Privacy statement

A.         Basic Information

Thank you very much for your interest in our website. The protection of your privacy is very important to us. We are aware of the great importance to the protection of your personal data and your right to informational self-determination.

We´d like to inform about the collection and processing of personal data when using our website. Personal data are all data that can be related to you personally, e.g. name, address, e-mail address.

1.   Controller

Responsible for data protection in accordance with Art. 4 No. 7 of the General Data Protection Regulation (GDPR):

XXImo GmbH

Kaiserswerther Straße 215

40474 Düsseldorf

Tel. + 49 180 6 555 333 *

(* 35 Cent/Anruf aus dem dt. Festnetz; Mobilfunk max. 60 Cent/Anruf)

E-Mail: servicedesk@xximo.de

Further information and contact details as well as additional legal notices can be found on www.xximo.de under “Imprint” and under “Contact”.

2.   Data and system security

We protect our website and systems making use of technical and organizational measures against loss, destruction, access, modification or distribution of your data by unauthorized persons.

In connection with access to our website, data that may allow identification (e.g. IP address) is temporarily stored on our servers for data and system security purposes, but in principle for no longer than 30 days. The processing of possibly personal data for data and system security purposes is carried out on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR and our legitimate interest in securing our systems and preventing misuse.

3.   Principles for the storage and deletion of personal data

Personal data will only be processed for the period required to achieve the respective storage purpose or if this is provided for in the laws or regulations applicable to us, e.g. commercial or tax storage obligations. If a storage purpose (e.g. in case of cancellation of our newsletter service) or a legally prescribed storage period expires, affected personal data will be deleted routinely and according to the legal regulations or their processing is restricted, e.g. limited processing within the scope of commercial or fiscal storage obligations.

The processing of personal data on the basis of a legal obligation, namely the fulfilment of legal storage obligations, is based on Art. 6 para. 1 sentence 1 lit. c GDPR. If and to the extent that personal data pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR is processed for the purpose of preserving evidence, these processing purposes shall cease after expiry of the statutory limitation periods; the statutory regular limitation period shall be three years.

For further details on specific storage and deletion periods, we also refer to respective service descriptions or information in this data protection declaration.

B.         Visiting our website

If you use our website for information purposes only, i.e. if you do not register for our newsletter or do not otherwise provide us with personal information, we may collect personal data that your browser transmits to our server. For the purposes of web analysis, we also use tracking technologies to the extent described below.

1.   Technical provision

When you visit our website, we collect the following data, which is technically necessary for us to display our website to you and to guarantee the stability and security of our online offer:

  • IP address
  • date and time of the request
  • Time zone difference to Greenwich Mean Time (GMT)
  • Content of the request (specific page)
  • Access status/HTTP status code
  • the amount of data transferred in each case
  • Website from which the request comes
  • Browser
  • Operating system and its interface
  • Language and version of the browser software.

The legal basis for this collection and processing is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest refers to the provision of a functional website and its system security. In addition, we use the aforementioned data in non-personal form for statistical purposes and to improve our online services.

2.   Cookies

Our website uses cookies. Cookies are small text files that are stored on a computer system via an Internet browser.

Many websites and servers use cookies. Cookies often contain a so-called cookie ID. Such an ID is a unique identifier for the cookie and consists of a string of characters through which websites and servers can be assigned to a specific Internet browser in which the cookie was stored. Such cookies make it possible to distinguish your individual browser from other Internet browsers that contain other cookies. A particular Internet browser can therefore be recognized and identified by a unique cookie ID.

By using cookies, we can provide you with more user-friendly services that could not or only to a limited extent be implemented without cookies. Cookies are used on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR. In this respect, we have a legitimate interest in the provision and optimisation of functional and convenient online services.

You can prevent the setting of cookies by setting your Internet browser and thus permanently object to the setting of cookies. In addition, cookies that have already been set can be deleted via an Internet browser or other software programs. However, please note that if you deactivate cookies in your Internet browser, you may not be able to use all the functions of our and other online services.

3.   Web analysis

This website uses Google Analytics, a web analysis service of Google Inc. “(“Google”). Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyze how users use the site. We also refer to the above general explanations on cookies in general with regard to the type, scope and function of cookies. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. However, if IP anonymization is activated on this website, Google will reduce your IP address within Member States of the European Union or in other states party to the Agreement on the European Economic Area beforehand. Only in exceptional cases the full IP address will be transmitted to a Google server in the USA and shortened there.

