• Notes and modifications as a result of the new data protection regulations (GDPR)

    Thank you for your interest in our website. The protection of your personal data is important to us. The following text includes information on how we handle your data, collected through your use of our website. Your data will be processed in accordance with the statutory data protection regulations. Where links are provided to other websites we have neither influence nor control over the linked content and the data protection conditions on these sites. We recommend examining the data protection declarations on the linked websites in order to be able to determine whether and to what extent personal data is collected, processed, used or made accessible to third parties.

    Responsible supervisory authority within the meaning of data protection law 
    Wilhelm Schimmel Pianofortefabrik GmbH
    Friedrich-Seele-Strasse 20,
    D- 38122 Braunschweig
    info@schimmel-piano.de
    Tel: +49 (0)531/8018-0

    Our responsible supervisory authority within the meaning of data protection law: 
    Mr. Dominik Fünkner
    PROLIANCE GmbH / www.datenschutzexperte.de
    Leopoldstr. 21
    D- 80802 München
    Tel: +49 89 217685170
    E-mail: datenschutzbeauftragter@datenschutzexperte.de

    Definitions
    Our data protection declaration should be simple and easy for everyone to understand. The data protection declaration generally uses the official terms in the General Data Protection Regulation (GDPR). The official definitions of terms are explained in Article 4 GDPR (https://dejure.org/gesetze/DSGVO/4.html)

    Data processing through the visit to our website
    When you open our website it is technically necessary that data regarding your Internet browser is communicated to our web server. The following data is recorded in the course of an ongoing connection for communication between your Internet browser and our web server: 

    Domain visited 

    • Date and time of the requests
    • The page from which the file was requested
    • Access status (file transferred, file not found, etc.)
    • Web browser used and operating system used
    • IP address of the requesting computer
    • Data quantity transferred

    We collect the listed data in order to ensure creation of a smooth connection to the website and to allow convenient use of our website by its users. The log file is also used to analyse system security and stability as well as for administrative purposes. The legal basis for the temporary storage of the data and/or the log files is Article 6 (1) lit. f GDPR.

    We store this data for seven days for technical security reasons, more specifically for defence against attempted attacks on our web server. After this time the data is automatically deleted. This data is not analysed. This data is not conflated with other data sources.

    Contact form
    If you send us an enquiry using a contact form or by e-mail, then we will store the information in the enquiry form and/or your e-mail, including the contact data that you provided so that the enquiry could be processed and in the event of further questions. We will never pass this data to a third party without your permission. The legal basis for the processing of the data is our legitimate interest in answering your enquiry in accordance with Article 6 (1) lit. f GDPR and in some cases Article 6 (1) lit. b DSGVO, if your enquiry aims to agree a contract. Your data will be deleted once the processing of your enquiry has been completed if there are no statutory storage obligations that contradict this.

    Data transfer and recipient
    Your personal data will not be transferred to third parties except 

    • If we indicate this explicitly in the relevant data processing description.

    • If you have provided express permission in accordance with Article 6 (1) page 1 lit. a GDPR,

    • Transfer is necessary in accordance with Article 6 (1) page 1 lit. f GDPR to assert, exert of defend legal claims and there is no reason to assume that you have an overriding legitimate interest in the non-transferral of your data, 

    • In the event that there is a legal obligation to transfer in accordance with Article 6 (1) page 1 lit. c GDPR and

    • To the extent that this is necessary in accordance with Article 6 (1) page 1 lit. b GDPR for the processing of contractual relationships with you.

    We also use external service providers, carefully selected and commissioned by us in writing, in order to provide our services. They are bound by our instructions and are inspected by us at regular intervals. We have agreed order processing contracts with them as necessary in accordance with Article 28 GDPR. They are service providers for web hosting, sending e-mails and the repair and maintenance of our IT systems etc. The service providers will not transfer this data to third parties. 

