Data Protection
Privacy Notice
We are delighted that you have visited our website and are interested in what we have to offer. We want you to feel at ease on our website and not have to worry about the confidentiality of your data. We are deeply committed to data protection and consider transparency in the handling of your data to be of the utmost importance. We would therefore like to inform you about what data we collect, why we do so, and how you can exercise control over your data at any time.
Data Controller
The data controller within the meaning of the law is:
puris Bad GmbH & Co. KG
Hinterm Gallberg 6 a
59929 Brilon
mail@puris.de
Categories of data, purpose and legal basis for processing
You are, of course, free to visit our website without providing any personal information. You can access the privacy policy via the link at the bottom of every page.
We use your personal data in connection with your visit to our website solely for the purpose of operating and optimising our website. For this purpose, we collect your IP address, various technical details of your device (e.g. operating system, browser used, etc.) and data relating to your use of our website. We do not store this data for longer than the statutory retention periods or beyond the fulfilment of the purpose. Processing this data is necessary to ensure the operation of the website. If you do not consent to this processing, we will be unable to make our online service available to you. We analyse this information statistically to make the use of our website even more enjoyable for all visitors. No link is established with any personal data we may already have stored. The data generated through the use of the website will be deleted after 14 months at the latest. The storage of data may be extended in individual cases to enforce legal claims, to defend against any legal claims, or to comply with legal obligations.
The processing of personal data for the purposes of operating the website and ensuring network and information security is based on Article 6(1)(f) of the GDPR. You are under no legal or contractual obligation to provide data when using our website. However, it is not possible to operate the website or respond to your enquiries without processing your data.
For further information on the specific data collected in the various services, please refer to the relevant sections in this privacy notice.
Recipients of the data
Your data will not be disclosed to third parties unless there is a legal obligation to transfer it. This processing is carried out on the basis of Article 6(1)(c) of the GDPR and in conjunction with the relevant order or legal obligation to which we are subject in each individual case. Under Article 6(1)(c) of the GDPR, it is permitted to process personal data if such processing is necessary for compliance with a legal obligation to which the controller is subject. Categories of data recipients include public authorities in the event of a legal obligation, and data processors who process the data collected online on our behalf, as well as, where applicable, joint controllers. The data processor involved is Mittwald Kirchner Media.
Contact form
When you complete the contact or catalogue order form, or when you contact us by email or telephone, you provide us with personal data. We may collect the following types of data: name, email address, postal address, telephone number and information required to prepare a personalised quote, or to respond to your enquiry and dispatch the catalogue you have selected. We use this data solely to respond to your specific enquiry or request and to provide information. To protect your data, we use a recognised encryption method when it is transmitted to us. We will retain your personal data for the period necessary to fulfil the purposes described in this notice. Statutory retention periods remain unaffected.
The legal basis for processing general enquiries is your consent in accordance with Article 6(1), first sentence, point (a) of the GDPR.
For enquiries regarding contracts or in the context of pre-contractual negotiations, the legal basis is Article 6(1), first sentence, point (b) of the GDPR.
The legal basis for enquiries regarding data protection is Article 6(1), first sentence, point (c) of the GDPR.
Submitting the form constitutes your consent to the processing of the data.
Photographs and videos taken at events (e.g. trade fairs)
Photographs and videos of participants and the event venue are taken and processed for the purpose of capturing the atmosphere and overall impression of the event. These images may be used for internal and external marketing purposes, as well as for presentations. Selected images and videos from this public event will be published on the puris Bad GmbH & Co. KG website and on social media platforms such as Instagram.
The legal basis is our legitimate interest pursuant to Article 6(1)(f) of the GDPR.
Matomo
This website uses the open-source software ‘Matomo’, matomo.org (formerly Piwik). So-called ‘cookies’ are used for this purpose. These are text files that are stored on the user’s computer. The software runs exclusively on the servers of the company Mittwald. Users’ personal data is stored only there. The software is configured so that IP addresses are not stored in full. The data is not passed on to third parties. It is no longer possible to link the truncated IP address to the computer accessing the site.
Processing users’ personal data enables us to analyse our users’ browsing behaviour. By analysing the data collected, we are able to compile information on the use of the individual components of our website. This helps us to continuously improve our website and its user-friendliness. Matomo is only used if you have given us your consent to do so. The legal basis for the processing of users’ personal data is your consent in accordance with Article 6(1)(a) of the GDPR and Section 25 of the TDDDG. We retain the data for the duration of the statutory retention periods.
Google Maps
This site uses the Google Maps map service via an API. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
In order to use the functions of Google Maps, it is necessary to store your IP address. This information is usually transferred to a Google server in the USA and stored there. The provider of this website has no influence over this data transfer.
