Privacy Policy
We are pleased that you are visiting our website. The protection and security of your personal information when using our website is very important to us. We would therefore like to inform you here which of your personal data we collect when you visit our website and for what purposes it is used.
This privacy policy applies to the website of Flammkuchen-Profi GmbH, which is available at the domain https://www.flammkuchen-profi.de/ and https://www.veganer-flammkuchen.de/ and the various subdomains („our website“) can be accessed.
Who is responsible and how can I reach you?
Controller for the processing of personal data within the meaning of the EU General Data Protection Regulation (GDPR):
Flammkuchen-Profi GmbH
4 Im Schlangengarten
D – 76877 Offenbach / Queich
Tel.: +49 (0) 6348.95.963-0
Fax: +49 (0) 6348.95.963-22
Data Protection Officer
Sovestro GmbH
Mr Jörg Hoffmann
Am Borsigturm 48
13507 Berlin
datenschutz@flammkuchen-profi.de
What is it about?
This privacy policy meets the legal requirements for transparency regarding the processing of personal data. This is all information relating to an identified or identifiable natural person. This includes, for example, information such as your name, your age, your address, your telephone number, your date of birth, your email address, your IP address or user behaviour when visiting a website. Information that we cannot link to your person (or can only do so with a disproportionate amount of effort), e.g. through anonymisation, is not personal data. The processing of personal data (e.g. collection, querying, use, storage or transmission) always requires a legal basis and a defined purpose.
Stored personal data will be deleted as soon as the purpose of the processing has been achieved and there are no legitimate grounds for the continued storage of the data. We inform you about the specific retention periods or criteria for storage in the individual processing operations. Irrespective of this, we store your personal data in individual cases for the establishment, exercise or defence of legal claims and in the event of statutory retention obligations.
Who gets my data?
We only share your personal data that we process on our website with third parties if this is necessary for the fulfilment of the purposes and is covered in individual cases by the legal basis (e.g. consent or pursuit of legitimate interests). In addition, we pass on personal data to third parties in individual cases if this serves the establishment, exercise or defence of legal claims. Potential recipients may then be, for example, law enforcement authorities, legal counsel, auditors, courts, etc.
Insofar as we use service providers for the operation of our website who process personal data on our behalf within the framework of data processing agreements pursuant to Art. 28 GDPR, these may be recipients of your personal data. Further information regarding the use of data processors and web services can be found in the overview of the individual processing operations.
Do you use cookies?
Cookies are small text files that are sent by us to the browser of your device during your visit to our websites and stored there. As an alternative to the use of cookies, information can also be stored in the local storage of your browser. Some functions of our website cannot be offered without the use of cookies or local storage (technically necessary cookies). Other cookies, however, enable us to carry out various analyses, allowing us, for example, to recognise the browser you are using upon a repeated visit to our website and to transmit various information to us (non-necessary cookies). Among other things, cookies help us to make our website more user-friendly and effective for you by, for example, tracking your use of our website and determining your preferred settings (e.g. country and language settings). Insofar as third parties process information via cookies, they collect the information directly via your browser. Cookies do not cause any damage to your device. They cannot execute programmes and do not contain any viruses.
We provide information about the respective services for which we use cookies in the individual processing operations. Detailed information on the cookies used can be found in the [cookie settings of this privacy policy / consent manager].
What rights do I have?
Subject to the provisions of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG), you as the data subject have the following rights:
* Information pursuant to Art. 15 GDPR, Section 34 BDSG [Federal Data Protection Act] regarding the data stored concerning your person in the form of meaningful information on the details of the processing, as well as a copy of your data;
* Rectification in accordance with Art. 16 GDPR of inaccurate or incomplete data stored by us;
* Erasure in accordance with Art. 17 GDPR of the data stored by us, unless the processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;
Restriction of processing pursuant to Art. 18 GDPR, insofar as the accuracy of the data is contested, the processing is unlawful, we no longer require the data and you refuse their erasure because you require them for the establishment, exercise or defence of legal claims, or you have lodged an objection to processing pursuant to Art. 21 GDPR.
