DATA PROTECTION DECLARATION

§1 Information on the collection of personal data

(1) We inform you below about the collection of personal data when using our website and sub-domains of our website. Personal data is all data that relates to you personally, e.g. name or address. The data that we can collect from you includes: Name, postal address, telephone number, email address, contact settings, marketing settings, information on social media accounts and possibly IP address. You will discover in this declaration which data we collect for each type of service usage.
(2) The responsible person under Art. 4 Para. 7 EU General Data Protection Regulation (GDPR) is Mr. Thomas Kaufhold, loadable address: kaufhold@karo-sportsystems.de, Ziegeleistr. 33a, D-57462 Olpe (refer to our Legal Notes).
(3) When contacting us by email or via a contact form, we store the data you have provided (your email address, if nec. your name and telephone number) in order to answer your questions. Data occurring in this regard is deleted once storage is no longer required or the processing is restricted if statutory storage obligations apply.
(4) If we intend to use contracted service providers for individual functions of our offering or your data for advertising purposes, we inform you about the relevant processes in detail below. We also state the criteria set for the storage period.

§2 Your rights

(1) You have the following rights relating to your personal data:
– Right to notification,
– Right to correction or deletion,
– Right to restriction on processing,
– Right to oppose the processing,
– Right to data transfer.

(2) You also have the right to complain to a data protection supervisory authority about how we process your personal data.
(3) These rights mean:
Right of access
You can request confirmation from the responsible person on whether we process personal data that relates to you.
If such processing occurs, you can request the following information from the responsible person:
– the purposes for which the personal data is processed;
– the categories of personal data that were processed;
– the recipient or categories of recipients to whom the relevant personal data was published or will be published;
– the planned storage term of your personal data or, if correct statements on this are not possible, criteria for setting the storage term;
– the existence of a right to correction or deletion of your personal data, a right to restrict the processing by the responsible person or a right to object to this processing;
– the existence of a complaint right to a supervisory authority;
– all available information on the origin of the data if the personal data is not collected from the affected person;
– the existence of automated decision-making including profiling under Art. 22 Para. 1 and 4 GDPR and – at least in these cases – meaningful information on the logic involved, extent and the desired effects of such processing for the affected person.
You have the right to request information on whether your personal data is transferred to a third country or an international organisation. In this regard you can request that you are informed about the transfer via the appropriate guarantees under Art. 46 GDPR.

Right to correction
You have the right to correction and/or completion by the person responsible if the processed personal data that relate to you are incorrect or incomplete. The responsible person must undertake the correction without delay.

Right to restriction on processing
Under the following conditions you can request a restriction on the processing of your personal data:
– if you dispute the correctness of your personal data for a term that enables the person responsible to check the correctness of the personal data;
– the processing is illegal and you reject the deletion of the personal data and instead request a restriction on the use of the personal data;
– the responsible person no longer requires the personal data for the processing purposes but does require them to assert, exercise or defend legal claims, or
– if you have submitted an objection against the processing under Art. 21 Para. 1 GDPR and it is not yet clear whether the justified reasons of the responsible person outweigh your reasons.
If the processing of your personal data was restricted, this data – apart from its storage – can only be processed with your consent or to assert, exercise or defend legal claims or to protect the rights of another natural person or legal entity or due to the important public interest of the Union or a member state.
If the restriction on processing was restricted according to the conditions stated above, you will be informed by the responsible person before the restriction is removed.

Right to deletion
Deletion duty
You can request of the responsible person that your personal data are deleted without delay and the responsible person is obligated to delete the data without delay if one of the following reasons applies:
– Your affected personal data are no longer required for the purposes for which it was collected or any other processing.
– You revoke your consent on which the processing is based as per Art. 6 Para. 1 lit. a or Art. 9 Para. 2 lit. a GDPR and there is no other legal basis for the processing.
You object to the processing under Art. 21 Para. 1 GDPR and there are no other priority justified reasons for the processing or you object to the processing under Art. 21 Para. 2 GDPR.
– Your personal data was processed illegally.
– The deletion of your personal data is required to fulfil a legal obligation under Union law or the law of the member state to which the responsible person is subject.
– Your personal data was collected for information company services offered under Art. 8 Para. 1 GDPR.