    Storage periods for personal data
    The storage period for personal data is calculated according to the relevant statutory storage deadlines (e.g. in commercial law and tax law). At the end of the relevant period the corresponding data will be routinely destroyed. If data is necessary in order to fulfil or initiate a contract or if we have a legitimate interest in continued storage then the data will be deleted once it is no longer needed for these purposes or you exercise your right of revocation or right of objection.  

    Your rights
    The following text includes information on the rights of the individual that the valid data protection law grants you towards the responsible parties with regard to processing of your personal data:

    The right, in accordance with Article 15 GDPR, to demand information on the personal data we have processed. In particular you can demand information on the purposes of the processing, the category of personal data, the categories of recipients who were or will be given access to your data, the planned storage period, the existing of a right of rectification, deletion, limitation of processing or objection, the existence of a right of appeal, the origin of the data if we did not collect them, and on the existence of an automated decision-making system, including profiling and any significant information on the details of the data.

    The right, in accordance with Article 16 GDPR, to demand immediate rectification of incorrect or completion of incomplete personal data that we are storing on you.

    The right, in accordance with Article 17 GDPR, to demand deletion of the personal data we are holding on you where it is not necessary for it to be processed in order to exercise the right to free expression and information, to fulfil a legal obligation, for reasons of public interest or in order to assert, exert or defend a legal claim. 

    The right, in accordance with Article 18 GDPR, to demand limitation of the processing of your personal data where you dispute the accuracy of the data, the processing is unlawful but you reject its deletion and we no longer need the data but you need it to assert, exert or defend a legal claim or you have objected to the processing in accordance with Article 21 GDPR. 

    The right, in accordance with Article 20 GDPR, to receive your personal data in a structured, standard and machine-readable format or to demand transfer of the same to another responsible party. 

    The right, in accordance with Article 77 GDPR, to complain to a supervisory authority. Usually you can contact the supervisory authority of the federal state of our headquarters, listed above, or in some cases the location of your habitual residence or workplace. 

    The right to revoke issued consent in accordance with Article 7 (3) GDPR: you are entitled to revoke consent that you have issued for the processing of the data at any time, effective from that time. In the event of a revocation we will delete the relevant data immediately wherever there is no legal basis for processing without consent. Revocation of consent does not affect the legality of the processing that took place based on the consent up to the time of revocation; 

    Right of objection 

    If we process your personal data on the basis of legitimate interests in accordance with Article 6 (1) page 1 lit. f GDPR you are entitled, in accordance with Article 21 GDPR, to object to the processing of your personal data where this is for reasons of your particular situation. Where the objection is against the processing of personal data for the purpose of direct advertising you have a general right of objection without the need to state a particular situation. 

    If you would like to exercise your right of revocation or right of objection please send an e-mail to info@schimmel-piano.de.

    Modification of our data protection declaration
    We reserve the right to adapt or update this data protection declaration as necessary, taking into account the valid data protection regulations. In this way we can adapt them to comply with the current legal requirements and take into account changes in our services; e.g. when introducing new services. The latest valid version applies to your visit. 

    Status of the data protection declaration: 25.05.2018

    Social Media Privacy Policy

    I. Introduction

    The protection of your personal data is very important to us. In the following, you will find information on how we handle your data, which are recorded through your use of our social media presence on social networks and platforms. The processing of your data is in accordance with the legal regulations.

    II. Providers
    1. Facebook fan page
    1.1 Controller
    In case you provide us with data, which is also or exclusively processed by Facebook, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland, is the controller for data processing, in accordance with the GDPR, in addition to or instead of us. For this purpose, there is an agreement with Facebook pursuant to Art. 26 GDPR on joint controllership for data processing (Controller Addendum). This agreement specifies which data processing operations we or Facebook are responsible for when you visit our Facebook fan page. See the following link to consult this agreement:
    www.facebook.com/legal/terms/page_controller_addendum.
    If you, as a visitor to the site, wish to exercise your rights (access, rectification, erasure, restriction, data portability, complaint with a supervisory authority, objection or withdrawal), you can contact Facebook.
    You can edit your advertising preferences in your account settings. Click on the following link and log in to your account to change your settings:
    www.facebook.com/settings or www.youronlinechoices.com
    For further details, please see Facebook’s privacy policy: www.facebook.com/about/privacy/

    1.2 Facebook’s data protection officer
    You can use Facebook’s online form to contact Facebook’s data protection officer. To access it, please
    use of the following link: https://www.facebook.com/help/contact/540977946302970.

