal obligation in Union or Member State law to which we are subject;
(6) Your personal data have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.
 
b) Data provided to third parties
Where we have made the personal data public and are obliged pursuant to Art. 17 (1) GDPR to erase the personal data, we, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you as the data subject have requested the erasure by such controllers of any links to, or copy or replication of, such personal data.
 
c) Exceptions
The right to erasure shall not apply to the extent that processing is necessary
(1) for exercising the right of freedom of expression and information;
(2) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(3) for reasons of public interest in the area of public health in accordance with points (h) and Art. 9 (2) lit. h and i as well as Art. 9 (3) GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) GDPR in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
(5) for the establishment, exercise or defence of legal claims.
 
5. Right to notification
Where you asserted the right to rectification or erasure of personal data or restriction of processing against us, we are obligated to notify each recipient to whom the personal data have been disclosed about such a rectification or erasure of personal data or restriction of processing, unless this proves impossible or involves disproportionate effort.
You have the right to be informed about such recipients.
 
6. Right to data portability
You shall have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format. In addition, you have the right to transmit such data to another controller without hindrance, where
(1) the processing is based on consent pursuant to Art. 6 (1) lit. a GDPR or Art. 9 (2) lit. a GDPR or on a contract pursuant to Art. 6 (1) lit. b GDPR and
(2) the processing is carried out by automated means.
In exercising your right to data portability, you shall have the right to have the personal data transmitted directly from us to another controller, where technically feasible. This may not adversely affect the rights and freedoms of others.
The exercise of the right to data portability shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
 
7. Right to object
You shall have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6 (1) lit. e or f GDPR, including profiling based on those provisions.
We shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or serve the establishment, exercise or defence of legal claims
Where your personal data are processed for direct marketing purposes, you shall have the right to object at any time to the processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Where you object to processing for direct marketing purposes, your personal data shall no longer be processed for such purposes.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.
 
8. Withdrawal of the declaration of consent under data protection law
You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of your consent will not affect the lawfulness of the processing of the personal data before the withdrawal.
 
9. Automated individual decision-making, including profiling
You shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This shall not apply if the decision
(1) is necessary for entering into, or performance of, a contract between you and us;
(2) s authorised by Union or Member State law to which we are subject to and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
(3) is based on your explicit consent.
Such decisions shall not be based on special categories of personal data referred to in Article 9(1) GDPR, unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.
With regard to the cases set out in (1) and (3), we shall take reasonable measures to safeguard the rights and freedoms as well as your legitimate interests.
 
10. Right to lodge a complaint with a supervisory authority
Without prejudice to any administrative our legal action, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes this Regulation.
The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.