Privacy Policy for Social Networks

Webdesign und Entwicklung

Privacy Policy for Social Networks
(valid from 01/08/2023)

We maintain online presences on various social networks and platforms. In the following, we would like to inform you about the data collected by them and by us, their purposes, the legal basis, recipients and your rights.

1. NOTE
We would like to point out that you are using our content and the interactive functions provided (e.g., commenting, sharing, rating) under your own responsibility. Alternatively, you can also find the information/products etc. offered via our social networks on our website at www.micaela-s.de. You can also contact us for more information at any time via email at mail@micaelaschaefer.de.

2. THE CONTROLLERS
The controllers within the meaning of Art. 26 of the General Data Protection Regulation and other national data protection laws of the member states, as well as other data protection regulations for our social platforms, are jointly

Mica Media GmbH
Brandenburgische Str. 55a
10707 Berlin
Email: mail@micaelaschaefer.de
Website: www.micaela-s.de

as well as the following company for the respective network named below

Facebook: Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland) . The supervisory authority is Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland, https://www.dataprotection.ie/;. Further information on data protection can be found at https://www.facebook.com/policies/cookies and https://www.facebook.com/about/privacy. Since the use of Facebook is currently extremely controversial with regard to data protection law, Facebook has added further terms of use for business tools. These can be found at https://de-de.facebook.com/terms, https://www.facebook.com/legal/terms/businesstools.

Instagram: Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland) . The supervisory authority is Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland, https://www.dataprotection.ie/; For more information on data protection, please visit https://help.instagram.com/519522125107875 and https://help.instagram.com/1896641480634370?ref=ig. Some of Facebook's business tools can also be connected to Instagram. We therefore also refer to the terms of use for business tools at https://www.facebook.com/legal/technology_terms.

YouTube: YouTube LLC, 901 Cherry Ave, San Bruno, CA 94066, USA. You Tube LLC is a subsidiary of Google LLC. The responsible party in the EU is Google Ireland Ltd, Gordon House, 4 Barrow St., Dublin, D04 E5W5, Ireland. More information on data protection at https://policies.google.com/privacy?hl=de and at https://policies.google.com/?hl=de and https://policies.google.com/technologies/product-privacy?hl=de.

TikTok: TikTok Technology Limited, 10 Earlsfort Terace, Dublin, D02 T380, Ireland. The authorised party for delivery pursuant to the State Media Treaty (MStV) and the State Media Treaty on Protecting Young Persons (JMStV) as well as the Protection of Young Persons Act (JuSchG) is Fieldfisher Plog Partnerschaft von Rechtsanwälten mbB, Am Sandtorkai 68, 20457 Hamburg. You can find further information on data protection for Germany at https://www.tiktok.com/legal/privacy-policy?lang=de and https://www.tiktok.com/legal/tiktok-website-cookies-policy?lang=de-DE.

3. GENERAL DATA COLLECTED
By visiting our website on the respective social network, your IP address and other information will be stored. Further information is obtained from the data mentioned in Section 4 that we process, as well as from the data that the respective network processes (for further information, see Section 6). The data is partly stored by cookies on your end device. Cookies are small text files which, when you visit a website, are sent from a web server to your browser and stored locally on your end device (PC, notebook, tablet, smartphone, etc.) and stored on your computer and send the user (i.e., our company) certain information. Cookies do not damage your computer and do not contain any viruses. Each cookie contains a characteristic string (called a cookie ID), which enables a unique identification of the browser when revisiting the site.

If you do not want the social network to use your data, you should log out of it or deactivate the "stay logged in" function, delete the cookies that are on your device, and quit and restart your browser. You can then visit our fan page without disclosing your own identifier. Please note, however, that you will then not be able to use any interactive functions; you will have to log in again to be able to use them.
Furthermore, you can deactivate or restrict the use of cookies by setting your browser software accordingly. However, in this case, you may not be able to access our site on the social network.

4. DATA COLLECTED BY US ON SOCIAL NETWORKS

4.1 Facebook
We have made various agreements with Facebook for protecting personal data,
• Addendum for controllers (agreement of joint responsibility pursuant to Art. 26 (1) (3) GDPR) , see https://www.facebook.com/legal/terms/page_controller_addendum.
• Data processing conditions (order processing contract pursuant to Art. 28 GDPR), available at https://www.facebook.com/legal/terms/dataprocessing.
• Facebook-EU Data Transmission Addendum (EU Controller-to-Processor Standard Contractual Clauses, i.e., transmission of responsible companies to Facebook as the order processor), available at https://www.facebook.com/legal/EU_data_transfer_addendum.

4.1.1 Page Insights
We ourselves use the respective statistical evaluations (Page Insights) that the social network makes available to us. We are currently unable to switch them off or modify them. As a result, we collect the following data:
• Statistical figures on people's actions: visits to our site (also staggered by area, age, gender, country, city, device), viewing of postings, subscription to pages, bookmarks, recommendations, comments, sharing, type of reactions, performance of postings, clicks, negative feedback such as reporting items as spam or "hiding", on conversations, on views of our shop or local interactions, on our events (ticket sales, clicks, registrations, postings by guests) or local interactions (use of links, tickets sold, people reached), on the use of the website, telephone number, route plan buttons or other buttons on our site.
• Statistical data on the actions themselves and the persons who performed the actions or on their browsers/apps used: access times (days, times of day), location (estimated using the IP address or, for logged-in users, from the user profile), language code (from the browser's http header and/or language setting); data on age/gender (from the user profile; only for logged-in users); previously visited website (from the browser's http header); use of a computer or a mobile device (from the browser's user agent or the app attributes); Facebook user ID (only for logged-in users).
• Insofar as we post events, live videos, stories or other items, the performance data will also be evaluated, i.e., the number of views or the duration of views, the number of interactions and the demographic target group.
The evaluations for the data mentioned in this paragraph are anonymised, whereas Facebook receives the data without anonymisation.
Whether someone is logged in to Facebook is determined using cookies (see cookie policy at https://www.facebook.com/policies/cookies). Most actions will not work without logging in. You can only visit a page or click on a photo/video to view it.
The legal basis for us to collect the aforementioned data for statistical purposes is Art. 89 GDPR and insofar as sensitive data is concerned, Section 27 of the Federal Data Protection Act (BDSG) in conjunction with Art. 9 (1) GDPR in conjunction with Art. 22 (2) (2) GDPR. The data is only collected anonymously by us. Facebook Ireland Ltd. takes appropriate technical and organisational measures to ensure that data is processed securely. The legal basis for this is Art. 6 (1) (f) GDPR; This applies above all to the marketing purposes pursued with Page Insights. We also have a legitimate interest in this. By anonymising the data, your rights are largely protected.
Purpose: We use the data so that we know with which postings visitors interact (or not). With the help of the results, we can build and expand our target group as well as offer interesting events, information, etc. to these target groups and optimise our content. The statistics on reach and postings tell us which postings have received the most attention; statistics on actions and postings tell us how we can motivate people to be more interactive; the call-up statistics allow us to use content to specifically address the target group.
Deletion: the statistical data is deleted after 7 days (actions on the page, page views) or after 2 months. As already mentioned, statistical data is collected without us having the choice of opting out or not. Insofar as you do not want this, you can configure it under Settings at https://www.facebook.com/settings. Furthermore, please contact the social network directly at the addresses mentioned in Section 2.