* Right to data portability pursuant to Art. 20 GDPR, provided that you have supplied us with personal data on the basis of consent pursuant to Art. 6 (1) (a) GDPR or on the basis of a contract pursuant to Art. 6 (1) (b) GDPR and that these have been processed by us using automated procedures. You will receive your data in a structured, commonly used and machine-readable format, or we will transmit the data directly to another controller, insofar as this is technically feasible.
* Objection pursuant to Art. 21 GDPR against the processing of your personal data, provided this is based on Art. 6(1)(e) or (f) GDPR for reasons arising from your particular situation or where the objection is directed against direct marketing. The right to object does not exist if compelling legitimate grounds for the processing can be demonstrated which override your interests, rights and freedoms, or if the processing serves the establishment, exercise or defence of legal claims. Where the right to objection does not exist for individual processing operations, this is indicated there.
* Withdrawal pursuant to Art. 7 para. 3 GDPR of your given consent with effect for the future.
* Complaint pursuant to Art. 77 GDPR with a supervisory authority if you consider that the processing of your personal data infringes the GDPR. As a rule, you can contact the supervisory authority of your habitual residence, your place of work or our company headquarters.
How is my data processed in detail?
Below, we inform you about the individual processing operations, the scope and purpose of the data processing, the legal basis, the obligation to provide your data, and the respective storage period. No automated decision-making in individual cases, including profiling, takes place.
Website provision
Nature and scope of processing
When accessing and using our website, we collect the personal data that your browser automatically transmits to our server. The following information is temporarily stored in a so-called log file:
- IP address of the requesting computer
- Date and time of access
- Name and URL of the retrieved file
- Referring website (referrer URL)
- Browser used and, if applicable, the operating system of your computer, as well as the name of your access provider
Our website is not hosted by us, but by a service provider who processes the aforementioned data on our behalf in accordance with Art. 28 GDPR for the purpose of providing the website.
Purpose and legal basis
Processing is carried out to protect our overriding legitimate interest in displaying our website and ensuring security and stability on the basis of Article 6(1)(f) of the GDPR. The collection of data and its storage in log files is strictly necessary for the operation of the website. There is no right to object to the processing on the basis of the exception under Article 21(1) of the GDPR. To the extent that further storage of the log files is required by law, processing is carried out on the basis of Article 6(1)(c) of the GDPR. There is no statutory or contractual obligation to provide the data, however, accessing our website is technically impossible without providing the data.
Retention period
The aforementioned data is stored for the duration of the display of the website [as well as for technical reasons beyond that for a maximum of [7 days]].
Contact form
Nature and scope of processing
On our website, we offer you the opportunity to get in touch with us via a provided form. The information collected via mandatory fields is required in order to process the enquiry. In addition, you can voluntarily provide extra information that you consider necessary for processing the contact enquiry.
When using the contact form, your personal data will not be passed on to third parties.
Purpose and legal basis
The processing of your data through the use of our contact form takes place for the purpose of communication and processing your enquiry on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR. Insofar as your enquiry relates to an existing contractual relationship with us, the processing takes place for the purpose of the performance of a contract on the basis of Art. 6 para. 1 lit. b GDPR. There is no legal or contractual obligation to provide your data, but it is not possible to process your enquiry without the provision of the information in the mandatory fields. Should you prefer not to provide this data, please contact us by other means.
Retention period
Insofar as you use the contact form on the basis of your consent, we store the data collected from each enquiry for a period of three years, commencing with the handling of your enquiry or until the withdrawal of your consent.
If you use the contact form as part of a contractual relationship, we shall store the data collected from each enquiry for a period of [three years] from the end of the contractual relationship.
presences on social media platforms
We operate fan pages, accounts or channels on the networks named below in order to provide you with information and offers also within social networks, and to offer you further ways of contacting us and finding out about our offers. Below, we inform you about which data we or the respective social network process from you in connection with visiting and using our fan pages/accounts.
Data that we process from you When you wish to contact us via messenger or direct message on the respective social network, we generally process your username via which you contact us and, where applicable, save further data provided by you insofar as this is necessary for processing/answering your request.
The legal basis is Article 6(1)(f) of the GDPR (processing is necessary for the purposes of the legitimate interests pursued by the controller).
