Privacy policy

I. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation, of other national data protection laws of the member states and of further data protection provisions is:

Phone: +49 341 2574 600
Email: email@sme-leipzig.de
Managing directors: Mandy Kögel, Ralf Kögel, Susanne Wolf

II. Data protection officer

Our data protection officer is:

Phone: +49 341 2574 600
Email: email@sme-leipzig.de

III. General information on data processing

1. Scope of the processing of personal data

As a rule we only collect and use personal data of our users where this is necessary to provide a working website and to provide our content and services. Personal data of our users is normally only collected and used with the user's consent. An exception applies in cases where it is not possible to obtain consent beforehand for practical reasons and the processing of the data is permitted by law.

2. Legal basis for the processing of personal data

Where we obtain the consent of the data subject for processing operations involving personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.

Where the processing of personal data is necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary to carry out pre-contractual measures. Where processing of personal data is necessary to comply with a legal obligation to which our company is subject, Article 6(1)(c) GDPR serves as the legal basis. Where vital interests of the data subject or of another natural person make processing of personal data necessary, Article 6(1)(d) GDPR serves as the legal basis. Where processing is necessary to protect a legitimate interest of our company or of a third party and the interests, fundamental rights and freedoms of the data subject do not override that interest, Article 6(1)(f) GDPR serves as the legal basis for the processing.

3. Erasure of data and storage period

The personal data of the data subject is erased or blocked as soon as the purpose of storage ceases to apply. Data may be stored beyond that point where this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which the controller is subject. Data is also blocked or erased when a storage period prescribed by those rules expires, unless there is a need to store the data further for the conclusion or performance of a contract.

IV. Provision of the website

1. Description and scope of the data processing

Each time our website is called up, our system automatically processes data and information from the computer system of the calling device that is required for the technical delivery of the page. This includes, among other things:

1. information about the browser type and the version used
2. the user's operating system
3. the user's internet service provider
4. the user's IP address
5. the date and time of access
6. websites from which the user's system reaches our website
7. websites that are called up by the user's system through our website

This data is processed only for the duration of the respective connection. It is not stored in log files or anywhere else.

2. Legal basis for the data processing

The legal basis for the temporary processing of the data is Article 6(1)(f) GDPR.

3. Purpose of the data processing

The temporary processing of the IP address by the system is necessary to allow the website to be delivered to the user's device. For this the user's IP address has to be available for the duration of the respective connection. This purpose is also where our legitimate interest in the data processing under Article 6(1)(f) GDPR lies.

4. Objection and removal

Processing the data to provide the website is essential for the operation of the website. There is therefore no way for the user to object to it.

V. Storage on your device: cookies and local storage

1. Description and scope of the data processing

This website sets no cookies. It stores a single value in your browser's local storage: your choice between the light and the dark appearance. The value contains nothing but „light“ or „dark“, allows no conclusion about you as a person, is not transmitted to us or to third parties and stays on your device alone.

Your behaviour is not analysed. We use no reach measurement, no statistics or analysis tools and no advertising networks.

2. Legal basis

This value is stored solely in order to provide the service you have expressly asked for, namely the appearance you have chosen. It is therefore permitted without consent under section 25(2)(2) TDDDG. Where personal data is processed alongside this, it is based on Article 6(1)(f) GDPR.

3. Storage period, objection and removal

The value is stored on your computer and transmitted from there to our site. You therefore have full control over it. Through your browser settings you can limit or prevent such storage and delete values that are already stored at any time. The website remains fully usable; it simply starts again in the appearance your operating system specifies.

VI. Third-party services used

1. Description and scope of the data processing

When this website is called up, it loads two components from external servers: the fonts used, from Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), and the underlying design framework from the jsDelivr delivery network. Your IP address is transmitted to the respective provider in the process, because it is technically necessary in order to deliver the files to your browser. Transmission to third countries outside the European Union cannot be ruled out.

2. Legal basis and purpose

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in presenting our website consistently and quickly.

VII. Contact by email, telephone and contact form

1. Description and scope of the data processing

You can contact us at the email address given or by telephone. In that case the personal data you transmit is stored. The data is not passed on to third parties. It is used solely to handle the conversation.

The enquiry form on our contact page transmits no data to our server. When you send it, the message you have typed opens in your own email program; your details (name, email address, subject and message as mandatory entries, company, telephone number and area of interest voluntarily) only reach us once you send it from there. The website stores neither your IP address nor the time at which the form was sent.

2. Legal basis for the data processing

The legal basis for processing data transmitted in the course of making contact is Article 6(1)(f) GDPR. Where the contact is aimed at concluding a contract, Article 6(1)(b) GDPR is an additional legal basis for the processing.