This website uses Google Analytics with the extension “_anonymizeIp()”. As a result, the IP addresses are further processed in abbreviated form, so that a personal relationship can be excluded. As far as the data collected about you is personal, it will be excluded immediately and the personal data will be deleted immediately.

On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with further services associated with website and Internet use. The IP address transmitted by your browser in the context of Google Analytics is not merged with other Google data.

We use Google Analytics to analyze and regularly improve the use of our website. We can improve our offer and make it more interesting for you as a user. Our legitimate interest in data processing also lies in these purposes. The legal basis for the use of Google Analytics is Art. 6 para. 1 sentence 1 lit. f GDPR. As a precaution, we also pursue a consent concept (Art. 6 Par. 1 sentence 1 lit. a GDPR) by means of a “cookie banner”. In this regard, we refer to the above general information on cookies.

The data sent by us and linked with cookies are automatically deleted after 14 months. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available under the following link: http://tools.google.com/dlpage/gaoptout?hl=en.

Third Party Information: Google Dublin, Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001.

Terms of Service: http://www.google.com/analytics/terms/gb.html

Overview of data protection: https://support.google.com/analytics/answer/6004245?hl=en

Google’s privacy policy: https://policies.google.com/privacy?hl=en&gl=de

C.         Use of Services

Personal data is collected and processed when you provide it when you subscribe to our newsletter service or communicate with us using the contact options provided (e.g. for recruiting).

1.   XXImo mobility services

If you register for our mobility services or use our services as cardholder, the specific Privacy Statement for Cardholders applies.

2.   Communication

On our website we offer various ways to get in touch with us and to send us messages. In particular, you can also contact us by telephone or e-mail.

If you contact us accordingly, we will store and process the data you provide (e.g. your e-mail address, if applicable your name and your telephone number) in order to process your request. The legal basis in this respect is Art. 6 para. 1 sentence 1 lit. b and f GDPR. Our legitimate interests refer to an efficient and structured collection and processing of inquiries. We delete the accruing data after the storage is no longer necessary, or limit the processing, if legal storage obligations exist.

3.   Newsletter

If you subscribe to our newsletter, we collect and process personal data for sending you advertising information, in particular information on the topics you may have selected when you subscribed to our newsletter as well as information on events and special offers or campaigns of our company.

Registration is based on consent. Only your e-mail address is mandatory. Optional information (surname, first name, preferred information) serves to address you personally and more individually. For the registration to our newsletter we use the so-called double opt-in procedure.

This means that after your registration we will send you an e-mail to the e-mail address you provided, in which we ask you to confirm that you wish to receive our newsletter via the e-mail address you provided.

We use your data transmitted for the registration to the newsletter for the purpose of the delivery of our newsletter. In addition, the following data is collected upon registration: IP address of the calling computer, date and time of registration. This data is collected and stored in order to demonstrate that effective consent has actually been given by the respective user and that the double opt-in procedure has been properly carried out.

The legal basis for the processing of your data for the purpose of carrying out the newsletter service is your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR. Insofar as the registration for our newsletter is technically documented, the legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR; our legitimate interests refers to the documentation of the proper collection and/or execution of the double opt-in procedure.

The data collected when subscribing to the newsletter will only be stored as long as the subscription to the newsletter is active. The subscription to the newsletter can be cancelled by the user concerned at any time. For this purpose, there is a corresponding unsubscribe link in every newsletter. You are also welcome to contact us using your e-mail address registered for the newsletter; simply use the contact data provided in this data protection declaration.

D.         Use of Social Media

We operate own websites within social networks and on third-party platforms in order to reach interested parties and users via these channels, to inform them about our services and to open up an additional contact channel.

Social networks and platforms may also process user data outside the EU. Insofar as US providers are certified under the so-called Privacy Shield, they have undertaken to comply with EU data protection standards. However, users may be exposed to risks due to data processing outside the EU. Enforcement in particular can be affected.