(Static) usage data that we receive from social networks We receive automatically provided statistics regarding our accounts via insights functionalities. Among other things, the statistics contain the total number of page views, likes, information on page activities and post interactions, reach, video views and information on the proportion of men/women among our fans/followers.
The statistics contain only aggregated data that cannot be linked to individual persons. You are not identifiable to us through this data.
What data social networks process about you
To be able to view the content of our fan pages or accounts, you do not need to be a member of the respective social network, and therefore a user account for the respective social network is not required.
Please note, however, that when you access the respective social network, social networks also collect and store data from website visitors who do not have a user account (e.g. technical data in order to be able to display the website to you) and use cookies and similar technologies, over which we have no influence whatsoever. Details regarding this can be found in the privacy policy of the respective social network (see the corresponding links above).
Insofar as you wish to interact with the content on our fan pages/accounts, e.g. by commenting on, sharing or liking our posts/contributions and/or wishing to contact us via messenger functions, prior registration with the respective social network and the provision of personal data is required.
We have no control over data processing by social networks in the context of your use. To the best of our knowledge, your data is stored and processed, in particular, in connection with the provision of the services of the respective social network, and further for the analysis of usage behaviour (using cookies, pixels/web beacons and similar technologies), on the basis of which interest-based advertising is served both within and outside the respective social network. It cannot be ruled out that your data may also be stored by the social networks outside the EU/EEA and passed on to third parties.
Information including the precise scope and purposes of the processing of your personal data, the storage period/deletion as well as policies on the use of cookies and similar technologies in the context of registration and use of the social networks can be found in the privacy policy/cookie policies of the social networks. There you will also find information on your rights and options to object.
Facebook page
When visiting our Facebook page, Facebook collects, among other things, your IP address and other information present on your PC in the form of cookies. This information is used to provide us, as the operators of the Facebook pages, with statistical information on the use of the Facebook page. Facebook provides more detailed information on this at the following link: https://de-de.facebook.com/help/pages/insights [https://de-de.facebook.com/help/pages/insights].
Using the transmitted statistical information, it is not possible for us to draw conclusions about individual users. We merely resort to this data in order to cater to the interests of our users, continually improve our online presence and ensure its quality.
We collect your data via our fan page solely to enable potential communication and interaction with us. This collection generally includes your name, message content, comment content, and the profile information you have made „public“.
The processing of your personal data for our aforementioned purposes is carried out on the basis of our legitimate business and communicative interest in offering an information and communication channel pursuant to Art. 6 para. 1 lit. f) GDPR. Should you as a user have given your consent to data processing to the respective provider of the social network, the legal basis for the processing extends to Art. 6 para. 1 lit. a), Art. 7 GDPR.
Due to the fact that the actual data processing is carried out by the social network provider, our access options regarding your data are limited. Only the social network provider is authorised to have full access to your data. Consequently, only the provider can directly take and implement appropriate measures to fulfil your user rights (requests for information, requests for deletion, objections, etc.). Therefore, asserting such rights is most effective directly against the respective provider.
We are jointly responsible with Facebook for the personal content of the fan page. Data subject rights can be asserted against both Facebook Ireland and us.
Under the GDPR, Facebook bears the primary responsibility for the processing of Insights data, Facebook fulfils all obligations under the GDPR with regard to the processing of Insights data, and Facebook Ireland makes the essence of the Page Insights addendum available to data subjects.
We make no decisions regarding the processing of insights data and all further information resulting from Art. 13 GDPR, including the legal basis, the identity of the controller and the storage duration of cookies on user terminals.
Further information can be found directly on Facebook (Page Controller Addendum): https://www.facebook.com/legal/terms/page_controller_addendum [https://www.facebook.com/legal/terms/page_controller_addendum].
Instagram page
When you visit our Instagram page, Instagram collects, among other things, your IP address and other information present on your PC in the form of cookies. This information is used to provide us, as the operators of the Instagram pages, with statistical information about the use of the Instagram page. Instagram provides further information on this at the following link: http://de-de.facebook.com/help/pages/insights [http://de-de.facebook.com/help/pages/insights].