3. Purpose of the data processing

We process the personal data solely in order to deal with your enquiry. This is also where the necessary legitimate interest in processing the data lies.

4. Storage period

The data is erased as soon as it is no longer needed for the purpose for which it was collected. For personal data from an enquiry this is the case once the conversation with the user has ended. A conversation has ended when it is clear from the circumstances that the matter concerned has been finally settled. Statutory retention obligations, in particular under commercial and tax law, remain unaffected.

5. Objection and removal

If you contact us by email, you can object to the storage of your personal data at any time. In that case the conversation cannot be continued. All personal data stored in the course of making contact will then be erased.

VIII. Rights of the data subject

If personal data concerning you is processed, you are a data subject within the meaning of the GDPR and you have the following rights in relation to the controller:

1. Right of access

You may ask the controller to confirm whether personal data concerning you is processed by us. If such processing is taking place, you may request access to the following information:

1. the purposes for which the personal data is processed;
2. the categories of personal data that are processed;
3. the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
4. the planned period for which the personal data concerning you will be stored or, if specific information on this is not possible, the criteria used to determine that period;
5. the existence of a right to have personal data concerning you rectified or erased, a right to have the processing restricted by the controller or a right to object to that processing;
6. the existence of a right to lodge a complaint with a supervisory authority;
7. any available information about the origin of the data where the personal data is not collected from the data subject;
8. the existence of automated decision-making including profiling under Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved and about the significance and the envisaged consequences of such processing for the data subject.

You have the right to ask whether personal data concerning you is transferred to a third country or to an international organisation. In this context you may ask to be informed of the appropriate safeguards under Article 46 GDPR relating to the transfer.

2. Right to rectification

You have a right to rectification and completion in relation to the controller where the personal data processed concerning you is inaccurate or incomplete. The controller must carry out the rectification without delay.

3. Right to restriction of processing

You may request the restriction of the processing of personal data concerning you under the following conditions:

1. where you contest the accuracy of the personal data concerning you, for a period enabling the controller to verify the accuracy of the personal data;
2. the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
3. the controller no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims, or
4. where you have objected to the processing under Article 21(1) GDPR and it is not yet clear whether the legitimate grounds of the controller override your grounds.

Where the processing of personal data concerning you has been restricted, that data may, apart from being stored, only be processed with your consent or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a member state. Where the processing has been restricted under the conditions named above, you will be informed by the controller before the restriction is lifted.

4. Right to erasure

You may ask the controller to erase personal data concerning you without delay, and the controller is obliged to erase that data without delay where one of the following grounds applies:

1. The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
2. You withdraw the consent on which the processing was based under Article 6(1)(a) or Article 9(2)(a) GDPR and there is no other legal basis for the processing.
3. You object to the processing under Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing under Article 21(2) GDPR.
4. The personal data concerning you has been processed unlawfully.
5. Erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union law or the law of the member states to which the controller is subject.
6. The personal data concerning you was collected in relation to information society services offered under Article 8(1) GDPR.

Where the controller has made the personal data concerning you public and is obliged to erase it under Article 17(1) GDPR, it shall take reasonable steps, including technical measures, taking account of available technology and the cost of implementation, to inform controllers processing the personal data that you, as the data subject, have requested the erasure of all links to, or copies or replications of, that personal data.

The right to erasure does not apply where processing is necessary for exercising the right of freedom of expression and information; for compliance with a legal obligation; for reasons of public interest in the area of public health; for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes under Article 89(1) GDPR; or for the establishment, exercise or defence of legal claims.

5. Right to be informed

Where you have asserted the right to rectification, erasure or restriction of processing in relation to the controller, the controller is obliged to communicate that rectification or erasure of the data or restriction of processing to all recipients to whom the personal data concerning you has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed about those recipients by the controller.

6. Right to data portability

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transmit that data to another controller without hindrance, where the processing is based on consent under Article 6(1)(a) GDPR or Article 9(2)(a) GDPR or on a contract under Article 6(1)(b) GDPR and the processing is carried out by automated means.

In exercising this right you also have the right to have the personal data concerning you transmitted directly from one controller to another, where this is technically feasible. The freedoms and rights of other people must not be affected by this.

7. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you carried out under Article 6(1)(e) or (f) GDPR; this also applies to profiling based on those provisions. The controller will then no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

8. Right to withdraw consent under data protection law

You have the right to withdraw your declaration of consent under data protection law at any time. Withdrawing consent does not affect the lawfulness of the processing carried out on the basis of that consent up to the withdrawal.

9. Automated individual decision-making including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. No such automated decision-making takes place on this website.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your residence, place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority with which the complaint has been lodged informs the complainant of the status and the outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR.