Privacy Policy
Data protection is of high importance to us – and surely to you as well. With this privacy policy, we inform you which personal data (hereinafter also referred to as "data") is processed by us in relation to our internet presence (hereinafter "websites") and what rights you are entitled to. This privacy policy also serves to implement our obligations under Section 19 of the German Telecommunication-Digital-Services-Data-Protection-Act (TDDG) as well as Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR).
1. Data Controller
Complex Pleasures
Sabrina Zeltner und Philipp Dittmar GbR
c/o Z-Bau
Frankenstraße 200
90461 Nürnberg
Kontakt
E-Mail: studio@complexpleasures.com
2. Definitions
This privacy policy uses the following terms within the meaning of the General Data Protection Regulation:
"personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
"processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
"controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;
"processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
"recipient" means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;
"third party" means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;
"consent" of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
"cross-border processing" means either: the processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or the processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.
3. Nature, Scope, Purpose and Legal Bases of Processing
3.1 The following types of data are processed by us:
Customer data (names, gender, date of birth, address, telephone and fax number, email address, bank details); content data (texts, images, videos); usage data (visited websites, access times, location, etc.); communication data (device information, IP addresses, etc.); contractual data (contract text, payments).
3.2 The following categories of data subjects are involved:
Visitors to our websites (hereinafter also referred to as "users") as well as other interested parties, lottery/contest participants; buyers of our goods and recipients of our services (hereinafter also referred to as "customers"); other business partners.
3.3 The data is processed for the following purposes and on the basis of the legal bases mentioned below:
Presentation, maintenance, and improvement of our websites including all functions vis-à-vis users, as well as for evidentiary purposes; this is carried out on the basis of Article 6(1)(f) GDPR (safeguarding our legitimate interests). Communication and usage data are processed; as a matter of principle, data is not disclosed to third parties unless there is a legal obligation to do so (Article 6(1)(c) GDPR).
Processing of usage data (visited websites, viewed products) and content data for advertising purposes, in particular for personalized product recommendations; this is carried out on the basis of Article 6(1)(f) GDPR (safeguarding our legitimate interests).
Responding to inquiries via a contact form, email correspondence with users and customers, and the execution of lotteries/contests; processing is carried out on the basis of Article 6(1)(b) GDPR.
Creation of a user account. On the occasion of the creation or modification of a user account for our websites, customer data, contractual data, and, if applicable, content data are processed in order to provide the services within the scope of the websites for registered users, Article 6(1)(b) GDPR; furthermore, communication data may be processed for evidentiary purposes and to protect against misuse of the functions, Article 6(1)(f) GDPR (safeguarding our legitimate interests).
For the performance of contractual obligations towards customers and other contractual partners, customer data as well as contractual data are processed. Insofar as data to be entered in forms is marked as mandatory, it is required for the fulfillment of the described purpose. Processing is carried out on the basis of Article 6(1)(b) and (c) GDPR.
For the display of the user's own content. If applicable, the user may post their own content in forums or similar functions on our websites; this is generally made possible anonymously. IP addresses are stored for evidentiary reasons and thus on the basis of our legitimate interests pursuant to Article 6(1)(f) GDPR.
Our own marketing; if consent has been obtained, processing is carried out in accordance with Article 6(1)(a) and Article 7 GDPR; otherwise, to safeguard our legitimate interests pursuant to Article 6(1)(f) GDPR.
If our processing is based on further legal bases, these will be named below in the further explanations.
4. Data Erasure
The erasure of data is carried out on the basis of Articles 17 and 18 GDPR; the same applies to the restriction of processing and the blocking of data. The erasure or restricted processing of the data takes place if and to the extent that it is no longer required to achieve a specified purpose, unless erasure is prohibited by law (e.g., statutory retention obligations under commercial or tax law) or something else has been agreed upon.
Pursuant to Section 257 of the German Commercial Code (HGB) and Section 147(1) of the German Fiscal Code (AO), every merchant/business entity is specifically obligated to retain commercial books and records, inventories, opening balance sheets including work instructions, annual financial statements, other organizational documents, and accounting vouchers for ten years; a retention period of six years applies to commercial and business letters.
5. Cookies
This website does not use cookies.
6. Hosting
To maintain, restore, and improve our services, we collaborate with hosting partners, particularly regarding storage space, computing capacity, database services, infrastructure, maintenance services, and similar services. In this context, data may be processed in accordance with Section 3.1 of this privacy policy; in particular, the collection of server log files (server access logs). The processing is carried out on the basis of a legitimate interest on our part pursuant to Article 6(1)(f) GDPR in conjunction with Article 28 GDPR. The data is erased no later than seven days after it has been stored; this does not apply if retention is required for evidentiary purposes – in such cases, erasure takes place once the purpose of evidence has ceased to exist.
7. Social Media Presence (Instagram & YouTube)
We maintain online presences within social networks in order to communicate with customers, interested parties, and users active there and to inform them about our services. When accessing the respective networks and platforms, the terms and conditions and the data processing guidelines of the respective operators apply.
Unless otherwise stated in our privacy policy, we process the data of users if they communicate with us within the social networks and platforms (e.g., write posts on our online presences or send us messages). The processing is carried out on the basis of our legitimate interests in effectively informing users and communicating with users pursuant to Art. 6(1)(f) GDPR.
Instagram: The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Instagram's privacy policy can be found at: instagram.com.
YouTube with Embedded Videos: We embed videos from the YouTube platform on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The embedding is carried out via a prior consent solution (e.g., two-click solution). Only after you actively grant your consent will the videos be loaded and data (such as your IP address and usage data) be transmitted to Google. The processing is carried out on the basis of your consent pursuant to Art. 6(1)(a) GDPR. YouTube's/Google's privacy policy can be found at: google.com.
8. Rights of the Data Subjects
Under the GDPR, you are entitled to various rights regarding your data:
You may request confirmation as to whether data concerning you is being processed; if this is the case, you may request access to this data as well as further information and a copy of the data, Article 15 GDPR.
You have the right to request the rectification of inaccurate personal data and the completion of incomplete personal data without undue delay, Article 16 GDPR.
You may request that data concerning you be erased without undue delay (Article 17 GDPR) or that its processing be restricted (Article 18 GDPR).
Subject to the requirements of Article 20 GDPR, you have the right to receive the data you have provided and to transmit this data to another controller without hindrance from us.
Pursuant to Article 77 GDPR, you may lodge a complaint with the competent supervisory authority.
You may withdraw consents granted pursuant to Article 7(3) GDPR with effect for the future and object to the future processing of data concerning you at any time in accordance with Article 21 GDPR.