4.1.2 Interactions/messages
We collect content, communications and other information that you provide when you visit our fan page and interact with us over it; see above. As a result, we collect and process the content you communicate (hashtags, messages, etc.) and the manner of interactions. We process the content of the message as well as the point in time.
We would like to point out that – insofar as you yourself have a Facebook profile – we are also able to track your networks (groups, linked pages) and connections and view the information you have posted there (photos, postings, information, etc.) on account of your interaction. In doing so, you may also disclose sensitive data pursuant to Art. 9 GDPR. If we collect this data, we will only collect it anonymously and evaluate it without any way of tracing it back to a person. This helps us to learn more about our customer target group and to better adapt our ads/products to our customers. We use the data so that we know which postings and information you are interacting with (or are not interacting with). With the help of the results, we can build and expand our target group as well as offer interesting events, information, etc. to these target groups and optimise our content. We also see which postings have received the most attention. In addition, we would like to know which visitors view our profile and how it came about. This also helps us learn more about our customer target group and better adjust our ads/products to you.
We would like to point out that the data is not only available from us and Facebook, but also through their affiliated partners/companies as well as from all subscribers, fans, posting sharers, commentators and other persons who click on our site or browse through the pages of our subscribers, fans, posting sharers and commentators.
The legal basis for the collection of the aforementioned data is Art. 6 (1) (a) GDPR. The subscribers, fans, posting sharers and commentators consent to the collection of data by voluntarily interacting with our fan page in connection with accepting Facebook's Terms of Use.

As a rule, the data will be removed when our site is deleted or temporarily removed when deactivated. Incidentally, you can delete your connections to us by deactivating the Like buttons again. Insofar as we receive a withdrawal and can delete your data (e.g., comments on our noticeboard, application documents, etc.), we will implement the necessary steps for this. The withdrawal does not affect the lawfulness of processing your data based on your consent before a possible withdrawal. The data is stored in our Facebook statistics for a period of 26 months and then automatically deleted. This also applies to the following, unless we inform you otherwise. Alternatively, we ask you to contact the social network directly at the addresses mentioned in Section 2, because we cannot decipher which data is yours due to the extensive anonymisation of data. You can prevent your data from being collected by selecting the appropriate privacy settings on Facebook; for this, see https://www.facebook.com/settings.

You can also send us messages via the social network. In this case, the personal data transmitted with the message (name/username; profile picture) will be stored. In this case, you also agree to us contacting you via this communication channel to answer your enquiry. Such data will not be disclosed to third parties in this context. This data will be used exclusively to respond to your enquiry. The legal basis for processing the data transmitted in the course of sending a message is Art. 6 (1) (f) GDPR. The legitimate interest lies in processing your enquiry. If the purpose of the message/contact is to conclude a contract, then an additional legal basis for processing is Art. 6 (1) (b) GDPR. The data from the message is deleted when the respective conversation has ended. However, if the conversation is aimed at concluding a contract, the data will be deleted in accordance with the statutory retention periods; these are usually 10 years. A withdrawal option exists insofar as the message is not used for preparing or executing a contract. Please note that in this case, the enquiry may not be processed.

4.1.3 Use of Facebook interfaces
Insofar as we use Facebook's tools that create an interface to Facebook (e.g., using the Like button, Facebook Connect, using the Facebook API/SDK/Pixel, etc. within the scope of the shop), information is passed on to Facebook, such as your device, websites visited, purchases made, ads viewed and how you use the services – regardless of whether you have a Facebook account or are logged in. As a result, we collect and process

• the type of interactions (Like button clicks),
• information about transactions, i.e., we process data, provided that you are forwarded to our shop via our fan page.
• Information on log data if you use our Facebook login

This helps us learn more about our customer target group and better adjust our ads/products to our customers. Furthermore, this helps us measure the effectiveness and distribution of the ads and promote products as effectively as possible on several channels.
When using the interface tools, the data is not only visible to us and Facebook, but also to their affiliated partners/companies and, if necessary, to all subscribers, fans, posting sharers, commentators and other people who click on our site (e.g., Like button clicks).
The legal basis for the collection of data within the framework of the tools is, in particular, Art. 6 (1) (a) GDPR. Using the tools is voluntary. You give your consent to the collection by voluntarily activating the tools or contacting us via them in connection with accepting Facebook's Terms of Use.
You can prevent your data from being collected by, for example, making purchases directly via our website, not activating any Like buttons and, for example, not logging in or registering via Facebook Connect. You can delete your connections to us by deactivating the Like button, for example. Insofar as we receive a withdrawal and can delete your data, we will implement the necessary steps for this. The withdrawal does not affect the lawfulness of processing your data based on your consent before a possible withdrawal. Alternatively, we ask you to contact the social network directly at the addresses mentioned in Section 2.

4.1.4 Events
We also use the "Events" tool on Facebook. If you have liked our fan page, we can invite you to events. You can also like and share the events and comment on them or show interest in them.
You can participate in the event by confirming your participation directly on Facebook, where we may ask you a few questions for marketing purposes. Some events can be booked via our ticket website Eventbrite. The data collected in this context is processed by us and – for bookings via a ticket website – also by the provider of this website.
In addition, feel free to ask us any questions about the event at any time. Within the framework of our events, you can contribute with postings, insofar as we grant you permission to do so.

We collect statistics on the number of participants and the interactions associated with them.
Data processing helps us learn more about our participants and interested parties and better adjust our events for you.
The information can be accessed by the host of the event, i.e., by us, as well as by all persons on and off Facebook. Incidentally, data will only be passed on to potential co-organisers.

Insofar as you want to make a booking for the event, the legal basis for processing this is Art. 6 (1) (b) GDPR. Insofar as you interact with us within the framework of or on the basis of the events (in particular with likes, comments, recommendations, contributions, etc.), the legal basis is Art. 6 (1) (a) GDPR, whereby you give your consent with the respective interaction by implication. Insofar as you show interest in our event or ask questions about it, the legal basis for the processing of the data processed in this way is Art. 6 (1) (f) GDPR, as this allows us to better plan the event or evaluate the interest in the topic of the event, etc., in order to adjust our event marketing for it in the future. In addition, only through your enquiries can this event offer you added value. This is also our legitimate interest in data processing.

The data is stored on Facebook for a period of 2 years and then automatically deleted. Insofar as the legal basis is your consent, you can cancel it at any time. Insofar as we receive a withdrawal and can delete your data (e.g., comments on our noticeboard, application documents, etc.), we will implement the necessary steps for this. The withdrawal does not affect the lawfulness of the processing of your data based on your consent before a possible withdrawal.

4.1.5 Live Videos
We also use the "Live Videos" tool on Facebook. Insofar as you watch these videos, your data will thus be collected – and also whether you have watched the video for more than 3 seconds.
We can choose target group settings for live videos, i.e., our video reaches the target group we have set, which we can restrict based on age and location. Insofar as we do not choose these settings, the Live Videos tool will be set for everyone to use.

You can also contact us directly in Messenger during the live video.
If you are a subscriber, you can post comments on our videos. We can set this comment function so that you can only post comments if your profile is at least 2 weeks old and/or you have subscribed to our fan page for at least 15 minutes. This helps to prevent people from misusing the live comment function. Please note that the comments will be displayed as part of the live video and will be viewed and connected to you by all those watching the video.
As part of the live videos, we collect statistics on the number of viewers, the number and the content of comments, questions and shared content, the number and type of reactions (likes, etc.).

In addition, we can connect the live videos with objectives, for example, with the objective of reaching more subscribers. Insofar as we achieve this objective, all those taking part in fulfilling the objective will receive a short message from us.
Furthermore, you can take part in surveys as part of our live video. The answers you provide will then be processed by us.
Insofar as we embed a link in our videos, you can click on it. In this case, you will be redirected to another website. There, the privacy policy for that website applies.
Processing of the aforementioned data helps us find out more about our viewers and interested parties and better adjust our videos to you.

