Data Protection Declaration DRIVTO GmbH

Below you will find information about which types of personal data we process, to what extent, and for what purposes.

Personal data is information through which you, as a data subject, can be identified, such as name, address, email address, or user behavior.

Data subjects are those with whom we have a relationship in the context of providing our services, visitors to our website, and users of our entire online offering.

Name and Address of the Controller for Data Processing:

DRIVTO GmbH
represented by the Managing Director: Philipp Lauterbach

Cantadorstr. 18
40211 Düsseldorf

Phone: +49 (0)211 81973601

Email: info@drivto.com

The following types of data are collected and stored by us:

• Inventory data (e.g., names and addresses)
• Contact data (e.g., phone numbers and email addresses)
• Usage data (e.g., access times, pages visited)
• Metadata (e.g., browser type, IP address, operating system)
• Content data (e.g., your text entries in contact forms or similar)

The categories of data subjects affected by this are:

• Customers
• Interested parties
• Users (website/online offerings)

Data is collected for the following purposes:

• Information
• Communication
• Customer service
• Services for contract fulfillment
• Direct marketing/Marketing
• (Technical) provision of the online offering
• Security measures to protect the (online) offering
• Reach measurement to improve the offering

The processing of your personal data is based exclusively on the following legal bases:

Consent pursuant to Art. 6 (1) (a) GDPR

"The data subject has given consent to the processing of his or her personal data for one or more specific purposes"

Contract fulfillment and pre-contractual inquiries pursuant to Art. 6 (1) (b) GDPR

"processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract"

Legal obligations pursuant to Art. 6 (1) (c) GDPR

"processing is necessary for compliance with a legal obligation to which the controller is subject"

Legitimate interest pursuant to Art. 6 (1) (f) GDPR

"processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child"

Transfer to Third Parties and Third Countries

Your data generally remains within our company. The transfer or disclosure of your personal data to a third party only occurs:

• on the basis of a legal permission,
• with your consent,
• if we are legally obliged to do so, or
• on the basis of a legitimate interest pursuant to Art. 6 (f) GDPR.

In this context, our processors are obliged by means of a data processing agreement pursuant to Art. 28 GDPR to comply with the necessary technical and organizational measures to ensure the protection of the rights of data subjects.

The transfer of your personal data to third countries (outside the European Union (EU) / European Economic Area (EEA)) only takes place to countries:

• for which an adequacy decision of the EU Commission exists, or
• for which suitable guarantees within the meaning of Art. 46 GDPR exist,
• which offer an adequate level of protection pursuant to Art. 45 ff. GDPR,
• are subject to officially recognized contractual obligations such as the so-called "standard contractual clauses", or
• for which one of the exceptions under Art. 49 GDPR applies.

Duration of Storage

Your personal data will be routinely deleted or restricted in processing, or blocked, at the latest after the expiry of the respective statutory retention periods (e.g., commercial and tax retention periods), provided that this data is no longer necessary for contract fulfillment and/or we have no legitimate interest in further storage.

Use of the Website and APP - Creation of Log Files

When you visit our website and use our APP, the following information is automatically transmitted by your browser to our provider's server:

– IP address of your end device

– Date and time of access

– Name and URL of retrieved files

– Website from which access is made or from which you were directed to our site (Referrer URL)

– Browser used and, if applicable, the operating system of your device

– Name of the access provider.

This data is not merged with other data sources. The IP address is anonymized.

This data is collected to ensure the proper use of the website, to optimize the website and app, and to ensure the security of our IT systems. Our legitimate interest in data processing pursuant to Art. 6 (1) (f) GDPR also lies in these aforementioned purposes.

This data is regularly deleted automatically. In the event of misuse of the website or app, the relevant data, the further storage of which is necessary for evidentiary purposes, will be retained until the matter is clarified.

Hosting by Hetzner

We use the hosting service of Hetzner Online GmbH, Industriestr. 25,

91710 Gunzenhausen, for the purpose of providing the website on the basis of processing on our behalf. All data collected on our website is processed on Hetzner's servers.