Using the transmitted statistical information, it is not possible for us to draw conclusions about individual users. We merely resort to this data in order to cater to the interests of our users, continually improve our online presence and ensure its quality.
We collect your data via our fan page solely to enable potential communication and interaction with us. This collection generally includes your name, message content, comment content, and the profile information you have made „public“.
The processing of your personal data for our aforementioned purposes is carried out on the basis of our legitimate business and communicative interest in offering an information and communication channel pursuant to Art. 6 para. 1 lit. f) GDPR. Should you as a user have given your consent to data processing to the respective provider of the social network, the legal basis for the processing extends to Art. 6 para. 1 lit. a), Art. 7 GDPR.
Due to the fact that the actual data processing is carried out by the social network provider, our access options regarding your data are limited. Only the social network provider is authorised to have full access to your data. Consequently, only the provider can directly take and implement appropriate measures to fulfil your user rights (requests for information, requests for deletion, objections, etc.). Therefore, asserting such rights is most effective directly against the respective provider.
We are jointly responsible with Instagram for the personal content of the fan page. Data protection rights can be asserted against Facebook Ireland as well as against us.
According to the GDPR, Instagram bears the primary responsibility for the processing of insights data and Instagram fulfils all obligations under the GDPR with regard to the processing of insights data; Facebook Ireland makes the essence of the Page Insights Addendum available to data subjects.
We make no decisions regarding the processing of insights data and all further information resulting from Art. 13 GDPR, including the legal basis, the identity of the controller and the storage duration of cookies on user terminals.
Further information can be found directly on Instagram (supplementary agreement with Facebook): https://www.facebook.com/legal/terms/page_controller_addendum [https://www.facebook.com/legal/terms/page_controller_addendum].
Google DoubleClick
Nature and scope of processing
We have integrated components from DoubleClick by Google on our website. DoubleClick is a brand of Google under which special online marketing solutions are primarily marketed to advertising agencies and publishers. DoubleClick by Google transmits data to the DoubleClick server with every impression as well as with clicks or other activities.
Each of these data transmissions triggers a cookie request to the browser of the data subject. If the browser accepts this request, DoubleClick places a cookie in your browser.
DoubleClick uses a cookie ID, which is required to carry out the technical process. The cookie ID is needed, for example, to display an advert in a browser. DoubleClick can also use the cookie ID to track which adverts have already been displayed in a browser, in order to prevent duplicate impressions. Furthermore, the cookie ID enables DoubleClick to track conversions. Conversions are tracked, for example, when a user has previously been shown a DoubleClick advert and subsequently makes a purchase on the advertiser’s website using the same web browser.
A DoubleClick cookie does not contain any personal data, but may contain additional campaign identifiers. A campaign identifier is used to identify the campaigns with which you have already interacted on other websites. As part of this service, Google receives data which Google also uses to generate commission statements. Among other things, Google can trace that you have clicked on certain links on our website. In this case, your data will be forwarded to the operator of DoubleClick, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Further information and the applicable data protection provisions of DoubleClick by Google can be accessed at https://policies.google.com/privacy.
Purpose and legal basis
We process your data using the DoubleClick cookie for the purpose of optimising and displaying adverts on the basis of your consent in accordance with Article 6(1)(a) of the GDPR. You give your consent by accepting the use of cookies (cookie banner / consent manager), through which you may also withdraw your consent at any time with future effect in accordance with Article 7(3) of the GDPR. The cookie is used, amongst other things, to serve and display user-relevant advertisements, as well as to generate reports on advertising campaigns or to improve them. Furthermore, the cookie serves to prevent the same advertisement from being displayed multiple times. Each time you visit a page on our website where a DoubleClick component has been integrated, your browser is automatically prompted by the relevant DoubleClick component to transmit data to Google for the purposes of online advertising and the settlement of commissions. There is no legal or contractual obligation to provide your data. If you do not give us your consent, you may still visit our website without restriction; however, not all functions may be fully available.
Retention period
The specific retention period of the processed data cannot be influenced by us, but is determined by Google Ireland Limited. Further information can be found in the privacy policy for Google DoubleClick: https://policies.google.com/privacy.