Insofar as you interact with us as part of the live videos (in particular, commenting, taking part in surveys, using the link, sharing, recommending, posting, etc.), the legal basis is for Art. 6 (1) (a) GDPR, whereby you give your consent with the respective interaction by implication. This consent is valid in connection with accepting Facebook's Terms of Use. The use of the target group settings is based on Art. 6 (1) (f) GDPR, since we only select the interested parties for whom our live video could be of potential interest and other people are not even bothered over it. This is in our interest as well as in the interest of all persons. The legal basis for processing the data transmitted in the course of sending a message is Art. 6 (1) (f) GDPR. The legitimate interest lies in processing your enquiry. The data from the message is deleted when the respective conversation has ended. In the event of an objection, please note that the enquiry may not be processed in this case.

Insofar as the legal basis is your consent, you can withdraw it at any time. Insofar as we receive a withdrawal and can delete your data (e.g., comments on our noticeboard, application documents, etc.), we will implement the necessary steps for this. The withdrawal does not affect the lawfulness of processing your data based on your consent before a possible withdrawal. You can also partially prevent your data from being collected by selecting the appropriate privacy settings on Facebook; for this, see https://www.facebook.com/settings.

4.1.6 Facebook jobs
We publish job ads on our fan page. You can apply accordingly by email and/or by post as well as via Facebook.
If you send us an application, we process the information that we receive from you as part of the application process, i.e., information from the

• Correspondence (in particular, from a possible application letter, attachments, in particular certificates, as well as your curriculum vitae)
• Photo
Insofar as you apply by email, we will also process the
• Email address
• If necessary, further information that is transmitted in the email

Insofar as you send an application via Facebook, we receive the data from the questionnaire we have added (e.g., professional experience, name, telephone number, contact details, certifications). In this case, we can ask for information on training and professional experience to be given on a mandatory basis (in particular with regard to place of employment and position, how long you have worked there with a brief description).

During an application process, we will not use information that discloses racial and ethnic origin, political opinions, religious beliefs or philosophical views, or any trade union membership, genetic data, biometric data for the precise identification of a natural person, health data or data on a person's sexual life, sexual orientation, pregnancy or family planning, age or gender. Please do not send us any such information from the start. Excluded from this is information on gender and on a possible severe disability. We require this information to implement and comply with the legal requirements for protective measures, etc. However, you are not obliged to provide us with such information on your own initiative during an application process. Insofar as you send us a photo of yourself, information on your racial or ethnic origin may be derived from it. We would like to point out that we do not allow the photos to be explicitly examined with regard to such information, biometric data or health data, but that there are sometimes indications just from viewing the image.

Your data will initially be processed exclusively for the purpose of carrying out the application procedure. If your application is successful, the data will become part of the personnel file and can be used to carry out and terminate the employment relationship. If we are unable to offer you employment at the moment, we will process your data in order to defend ourselves against any legal claims, in particular due to an alleged disadvantage during the application process. The legal basis for data processing is Art. 6 (1) (b) GDPR, insofar as processing the data can be used to decide on whether an employment relationship should or can be established or not and insofar as the data is then included in the employment relationship. If storage helps protect claims, then the legal basis is Art. 6 (1) (f) GDPR. The legitimate interest here is the receipt of evidence for possible defence. We process information and documents that are not required for the aforementioned purposes on the basis of your implied consent pursuant to Art. 6 (1) (a) GDPR, which you have given us by sending them to us.

We store the data required for a successful application and for an employment relationship until the end of the employment relationship and for a period of up to 3 years thereafter. We process the data relating to an application which we decided to reject for a period of 6 months after sending the rejection in order to safeguard our legitimate interests. Insofar as data is used within the context of a process, we store the data until the process is over. This also applies to the data received on a voluntary basis.

4.1.7 Purchase of gift vouchers
You can also purchase gift vouchers from us. We have set our ad on Facebook so that you are redirected to an external booking page.
This helps process the purchase of the vouchers. The legal basis for this is Art. 6 (1) (b) GDPR.
We are entitled to transfer your contractual data to third parties if and insofar as this is necessary to implement pre-contractual measures and fulfil this contract pursuant to Art. 6 (1) (b) GDPR, to fulfil a legal obligation within the meaning of Art. 6 (1) (c) GDPR, or to assert our legitimate interests pursuant to Art. 6 (1) (f) GDPR. Data may be transferred in particular to the following:

a) Shipping service providers for deliveries
b) Collection companies or lawyers for enforcing claims, insofar as you are in default. Here our legitimate interest lies in enforcing our legitimate claim. Due to our advance payment and your delay, our legitimate interests prevail.
c) Tax consultants.
In addition, the data is also forwarded to the external platform on the basis of the booking. We use various service providers for this. Depending on the service provider, the recipient of the data is therefore
• SumUp Payments Limited, 32 – 34 Great Marlborough St, W1F 7JB, London, UK, info@sumup.co.uk. The privacy policy can be viewed at https://sumup.co.uk/privacy/?prc=3GP119GBP-s-UKAIRBTN&fbclid=IwAR2fXZOQ57TNiB_rKRuPW7tgXIqfwoN23lsV2n9__mUm8IyWJ-aOGodTdPY
• Ecwid Inc., 687 S. Coast Highway 101, Suite 239, Encinitas, CA 92024 USA. The privacy policy can be viewed at https://www.ecwid.com/privacy-policy
• MyTreat LTD (rise.ai), Montefiore 33, 65201, Tel Aviv, info@rise.ai. The privacy policy can be viewed at https://d1wr3t1or162si.cloudfront.net/website/Privacy%20Policy.pdf
The personal data collected will be stored until the end of the statutory storage obligation for merchants (6, 8 or 10 years after the end of the calendar year in which the contractual relationship was terminated) and is then deleted. This shall not apply in exceptional cases if we are obliged to store data for a longer period due to tax or commercial storage obligations (in accordance with the German Commercial Code (HGB), the German Criminal Code (StGB) or the German Fiscal Code (AO)) or if you have consented to further storage.

4.1.8 Facebook Stories
We also use the "Stories" tool on Facebook. You can like, share and comment on these and otherwise interact with us and others over it. As a result, we collect and process the content you communicate (hashtags, messages, etc.) and the manner of interactions. We process the content of a potential message as well as the point in time. Collecting it helps us learn more about our fans and better adjust our advertising/products to them.
Only we, the authors see your comments a

nd reactions to the stories. However, we would like to point out that the data is also processed by Facebook.
The legal basis for the collection of the aforementioned data is Art. 6 (1) (a) GDPR. You consent to the collection by voluntarily interacting with our story in connection with accepting Facebook's Terms of Use.
Insofar as we receive a withdrawal and can delete your data (e.g., messages), we will implement the necessary steps for this. The withdrawal does not affect the lawfulness of processing your data based on your consent before a possible withdrawal. Incidentally, you can delete your connections to us by deactivating the Interaction buttons again.

4.1.9 Postings about offers or discounts
Insofar as we have posted offers or discounts, both Facebook and we may collect information about you if you have saved the offer or discount as interesting or acted on it (e.g., by purchase, call, message). You will then receive a notification from Facebook before the offer ends.

This data is collected, stored and, if necessary, passed on by us to the extent necessary to provide the contractual services. We use the data in particular to identify you as a customer, for processing the order, for communicating with you, for invoicing and for any necessary processing of contractual and non-contractual claims.
The legal basis for the processing of data transmitted in the course of storing the offer as well as the call or message is Art. 6 (1) (f) GDPR. The legitimate interest lies in processing your enquiry. If the purpose of the message/call is to conclude a contract, then an additional legal basis for processing is Art. 6 (1) (b) GDPR; the same applies to the additional data that we receive on the basis of your Facebook login.