Further information on Hetzner's data protection can be found on the following website: https://www.hetzner.com/legal/privacy-policy/

Further processing on servers other than the aforementioned Hetzner servers only takes place within the scope communicated below.

Cookies

This website uses cookies. These are small text files that are stored in the internet browser or by the internet browser on the user's end device. When a user calls up a website, a cookie can be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again.

A distinction is made here between the following types of cookies:

Session Cookies

Session cookies are functionally necessary cookies that do not require consent, as they are automatically deleted when you leave the homepage.

The legal basis for this processing is Art. 6 (1) (f) GDPR.

Permanent Cookies

Permanent cookies remain permanently on the end device. This allows, for example, the login status to be checked or preferred content to be displayed. In addition, the data processed here can be used for reach measurement.

The legal basis for this processing is Art. 6 (1) (a) GDPR, which therefore requires the user's consent.

We use cookies that enable an analysis of the user's surfing behavior.

The following data is stored and transmitted in the cookies:

– Frequency of page views

– Use of website functions

When calling up our website, the user is informed about the use of cookies for analysis purposes and his/her consent to the processing of personal data used in this context is obtained. In this context, reference is also made to this data protection declaration.

The user can revoke his/her consent at any time via the cookie settings and object to the processing of his/her personal data.

In addition, the user can also object via the corresponding settings in his/her browser.

The transmission of cookies can be deactivated or restricted by changing the settings in the internet browser. Cookies that have already been saved can be deleted at any time. This deletion can also be automated. Each browser manages these cookie settings differently. This setting is described in the help menu of each browser, which explains how you can change your cookie settings. If cookies are deactivated, the functionality of this website may be restricted.

We may work with advertising partners who help us to make our internet offering more interesting for you. For this purpose, cookies from partner companies are also stored on your hard drive when you visit our website (third-party cookies). This also includes providers from insecure third countries. The data is passed on, for example, to partner companies in the USA.

Consent with NAME Consent Provider (e.g., Borlabs)

Our website uses the consent technology of NAME Consent Provider (e.g., Borlabs) to obtain your consent to the storage of certain cookies in your browser or for the use of certain technologies and to document this in a data protection-compliant manner. The provider of this technology is NAME, Address of the Consent Provider.

When you enter our website, a cookie is stored in your browser in which the consents you have given or the revocation of these consents are stored. This data is not passed on to the provider of NAME Consent Provider.

The collected data is stored until you request us to delete it, delete the cookie yourself, or the purpose for data storage no longer applies. Mandatory statutory retention periods remain unaffected. Details on data processing by NAME Consent Provider can be found at Link to the Consent Provider's privacy policy.

The cookie consent technology is used to obtain the legally required consents for the use of cookies. The legal basis for this is Art. 6 (1) (c) GDPR.

Other Services

Google Services

Our website uses various services from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

Google Ads is used to display advertisements in the Google search engine or on third-party websites when the user enters certain search terms on Google (keyword targeting).

Legal Basis

The use of the aforementioned services is based on your consent pursuant to Art. 6 (1) (a) GDPR and on our legitimate interest pursuant to Art. 6 (1) (f) GDPR.

Revocation
You can revoke your consent at any time with effect for the future by accessing the cookie settings and changing your selection there. The legality of the processing carried out on the basis of the consent until revocation remains unaffected.

Storage Duration
The data sent by us and linked to cookies is automatically deleted after 2 months. The maximum lifespan of the cookies is 2 years. Data whose retention period has been reached is automatically deleted once a month.

Third-Country Transfer

Through the integration of these Google services, personal data, such as your IP address, can be transmitted to Google. This transmission is necessary to be able to fully use the respective functions.

Recipients of the data may be:

• Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

• Alphabet Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

For the third-country transfer to the USA, the European Commission adopted its adequacy decision on July 10, 2023. Google LLC is certified under the EU-US Privacy Framework.

Since Google servers are distributed worldwide and a transfer to third countries (e.g., Singapore) cannot be completely ruled out, we have also concluded EU Standard Contractual Clauses with the provider.