Google Fonts
Nature and scope of processing
We use Google Fonts from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as a service to provide fonts for our online service. To obtain these fonts, you establish a connection to servers of Google Ireland Limited, whereby your IP address is transmitted.
Purpose and legal basis
The use of Google Fonts is based on our legitimate interests, i.e., an interest in the uniform provision and optimisation of our online offering pursuant to Art. 6 para. 1 lit. f GDPR.
Retention period
The exact storage duration of the processed data cannot be influenced by us, but is determined by Google Ireland Limited. Further information can be found in the privacy policy for Google Fonts: https://policies.google.com/privacy.
Google Maps
Nature and scope of processing
We use the mapping service Google Maps to create directions. Google Maps is a service provided by Google Ireland Limited, which displays a map on our website.
When you access this content on our website, a connection is established with servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, whereby your IP address and, where applicable, browser data such as your user agent are transmitted. This data is processed exclusively for the aforementioned purposes and to maintain the security and functionality of Google Maps.
Purpose and legal basis
The use of Google Maps is based on our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR, i.e. our interest in making it easier for you to find the locations mentioned on the website.
Retention period
We cannot influence the specific storage period of the processed data; this is determined by Google Ireland Limited. Further information can be found in the privacy policy for Google Maps: https://policies.google.com/privacy.
Google reCAPTCHA
Nature and scope of processing
We have integrated Google reCAPTCHA components on our website. Google reCAPTCHA is a service provided by Google Ireland Limited and allows us to determine whether a contact enquiry originates from a natural person or is automated by means of a programme. When you access this content, you establish a connection to servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, whereby your IP address and, where applicable, browser data such as your user agent are transmitted. Furthermore, Google reCAPTCHA records the user's dwell time and mouse movements in order to distinguish automated requests from human ones. This data is processed exclusively for the aforementioned purposes and to maintain the security and functionality of Google reCAPTCHA.
Purpose and legal basis
The use of the service is based on our legitimate interests, i.e., for protection when submitting forms in accordance with Art. 6(1)(f) GDPR.
Retention period
Die konkrete Speicherdauer der verarbeiteten Daten ist nicht durch uns beeinflussbar, sondern wird von Google Ireland Limited bestimmt. Weitere Hinweise finden Sie in der Datenschutzerklärung für Google reCAPTCHA: https://policies.google.com/privacy?hl=en-US.
Datenschutzbestimmungen bei der Verwendung von externen Zahlungsdienstleistern (Paypal)
Allgemeine Informationen zu PSD2/SCA
Die PSD2 (Payment Service Directive 2) sieht vor, dass Banken und Finanzdienstleister eine starke Kunden Authentifizierung (SCA) für die Abwicklungen von Transaktionen bereitstellen müssen, um Kontozugriffe eindeutig zu identifizieren und Zahlungsvorgänge zu verifizieren. Sie werden deshalb während des Zahlungsvorgangs aufgefordert, eine sog. Zwei Faktor Authentifizierung (2FA) vorzunehmen. Dies bedeutet, dass Sie zwei aus drei möglichen Faktoren (Besitz, Wissen, Inhärenz) wählen müssen, um die Zahlung abzuwickeln. Die Auswahl und technische Ausgestaltung der SCA obliegt den jeweiligen Banken und Zahlungsdienstleistern.
Jeder Zahlungsvorgang erfordert zur Erfüllung des Zahlungsdienstevertrages (§ 675f BGB) die Verarbeitung von personenbezogenen Daten – zumindest dann, wenn Zahlungsempfänger oder Zahler eine natürliche Person ist oder der Verwendungszweck Angaben zu einer natürlichen Person enthält. Die Datenverarbeitung beschränkt sich auf das notwendige Maß zur Durchführung des Zahlungsdienstevertrages und dessen gesetzlich geforderter Dokumentation. Es bedarf somit keiner ausdrücklichen Einwilligung des Kunden, da sich die ausführenden Transaktionsbeteiligten auf die gesetzliche Erlaubnis zur Datenverarbeitung zur Vertragserfüllung berufen. Demnach ist der Zahlungsvorgang von Art.6 Abs. 1 lit. b DSGVO (Erfüllung eines Vertrages) gedeckt.
Um die Zahlung abwickeln zu können, übermittelt unser Zahlungsdienstleister insbesondere die folgenden Daten an den ausgewählten kundenseitigen Zahlungsdienstleister:
Transaktionsbezogene und technische Informationen (TransaktionsID, Zahlungsbetrag, Währung, etc.);
Kundenbezogene Informationen (Privat- oder Geschäftskunde, Telefonnummer, etc.);
Rechnungsbezogene Informationen (Rechnungsadresse mit Stadt, Land, PLZ);
Lieferungsbezogene Informationen (Lieferadresse mit Stadt, Land, PLZ).
Weitere Informationen zu PSD2, SCA und 2FA, sowie die Erhebung und Verarbeitung personenbezogener Daten erhalten Sie bei Ihrer kontoführenden Bank, oder Zahlungsdienstleister.
Paypal
Wir bieten für die Nutzung unseres Angebots neben der Barzahlung vor Ort, bei Lieferung auch die Zahlung via Paypal an. Entscheiden Sie sich für die Zahlungsart PayPal, so werden Ihre personenbezogenen Daten an PayPal übermittelt. Voraussetzung für die Nutzung von PayPal ist die Eröffnung eines PayPal-Kontos. Mit der Nutzung bzw. Eröffnung eines PayPal Kontos müssen unter anderem Name, Adresse, Telefonnummer und E-Mail-Adresse an PayPal übermittelt werden. Rechtsgrundlage für die Übermittlung der Daten ist Artikel 6 Abs. 1 lit. a DSGVO (Einwilligung) und Artikel 6 Abs. 1 lit. b DSGVO (Verarbeitung zur Erfüllung eines Vertrages).
Betreiber des Zahlungsdienstes PayPal ist die: PayPal (Europe) S.à r.l. et Cie, S.C.A.
22-24 Boulevard Royal
L-2449 Luxembourg
E-Mail: impressum@paypal.com
Mit der Zahlungsoption PayPal willigen Sie in die Übermittlung der personenbezogenen Daten wie Name, Adresse, Telefonnummer und E-Mail-Adresse, an PayPal ein. Welche weiteren Daten von PayPal erhoben werden, ergibt sich aus der jeweiligen Datenschutzerklärung von PayPal. Diese findet sich unter: www.paypal.com/de/webapps/mpp/ua/privacy-full
YouTube Video
Nature and scope of processing
Wir haben auf unserer Website YouTube Video integriert. YouTube Video ist eine Komponente der Videoplattform der YouTube, LLC, auf der Nutzer Inhalte hochladen, über das Internet teilen und detaillierte Statistiken erhalten können.
YouTube Video ermöglicht es uns, Inhalte der Plattform in unsere Website zu integrieren.
YouTube Video nutzt Cookies und weitere Browser-Technologien um Nutzerverhalten auszuwerten, Nutzer wiederzuerkennen und Nutzerprofile zu erstellen. Diese Informationen werden unter anderem genutzt, um die Aktivität der angehörten Inhalte zu analysieren und Berichte zu erstellen. Wenn ein Nutzer bei YouTube, LLC registriert ist, kann YouTube Video die abgespielten Videos dem Profil zuordnen.
Wenn Sie auf diese Inhalte zugreifen, stellen Sie eine Verbindung zu Servern der YouTube, LLC, her, wobei Ihre IP-Adresse und ggf. Browserdaten wie Ihr User-Agent übermittelt werden.
Purpose and legal basis
Die Nutzung des Dienstes erfolgt auf Grundlage unserer berechtigten Interessen, d.h. Interesse an einer plattformunabhängigen Bereitstellung von Inhalten gemäß Art. 6 Abs. 1 lit. f. DSGVO.
Retention period
Die konkrete Speicherdauer der verarbeiteten Daten ist nicht durch uns beeinflussbar, sondern wird von YouTube, LLC bestimmt. Weitere Hinweise finden Sie in der Datenschutzerklärung für YouTube Video: https://policies.google.com/privacy.
Stand: 05/2023
