Privacy Policy
This Privacy Policy explains the type, scope and purpose of processing personal data (hereinafter "data") within our services as well as within our online offering and associated websites, functions and content, and external online presences, such as our social media profiles (collectively referred to as "Online Offering"). With regard to the terms used (e.g. "processing" or "controller"), we refer to the definitions in Art. 4 of the EU General Data Protection Regulation (GDPR).
Controller
Bear Hands Crew GmbH
Hamburger Straße 273c
38114 Braunschweig
Germany
Represented by: Benjamin Krein
E-mail: info@bearhands.de
Phone: +49 (0) 531 61807831
Data Protection Officer:
LGD Datenschutz und Compliance GmbH
Consultant: Jörn Hirsch
Werner-Heisenberg-Straße 8
39106 Magdeburg
+49 (0)391 5568632-5
j.hirsch@lgd-data.de
Types of data processed
- Inventory data (e.g. master data, names, addresses)
- Contact data (e.g. e-mail, phone numbers)
- Content data (e.g. text entries, photos, videos)
- Usage data (e.g. visited websites, interest in content, access times)
- Meta/communication data (e.g. device information, IP addresses)
Categories of data subjects
Visitors and users of the Online Offering (hereinafter we refer to the data subjects collectively as "users").
Purpose of processing
- Provision of the Online Offering, its functions and content
- Responding to contact requests and communication with users
- Security measures
- Reach measurement/marketing
Terms used
“Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”). A natural person is regarded as identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers practically any handling of data.
“Pseudonymisation” is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without additional information.
“Controller” means the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data.
“Processor” means a natural or legal person which processes personal data on behalf of the controller.
Relevant legal bases
In accordance with Art. 13 GDPR, we inform you of the legal bases of our data processing. If the legal basis is not specified in the Privacy Policy, the following applies: The legal basis for obtaining consent is Art. 6(1)(a) and Art. 7 GDPR; the legal basis for processing for the performance of our services and the execution of contractual measures as well as responding to enquiries is Art. 6(1)(b) GDPR; the legal basis for processing to comply with our legal obligations is Art. 6(1)(c) GDPR; and the legal basis for processing to protect our legitimate interests is Art. 6(1)(f) GDPR. In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6(1)(d) GDPR serves as the legal basis. The legal basis for processing special categories of data (Art. 9(1) GDPR) is determined according to the provisions of Art. 9(2) GDPR.
Security measures
We take appropriate technical and organisational measures in accordance with the legal requirements, taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, in order to ensure a level of security appropriate to the risk. Such measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical access to the data, as well as access, input, disclosure, availability and separation of the data. Furthermore, we have established procedures to ensure the exercise of data subjects’ rights, the deletion of data and the response to data threats. We also take into account the protection of personal data when developing and selecting hardware, software and procedures, in accordance with the principle of data protection through technology design and data protection-friendly default settings.
Cooperation with processors, joint controllers and third parties
If, in the course of our processing, we disclose data to other persons and companies (processors, joint controllers or third parties), transmit it to them or otherwise grant them access to the data, this is done only on the basis of a legal permission (e.g. if transmission of the data to third parties, such as payment service providers, is required for contract performance pursuant to Art. 6(1)(b) GDPR), you have consented, a legal obligation provides for this or on the basis of our legitimate interests.
Transfers to third countries
If we process data in a third country (i.e. outside the European Union (EU), the European Economic Area (EEA) or the Swiss Confederation) or this occurs in the context of the use of services of third parties or disclosure/transfer of data to third parties, this only takes place if it is necessary to fulfil our (pre-)contractual obligations, on the basis of your consent, due to a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or have the data processed in a third country only where the special requirements of Art. 44 et seq. GDPR are met (e.g. processing based on special guarantees, such as an adequate level of data protection acknowledged by the EU Commission, or compliance with officially recognised special contractual obligations—standard contractual clauses). For more information, see the
EU Commission’s information page on data transfers outside the EU.
Rights of the data subjects
You have the right to obtain confirmation as to whether or not personal data concerning you is being processed and to access this data, as well as further information and a copy of the data, in accordance with Art. 15 GDPR. You have the right to have incomplete or inaccurate data rectified, in accordance with Art. 16 GDPR. In accordance with Art. 17 GDPR, you have the right to demand that data in question be erased without delay, or alternatively, in accordance with Art. 18 GDPR, to demand restriction of processing. You have the right to receive the data you have provided to us in accordance with Art. 20 GDPR and to request its transmission to other controllers.
Right to withdraw consent
You have the right to withdraw consent given with effect for the future.
Right to object
You may object at any time to the future processing of your data in accordance with Art. 21 GDPR. The objection may in particular be made against processing for direct marketing purposes.
Cookies and right to object to direct marketing
"Cookies" are small files that are stored on users' devices. Various information can be stored within cookies. A cookie primarily serves to store information about a user (or the device on which the cookie is stored) during or after a visit to an online offering. Temporary cookies (also called session or transient cookies) are cookies that are deleted after a user leaves an online offering and closes the browser. Permanent or persistent cookies remain stored even after the browser is closed. Users can generally disable the storage of cookies in their browser settings. An objection to the use of cookies for online marketing purposes can also be declared via a number of services.