Data is transferred to the USA on the basis of the Data Privacy Framework.
Google Maps is only used if you consent to its use. The legal basis is your consent in accordance with Article 6(1)(a) of the GDPR and Section 25 of the TDDDG.
Further information on the handling of user data can be found in Google’s privacy policy:
https://www.google.de/intl/de/policies/privacy/.
If you consent to the use of Google Maps, Google will also load so-called web fonts (Google Fonts). To do this, the browser you are using must establish a connection to Google’s servers. As a result, Google becomes aware that our website has been accessed via your IP address. Further information on Google Web Fonts can be found at
https://developers.google.com/fonts/faq and in Google’s privacy policy:
https://www.google.com/policies/privacy/.
We have no influence over this data collection.
YouTube videos
We have embedded YouTube videos (the service provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) using a so-called iframe. This iframe is only loaded once you have given your consent by making the appropriate selection in the cookie banner. As soon as you do so, a connection is established to YouTube’s server in the USA.
This connection is necessary to display the relevant video on our website via your web browser. In the course of this, YouTube will collect and process at least your IP address, the date and time, and the web page you are visiting. In addition, a connection is established with Google’s ‘DoubleClick’ advertising network.
If you are logged into YouTube at the same time, YouTube will associate the connection information with your YouTube account. If you wish to prevent this, you must either log out of YouTube before visiting our website or adjust the relevant settings in your YouTube account.
For the purposes of functionality and to analyse usage behaviour, YouTube permanently stores cookies on your device via your web browser.
In addition, once you have given your consent, Google loads so-called web fonts into your browser cache to display text and fonts correctly. To do this, the browser you are using must establish a connection to Google’s servers. This enables Google to recognise that our website has been accessed via your IP address. Further information on Google Web Fonts can be found at
https://developers.google.com/fonts/faq and in Google’s privacy policy:
https://www.google.com/policies/privacy/.
The legal basis is your consent in accordance with Article 6(1)(a) of the GDPR.
Instagram Account
We have a profile on Instagram. The provider is Meta Platforms Inc., 1 Hacker Way, Menlo Park, California 94025, USA.
We have entered into an agreement with Meta regarding joint responsibility for data processing (Controller Addendum). This agreement sets out which data processing operations we or Meta are responsible for when you visit our Facebook fan page. Meta Platforms bears primary responsibility under the GDPR for the processing of Insights data. You can view this agreement via the following link:
https://www.facebook.com/legal/terms/page_controller_addendum
You can adjust your advertising settings yourself in your user account. To do so, click on the following link and log in:
https://www.facebook.com/settings?tab=ads
For further details, please refer to Meta’s Privacy Policy:
https://www.facebook.com/about/privacy/
The legal basis for the processing is Article 6(1)(f) of the GDPR. Tailoring our posts to specific target groups is in our legitimate interest. We receive aggregated data from Meta which does not allow identification of individual persons.
Your rights regarding the processing of your personal data
You have various rights regarding the processing of personal data, which we would like to inform you about below. Further details on your rights can also be found in Articles 15 to 21 of the GDPR and Sections 32 to 37 of the Federal Data Protection Act (“BDSG”).
You have the right to access your personal data. You may also request the rectification of inaccurate data.
Furthermore, under certain conditions, you are entitled to the right to erasure, the right to restriction of processing and the right to data portability. You may object to processing carried out on the basis of Article 6(1)(f) of the GDPR, as well as to any profiling carried out in accordance with Article 21 of the GDPR. You may withdraw any consent you have given in connection with your use of the website at any time, informally and without giving reasons, with effect for the future.
You may exercise all the above rights under Articles 15 to 21 of the GDPR by contacting the data controller informally by email or post.
You also have the right to lodge a complaint with the relevant data protection supervisory authority if you believe that the processing of your data is unlawful. A list of data protection officers and their contact details can be found at:
https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html
If you have any questions regarding data protection, please feel free to contact our external data protection officer:
David Gabel – Email: david.gabel@your-insider.com
General information on data protection and the processing of personal data in data protection processes can be found at www.your-insider.com
Data protection information for Meta products (e.g. Facebook/Instagram Page)
A warm welcome to our Meta pages.
We are deeply committed to data protection and consider transparency in the handling of your data to be of the utmost importance. We would therefore like to provide you with the relevant information.
There is an agreement in place between Meta and us as joint controllers in accordance with Article 26 of the GDPR. You can access this agreement via the following link [https://www.facebook.com/legal/terms/page_controller_addendum]. This agreement stipulates that Meta assumes full responsibility for the data protection obligations relating to Page Insights.
1. Name and address of the data controllers:
The joint controllers responsible for the operation of our Meta pages are:
a)
Meta Platforms Ireland Ltd.