Information to third parties
If the responsible person has published your personal data and is obliged to delete it under Art. 17 Para. 1 GDPR, whilst taking into account the available technology and implementation costs, they must undertake appropriate measures, including of a technical nature, to inform the person responsible for data protection who is processing the personal data that you as the affected person have requested the deletion of all links to this personal data or copies or replications of this personal data.

Exceptions from the right to deletion
The right to deletion does not exist if the processing is necessary
– to exercise the right to express an opinion and information;
– to fulfil a legal obligation that requires the processing under the law of the Union or member state to which the responsible person is subject or to undertake a task that is in the public interest or to exercise public authority that has been transferred to the responsible person;
– in the public interest relating to public health pursuant to Art. 9 Para. 2 lit. h and i and Art. 9 Para. 3 GDPR;
– for archive purposes, scientific or historic research purposes or statistical purposes that are in the public interest under Art. 89 Para. 1 GDPR if the right stated in Section a) is expected to make the implementation of the objectives of this processing impossible or seriously adversely affect them, or
– to assert, exercise or defend legal claims.

Right to notification
If you have asserted the right to correction, deletion or restriction of processing to the person responsible, they are obliged to inform all recipients to whom your personal data was published about this correction, deletion or restriction of processing unless this is impossible or associated with disproportionate effort.
You have the right to be informed about these recipients by the person responsible.

Right to data transfer
You have the right to receive your personal data that you have provided to the person responsible in a structured, common and machine readable format. You also have the right to transfer this data to another responsible person without hindrance by the responsible person who provided the personal data if
– the processing is based on consent under Art. 6 Para. 1 lit. a GDPR or Art. 9 Para. 2 lit. a GDPR or a contract pursuant to Art, 6 Para. 1 lit. b GDPR and
– the processing takes place using automated processes.
In executing this right you also have the right to ensure that your personal data is transferred directly from one responsible person to another if this is technically feasible. This may not adversely affect the freedoms and rights of other people.
The right to transfer the data does not apply to processing personal data that is required to undertake a task that is in the public interest or to exercise public authority that has been transferred to the person responsible.

Right of objection
You have the right for reasons arising from your special situation to object to the processing of your personal data at any time as a result of Art. 6 Para. 1 lit. e or f GDPR; this also applies to profiling based on these provisions.
The responsible person no longer processes your personal data unless they can demonstrate binding reasons requiring protection for the processing that outweigh your interests, rights and freedoms or the processing is used to assert, exercise or defend legal claims.
If your personal data is processed for direct advertising purposes, you have the right to object to the processing of your personal data for such advertising purposes; this also applies to profiling if it is in connection with direct advertising.
If you object to the processing for the purposes of direct advertising, your personal data is no longer processed for these purposes.
You have the opportunity to exercise your objection right in relation to the use of the services of the information company – notwithstanding Directive 2002/58/EU – when technical specifications are used for automated processes.

Right to revoke data protection declaration of consent
You have the right to revoke your data protection consent at any time. The revocation of consent does not affect the legality of the processing that took place until your consent was revoked.

§3 Collection of personal data when visiting our website

(1) If you only use our website to obtain information, i.e. if you do not register or otherwise transfer information, we only collect the personal data that your browser transfers to our server.
If you wish to view our website, we collect the following data that is technically required for us to display our website and ensure the stability and security (the legal basis is Art. 6 Para. 1 S. 1 lit. f GDPR):
– IP address
– Date and time of the request
– Time zone difference to Greenwich Mean Time (GMT)
– Content of the request (specific page)
– Access status/HTTP status code
– Data quantity transferred
– Website from where the request came
– Browser
– Operating system and its interface
– Language and version of the browser software.

(2) The legal basis is Art. 6 Para. 1 f) GDPR.

§4 Cookies and web-beacons
The websites, advertising, emails and online services of KARO use certain technologies for automatic data collection such as cookies and web-beacons. We therefore collect data – including personal data – about you when you use our website or products or interact with us.

