Data Privacy Statement

This Data Privacy Statement explains the nature, scope and purpose of the processing of Personal Data (hereinafter referred to as "Data") within our online offer and its related websites, functions and content, as well as external online presence, such as our social media profile (hereafter collectively referred to as "Online Offer"). With regard to the terms used, such as "Processing" or "Controller", we refer to the definitions in Article 4 of the General Data Privacy Regulation (GDPR).
 
This Data Privacy Statement belongs to the website of AfB gGmbH under the internet address www.afb-group.eu as well as all subpages, and controls the collection and use of your personal Data. When using this website of AfB gGmbH you consent to the procedure described here.

AfB gemeinnützige GmbH
Willi-Bleicher-Straße 2
52353 Düren

Phone: +49 7243 20000-0
Fax: +49 7243 20000-101
Web: www.afb-group.eu
Email: info@afb-group.eu

Managing directors: Daniel Büchle, Yvonne Cvilak, Mike Reif

Link to legal information: www.afb-group.de/meta-navigation-footer/impressum/

Data privacy officer

a.s.k. Datenschutz e. K.
Phone: +49 9155 2639970
Email: extdsb@ask-datenschutz.de

Responsible data privacy supervisory body
State Data Protection and Freedom-of-Information Officer, NorthRhine-Westphalia
+49 211 38424-0
poststelle@ldi.nrw.de

Types of Data processed:

- Inventory Data (e.g. names, addresses)
- Contact details (e.g. email, telephone numbers)
- Content Data (e.g. text input, photographs, videos)
- Usage Data (e.g. visited websites, interest in content, access times)
- Meta/communication Data (e.g. device information, IP addresses).

Categories of affected persons

Visitors and Users of the Online Offer (hereinafter we refer to the affected persons as "Users").

Purpose of processing

- Provision of the Online Offer, its functions and contents
- Answering contact requests and communicating with Users
- Safety measures
- Reach measurement / marketing.
 

Terms used

"Personal Data" means any information relating to an identified or identifiable natural person (hereinafter the "Data Subject"); a natural person is considered as identifiable who can be identified directly or indirectly, in particular by means of assignment to an identifier such as a name, to an identification number, to location Data, to an online identifier (e.g. cookie) or to one or more special features that express the physical, physiological, genetic, mental, economic, cultural or social identity of this natural person..

"Processing" means any process performed with or without the aid of automated procedures or any such process associated with Personal Data. The term goes far and includes virtually every handling of Data

"Pseudonymization" means the Processing of Personal Data in such a way that the Personal Data can no longer be assigned to a specific Data Subject without additional information being provided, as long as such additional information is kept separate and is subject to technical and organizational measures to ensure that the Personal Data is not assigned to an identified or identifiable natural person.

"Profiling" means any kind of automated Processing of Personal Data which involves the use of such Personal Data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects relating to job performance, economic situation, health, personal preferences, interests, reliability, behaviour, whereabouts or relocation of that natural person.

"Controller" means the natural or legal person, public authority, agency or other or body that decides, alone or in combination with others, on the purposes and means of Processing Personal Data.

"Processor" means a natural or legal person, public authority, agency or other body that processes Personal Data on behalf of the Controller.

Relevant legal basis

In accordance with Art. 13 GDPR, we inform you about the legal basis of our data Processing. If the legal basis is not mentioned in the Data Privacy Statement, the following applies: The legal basis for obtaining consent is Article 6 (1) lit. a and Art. 7 GDPR, the legal basis for the Processing in order to perform our services and execute contractual measures as well as for the response to inquiries is Art. 6 (1) lit. b GDPR, the legal basis for Processing in order to fulfil our legal obligations is Art. 6 (1) lit. c GDPR, and the legal basis for Processing in order to safeguard our legitimate interest is Article 6 (1) lit. f GDPR. In the event that the vital interests of the Data Subject or another natural person require the Processing of Personal Data, Art. 6 (1) lit. d GDPR is the legal basis.

Security measures

We take appropriate technical measures and organizational measures in accordance with Art. 32 GDPR, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the Processing as well as the different likelihood and severity of the risk to the rights and freedoms of natural persons to ensure a level of protection appropriate to the risk.

Measures include, in particular, ensuring the confidentiality, integrity and availability of Data by controlling physical access to the Data, as well as its access, input, disclosure, availability and separation. In addition, we have established procedures that ensure the enjoyment of Data Subject rights, Data deletion and response to Data vulnerability. Furthermore, we consider the protection of Personal Data already during the development, or when selecting hardware, software and procedures, according to the principle of data privacy by technology design and by privacy-friendly settings by default (Article 25 GDPR).

Collaboration with Processors and third parties

If, in the context of our Processing, we disclose Data to other persons and companies (Processors or third parties), transmit the Data to them or otherwise grant them access to the Data, this will only be done on the basis of a statutory permission (e.g. if a transmission of the Data to third parties is required by payment service providers, pursuant to Art. 6 (1) lit. b GDPR to fulfil the contract), you have consented, a legal obligation requires this or this is based on our legitimate interest (e.g. the use of agents, webhosters, etc.).

If we commission third parties to process Data on the basis of a so-called Processing by a Processor governed by a contract, this is done on the basis of Art. 28 GDPR.

Transfers to third countries

If we process Data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or in the context of the use of third party services or disclosure or transmission of Data to third parties, this will only be done if it is to fulfil our (pre) contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interest. Subject to statutory or contractual permissions, we process or have the Data processed in a third country only in the presence of the special conditions of Art. 44 et seq. GDPR. This means, for example, that the Processing takes place on the basis of special guarantees, such as the officially recognized level of data protection (e.g. for the USA through the "Privacy Shield") or compliance with officially recognized special contractual obligations (so-called "standard contractual clauses").

Rights of Data Subjects

You have the right to ask for confirmation as to whether the Data in question is being processed and for information about this Data as well as for further information and a copy of the Data in accordance with Art. 15 GDPR.
You have, according to Art. 16 GDPR, the right to demand the completion of the Data concerning you or to demand the correction of the incorrect Data concerning you.
In accordance with Art. 17 GDPR, you have the right to demand that the relevant Data be deleted immediately or, alternatively, to demand a restriction of the Processing of Data in accordance with Art. 18 GDPR.
You have the right to demand that the Data relating to you, which you have provided to us, be obtained in accordance with Art. 20 GDPR and request its transmission to other Controllers.
Furthermore, you have, according to Art. 77 GDPR, the right to file a complaint with the competent supervisory authority.

Revocation right

You have the right to revoke consent granted with effect for the future in accordance with Art. 7 (3) GDPR.

Objection right

You can object to the future Processing of your Data in accordance with Art. 21 GDPR at any time. The objection may in particular be made against Processing for direct marketing purposes.