Please, note that user data can be processed in the context of using social networks and platforms for market research and advertising purposes. User profiles can be created from the behaviour of users. On the basis of such user profiles, for example, advertisements can be placed within the social networks or platform, but also on third party sites if necessary. For these purposes, cookies are often stored on the computers of users, which serve to record the user behaviour and the interests of the users.

The processing of personal data is carried out on the basis of Art. 6 para. 1 sentence 1 lit. f. GDPR and our legitimate interests in effective information for users and the opening of additional communication channels. Art. 6 para. 1 sentence 1 lit. a GDPR may also be processing basis if a user has consented to data processing with a provider of a social network or a platform.

Detailed information about data processing in social networks or on platforms is provided by the respective providers. This also regularly includes information about the possibility of objecting to certain data processing procedures, so-called opt-out. In the case of requests for information and the assertion of user rights, it is recommended to contact the respective providers, since they have access to the users’ data and can also take direct measures in addition to providing information. We are happy to support you if you need help. Please, note the following information from the providers:

  • Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland

Privacy Policy: https://www.facebook.com/about/privacy/

Opt-Out: https://www.facebook.com/settings?tab=ads

Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active

  • Twitter, 1355 Market Street, Suite 900, San Francisco, CA 94103, USA:

Privacy Policy: https://twitter.com/de/privacy

Opt-Out: https://twitter.com/personalization

Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000TORzAAO&status=Active

  • LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Irland

Privacy Policy: https://www.linkedin.com/legal/privacy-policy

Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000L0UZAA0&status=Active

  • Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA)

Privacy Policy: https://policies.google.com/privacy

Opt-Out: https://adssettings.google.com/authenticated

Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active

E.         Rights of the data subject

We would be happy to inform you about your rights under the GDPR as “data subject”. Thereafter, you have the following rights with respect to the personal data that concerns you:

  • right of access (Art. 15 para. 1, 2 GDPR)
  • right to rectification (Article 16 GDPR) and right to erasure (Article 17 GDPR)
  • the right to restriction of processing (Article 18 GDPR)
  • right to data portability (Art. 20 GDPR)
  • right to object (Article 21 GDPR)
  • right to withdraw (Art. 7 para. 3 GDPR)
  • right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

In addition, we summarise the key points of the rights of those affected under the GDPR. Please, be aware that this presentation is not exhaustive, but merely addresses basic information of the rights under the GDPR:

1.   Right of access by the data subject

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

  • the purposes of the processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
  • where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
  • the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
  • the right to lodge a complaint with a supervisory authority;
  • where the personal data are not collected from the data subject, any available information as to their source;
  • the existence of automated decision-making, including profiling, referred to in Art. 22 para. 1 and 4 GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
  • where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.

The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs.  Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.

2.   Right to rectification

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

3.   Right to restriction of processing

The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:

  • the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
  • the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
  • the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
  • the data subject has objected to processing pursuant to Article 21 para. 1 GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

4.   Right to erasure

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

  • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • the data subject withdraws consent on which the processing is based according to Art. 6 para. 1 sentence 1 lit. a GDPR or Art. 9 para 2 lit. a GDPR, and where there is no other legal ground for the processing;
  • the data subject objects to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21 para. 2 GDPR;
  • the personal data have been unlawfully processed;
  • the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
  • the personal data have been collected in relation to the offer of information society services referred to in Art. 8 para. 1 GDPR.

5.   Right to data portability

The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where: the processing is based on consent pursuant to Art. 6 para. 1sentence 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract pursuant to Art. 6 para. 1 sentence 1 lit. c GDPR; and the processing is carried out by automated means.

In exercising his or her right to data portability pursuant to paragraph Art. 20 para. 1 GDPR, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

6.   Right to withdraw

The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof.

7.   Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes GDPR.

The data protection supervisory authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden.

8.   Rights to object (Art. 21 (1), (2) GDPR

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on Art. 6 para. 1 sentence 1 lit. e or f GDPR, including profiling based on those provisions.  The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

 

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

F.         Contact

You can contact us at any time to exercise your rights as a data subject or if you have general questions about data protection:

XXImo GmbH

Kaiserswerther Straße 215

40474 Düsseldorf

Tel. + 49 180 6 555 333*

(* 35 Cent/Anruf aus dem dt. Festnetz; Mobilfunk max. 60 Cent/Anruf)

E-Mail: servicedesk@xximo.de