The user data collected help us to understand the behaviour of our users and tell us what they are searching for on the internet. They also tell us which of our websites the users have visited. Cookies are used on our websites to differentiate you from other users of our website and offer you a good user experience when navigating our website. They also provide us with information to improve our website. A cookie is a small data package that your web browser stores on your computer’s hard drive. When you visit www.KARO.com (or another KARO website) our server detects the cookie and it provides us with information on your last visit to the website. Many browsers accept cookies automatically; but you can deactivate this in your browser’s settings. If you decide not to use any cookies this may restrict the function of our website.

Web-beacons (including counting pixels, tracking pixels, pixel tags) help us to optimise the content of our website by informing us about which content is effective. A web-beacon is integrated into a website or email and aims to track the user activities on the website or email. Like a cookie, a beacon also tracks the user’s visits and sends the associated data to the server. In contrast to a cookie, a beacon can however not be used for identification and can also not save any data on your computer as it is not browser-based.
Data entered using cookies or similar technologies is not handled as personal data if the IP address (or similar means of identification) is not defined under applicable law as personal data.
The legal basis for using cookies and web-beacons is Art. 6 Para. 1 a) and f).

The data is stored for 26 months.

§5 Use of Google Analytics

(1) This website uses Google Analytics, a web analysis service by Google Inc. (Google). Google Analytics that uses so-called “cookies”, text files that are saved on your computer and enable the use of the website to be analysed. The information created by the cookie on your use of this website is transferred to and stored on a Google server in the US. However, if IP anonymization has been activated on this website, Google will first shorten your IP address within European Union Member States or in other signatory states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transferred to a Google server in the USA and abbreviated there. On behalf of the operator of this website, Google uses this information to analyse your use of the website, create reports on the website activities and provide other services associated with the website and internet use for the website operator.

(2) The IP address provided using Google Analytics is not combined with other Google data.

(3) You can prevent the installation of cookies by adjusting the relevant setting in your browser software; but in this case we expressly point out that you may not be able to use the full functions of this website. You can also prevent the recording of the data created by the cookie related to your use of the website (incl. your IP address) by Google and the processing of this data by Google by downloading and installing a browser plug-in available from the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

(4) This website uses Google Analytics with the “_anonymizeIp()” extension. This processes IP addresses in an abbreviated form to exclude reference to a particular person. If the data collected refers to you this is therefore excluded immediately and the personal data is immediately deleted.

(5) We use Google Analytics to analyse the use of our website and regularly improve it. Using the statistics gained we can improve our offer and make it more interesting for you as a user. In exceptional cases when the personal data is transferred to the USA, Google is subject to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. The legal basis for using Google Analytics is Art. 6 Para. 1 S. 1 lit. f GDPR.2

(6) Information about the third party supplier: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436?1001. User terms: http://www.google.com/analytics/terms/de.html, Overview of data protection http://www.google.com/intl/de/analytics/learn/privacy.html, and the data protection declaration: http://www.google.de/intl/de/policies/privacy.

(7) This website also uses Google Analytics for a cross-device analysis of visitor flows implemented via a user ID. You can deactivate the cross-device analysis of your use in a customer account under “My data”, “Personal data”.]

(8) The legal basis is Art. 6 Para. 1 f) GDPR.

§ 6 Communication and subscription settings

(1) You can decide which information you receive from KARO about products and services by selecting your communication settings on the Contact page along with your message or question. If you no longer want to receive marketing information and/or transactional emails from us, you can also stop these by clicking on the unsubscribe link that you find in every email or call up the contact from the KARO page in order to leave information on unsubscribing. We wish however to point out that this setting does not apply to transactional emails between KARO and the user.

(2) If you wish not to state particular personal data we may not be able to respond to your queries in full or appropriately, provide updates and/or inform you about our products and services. Via the opt-out process you can unsubscribe from certain types of emails at any time. Click on the link to unsubscribe that is found in every email or call up the KARO contact page. In all cases however we use your personal data to send you important information on products and changes to our guidelines and agreements or for other purposes permitted by law.