We are entitled to transfer your contractual data to third parties if and insofar as this is necessary to implement pre-contractual measures and fulfil this contract pursuant to Art. 6 (1) (b) GDPR, to fulfil a legal obligation within the meaning of Art. 6 (1) (c) GDPR, or to assert our legitimate interests pursuant to Art. 6 (1) (f) GDPR. Data may be transferred in particular to the following:

a) Shipping service providers for deliveries) Collection companies or lawyers for enforcing claims, insofar as you are in default. Here our legitimate interest lies in enforcing our legitimate claim. Due to our preliminary work and your delay, our legitimate interests prevail.
c) Tax consultants.
Personal data collected will be stored until the end of the legal obligation to store it for merchants (6, 8 or 10 years after the end of the calendar year in which the contractual relationship was terminated) and then deleted. This shall not apply in exceptional cases if we are obliged to store data for a longer period due to tax or commercial storage obligations (in accordance with the German Commercial Code (HGB), the German Criminal Code (StGB) or the German Fiscal Code (AO)) or if you have consented to further storage.

4.1.10 Miscellaneous

4.1.10.1 Connection to a WhatsApp account
We can connect WhatsApp to our Facebook account. Insofar as you click on a corresponding ad or button, the message you send over it will be transferred directly to our smartphone's WhatsApp app and processed there.
In the course of these actions, you consent to us processing your personal data for communication purposes using the "WhatsApp" service of Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland). When you contact us via "WhatsApp", the following personal data transmitted with the message are stored: first name, last name, mobile phone number, profile picture if applicable, status if applicable, and the content of the messages. Insofar as you provide further information on communication channels in your message (e.g., email address, postal address), you also agree that we may contact you via this communication channel in order to answer your enquiry.

In this context, we do not directly pass on the data to third parties (as regards the transfer to the WhatsApp provider Facebook, see below).
This data will be used exclusively to respond to your enquiry. The legal basis for processing the data transmitted in the course of sending a "WhatsApp" message is your consent pursuant to Art. 6 (1) (a) GDPR. By you transmitting the data, we assume that you agree to a response via the same communication channel. If the purpose of contact via "WhatsApp" is to conclude a contract, then an additional legal basis for processing is Art. 6 (1) (1) (b) GDPR.
The data from your "WhatsApp" enquiries will of course only be used for the purpose for which you made it available to us when contacting us. Data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. For any personal data that was sent with the "WhatsApp" message, this is the case when the respective conversation with the user has been completed. The conversation is considered to have ended when it is evident from the circumstances that the matter at hand has been conclusively resolved. If the "WhatsApp" contact relates to the completion of a contract, data will be deleted after expiry of the statutory (commercial or tax) storage periods required for this. Furthermore, we delete your data and messages if you withdraw your consent to our use of WhatsApp; this deletion does not apply to data that is required for us under a contract and is subject to commercial or tax retention periods.

We would also like to inform you that through using "WhatsApp", WhatsApp Ireland Limited receives personal data (in particular communication metadata), which is also processed on servers in countries outside the EU (e.g., USA). WhatsApp shares this data with other companies within Facebook's group of companies and outside of them. For more information, consult WhatsApp's privacy policy at (https://www.whatsapp.com/legal/#privacy-policy). We have neither exact knowledge nor influence on the data processing by WhatsApp Ireland Limited. Since we have no exact knowledge on the actual processing operations by WhatsApp, and since the level of data protection in the USA is currently considered adequate, we recommend that you not use WhatsApp for communication or exchange sensitive data over it.

4.1.10.2 Call-to-Action buttons
You can enquire about appointments or book an appointment or service immediately via the button. The latter is only possible if we make this option available to you. Depending on the setting, you will receive a confirmation of the appointment booked as well as an appointment reminder. We can link things via the button. You can also request an offer over it. For an offer, however, we need some information from you in advance, which we request, including the type of service desired, time, telephone number).

Furthermore, that which is stated in Section 4.1.6 applies, whereby the same applies to booked appointments and reservations as it does to purchase enquiries.

4.1.10.3 Lead generation
With the help of an ad, we can also generate leads. For example, clicking on an ad will take you to a short questionnaire. You can use this to answer our survey or create an appointment. Via the form, we can also request for various information, e.g.,
• Contact details: email address, number, address, country
• User information: name
• Demographic data: date of birth, gender, marital status, relationship status, military service
• Business information: job title, business contact information, company name
• ID card number
If you have already filled out forms at some point, Facebook may recognise this and transfer the data to our form. This helps make it as easy as possible for you to answer the questionnaire. We would like to point out that we can connect the form or the answers to our CRM system.
The data here also helps us learn more about our fans and potential customers and better adjust our content and offers to you.
Insofar as you fill in the form, the legal basis is Art. 6 (1) (a) GDPR, whereby you give your consent when you submit the form.
You can withdraw your consent at any time. Insofar as we receive a withdrawal and can delete your data, we will implement the necessary steps for this. The withdrawal does not affect the lawfulness of the processing of your data based on your consent before a possible withdrawal.

4.2 Instagram
Instagram is an offer by Facebook. However, in order to avoid confusion, we continue to use the term Instagram below, even when we are referring to the operator.

4.2.1 Page Insights
We ourselves use the respective statistical evaluations (Page Insights) that the social network makes available to us. We are currently unable to switch them off or modify them. As a result, we collect the following data:

• Statistical figures on people's actions: accessing our profile, our website, our posting, our button clicks or the route planner, interactions with our postings and the type of interaction/reaction.
• Depending on the type of posting, interactions include bookmarks, comments, sharing or saving our content, negative feedback such as messages as spam or hidden messages, Like button clicks, leaving or clicks on next stories, clicks on links.
• Furthermore, statistical payments: reaching new subscribers through our postings, reach, average percentage of a viewed video content.

Moreover, data about our target group is collected: top locations, average age, gender, most active times, interests, etc.
In connection with Instagram, no insights are created in connection with messages within the EU.
Insofar as we post live videos, stories or other things, the performance data is also evaluated according to the aforementioned data.
The evaluations for the data mentioned in this paragraph are anonymised in each case, whereas Instagram receives the data without anonymisation. Whether someone is logged in to Instagram is determined with the use of cookies (see cookie policy at https://www.facebook.com/policies/cookies). Most actions will not work without logging in. You can only visit a page or click on a photo/video to view it.

The legal basis for us collecting the aforementioned data for statistical purposes is Art. 89 GDPR and, insofar as sensitive data is concerned, Section 27 BDSG in conjunction with Art. 9 (1) GDPR in conjunction with Art. 22 (2) (2) GDPR. The data is only collected anonymously by us. A further legal basis for the collection of the aforementioned data is Art. 6 (1) (a) GDPR. You give your consent to the collection of data by accepting the terms of use of the respective social network and the postings based on them.
Purpose: we use the data so that we know with which postings you are interacting (or not). With the help of the results, we can build and expand our target group as well as offer interesting events, information, etc. to these target groups and optimise our content. The statistics on reach and postings tell us which postings have received the most attention; statistics on actions and postings tell us how we can motivate people to be more interactive; the call-up statistics allow us to use content to specifically address the target group.

Deletion: this data is available for up to 2 years in each case. As already mentioned, statistical data is collected without us having the choice of opting out or not. Insofar as you do not want this, you can configure it under Settings at https://www.instagram.com/accounts/privacy_and_security/. Furthermore, please contact the social network directly at the addresses mentioned in Section 2.