    1.3 Data processing for statistical purposes using Page Insights
    Facebook provides Page Insights Data for our Facebook fan page: www.facebook.com/business/a/page/page-insights. This aggregated data gives us an insight into how people interact with our page.
    Page Insights data may be based on personal data gathered from visits and interactions on, or with our page, and from connections with provided content. Please consider which personal data you share with us via Facebook. Your data may be processed for market research and promotional purposes, even if you are not logged into Facebook or do not have a Facebook account. User profiles can be created on the basis of user behaviour and the resulting interests of users. User profiles may be used for targeted advertisements within or outside the platform. Data recording is done using cookies, which are stored on your terminal device. In addition, user profiles may contain data, that is gathered from memberships on other platforms. Legal basis of the processing is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the optimised presentation of our proposition, the effective information and communication with customers and interested parties as well as in the targeted placement of advertisements.
    Please note that we have no influence on the data gathering and further processing by Facebook. As a result, we cannot provide any access about where, for how long and to which extent Facebook retains the data. Furthermore, we cannot make any statements about the extent to which Facebook complies with existing erasure deadlines, what evaluations and translations are made and to whom the data is transferred by Facebook. If you want to prevent your personal data being processed by Facebook, please contact us by other means.

    2. Other social media providers
    2.1 Controller
    If your personal data is processed by one of the providers listed below, this provider is responsible for data processing within the meaning of the GDPR. For the assertion of your rights, please contact the respective provider. Only they have access to the data collected from you. However, if you need any assistance, please contact us any time.

    We are also present on social media platforms of the following providers:
    - Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07 Ireland
    - Instagram Inc., Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2
    Ireland
    - YouTube, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

    2.2 Data protection officer
    Information on how to contact the data protection officer of the respective social media providers can be found here:
    - Twitter Inc.: twitter.ethicspointvp.com/custom/twitter/forms/data/form_data.asp
    - Instagram Inc.: www.facebook.com/help/contact/540977946302970
    To contact the YouTube data protection officer, please approach Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

    III. General information on social media platforms given by
    Wilhelm Schimmel Pianofortefabrik GmbH

    1. Controller
    Insofar as we process the data provided by you via social media, the following body is responsible for data processing within the meaning of GDPR:

    Wilhelm Schimmel Pianofortefabrik GmbH
    Friedrich-Seele-Straße 20,
    38122 Braunschweig
    Telefon: +49 (0)531/8018-0
    info@schimmel-piano.de

    2. Our data protection officer
    If you have any concerns about us processing your data, please contact our data protection officer at the following contact details:

    PROLIANCE GmbH / datenschutzexperte.de
    Datenschutzbeauftragter
    Leopoldstr. 21
    80802 München
    e-mail: datenschutzbeauftragter@datenschutzexperte.de

    General data processing on social media platforms
    3.1 Data processing for market research and advertising
    Organisations generally process data for market research and promotional purposes. Therefore, website providers use cookies, which load on to your browser and detect your return to the same URL.
    The recorded data is used to create user profiles. User profiles may be used for targeted advertisements within or outside the platform. In addition, user profiles may contain data, that is gathered from memberships on other platforms.

    3.2 Data processing through making contact
    We collect data when you contact us, for example via contact form or messenger services such as Facebook Messenger. The data collected depends on the details you provide and the contact details you specify. It will be stored for the purpose of processing the inquiry and in the event of follow-up questions. Under no circumstances we will pass on the data to third parties without your consent. The legal basis for the data processing is our legitimate interest in responding to your request pursuant to Art. 6 para. 1 lit. f GDPR and, if applicable, Art. 6 para. 1 lit. b GDPR if your request aimed at the conclusion of a contract. Unless there are compelling reasons, your data will be erased after final processing. We assume the processing is finalized, when the regarding circumstances are clarified.

