1. Name and Address of the Person Responsible
The person responsible within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the Member States as well as other data protection regulations is:
North Channel Bank GmbH & Co. KG
Erthalstraße 1, Bonifaziusturm B
Phone: +49 6131 6693-0
2. Name and Address of the data Protection Officer
The data protection officer of the person responsible is:
Phone: +49 69 6978-3324
3. General Remarks on Data Processing
3.1. Scope of Processing of Personal Data
As a matter of principle, we collect and use personal data solely if doing so is necessary for the provision of a functional website and our content and services. Personal data are obtained and used solely after receipt of consent. An exception to this applies in cases in which obtaining prior consent is not possible for actual reasons and statutory provisions permit processing of the data. The collection and use of personal data of our users regularly takes place only with the consent of the user. An exception applies to cases in which prior consent cannot be obtained for reasons of fact and the processing of the data is permitted by law.
3.2. Legal Basis for the Processing of Personal Data
Insofar as we obtain the consent of the data subject for activities that entail processing of personal data, Art. 6 (1) (a) of the EU General Data Protection Regulation (GDPR) serves as legal basis.
With regard to processing of personal data necessary to fulfil a contract to which the data subject is a contracting party, Art. 6 (1) (b), GDPR, serves as the legal basis. This also applies to processing activities that are necessary to implement pre-contractual measures.
If processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 (1) (c), GDPR, serves as the legal foundation.
For the event that vital interests of the affected person, or of another natural person, render processing of personal data necessary, Art. 6 (1) (d), GDPR, serves as the legal foundation.
If the processing is necessary to safeguard a justified interest that our company or a third party has, and if the data subject’s interests, basic rights and basic freedoms do not override that interest, Art. 6 (1) (f), GDPR, serves as the legal foundation for the data processing.
3.3. Data Erasure and Duration of Storage
The data subject’s personal data are erased or blocked as soon as the purpose of storing the data no longer applies. In addition, data can be stored if provision to do so is made by the European or national legislature in EU law regulations, and other law or stipulations to which the person responsible is subject. The data is blocked or erased even in instances in which a storage time limit, determined by the stated norms, expires; this is the case unless a necessity arises to continue storing the data in order to conclude a contract or to fulfil a contract.
4. Provision of the Website and Creation of Log Files
4.1. Description and Scope of Data Processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.
The following data is collected here:
(1) Information about the browser type and version used
(2) The operating system of the user
(3) Date and time of access
(4) Websites from which the user's system reaches our website.
The data is also stored in the log files of our system. Not affected hereof are the IP addresses of the user or other data, which allow for the assignment of the data to a user. Any storage of this data in combination with other personal data of the user does not occur.
4.2. Legal Basis for Data Processing
The legal basis for the temporary storage of data is Art. 6 (1) (f), GDPR.
4.3. Purpose of Data Processing
The temporary storage of the IP address by the system is necessary to allow the delivery of the website to the computer of the user. For this purpose the IP address of the user must remain stored for the duration of the session.
These purposes also constitute the basis for our legitimate interest in the data processing according to Art. 6 (1) (f), GDPR.
4.4. Duration of Storage
The data will be deleted as soon as it is no longer necessary for the purpose of its collection. In the case of collecting the data to provide the website this is the case when the respective session is over.
4.5. Option of Objection and Removal
The collection of data for the provision of the website is absolutely necessary for the operation of the website. Consequently, there can be and is no right of objection on the part of the user.
5.1. Description and Scope of Data Processing
The following anonymous data are stored and transmitted in the cookies:
1) Language settings
2) Log-in information (only as a hash value)
5.2. Legal Basis for Data Processing
The legal basis for the processing of personal data using cookies is Art. 6 (1) (f), GDPR.
5.3. Purpose of Data Processing
We require cookies for the following applications
1) Adoption of language settings
2) Remembering keywords
The user data collected by technically necessary cookies will not be used for the creation of user profiles.
5.4. Duration of Storage, Rights of Objection and Removal
6. E-Mail Contact
6.1. Description and Scope of Data Processing
Our website enables contact support via the provided e-mail address. In this case, the personal data transmitted by the e-mail of the user is saved.