4.2.2 Interactions/messages ("Instagram Direct")
We collect content, communications and other information that you provide when you visit our fan page and interact with us over it; see above. As a result, we collect and process the content you communicate (hashtags, messages, etc.) and the manner of interactions. We process the content of the message as well as the point in time. We would like to point out that – insofar as you yourself have an Instagram profile – we are also able to track your networks (subscriptions) and connections and to view the information you have posted there (postings, etc.) on account of your interaction. In doing so, you may also disclose sensitive data pursuant to Art. 9 GDPR.
Insofar as we do this, this also helps us learn more about our customer target group and better adjust our ads/products to you. We may mention and display your name, postings and interactions in a posting (story, etc.), for example, because your posting or interaction helps us as a review.

We would like to point out that the data is not only accessible by us and Instagram, but also by their affiliated partners/companies as well as by all subscribers, posting sharers, commentators and other persons who click on our site or browse through the pages of our subscribers, posting sharers and commentators.
The legal basis for the collection of the aforementioned data is Art. 6 (1) (a) GDPR. Subscribers, contributors and commentators consent to the collection of data by voluntarily interacting with our fan page in connection with accepting Instagram's Terms of Use.

The data will generally be removed with the deletion of our site or temporarily removed if deactivated. Incidentally, you can delete your connections to us by deactivating the Like buttons again. Insofar as we receive a withdrawal and can delete your data, we will implement the necessary steps for this. The withdrawal does not affect the lawfulness of processing your data based on your consent before a possible withdrawal. The data is stored in our Instagram statistics for a period of 24 months and then automatically deleted. This also applies to the following, unless we inform you otherwise. You can prevent your data from being collected by selecting the appropriate privacy settings on Instagram; for this, see https://www.instagram.com/accounts/privacy_and_security/.
You can also send us messages via the social network. In this case, the personal data transmitted with the message (name/username, profile picture) will be stored; if you send us videos, voice messages or images, the information transmitted in this way will also be processed by Instagram and, if necessary, by us (image, voice, etc.). In this case, you also agree to us contacting you via this communication channel to answer your enquiry. Such data will not be disclosed to third parties in this context. This data will be used exclusively to respond to your enquiry. The legal basis for processing the data transmitted in the course of sending a message is Art. 6 (1) (f) GDPR. The legitimate interest lies in processing your enquiry. If the purpose of the message/contact is to conclude a contract, then an additional legal basis for processing is Art. 6 (1) (b) GDPR. The data from the message is deleted when the respective conversation has ended. However, if the conversation is aimed at concluding a contract, the data will be deleted in accordance with the statutory retention periods; these are usually 10 years. A withdrawal option exists insofar as the message is not used for preparing or executing a contract. Please note that in this case, the enquiry may not be processed.

4.1.3 Use of Instagram interfaces
Insofar as we use Instagram's tools that create an interface to Facebook (e.g., using the Like button, using Instagram API/Pixel, etc. within the scope of the shop), information is passed on to Instagram, such as websites visited, purchases made and type of service usage – regardless of whether you have an Instagram account or are logged in there.
As a result, we collect and process

• The type of interactions (Like button),
• information about transactions, i.e., we process data, insofar as you are forwarded to our shop via our fan page

The legal basis for the collection of data within the framework of the tools is, in particular, Art. 6 (1) (a) GDPR. Using the tools is voluntary. You give your consent to the collection by voluntarily activating the tools or contacting us via them in connection with accepting Instagram's Terms of Use.
You can prevent your data from being collected by, for example, making purchases directly from our website and not activating any Like buttons. You can delete your connections to us by deactivating the Like button, for example. Insofar as we receive a withdrawal and can delete your data, we will implement the necessary steps for this. The withdrawal does not affect the lawfulness of processing your data based on your consent before a possible withdrawal. Furthermore, please contact the social network directly at the addresses mentioned in Section 2.

4.1.5 Live Videos
We also use the "Live Videos" or "Live Rooms" tool on Instagram. Insofar as you watch these videos, your data will thus be collected – and also whether you have watched the video for more than 3 seconds. In doing so, we see the number of viewers as well as whether someone has liked the video.
The live video can be used for fundraising. In this case, 100% of the proceeds will go to a non-profit organisation.
Insofar as you watch our live video, you can post comments on our videos. Please note that the comments will be displayed as part of the live video and will be viewed and connected to you by all those watching the video.
We may invite people watching the video to join the live video. Thereby, the number of possible viewers is increased first and foremost.

As part of the live videos, we collect statistics on the number of viewers, the content of comments, the number and type of reactions (likes).
Processing of the aforementioned data helps us find out more about our viewers and interested parties and better adjust our videos to you and to generate donations.
The legal basis for processing data in the context of live videos is Art. 6 (1) (f) GDPR. A legitimate interest for us is given insofar as we use the data for marketing purposes. We collect the number of viewers anonymously. Insofar as you have checked a video with the Like button, the legal basis is Art. 6 (1) (a) GDPR. Insofar as you leave a comment as part of the live videos or we invite a viewer to join and they do so, the legal basis is Art. 6 (1) (a) GDPR, whereby you give your consent with the respective interaction by implication. This consent is valid in connection with accepting Instagram's Terms of Use. The legal basis for donation campaigns is Art. 6 (1) (f) GDPR. A legitimate interest is given in the charitable purpose that we pursue with the fundraising campaign.

Please note that the data is not only accessible by us and Instagram, but also by their affiliated partners/companies and, if applicable, by all subscribers, posting sharers, commentators and others who click on our site (e.g., Like button clicks).

You can prevent your data from being collected by, for example, not leaving any comments. As a rule, the data will be removed when our account is deleted or temporarily removed when deactivated. Incidentally, you can delete your connections to us by deactivating the Interaction buttons again. Insofar as we receive a withdrawal and can delete your data (e.g., comments), we will implement the necessary steps for this. The withdrawal does not affect the lawfulness of processing your data based on your consent before a possible withdrawal. Alternatively, we ask you to contact the social network directly at the addresses mentioned in Section 2. You can also partially prevent your data from being collected by selecting the appropriate privacy settings; for this, see https://www.instagram.com/accounts/privacy_and_security/.

4.2.5 Shop
We also use the "Shop" tool on Instagram.
Via our fan page on Instagram, you will be redirected to our website https://mica-shop.de/, on which you can make purchases. For the data collected and processed there, please refer to our Privacy Policy under Website.
You can (also) send us a message (messaging) about a specific product you are interested in via our Instagram shop. In this case, we collect the following minimum information from you: name, (where applicable) company, address.
Furthermore, you can save and post articles or simply view or forward products and services placed in our shop over this.

This data is collected, stored and, if necessary, passed on by us to the extent necessary to provide the contractual services. We use the data in particular to identify you as a customer, for processing an order, for contacting you, for invoicing and for any necessary processing of contractual and non-contractual claims. Insofar as you are logged into Instagram, we ourselves receive and process your Instagram data (especially clicks, actions) and the information in your messages besides the data mentioned in Section 4.2.2. Insofar as you are not logged in, we will only receive the anonymised version from Instagram that you have viewed products and perhaps clicked on them, and which ones. The collection of the aforementioned data helps us learn more about our customer target group and better adjust our ads/products to our customers.

The legal basis for processing data which was transmitted
with the sending of a message is Art. 6 (1) (f) GDPR. The legitimate interest lies in processing your enquiry. If the purpose of the message/forwarding is to conclude a contract, then an additional legal basis for processing is Art. 6 (1) (b) GDPR; the same applies to the additional data that we receive on the basis of your Instagram login. The legal basis for the processing of the remaining data is Art. 6 (1) (f) GDPR. A legitimate interest for us is given insofar as we use the data for marketing purposes. Insofar as you bookmark, post, view or forward a product, the legal basis is Art. 6 (1) (a) GDPR.

