Privacy Policy

Privacy Policy

We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

1. Definitions

Below we present a few important data protection definitions. For further definitions we refer you to Art. 4 GDPR.

a) Controller…

… is the natural or legal person, authority, institution, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

b) Personal data…

… is any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

c) Processing…

… is any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

2. Name and Contact Details of the Controller Responsible for Processing

Dieter Backs
Storchsbaumstr. 95
46282 Dorsten
Tel.: +49(0)2362 / 9961906
E-mail:backs@positive-records.com

3. General Information on Data Processing

a) What types of data do we collect?

- Master data such as name and address
- Contact data such as e-mail addresses or telephone number
- Content data such as text entered in the contact form
- Usage data such as access times (when visiting the website)
- Meta/communication data (when visiting the website)
- Payment information

b) For what purposes does the processing take place?

- To provide our online offering, its functions and content
- To answer contact requests and to communicate with you
- For security measures
- For reach measurement and marketing
- To process contracts when you make a purchase in our shop

c) On what legal bases do we process data?

Pursuant to Art. 13 GDPR, we inform you of the legal bases for our data processing. Art. 6(1)(a) GDPR serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose.

Where the processing of personal data is necessary for the performance of a contract to which the data subject is party, as is the case, for example, with processing operations necessary for the delivery of goods or the provision of any other service or consideration, the processing is based on Art. 6(1)(b) GDPR.

The same applies to processing operations necessary for carrying out pre-contractual measures, for example in cases of inquiries concerning our products or services.

If our company is subject to a legal obligation that requires the processing of personal data, such as for the fulfilment of tax obligations, the processing is based on Art. 6(1)(c) GDPR.

Finally, processing operations could be based on Art. 6(1)(f) GDPR. This legal basis is used for processing operations which are not covered by any of the above legal bases, if processing is necessary to safeguard a legitimate interest of our company or a third party, unless such interests are overridden by the interests, fundamental rights, and freedoms of the data subject. Such processing operations are permitted to us in particular because they have been specifically mentioned by the European legislator, who took the view that a legitimate interest could be assumed if the data subject is a customer of the controller (Recital 47, sentence 2 GDPR).

Where the processing of personal data is based on Article 6(1)(f) GDPR, our legitimate interest is the pursuit of our business activities for the benefit of the wellbeing of all our employees and owners.

d) Order Processing and Disclosure of Data to Third Parties

Where, in the course of our processing, we disclose data to other persons and companies (processors or third parties), transmit it to them, or otherwise grant them access to the data, this is done only on the basis of a legal permission (e.g. where transmission of the data to third parties, such as payment service providers, is necessary for the performance of the contract pursuant to Art. 6(1)(b) GDPR), where you have consented, where a legal obligation provides for this, or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).

Where we engage third parties to process data on the basis of a so-called "data processing agreement", this is done on the basis of Art. 28 GDPR.

e) Transfer of Data to Third Countries

Where we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or where this occurs in connection with the use of third-party services or the disclosure or transmission of data to third parties, this only takes place if it is necessary for the performance of our (pre-)contractual obligations, on the basis of your consent, due to a legal obligation, or on the basis of our legitimate interests. Subject to statutory or contractual permissions, we only process or have data processed in a third country where the specific requirements of Art. 44 et seq. GDPR are met. This means the processing takes place, for example, on the basis of special safeguards, such as the officially recognized determination of a level of data protection equivalent to that of the EU (e.g. for the USA through the "Privacy Shield") or compliance with officially recognized special contractual obligations (so-called "standard contractual clauses").

f) Duration of Data Storage

The data we process is erased or its processing restricted in accordance with Art. 17 and 18 GDPR. Unless expressly stated within this privacy policy, data stored with us will be erased as soon as it is no longer required for its intended purpose and there are no statutory retention obligations preventing its erasure. Where data is not erased because it is required for other legally permissible purposes, its processing is restricted. This means the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.

Under German statutory requirements, retention is required in particular for 6 years pursuant to Section 257 (1) of the German Commercial Code (HGB) (commercial books, inventories, opening balance sheets, annual financial statements, commercial letters, accounting vouchers, etc.) and for 10 years pursuant to Section 147 (1) of the German Fiscal Code (AO) (books, records, management reports, accounting vouchers, commercial and business letters, documents relevant for taxation purposes, etc.).

g) Rights of Data Subjects

As a data subject, you have numerous rights, which are set out in particular in Art. 15 et seq. GDPR. These are, individually:

• The right to request confirmation as to whether data concerning you is being processed, and to information about that data as well as further information and a copy of the data (Art. 15 GDPR).
• The right to request completion of data concerning you, or the correction of inaccurate data concerning you (Art. 16 GDPR).
• The right to request that data concerning you be erased without undue delay, or alternatively to request restriction of the processing of that data (Art. 17 and 18 GDPR).
• The right to request that the data concerning you which you have provided to us be handed over to you, and to demand its transmission to other controllers (Art. 20 GDPR).
• The right to object at any time to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(e) or (f), for reasons arising from your particular situation (Art. 21 GDPR)
• Where processing is based on Art. 6(1)(a) or Art. 9(2)(a), the right to withdraw your consent to the processing of personal data at any time, without affecting the lawfulness of processing carried out on the basis of consent prior to its withdrawal. The right to lodge a complaint with the competent supervisory authority (Art. 77 GDPR).

h) Is the provision of personal data required by law or contract, or necessary to enter into a contract? Am I obliged to provide personal data, and what are the possible consequences if I do not?
Insofar as you enter data on our website yourself (such as your name, contact details, etc.), there is no legal obligation to do so. However, providing such data is necessary if, for example, you contact us via our contact form, subscribe to our newsletter, or wish to purchase something via our website. Failure to provide the personal data would mean that we cannot contact you, cannot send you our newsletter, or cannot accept your orders.

Data collected when you access our site, for example via cookies (see below), is used for the purposes of reach measurement and marketing. There is no legal obligation to collect or disclose this data. You can take precautions to prevent this data from being collected (see below). This may result in functional restrictions to our online offering.

i) Is there automated decision-making?

As a responsible company, we do not use automated decision-making or profiling.

4. Cookies

We use cookies on our site. These are small files that your browser automatically creates and that are stored on your device (laptop, tablet, smartphone, etc.) when you visit our site. Cookies do not cause any damage to your device, do not contain viruses, trojans, or other malware. Information is stored in the cookie that arises in connection with the specific device used. This does not mean, however, that we thereby gain direct knowledge of your identity. The use of cookies serves, on the one hand, to make the use of our offering more pleasant for you. For example, we use so-called session cookies to recognize that you have already visited individual pages of our website. These are automatically deleted when you leave our site. In addition, we also use temporary cookies to optimize user-friendliness, which are stored on your device for a specified period of time. If you visit our site again to make use of our services, it is automatically recognized that you have already been to our site and which entries and settings you made, so that you do not have to enter them again. We also use cookies to statistically record the use of our website and to evaluate it for the purpose of optimizing our offering for you (see item 5). These cookies allow us to automatically recognize, on a repeat visit to our site, that you have already visited us before. These cookies are automatically deleted after a defined period of time. The data processed by cookies is necessary for the aforementioned purposes to protect our legitimate interests and those of third parties pursuant to Art. 6(1) sentence 1(f) GDPR. Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer, or so that a notice always appears before a new cookie is created. Completely deactivating cookies may, however, mean that you are unable to use all the functions of our website.

5. Hosting

The hosting services we use serve to provide the following services: infrastructure and platform services, computing capacity, storage space and database services, security services, and technical maintenance services, which we use for the purpose of operating this online offering.

In doing so, we, or our hosting provider, process master data, contact data, content data, contract data, usage data, and meta and communication data of customers, prospective customers, and visitors of this online offering on the basis of our legitimate interests in an efficient and secure provision of this online offering pursuant to Art. 6(1)(f) GDPR in conjunction with Art. 28 GDPR (conclusion of a data processing agreement). We, or our hosting provider, collect data on every access to the server on which this service is located (so-called server log files) on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR. Access data includes:

• Name of the web page or file accessed
• Date and time of access
• Amount of data transferred
• Notification of successful access
• Browser type and version
• The user's operating system
• Referrer URL (the previously visited page)
• IP address and the requesting provider.

Log file information is stored for security reasons (e.g. to investigate cases of abuse or fraud) for a maximum of 7 days and then deleted. Data whose further retention is required for evidentiary purposes is exempt from deletion until the respective incident has been finally resolved.

6. Registration on Our Website

You have the option of registering on our website. The personal data transmitted to the controller in this process arises from the input form used for registration. The personal data you enter is collected and stored exclusively for internal use by us and for our own purposes. We may arrange for it to be forwarded to one or more processors, for example a parcel delivery service, which likewise uses the personal data exclusively for internal use attributable to the controller.

Registering on our website also stores the IP address assigned by your internet service provider (ISP), as well as the date and time of registration. This data is stored because this is the only way to prevent misuse of our services, and because it enables us, if necessary, to investigate offenses that have been committed. To that extent, the storage of this data is necessary to protect us. This data is generally not passed on to third parties unless there is a legal obligation to disclose it, or the disclosure serves law-enforcement purposes.