In this context, there will be no disclosure of the data to third parties. The data are used exclusively for processing the conversation.
6.2. Legal Basis for Data Processing
Legal basis for the processing of the data in the course of sending an e-mail is Art. 6 (1) (f), GDPR. If the e-mail contact aims at the conclusion of a contract, the additional legal basis for the processing is Art. 6 (1) (b), GDPR.
6.3. Purpose of Data Processing
The processing of the personal data from the e-mail is solely used by us to process the contact request.
6.4. Duration of Storage
The data will be deleted as soon as it is no longer necessary for the purpose of its collection. For the personal data sent by e-mail this is the case when the conversation with the user ends. The conversation ends when it can be derived from the circumstances that the concerned facts are finally clarified.
6.5. Right of Objection and Removal
At any time, the user has the opportunity to revoke his consent to the processing of personal data. If the user contacts us by e-mail, he may object to the storage of his personal information at any time. In such a case, the conversation cannot continue.
The revocation should be directed to the responsible person (see section I).
All personal data stored in the course of contacting will be deleted in this case.
7. Rights of the Person Concerned
If your personal data is processed, you are the person affected within the meaning of the GDPR, and you have the following rights towards the person responsible:
7.1. Right of Information
You are entitled to ask the person responsible for a confirmation of whether personal data concerning you is processed by us.
If such processing is the case, you can request the following from the person responsible:
(1) The purposes for which the personal data are processed;
(2) The categories of personal data being processed;
(3) The planned duration of storage of your personal information data or, if specific information is not available, criteria for determination of the storage duration;
(4) The existence of a right of appeal to a supervisory authority;
(5) All available information on the source of the data, if the personal data is not collected from the affected person.
7.2. Right to Rectification
You have a right to rectification and / or completion in relation to the person responsible, provided that the personal data processed relating to you is incorrect or incomplete. The person responsible is obligated to perform the correction immediately.
7.3. Right to Restrict Processing
Under the following preconditions, you can request restriction of the processing of personal data relating to you:
(1) You have disputed the accuracy of your personal data for a duration, which allows the person responsible to verify the correctness of the personal data
(2) The processing is unlawful and you refuse deletion of the personal data and instead demand restriction of the use of the personal data;
(3) The person responsible longer needs the personal data for the purposes of processing, but you require those to exercise or defend legal claims, or
(4) If you objected to the processing according to Art. 21 (1), GDPR, and it has not yet been determined whether the legitimate reasons of the responsible person outweigh your reasons.
If the processing of the personal data relating to you has been restricted, these data may – with the exception of storage – only be used with your consent, or to assert, exercise or defend legal claims, or to protect the rights of another natural or legal person or for reasons of important public interest of the EU or of a Member State.
If the limitation of the processing has been restricted according to the above- mentioned preconditions, you will be informed by the person responsible before the restriction is suspended.
7.4. Right to Delete
a) Obligation to Delete
You can request from the person responsible that the personal data relating to you is deleted immediately, and the person responsible is obliged to delete this data immediately if one of the following reasons applies:
(1) The personal data relating to you are no longer necessary for the purposes for which they were collected or otherwise processed.
(2) You revoke your consent on which the processing was based according to Art. 6 (1) (a) or Art. 9 (2) (a), GDPR, and there is no other legal basis for processing.
(3) You file an objection against processing according to Art. 21 (1), GDPR, and there are no legitimate grounds for the processing, or you file an objection against processing according to Art. 21 (2), GDPR.
(4) The personal data relating to you have been processed unlawfully.
(5) The deletion of your personal data is required to fulfil a legal obligation under EU or international law of the Member States to which the person responsible is subject.
(6) The personal data relating to you were collected in relation to offered services of the information society pursuant to Art. 8 (1), GDPR.
b) Information to Third Parties
If the person in charge has publicly disclosed personal data relating to you, and he is obligated to delete them according to Art. 17 (1), GDPR, he shall take appropriate measures – taking into account both available technology and implementation costs –, including technical ones, to inform responsible persons for data processing, who process the personal data, that you as affected person have requested them to delete all links to these personal data or of copies or replications thereof.