We would like to point out that Instagram also collects data about which products you are interested in.
Personal data collected will be stored until the end of the legal obligation to store it for merchants (6, 8 or 10 years after the end of the calendar year in which the contractual relationship was terminated) and then deleted. This shall not apply in exceptional cases if we are obliged to store data for a longer period due to tax or commercial storage obligations (in accordance with the German Commercial Code (HGB), the German Criminal Code (StGB) or the German Fiscal Code (AO)) or if you have consented to further storage. Insofar as the legal basis is your consent, you may also withdraw it. The withdrawal does not affect the lawfulness of the processing of your data based on your consent before a possible withdrawal.

4.2.6 Instagram Stories
We also use the "Stories" tool on Instagram. You can like, share and comment on these and otherwise interact with us and others over it. As a result, we collect and process the content you communicate (hashtags, messages, etc.) and the manner of interactions. We process the content of a potential message as well as the point in time. Collecting it helps us learn more about our fans and better adjust our advertising/products to them.
Only we, the authors see your comments and reactions to the stories. However, we would like to point out that the data is also processed by Instagram.
We can also link our stories to a

• Questionnaire. You can take part in the questionnaire or move the emoji depending on how we have set up the questionnaire. The voting results are displayed in real time. We can also see which option received how many votes and how you voted.
• Connect with questions: you are welcome to ask us a question or send us a song, depending on what set-up we chose. We can then see who answered what; we can also share this answer anonymously.
• Connect with a quiz: you can take part in one. After taking part, we can see how you voted and which option received how many votes
• Connect with donations: when you donate something, we can see how much you donated and the total amount of all donations
• Connect with a challenge to participate in popular challenges. Here we can nominate fans to participate as well.
• Connect to a countdown: this allows you to set a reminder or share the countdown, and then receive a reminder when the countdown expires.
• Connect to a song
• Connect to a location
• Connect to a hashtag
• Connect to time/weather information
• Connect to a mention sticker. Through this, we can mention other Instagram profiles in our story.

The legal basis for the collection of the aforementioned data is Art. 6 (1) (a) GDPR. You consent to the collection by voluntarily interacting with our story in connection with accepting Instagram's Terms of Use.
Insofar as we receive a withdrawal and can delete your data (e.g., messages), we will implement the necessary steps for this. The withdrawal does not affect the lawfulness of the processing of your data based on your consent before a possible withdrawal.

4.2.7 Miscellaneous

4.2.7.1 Contact and action buttons
We can integrate contact buttons into our profile (calls as well as SMS or email buttons). If you click on it, you can contact us via the selected media.
Furthermore, we can integrate action buttons into our profile. This allows you to book or reserve something with us via a provider offered by Instagram.
The legal basis for the processing of the data transmitted in the course of sending a contact is Art. 6 (1) (f) GDPR. The legitimate interest lies in processing your enquiry. If the purpose of contact is to conclude a contract, then an additional legal basis for processing is (1) (b) GDPR.
The data from the message is deleted when the respective conversation has ended. However, if the conversation is aimed at concluding a contract, the data will be deleted in accordance with the statutory retention periods; these are usually 10 years. A withdrawal option exists insofar as the message is not used for preparing or executing a contract. Please note that in this case, the enquiry may not be processed.

4.2.7.2 Reels and guides
We use reels. These are videos with a maximum length of 30 seconds which can have additional music and/or effects. We also use guides. Guides are recommendations for places, products or postings. If you interact with us on this basis, we can see this. The legal basis for this is Art. 6 (1) (a) GDPR. In addition, that which is stated in Section 4.2.2 applies.

4.2.7.3 Branded content
We use branded content to highlight business partners. We receive compensation for this. We would like to point out that in the event of interaction with branded content, all data that we receive will also be transmitted to our business partners. We are contractually obliged to do so. Our respective business partner can be seen in an ad. The legal basis for this is Art. 6 (1) (b) GDPR. In addition, that which is stated in Section 4.2.2 applies.

4.2.7.4 Promotions
We use the possibility of promotions (Instagram ads) in order to receive more profile views, more website visitors or more messages. The ads are addressed to specific target groups with regard to location, interests, age and gender. Instagram automatically selects the target group based on people who have similar traits to our subscribers; we can (also) insert the target group. The legal basis for the collection of the aforementioned data is Art. 6 (1) (a) GDPR. You give your consent to the collection of data by accepting the terms of use of the respective social network and the postings based on them. We would like to point out that the data is not only available from us and Instagram, but also through their affiliated partners/companies. You can prevent your data from being collected by, for example, not visiting our website via Instagram and not following any links. As a rule, the data will be removed when our account is deleted or temporarily removed when deactivated. Insofar as we receive a withdrawal and can delete your data (e.g., comments, etc.), we will implement the necessary steps for this. The withdrawal does not affect the lawfulness of processing your data based on your consent before a possible withdrawal. Alternatively, we ask you to contact the social network directly at the addresses mentioned in Section 2. You can also partially prevent your data from being collected by selecting the appropriate privacy settings; for this, see https://www.instagram.com/accounts/privacy_and_security/.

4.2.7.5 Name tags
We also have the possibility of using a name tag provided by Instagram. This is a QR code. Scan it and you can follow our Instagram profile. When you scan this name tag, you transmit the same data as if you were following our profile. For further information, please see Sections 4.2.1 and 4.2.2

4.3 YouTube
We put videos on our YouTube channel. To evaluate these videos, we use the respective statistical evaluations which YouTube makes available to us. We are currently unable to switch them off or modify them. As a result, we limitedly collect the following data:

• Number of views and subscribers
• Sources of access • Interactions (playback duration, top videos)
• Information about the target group (number of viewers in general, recurring viewers, subscribers; times of the activities, playback time, age, gender, other videos/channels viewed, countries, languages)

These evaluations are anonymised in each case.
Furthermore, we collect data about our fans ("Like"/subscribers), those who are not fans ("Don't like") or people who have added comments or shared something. For this purpose, we see the name (or only the username of the account), (if available) the profile picture, the time the comment and rating were entered and, in turn, the information made publicly available by the persons, in particular about their own YouTube activities. We also learn something about the opinion or the person themselves in the comments.
If you subscribe to our channel, you will receive a not

ification from YouTube about new videos we have posted, and you will also see them in your subscription area.
Purpose: only the data tells us which measures are worthwhile on our part and whether our videos are liked by viewers. This allows us to optimise our content.

The legal basis for the collection of the aforementioned data is Art. 6 (1) (a) GDPR. Subscribers, fans, posting sharers and commentators give their consent to the collection by accepting the terms of use of the respective social network and the postings based on them.
The statistical data as well as the comments are collected and processed by us. In addition, this data is processed by the social network and its affiliated partners/companies, etc. The public comments and ratings of a video as well as subscriptions to our channel/video can be viewed not only by us and the social network as well as their affiliated partners/companies, but also by all subscribers, fans, posting sharers, commentators and other people who click on our video.

We can also allow for our videos to be played directly to our target audience based on a selected target group. However, YouTube does the allocation. In addition, we may link our videos to GoogleAds with the aim of retrieving measurement values for interactions and remarketing. The legal basis for this is Art. 6 (1) (f) GDPR, since this is the only way we can determine whether the effort from creating such a video is worth it and in order to be able to make our videos more appealing for target customers. Insofar as we connect this to GoogleAds, we have concluded the standard contractual clauses with Google, see privacy.google.com/businesses.