4 Grand Canal Square
Dublin 2, Ireland
You can contact Meta’s Data Protection Officer via the following form:
www.facebook.com/help/contact/540977946302970.
and
b)
puris Bad GmbH & Co. KG
Hinterm Gallberg 6a
59929 Brilon
mail@puris.de
You can contact our external Data Protection Officer at:
Email: support@your-insider.com
2. Categories of data, purpose and legal basis for processing
With regard to data processing by Meta, please refer to their privacy policy at https://www.facebook.com/privacy/center/
Below, we explain the data processing operations carried out by us.
a. Statistical data
We can access statistical data of various categories via the so-called ‘Insights’ on Meta’s pages. (https://www.facebook.com/business/a/page/page-insights)
These statistics are generated and provided by Meta. As the operators of the pages, we have no influence over their generation or presentation. We cannot disable this function or prevent the generation and processing of the data. For a selectable time period and for the categories ‘Fans’, ‘Followers’, ‘People Reached’ and ‘People Who Interacted’, Meta provides us with the following data, amongst others, relating to our Meta pages:
Total number of page views, ‘Likes’, page activity, post interactions, reach, video views, post reach, comments, shared content, replies, proportion of men and women, location by country and city, language, shop views and clicks, clicks on route planners, clicks on telephone numbers. Data relating to the groups linked to our Meta pages is also provided in this way. As Meta is constantly evolving, the availability and presentation of the data are subject to change; we therefore refer you to Meta’s privacy policy, as mentioned above, for further details.
The processing of personal data is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in making our posts and activities on our Meta pages more appealing to users. For example, we use data on age and gender distributions to tailor our messaging, and information on users’ preferred visiting times to optimise the timing of our posts. Information on the types of devices used by visitors helps us to adapt the visual design of our posts accordingly.
b. Interactions with our account
You also have the option to interact with our account. You can do this, for example, by ‘liking’, sharing or commenting on a post, or by messaging us directly.
When you interact with us, this generally inevitably involves data processing on our part, as this allows us to view your account and thus gives us access to your personal data; for example, your username, your profile picture or the date and time of the interaction. In accordance with Meta’s Terms of Service, to which every user has agreed when creating a Meta profile, we can identify the page’s followers and fans and view their profiles as well as other information shared by you.
The data collected in this context consists of information that is only made available to us as a result of your interaction with our profile. The processing of personal data is therefore based on Article 6(1)(b) of the GDPR.
3. Recipients of the data
Please note that Meta may disclose your data to third parties. However, we have no control over this. Further details can be found in Meta’s privacy policy: https://www.facebook.com/privacy/center/
We do not disclose your data to third parties unless there is a legal obligation to do so. Such disclosure is made on the basis of Article 6(1)(c) of the GDPR and in conjunction with the relevant order or legal obligation to which we are subject in each individual case. Categories of data recipients include public authorities in the event of a legal obligation, and data processors who process the data collected online on our behalf, such as web hosting providers and web designers, analytics service providers, etc.
4. Retention period and erasure
Information on data storage by Meta can be found in their privacy policy: https://www.facebook.com/privacy/center/.
We store all personal data that you provide to us only for as long as is necessary to fulfil the purposes for which this data was provided, or for as long as required by law. Once the purpose has been fulfilled and/or the statutory retention periods have expired, we will delete or block the data.
5. Rights of the data subject
You have various rights regarding the processing of personal data, which we would like to inform you about below. Further details regarding your rights can also be found in Articles 15 to 21 of the GDPR and Sections 32 to 37 of the Federal Data Protection Act (“BDSG”).
You have the right to obtain information about your personal data. You may also request the rectification of inaccurate data.
Furthermore, under certain conditions, you are entitled to the right to erasure, the right to restriction of processing and the right to data portability. You may object to processing carried out on the basis of Article 6(1)(f) of the GDPR, as well as to any profiling carried out in accordance with Article 21 of the GDPR. You may withdraw any consent you have given in connection with your use of the website at any time, informally and without giving reasons, with effect for the future.
You may exercise all the above rights under Articles 15 to 21 of the GDPR by contacting the data controller informally by email or post.
You also have the right to lodge a complaint with the relevant data protection supervisory authority if you believe that the processing of your data is unlawful. A list of data protection officers and their contact details can be found at: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html
Where processing is carried out by Meta, you may also contact Meta directly. This applies in particular where processing takes place in connection with Page Insights.
You may also write to us at the following address:
Meta Platforms Ireland Ltd.
4 Grand Canal Square
Dublin 2, Ireland
Alternatively, you are of course welcome to contact us, and in such cases we will forward your enquiry to Meta in accordance with our agreement with them under Article 26 of the GDPR.