Registration, with the voluntary provision of personal data, also serves to make it easier for you to complete a purchase via our website, since data provided once does not need to be entered again for every purchase. Registered persons are free to change the personal data provided during registration at any time, or to have it deleted completely from our records.

7. Newsletter Subscription

If you have expressly consented pursuant to Art. 6(1) sentence 1(a) GDPR, we use your e-mail address to regularly send you our newsletter. You can unsubscribe at any time, for example via a link at the end of every newsletter. Alternatively, you are welcome to send your unsubscribe request at any time by e-mail to backs@positive-records.de.

8. Use of Our Contact Form

For any kind of question, we offer you the option of contacting us via a form provided on the website. A valid e-mail address is required so that we know who the inquiry is from and are able to respond to it. Further information may be provided voluntarily. Data processing for the purpose of contacting us takes place pursuant to Art. 6(1) sentence 1(a) GDPR on the basis of your voluntarily given consent. The personal data collected by us for use of the contact form is automatically deleted once your inquiry has been dealt with.

9. Google Analytics

For the purpose of designing our pages to meet demand and continuously optimizing them, we use Google Analytics, a web analytics service provided by Google Inc. (https://www.google.de/intl/de/about/) (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; hereinafter "Google"). In this context, pseudonymized usage profiles are created and cookies (see item 4) are used. The information generated by the cookie about your use of this website, such as

• Browser type/version,
• Operating system used,
• Referrer URL (the previously visited page),
• Host name of the accessing computer (IP address),
• Time of the server request,

is transmitted to a Google server in the USA and stored there. This information is used to evaluate use of the website, to compile reports on website activity, and to provide further services related to website and internet use for the purposes of market research and demand-oriented design of these websites. This information may also be transferred to third parties if this is required by law, or insofar as third parties process this data on our behalf. Under no circumstances will your IP address be merged with other data held by

Google. IP addresses are anonymized so that assignment is not possible (IP masking). You can prevent the installation of the cookies by setting your browser software accordingly; however, we point out that in this case you may not be able to use all functions of this website to their full extent.

You can also prevent the collection of the data generated by the cookie and related to your use of the website (including your IP address), and the processing of this data by Google, by downloading and installing a browser add-on (https://tools.google.com/dlpage/gaoptout?hl=de). As an alternative to the browser add-on, in particular for browsers on mobile devices, you can also prevent collection by Google Analytics by clicking this link. An opt-out cookie will be set that prevents future collection of your data when visiting this website. The opt-out cookie only applies to this browser and only for our website, and is stored on your device. If you delete the cookies in this browser, you must set the opt-out cookie again. Further information on data protection in connection with Google Analytics can be found, for example, in the Google Analytics help pages (https://support.google.com/analytics/answer/6004245?hl=de).

10. PayPal as a Payment Method

We have integrated components of PayPal on our website. PayPal is an online payment service provider. Payments are processed via so-called PayPal accounts, which are virtual private or business accounts. PayPal also offers the option of processing virtual payments via credit cards if a user does not hold a PayPal account. A PayPal account is managed via an e-mail address, which is why there is no classic account number. PayPal makes it possible to trigger online payments to third parties, as well as to receive payments. PayPal also performs escrow functions and offers buyer-protection services.

The European operating company of PayPal is PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg.

If you select "PayPal" as your payment method during the order process in our online shop, your data is transmitted automatically to PayPal. By selecting this payment option you consent to the transmission of personal data required for payment processing.

The personal data transmitted to PayPal generally consists of first name, last name, address, e-mail address, IP address, telephone number, mobile phone number, or other data necessary for payment processing. Personal data related to the respective order is also necessary for processing the purchase contract.

The purpose of the data transmission is payment processing and fraud prevention. We will transmit personal data to PayPal in particular where there is a legitimate interest in the transmission. The personal data exchanged between PayPal and us may be transmitted by PayPal to credit agencies under certain circumstances. This transmission is for the purpose of identity and credit checks.

PayPal may pass on the personal data to affiliated companies and service providers or subcontractors, insofar as this is necessary to fulfil contractual obligations or the data is to be processed on its behalf.

You have the option of withdrawing your consent to the handling of personal data vis-à-vis PayPal at any time. A withdrawal does not affect personal data that must be processed, used, or transmitted to fulfil payment obligations (in accordance with the contract).

PayPal's applicable privacy policy can be accessed at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

11. Social Media Plug-ins

On our website, on the basis of Art. 6(1) sentence 1(f) GDPR, we use social plug-ins from the social networks Facebook and YouTube in order to raise our profile. The advertising purpose behind this is to be regarded as a legitimate interest within the meaning of the GDPR. Responsibility for data-protection-compliant operation lies with the respective provider.

a) Facebook

Our website uses Facebook social media plug-ins to make their use more personal. This is an offering from Facebook.

If you visit a page of our website that contains such a plug-in, your browser establishes a direct connection to Facebook's servers. The content of the plug-in is transmitted by Facebook directly to your browser and integrated into the website from there.

By integrating the plug-ins, Facebook receives the information that your browser has accessed the corresponding page of our website, even if you do not have a Facebook account or are not currently logged in to Facebook. This information (including your IP address) is transmitted by your browser directly to a Facebook server in the USA and stored there.

If you are logged in to Facebook, Facebook can directly link your visit to our website to your Facebook account. If you interact with the plug-ins, the corresponding information is likewise transmitted directly to a Facebook server and stored there. This information is also published on Facebook and shown to your Facebook friends. Facebook may use this information for the purposes of advertising, market research, and demand-oriented design of the Facebook pages. For this purpose, Facebook creates usage, interest, and relationship profiles, e.g. to evaluate your use of our website with regard to the advertisements displayed to you on Facebook, to inform other Facebook users about your activities on our website, and to provide other services connected with the use of Facebook.

If you do not want Facebook to associate the data collected via our website with your Facebook account, you must log out of Facebook before visiting our website. Please refer to Facebook's privacy notices (https://www.facebook.com/about/privacy/) for the purpose and scope of data collection and its further processing and use by Facebook, as well as your rights in this regard and options for protecting your privacy.

b) YouTube

Our website uses plug-ins from the YouTube site operated by Google. The operator of the site is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. If you visit one of our pages equipped with a YouTube plug-in, a connection to YouTube's servers is established. This tells the YouTube server which of our pages you have visited.

If you are logged in to your YouTube account, you allow YouTube to directly link your browsing behavior to your personal profile. You can prevent this by logging out of your YouTube account.

Further information on the handling of user data can be found in YouTube's privacy policy at https://www.google.de/intl/de/policies/privacy

b) Instagram

Our website also uses so-called social plug-ins ("plug-ins") from Instagram, operated by Instagram LLC., 1601 Willow Road, Menlo Park, CA 94025, USA ("Instagram"). The plug-ins are marked with an Instagram logo, for example in the form of an "Instagram camera". If you visit a page of our website that contains such a plug-in, your browser establishes a direct connection to Instagram's servers. The content of the plug-in is transmitted by Instagram directly to your browser and integrated into the page. Through this integration, Instagram receives the information that your browser has accessed the corresponding page of our website, even if you do not have an Instagram profile or are not currently logged in to Instagram.

This information (including your IP address) is transmitted by your browser directly to an Instagram server in the USA and stored there. If you are logged in to Instagram, Instagram can directly link your visit to our website to your Instagram account. If you interact with the plug-ins, for example by clicking the "Instagram" button, this information is likewise transmitted directly to an Instagram server and stored there. The information is also published on your Instagram account and shown there to your contacts. If you do not want Instagram to directly associate the data collected via our website with your Instagram account, you must log out of Instagram before visiting our website. Further information on this can be found in Instagram's privacy policy (https://help.instagram.com/155833707900388).

12. Google Maps

We use Google Maps on our website to display interactive maps and to create directions. Google Maps is a mapping service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, California 94043, USA. By using Google Maps, information about the use of this website, including your IP address and the (starting) address entered as part of the route-planning function, may be transmitted to Google in the USA. If you access a page of our website that contains Google Maps, your browser establishes a direct connection to Google's servers. The map content is transmitted by Google directly to your browser and integrated into the website from there. We therefore have no influence over the scope of the data collected by Google in this way. To the best of our knowledge, this includes at least the following data:

• Date and time of the visit to the relevant web page,
• Internet address or URL of the web page accessed,
• IP address,
• (Starting) address entered as part of route planning.

If you do not want Google to collect, process, or use data about you via our website, you can disable JavaScript in your browser settings. In this case, however, you will not be able to use the map display.

For the purpose and scope of data collection and its further processing and use by Google, as well as your rights in this regard and options for protecting your privacy, please refer to Google's privacy notices.

13. Google Fonts

This website uses external fonts from Google Fonts. Google Fonts is a service of Google Inc. ("Google"). These web fonts are embedded via a server call, generally to a Google server in the USA. This transmits to the server which of our web pages you have visited. Google also stores the IP address of the browser of the device of the visitor to these web pages. Further information can be found in Google's privacy notices, which you can access here: www.google.com/fonts#AboutPlace:about www.google.com/policies/privacy/

Any further questions?

If you have any further questions regarding data protection, please feel free to contact us at any time.