Statistical, anonymised data is available for 5 years in accordance with YouTube's unchangeable settings. The remaining interaction data is irrevocably removed when our site is deleted.
As previously stated, the statistical data is collected without us having the option of deselection at this time. For this reason, we cannot comply with your right to object for technical reasons. We therefore ask you to contact the social network directly at the addresses mentioned in Section 2. Furthermore, there is a way to object with regard to comments as follows: we can delete comments on request, insofar as we find their content to be against the law. Regarding further interactions (Share, Like, Do not like), we ask you to contact YouTube, as we have no influence on this either. Insofar as you do not wish to have your data collected, you can set your privacy settings accordingly at https://myaccount.google.com/privacycheckup?utm_source=pp&utm_medium=Promo-in-product&utm_campaign=pp_intro&hl=d e.

4.4. TikTok

4.4.1 Page Insights
We ourselves use the respective statistical evaluations (analyses) that the social network makes available to us. We are currently unable to switch them off or modify them. As a result, we collect the following data:

• Interactions are, depending on the type of posting, comments, likes, video views, profile views, shared items, followers and their number
• Data on followers according to gender, area, follower activity (if we have more than 100 followers)

We receive the evaluations of the data mentioned in this paragraph in each case anonymised, whereas TikTok receives the data without anonymisation. Whether someone is logged in to Instagram is determined using cookies and various other tracking instruments (see cookie policy at https://www.tiktok.com/legal/tiktok-website-cookies-policy?lang=de-DE). Most actions will not work without logging in. Then you can only watch the videos.
The legal basis for us collecting the aforementioned data for statistical purposes is Art. 89 GDPR. The data is only collected anonymously by us. A further legal basis for the collection of the aforementioned data is Art. 6 (1) (a) GDPR. You give your consent to the collection of data by accepting the terms of use of the respective social network and the postings based on them.

Purpose: we use the data so that we know with which postings you are interacting. With the help of the results, we can build and expand our target group (according to location, gender) as well as offer interesting content and optimise it for each target group. The statistics on reach and postings tell us which contributions have received the most attention.
Deletion: this data is available for up to 60 days in each case. As already mentioned, statistical data is collected without us having the choice of opting out or not. Insofar as you do not want this, you can configure this under Settings at https://www.tiktok.com/setting?lang=de-DE. Furthermore, please contact the social network directly at the addresses mentioned in Section 2.

4.4.2 Interactions/messages
We collect content, communications and other information that you provide when you visit our fan page and interact with us over it; see above. As a result, we collect and process the content you communicate (messages, etc.) and the manner of interactions (likes, comments, mentions, followers, duets, stitches). We process the content of the message as well as the point in time. We would like to point out that – if you yourself have a TikTok profile – we can view the information you have posted there (profile information, postings, videos you like, as well as other social media profiles linked to Instagram and YouTube, etc.) due to your interaction. In doing so, you may also disclose sensitive data pursuant to Art. 9 GDPR.

Insofar as we do this, this helps us learn more about our customer target group. We can mention you in a posting (story, etc.), use your videos for duets or take the videos and show them as part of our videos (stitch).
We would like to point out that the data is not only available from us and TikTok, but also through their affiliated partners/companies as well as commentators and others who click on our site.

The legal basis for the collection of the aforementioned data is Art. 6 (1) (a) GDPR. The followers, likers, mentioners, posting sharers and commentators consent to the collection of data by voluntarily interacting with our fan page in connection with accepting TikTok's Terms of Use.

As a rule, the data will be removed when our site is deleted or temporarily removed when deactivated. Incidentally, you can delete your connections to us by deactivating the Like buttons again. Insofar as we receive a withdrawal and can delete your data, we will implement the necessary steps for this. The withdrawal does not affect the lawfulness of processing your data based on your consent before a possible withdrawal. The data is stored in our TikTok statistics for up to 60 days and then automatically deleted. This also applies to the following, unless we inform you otherwise. You can prevent the collection of a lot of data by selecting the appropriate privacy settings on TikTok, see https://www.tiktok.com/setting?lang=de-DE.

Furthermore, you can send us messages via the social network. In this case, the personal data transmitted with the message (name/username, profile picture) will be stored; if you send us videos, the information transmitted in this way will also be processed by TikTok and, if necessary, by us (image, voice, etc.). In this case, you also agree to us contacting you via this communication channel to answer your enquiry. Such data will not be disclosed to third parties in this context. This data will be used exclusively to respond to your enquiry. The legal basis for processing the data transmitted in the course of sending a message is Art. 6 (1) (f) GDPR. The legitimate interest lies in processing your enquiry. If the purpose of the message/contact is to conclude a contract, then an additional legal basis for processing is Art. 6 (1) (b) GDPR. The data from the message is deleted when the respective conversation has ended. However, if the conversation is aimed at concluding a contract, the data will be deleted in accordance with the statutory retention periods; these are usually 10 years. A withdrawal option exists insofar as the message is not used for preparing or executing a contract. Please note that in this case, the enquiry may not be processed.

5. RIGHTS OF THE DATA SUBJECT VIS-À-VIS OURSELVES
In the following, we would like to draw your attention to your rights. Please note that we can unfortunately only provide limited information because we receive the data collected by social networks anonymously, i.e., we only collect anonymised data in this sense. Therefore, we cannot assign an enquiry to any individual person. However, we can detect your identity and guarantee your rights insofar as we collect your data directly, for example, on the basis of a request, a like, etc.

5.1 Rights vis-à-vis ourselves
You have the right to request information from us at any time about your personal data stored by us (Art. 15 GDPR). This also applies to the recipients or categories of recipients to whom this data is passed on and the purpose of storing it.
In addition, you have the right to request that incorrect or incomplete data be corrected under the conditions laid down in Art. 16 GDPR and/or stored data be deleted under the conditions laid down in Art. 17 GDPR. Data can only be deleted insofar as the processing is not essential to exercise your right to freedom of expression and information, to fulfil a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims.
You have the right to request the restriction of processing under the conditions laid down in Art. 18 GDPR, insofar as you dispute the accuracy of your data, the processing is illegitimate and we reject deleting it, you need the data to assert legal claims or if you have objected to its processing.

Furthermore, you can request a transfer of data at any time under the conditions laid down in Art. 20 GDPR.
If the collection of data is based on consent, you can withdraw your consent vis-à-vis us at any time. We would therefore no longer be allowed to process this data in the future.
In the case of processing personal data to perform tasks in the public interest (Art. 6 (1) (1) (e) GDPR) or to protect legitimate interests (Art. 6 (1) (1) (f) GDPR), you may object to the processing of your personal data at any time with effect for the future. In the event of an objection, we shall refrain from any further processing of your data for the aforementioned purposes, unless

• There are compelling, legitimate reasons for processing that outweigh your interests, rights and freedoms, or
• Processing is necessary for establishing, exercising or defending legal claims.
For more detailed information, please refer to the full text of the GDPR.

For all requests regarding information, enquiries for information, withdrawals or objections to data processing, please send an email to the data controller mentioned under Section 2. Furthermore, you can also file a complaint concerning the protection of your data with the responsible supervisory authority. The competent authority responsible for us is the

Berlin Commissioner for Data Protection and Freedom of Information,
Friedrichstr. 219, 10969 Berlin,
www.datenschutz-berlin.de.