    3.3 Data processing for the purpose of contract handling
    If your request via social media or other platforms is aimed at the conclusion of a contract, regarding the delivery of goods or the provision of services, we process your data in order to perform the contract and the requested services, or pre-contractual measures. In this case, the legal basis for the processing of your data is Art. 6 para. 1 lit. b GDPR. Your data will be erased if they are no longer necessary for the fulfilment of the contract or if it is certain, that pre-contractual measures will not lead to the conclusion of a contract corresponding to the purpose of establishing the contact. Please take into account, that it may be necessary to store personal data of our contractual partners in order to comply with contractual or legal obligations even after the conclusion of contract.

    3.4 Data processing by virtue of consent
    If the respective platform providers request you to consent to the processing for a particular purpose, the legal basis for the processing is Art. 6 para. 1 lit. a, Art. 7 GDPR. You have the right to withdraw such consent with effect for the future at any time.

    IV. Data transfer and recipient
    Please note, that by using social media platforms, data processing may take place outside the EU and the European Economic Area, wherefore European levels of data protection cannot be guaranteed. The US based social media providers mentioned above are certified by “Privacy Shield “. “Privacy Shield” is an US-European-data protection convention, warranting the compliance with EU data protection levels. We have no influence on the processing and handling of your personal data by the respective providers as well as we have no information on this matter. Please consider the privacy policy of the providers for further information:
    - Twitter privacy policy: twitter.com/de/privacy, Opt-out: twitter.com/personalization, Privacy Shield: www.privacyshield.gov/participant
    - Instagram privacy policy:/Opt-out: instagram.com/about/legal/privacy/
    - YouTube/Google privacy policy: policies.google.com/privacy, Opt-out:
    adssettings.google.com/authenticated , Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active

    V. Your rights
    You will find information on which data subject rights the applicable data protection law grants you vis-à-vis the controller in the following. You have the right,

    - to request information about your personal data processed by us; Art. 15 GDPR. In particular, you may obtain information about the purpose of processing, the categories of personal data concerned, the recipients or categories of recipients to whom the personal data have been or will be disclosed, the envisaged period for which the data will be stored, the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing, the right to lodge a complaint, where the personal data are not collected from us, any available information as to their source, the existence of automated decision-making, including profiling and meaningful information about the logic involved.

    - to obtain from the controller without undue delay the rectification of inaccurate personal data or have incomplete personal data completed; Art. 16 GDPR.

    - to obtain from us the erasure of personal data concerning, unless the processing is necessary for, exercising the right of freedom of expression and information, compliance with a legal obligation, reasons of public interest, achieving purposes in the public interest and the establishment, exercise or defence of legal claims, Art. 17 GDPR.

    - to obtain from us restriction of processing where, the accuracy of personal data is contested by you, the processing is unlawful, we no longer need the personal data for the purposes of processing, but they are required by you for the establishment, exercise or defence of legal claims or you have objected to processing pursuant to Art. 21; Art. 18 GDPR.

    - to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller; Art. 20 GDPR to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of alleged infringement; Art. 77 GDPR.

    - to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before it’s withdrawal. Prior to giving consent, you shall be informed thereof; Art. 7 para. 3 GDPR. In case of countermand the respective data shall be deleted immediately, unless further processing cannot be based on a legal basis for processing without consent.

    Right of object
    In line with Art. 21 GDPR, you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on processing for the purposes of the legitimate interests (Art. 6 Abs. 1 lit. GDPR) pursued by us. Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing.
    If you wish to make use of your right of objection or withdrawal, send an E-Mail to info@schimmel-piano.de

    VI. Duration of storage
    The personal data collected and stored by us will be erased from our systems, if the purpose of processing ceases to exist or if you have made use of your right of withdrawal or objection. Legal retention periods remain unaffected. We have no influence on the storage period of your data being stored by social media providers for their own purposes. For further details, please contact them directly.

    Status of the data protection declaration: 23.04.2019