The right to erasure does not exist if the processing is necessary
(1) To exercise the right to freedom of expression and information;
(2) To fulfil a legal obligation, which requires the processing under the law of the EU or the Member States to which the controller is subject, or to perform a task that is in the public interest or has been delegated to the responsible person in exercise of official authority;
(3) For reasons of public interest in the field of public health pursuant to Art. 9 (2) (h) and (i) and Art. 9 (3), GDPR;
(4) For public interest archiving purposes, scientific or historical research purposes or for statistical purposes according to Art. 89 (1), GDPR, insofar as the right referred to in section (a) is likely to render impossible or seriously impair the realization of the objectives of such processing, or
(5) To assert, exercise or defend legal claims.
7.5. Right to Information
If you have asserted the right to rectification, deletion or restriction of processing to the person responsible, he shall be obliged to inform all recipients to whom the personal data relating to you have been disclosed, about the correction or deletion of data or limitation of processing unless it turns out to be impossible or of disproportionate effort.
You have a right to be informed about these recipients by the person responsible.
7.6. Right to Data Transferability
You have the right to receive the personal data relating to you, which you have provided to the responsible person, in a structured, commonly used and machine-readable format. In addition, you have the right to data transferability to another responsible person without interference by the person responsible, who was provided the personal data, given that
(1) The processing is based on consent according to Art. 6 (1) (a), GDPR, or Art. 9 (2) (a), GDPR, or on a contract in accordance with Art. 6 (1) (b), GDPR, and
(2) The processing is performed by automated procedures.
In exercising this right, you also have the right to obtain that the personal data relating to you be transferred directly from one responsible person to another responsible person, insofar as this is technically feasible. Freedoms and rights of other persons may not be affected.
The right to data transferability does not apply to the processing of personal data required for the performance of a task performed in public interest or in the exercise of public authority, which was transferred to the person responsible.
7.7. Right of Objection
You have the right, for reasons that arise from your particular situation, to file an objection at any time against the processing of your personal data which is carried out on the basis of Art. 6 (1) (e) or (f), GDPR; this applies also for profiling based on these provisions.
The person responsible shall not process personal data relating to you any more, unless he can provide evidence of compelling legitimate interests for the processing that outweighs your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.
If your personal data are processed to conduct direct mailings, you have the right at any time to object to the processing of your personal data for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct mail.
If you object to processing for direct marketing purposes, the personal data relating to you will no longer be processed for these purposes.
In connection with the use of services of the information society – irrespective of the Directive 2002/58 / EC – you have the opportunity to exercise your right to object by means of automated procedures involving the use of technical specifications.
7.8. Right to Revoke the Declaration of Consent Regarding Data Protection Law
You have the right to revoke your declaration of consent regarding data protection law at any time. The legality of the processing conducted on the basis of consent until the revocation remains unaffected by the revocation of consent.
7.9. Automated Decision on an Individual Basis Including Profiling
You have the right not to be subjected solely on a decision based on automated processing – including profiling –, which takes a legal effect on you or similarly impairs you in a significant manner. This does not apply if the decision
(1) is required for the conclusion or fulfilment of a contract between you and the responsible person,
(2) Is permissible on the basis of EU or Member State legislation to which the responsible person is subject to, and this legislation comprises appropriate measures to safeguard your rights and freedoms as well as your entitled interests included or
(3) Is made with your explicit consent.
However, these decisions may not be based on specific categories of personal data pursuant to Art. 9 (1), GDPR, unless Art. 9 (2) (a) or (g) GDPR applies and appropriate measures for the protection of the rights and liberties and your legitimate interests have been taken.
With regard to the cases referred to in (1) and (3), the person responsible shall take appropriate measures to safeguard the rights and freedoms and your legitimate interests, which at least comprises the right to obtain the intervention of a person assigned by the person responsible, the statement of one’s own position and challenge of the decision itself.
7.10. Right to Complain to a Supervisory Authority
Without prejudice to any other administrative or judicial legal remedy you have the right to complain to a supervisory authority, particular in the Member State of your place of residence, employment or place of the alleged infringement, if you assert that the processing of your personal data violates the GDPR.
The supervisory authority to which the complaint has been filed shall inform the complainant on the status and results of the complaint, including the possibility of a judicial remedy pursuant to Art. 78, GDPR.