In addition, we refer below to the specificities of the respective social networks:

5.2 Facebook
In accordance with the agreement between Facebook Ireland and us with regard to the processing of Insights data, Facebook Ireland is responsible for providing information on the processing of the aforementioned Page Insights if there are any enquiries. We will therefore forward your enquiry with your name and email address to Facebook Ireland Ltd., which will help us answer or deal with the enquiry.
Facebook Ireland Ltd. has also assumed primary responsibility for the processing of Insights data in accordance with Section 2 (1) and has guaranteed to fulfil all obligations regarding the processing of data, in particular the rights of data subjects. Accordingly, further rights of data subjects to correction, transferability, deletion and objection must also be asserted with Facebook Ireland Ltd. (see Section 2). The Irish Data Protection Commission has been designated as the competent body for complaints against Facebook and us regarding the processing of data for Page Insights; for this, see https://www.dataprotection.ie/. Insofar as the legal basis for data processing is Art. 6 (1) (c) or (e) GDPR, the supervisory authority mentioned in Section 5.1 is responsible for complaints.

5.3 Other networks
Moreover, the social networks have not yet taken any implementation measures, so that we can currently only advise you to assert the following rights against social networks. Insofar as it has to do with data that you provide to us, we will also implement this, insofar as it is technically possible for us.

6. PROCESSING OF DATA BY SOCIAL NETWORKS AND THE FORWARDING OF DATA

Social networks collect various information about you. Unfortunately, we cannot tell you for which purposes, to what extent, for how long, in what way and for which recipients the data is processed by the respective social network. We therefore refer to the privacy policy of the respective network regarding data and the purposes for which the data is collected, as well as the recipients of this data.
The data is therefore also passed on to partners and companies in countries outside the European Union, in particular to the USA, which, according to a ruling of the European Court of Justice, currently do not have a sufficient level of data protection.

The rights laid down in the GDPR are also available to you vis-à-vis social networks:
• You have the right to request information at any time about your stored personal data (Art. 15 GDPR). You may also request information about recipients or categories of recipients with whom this data has been shared and the purpose of the storage.
• In addition, you have the right to request corrections under the conditions of Article 16 GDPR and/or, under the conditions of Article 17 GDPR, the cancellation and/or, under the conditions of Article 18 GDPR, the restriction of processing.
• Furthermore, you can request data transmission at any time under the conditions of Art. 20 GDPR.
• For further information, please refer to the full text of the GDPR.
• In the case of processing personal data to perform tasks in the public interest (Art. 6 (1) (1) (e) GDPR) or to protect legitimate interests (Art. 6 (1) (1) (f) GDPR), you may object to the processing of your personal data at any time with effect for the future. In the event of an objection, any further processing of your data for the aforementioned purposes must be refrained from, unless there are compelling, legitimate reasons for processing which outweigh your interests, rights and freedoms, or the processing is necessary to assert, exercise or defend legal claims.

Please send all requests for information, revocations or objections to data processing by email to the address of the social network company mentioned in Section 2. Furthermore, you can also file a complaint concerning the protection of your data with the responsible supervisory authority mentioned there. If known, it is also mentioned under Section 2.

Furthermore, you can withdraw your consent to the processing of certain data on social networks by selecting the appropriate settings. For this purpose, however, we refer you to the providers:

6.1 Facebook
You can find further information on data protection at http://de-de.facebook.com/about/privacy and https://www.facebook.com/policies/cookies. However, since Facebook also stores information about the end devices of users, Facebook can assign IP addresses to individual users. In addition, Facebook can see that you have visited our site and how you used it.
The user's data is stored until the account is deleted or until it is needed to provide the services of the social network – whichever comes first. However, only content that you have set and managed yourself will be deleted, not the content that others provide about you. Insofar as data is the subject of an enquiry or a legal obligation, official investigation, etc., the data may be stored longer, but no longer than it takes to complete the matter. In order to prevent misuse, the social network also stores information about accounts that have been deactivated due to violations of the Terms of Use for at least 1 year.

Facebook is based in the USA. This means that data is also transmitted to the USA. The transferring of data there is currently critical from the judgment of the European Court of Justice. We have concluded the available agreements with Facebook (see Section 4.1). We will implement all measures in the best possible way in order to nevertheless comply with the conditions of Art. 44 GDPR and to comply with appropriate safeguards.
Settings and objections with regard to the use of data for advertising purposes are available in the profile settings at https://www.facebook.com/settings?tap=ads.

6.2 Instagram
You can find more information about data protection at https://help.instagram.com/519522125107875 and https://help.instagram.com/1896641480634370?ref=ig. Incidentally, we would like to point out the following:
According to information available to us, IP addresses are stored anonymously on Instagram. However, since Instagram also stores information about the end devices of users, Instagram can therefore assign IP addresses to individual users. In addition, Instagram can see that you have visited our site and how you used it.
Your data is stored until your account is deleted or until it is needed to provide the services of the social network – whichever comes first. However, only content that you have set and managed yourself will be deleted, not the content that others provide about you. Insofar as data is the subject of an enquiry or a legal obligation, official investigation, etc., the data may be stored longer, but no longer than it takes to complete the matter. In order to prevent misuse, the social network also stores information about accounts that have been deactivated due to violations of the Terms of Use for at least 1 year.

Instagram as part of Facebook is based in the USA. This means that data is also transmitted to the USA. The transferring of data there is currently critical from the judgment of the European Court of Justice. We will implement all measures in the best possible way in order to nevertheless comply with the conditions of Art. 44 GDPR and to comply with appropriate safeguards.
Settings and objections with regard to the use of data for advertising purposes are available in the profile settings at https://www.instagram.com/accounts/privacy_and_security/.

6.3 YouTube
You can find more information about data protection at https://policies.google.com/privacy?hl=de DSE and at https://policies.google.com/?hl=de and at https://policies.google.com/technologies/product-privacy?hl=de.
In the context of YouTube, your data is stored by Google for different periods of time, depending on which data this concerns. In this regard, we refer to Google's deletion policy at https://policies.google.com/privacy?hl=de&gl=de#infodelete.

Google is based in the USA. This means that data is also transmitted to the USA. The transferring of data there is currently critical from the judgment of the European Court of Justice. We will implement all measures in the best possible way in order to nevertheless comply with the conditions of Art. 44 GDPR and to comply with appropriate safeguards.

You can change your settings and object to the use of your data for advertising purposes in the profile settings at https://myaccount.google.com/privacycheckup?utm_source=pp&utm_medium=Promo-in-product&utm_campaign=pp_intro&hl=de.

6.4 TikTok
You can find more information about data protection at https://www.tiktok.com/legal/privacy-policy?lang=de and at https://www.tiktok.com/legal/tiktok-website-cookies-policy?lang=de and at https://www.tiktok.com/legal/law-enforcement?lang=de. If you have any questions about data protection (requesting information, reporting violations, information), you can use the form at https://www.tiktok.com/legal/report/privacy.
As part of TikTok, your data will be stored by TikTok for different periods of time, depending on which data is involved. In this regard, we refer to the deletion provisions of https://www.tiktok.com/legal/privacy-policy?lang=de.
TikTok is headquartered in China and the USA. TikTok expressly points out in its privacy policy that transfers and storage are also carried out in countries outside the EU; this applies regardless of whether TikTok Ireland is the competent establishment for the European Economic Area. The transferring of data there is currently critical from the judgment of the European Court of Justice. We will implement all measures in the best possible way in order to nevertheless comply with the conditions of Art. 44 GDPR and to comply with appropriate safeguards.
You can change your settings and object to the use of your data for advertising purposes in the profile settings at https://www.tiktok.com/setting?lang=de-DE.

7. CHANGES TO OUR PRIVACY POLICY
We reserve the right to modify our data protection practices and these terms to adapt them to changes in relevant laws and/or regulations or case law or requirements of data protection authorities, or to better meet your needs. We will notify you of possible changes to our data protection practices here. Please note the current version date of this privacy policy.