Further information on Google's terms of use and data protection can be found at https://marketingplatform.google.com/about/analytics/terms/en/ and at https://policies.google.com/?hl=en.

Contact

The use of our website is generally possible without providing personal data.

If you contact us via other means, such as a contact form, email, or telephone, the data collected here will be treated confidentially and will not be passed on to third parties without consent.

The respective purpose of data processing results from:

• the voluntary provision by the data subject pursuant to Art. 6 (1) (a) GDPR
• the fulfillment of a contract or for carrying out pre-contractual measures pursuant to Art. 6 (1) (b) GDPR
• the legitimate interest in the effective processing of inquiries addressed to the company pursuant to Art. 6 (1) (f) GDPR.

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected.

For personal data transmitted by email, this is the case when the respective conversation with the user has ended. The conversation is deemed to have ended when it can be inferred from the circumstances that the matter in question has been finally clarified.

A contact form is available on our website for electronic contact. If this option is used, the data entered in the input mask will be transmitted to us and stored. This personal data is optional:

- Name

- Email address

In addition, the following data is stored at the time the message is sent:

- The user's IP address

- Date and time of registration

- Browser and device

The user has the option to object to the processing of personal data at any time. In such a case, the conversation cannot be continued. All personal data stored in the course of contacting us will be deleted in this case.

Registration – User Profiles

To use our portal, registration and creation of a profile are necessary. We process the data collected in this context on the basis of Art. 6 (1) (b) GDPR for the fulfillment of a contract or for carrying out pre-contractual measures, as well as on the basis of Art. 6 (1) (f) GDPR for the protection of our legitimate interests, in particular to ensure the security and functionality of our portal.

For registration, we use the double opt-in procedure. This means that after entering your email address, you will receive a confirmation email from us asking you to confirm your registration. This confirmation is necessary to ensure that no one registers with a third-party email address. Your account will only be activated after successful confirmation.

Direct Marketing

If you have given us your consent, we will use your email address and, if applicable, other contact details that you provide during the registration process to regularly send you information and offers that may be of interest to you. The legal basis for this processing is Art. 6 (1) (a) GDPR.

Of course, you have the right to object to the use of your data for direct marketing purposes at any time. You can send your objection by email to [Email Address]. Upon receipt of your objection, we will immediately stop processing your data for this purpose.

Newsletter

Registration for our newsletter dispatch takes place using the so-called double opt-in procedure. After entering your email address on our website, an email will be sent to the specified address and you will be asked to confirm it.

When registering for the newsletter, the data from the input mask is transmitted to us:

- Email address

In addition, the following data is collected during registration:

- IP address of the calling computer

- Date and time of registration

- Browser and device

Newsletter registration is based on the user's consent pursuant to Art. 6 (1) (a) GDPR. The purpose of data processing is the proper delivery of the newsletter using the user's email address. In addition, the processing of further personal data during the registration process serves to prevent misuse of the service or the email address.

As an existing customer, you will regularly receive product updates from us by email. You will receive these product updates from us regardless of whether you have subscribed to a newsletter. We use the email address you provided during registration for this purpose. The legal basis for this data processing is Article 6 (1) (a) GDPR.

The data is passed on to our service provider for dispatch:

Intuit Mailchimp
405 N Angier Ave. NE
Atlanta, GA 30308 USA

This service enables the tracking of opening times by recipients. The collected information is stored and used to analyze the reach of individual campaigns.

Objection and Deletion Option

The data subject can cancel the newsletter subscription at any time. You will find an option to delete the newsletter at the end of each newsletter email or via this link: Please insert.

Contract and Business Partners

The data of our contract and business partners is processed by us primarily to fulfill our contractual obligations and for communication. In addition, processing takes place for proper and business-like management and to protect our rights. Processing therefore takes place:

• for contract fulfillment and pre-contractual inquiries pursuant to Art. 6 (1) (b) GDPR,
• due to legal obligation pursuant to Art. 6 (1) sentence 1 (c) GDPR, or
• based on legitimate interests pursuant to Art. 6 (1) sentence 1 (f) GDPR.

Data is only passed on to third parties if it is necessary to fulfill legal obligations or if this is stated in the contract or this data protection declaration.

Social Media Presences

For communication and information of users as well as for advertising purposes, we are represented on the following social networks:

• Facebook
• Instagram
• Youtube
• LinkedIn

The processing of data obtained via social media presences is carried out by us only for the stated purposes on the legal basis of:

• the voluntary provision by the data subject pursuant to Art. 6 (1) (a) GDPR
• the fulfillment of a contract or for carrying out pre-contractual measures pursuant to Art. 6 (1) (b) GDPR, or
• the legitimate interest in the effective processing of inquiries addressed to the company pursuant to Art. 6 (1) (f) GDPR.

The operators of social networks generally process user data for market research and advertising purposes. With the help of the user's interests and usage behavior, user profiles can be created to display advertising to the user in the future, both within and outside the network, that corresponds to their profile/interests.

Further information on processing, objection options, and assertion of data subject rights can be found in the data protection declarations of the respective providers.

Facebook & Instagram

Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland - To the Privacy Policy

YouTube

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland - To the Privacy Policy

LinkedIn

LinkedIn Ireland Unlimited Company, Wilton Plaza Wilton Place, Dublin 2, Ireland

(https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy)

Data Processing Agreement: https://www.linkedin.com/legal/l/dpa

Your Rights

As a data subject, you have the opportunity to assert your rights in connection with the General Data Protection Regulation against us. These include the following rights:

Right to Information pursuant to Article 15 GDPR

You have the option to request information about your data stored by us. In particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected by us, and the existence of automated decision-making including profiling and, if applicable, meaningful information about their details. An informal request via email or post is sufficient for this. You will receive the requested information within one month of receipt of the letter.

Right to Rectification pursuant to Article 16 GDPR

If we have collected/stored incorrect data about you, you can request the rectification or completion of this data via an informal request. You will receive information about the change to your data within one month of receipt of the letter.

Right to Erasure pursuant to Article 17 GDPR

You have the option to request the erasure of your personal data stored by us, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defense of legal claims. However, this requires that the purposes for processing have ceased, or that you have objected to processing pursuant to Article 21 GDPR, you have withdrawn your consent pursuant to Article 7 GDPR, or the processing is unlawful.

Right to Restriction of Processing pursuant to Article 18 GDPR

You have the right to request the restriction of processing of your personal data if the accuracy of the data is contested by you, the processing is unlawful but you oppose its erasure and we no longer need the data, but you require it for the establishment, exercise or defense of legal claims, or you have objected to processing pursuant to Art. 21 GDPR. You can also inform us of this informally.

Right to Data Portability pursuant to Article 20 GDPR

You have the option to receive the data stored about you by us in a structured, commonly used and machine-readable format or to request its transmission to another controller.

Right to Withdraw Consent pursuant to Art. 7 (3) GDPR

You have the right to withdraw your consent once given to us at any time. This means that we may no longer continue the data processing based on this consent for the future and

Right to Object pursuant to Article 21 GDPR

If your personal data is processed on the basis of legitimate interests pursuant to Art. 6 (1) sentence 1 (f) GDPR, you have the right to object to the processing of your personal data if there are reasons for this arising from your particular situation or if the objection is directed against direct marketing.

In the latter case, you have a general right to object, which will be implemented by us without specifying a particular situation.

If you wish to exercise your right of withdrawal or objection, an email to Email is sufficient.

Right to Lodge a Complaint pursuant to Article 77 GDPR

You have the right to lodge a complaint with a supervisory authority. For this purpose, you can contact the supervisory authority of your usual place of residence or workplace or our registered office.

The State Commissioner for Data Protection North Rhine-Westphalia

Kavalleriestr. 2-4

40213 Düsseldorf

Phone: 0211/38424-0

Fax: 0211/38424-999

Email: poststelle@ldi.nrw.de

Actuality and Changes to this Privacy Policy

This privacy policy is currently valid and has the status 22.08.2024