Foto Erhardt's Privacy Policy is based on the terms used by the European Directive and the General Data Protection Regulation. Our Privacy Policy should be easy to read and be understandable for the public as well as for our customers and business partners. To ensure this is the case, we would like to explain, in advance, some of the terminology used.

We use the following terms, among others, in this Privacy Policy:

1.1 Personal data

Personal data is any information relating to an identified or identifiable natural person (hereinafter "Data Subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

1.2 Data Subject

A Data Subject is any identified or identifiable natural person whose personal data is processed by Foto Erhardt, in particular, the users of Foto Erhardt's website.

1.3 Processing

Processing means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, filing, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

1.4 Profiling

Profiling is any type of automated processing of personal data that consists of using such personal data to evaluate certain personal aspects relating to a natural person, in particular, to analyse or predict aspects relating to that natural person's job performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or change of location.

1.5 Pseudonymisation

Pseudonymisation is the processing of personal data in such a way that the personal data can no longer be attributed to a specific Data Subject without the use of additional information, provided that such additional information is kept separate and is subject to technical and organisational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.

1.6 Processors

A processor is a natural or legal person, authority, institution or other body that processes personal data on behalf of Foto Erhardt.

1.7 Third party

Third party means any natural or legal person, public authority, agency or other body other than the Data Subject, Foto Erhardt, the processor and the persons authorised to process the personal data, for which Foto Erhardt or the processor are directly responsible.

1.8 Consent

Consent shall mean any freely given indication of the Data Subject's wishes for the specific case in an informed and unambiguous manner in the form of a statement or any other unambiguous affirmative act by which the Data Subject indicates that they consent to their personal data being processed.

The data controller within the meaning of the GDPR, other data protection laws applicable in the Member States of the European Union and other provisions of a data protection nature is:

Foto Erhardt GmbH
Gartenkamp 101
49492 Westerkappeln
Germany
Tel.: 05404 96330
E-mail: info@foto-erhardt.de
Website: https://www.foto-erhardt.de

The Data Protection Officer at Foto Erhardt is:

Axel Kersting
Foto Erhardt GmbH
Gartenkamp 101
49492 Westerkappeln
Germany
Tel: 05404 96330
E-mail: kersting@foto-erhardt.de
Website: https://www.foto-erhardt.de

Every user can contact our Data Protection Officer directly at any time with all questions and suggestions relating to data protection.

Each time the website is accessed, Foto Erhardt collects a series of general data and information of the accessing computer via an automated system. This general data and information is stored in the server's log files.

The following can be recorded:
Browser types and versions used
The operating system used by the accessing system
The website from which an accessing system arrives at our website ('referrer')
The sub-websites that are accessed via an accessing system on our website
The date and time the website is accessed
An Internet Protocol (IP) address
The Internet Service Provider (ISP) of the accessing system
Other similar data and information that serve to avert danger in the event of attacks on our information technology systems.

The IP address is transmitted with each server request, so that the server knows where to send the response. Every Internet user receives the IP address from their ISP, as soon as they connect to the Internet. The ISP can track which IP address was assigned to which of its customers and at what time. As long as the IP address is stored, the identity of the connection owner can theoretically be determined via the ISP.

The legal basis for the temporary storage of the data and the log files is Art. 6 para. 1 lit. f GDPR.

The processing of the data is used to deliver contents of the website, for optimising the contents of the website and for ensuring the long-term operability of the information technology systems and technology of the website. The log file data is always stored separately from other personal data. Personal data is not evaluated for marketing purposes in this context.

Therefore, the data and information collected will be used by Foto Erhardt for statistical purposes only and with the aim of improving the data protection and data security of our company, so that we can ultimately ensure an optimal level of protection for the personal data we process.

These purposes are also based on the legitimate interest of Foto Erhardt in the data processing in accordance with Art. 6 para. 1 lit. f GDPR.

The data is deleted as soon as it is no longer required for the purpose for which it was collected. In the case of data that is collected for the provision of the website, this will be as soon as the respective session has ended.

In the case of storage of data in log files, this will be after seven days at the latest.

The websites of Foto Erhardt use cookies. Cookies are text files that are placed and stored on a computer system via an Internet browser.

Many websites and servers use cookies. Many cookies contain a 'cookie ID'. A cookie ID is a unique identifier of the cookie. It consists of a string of characters by which websites and servers can be assigned to the specific Internet browser in which the cookie was stored. This allows visited websites and servers to distinguish the user's individual browser from other Internet browsers that contain other cookies. A specific Internet browser can be recognised and identified via the unique cookie ID.

Through the use of cookies, Foto Erhardt can provide the users of this website with more user-friendly services that would not be possible without the cookie setting.

The following data is stored and transmitted in the cookies:
Products added to the shopping basket
Entries made during check-out or during order placement
Preferences such as language, location, number of search results, etc.

At https://www.foto-erhardt.com/cookie-policy.html we provide information on which cookies are stored, what purpose they have, and the expiry date.

Foto Erhardt has integrated the Google Analytics component (with anonymisation function) on this website. Google Analytics is a web analysis service. Web analysis is the collection, compilation and evaluation of data about the behaviour of visitors to websites. A web analysis service collects, for example, data regarding the website from which a user has accessed a website ('referrer'), regarding which subpages of the website have been accessed or how often and for how long a subpage has been viewed. A web analysis is mainly used to optimise a website and to analyse the cost-benefit of Internet advertising.

Google Analytics sets a cookie on the user's information technology system. It has already been explained above what cookies are. Setting the cookie enables Google to analyse the use of our website. Each time one of the individual pages of this website which is operated by Foto Erhardt is accessed and on which a Google Analytics component has been integrated, the respective Google Analytics component causes the Internet browser on the user's information technology system to transmit data to Google for the purpose of online analysis. As part of this technical process, Google obtains knowledge of personal data, such as the IP address of the user, which Google uses, among other things, to track the origin of visitors and clicks and to subsequently enable commission calculations. Personal information, such as the time of access, the place from which access originated and the frequency of visits to our website by the user, is stored by means of the cookie Each time the user visits our website, this personal data, including the IP address of the Internet connection used by the user, is transmitted to Google in the United States of America. This personal data is stored by Google in the United States of America. Google may share this personal data, which was collected through the technical process, with third parties.

Foto Erhardt uses the addition "_gat._anonymizeIp" for web analysis via Google Analytics. By means of this addition, the IP address of the user's Internet connection is truncated by Google and stored anonymously, if access to our website is from a Member State of the European Union or from another Contracting State to the Agreement on the European Economic Area.

The operating company of the Google Remarketing services is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

You can find more information about Google's data protection here: http://www.google.com/intl/en/policies/privacy and https://services.google.com/sitestats/en.html. Alternatively, you can visit the Network Advertising Initiative (NAI) website at http://www.networkadvertising.org.

Transfers to non-EU countries are possible. Standard contractual clauses pursuant to Art. 46 GDPR were entered into as suitable guarantees. More information can be found here: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu_de.

The legal basis for processing personal data by Google Analytics is Art. 6 (1) lit. f GDPR. The purpose of the Google Analytics component is to analyse the flow of visitors to our website. The reasons for which Google uses the data and information obtained include to evaluate the use of our website, to compile online reports for us showing the activities on our websites, and to provide other services related to the use of our website. This is also the legitimate interest of Foto Erhardt in the data processing.

The user can prevent cookies from being set by our website, as already described above, at any time by means of an appropriate setting of the Internet browser used and thus permanently object to the setting of cookies. Such a setting of the Internet browser used would also prevent Google from setting a cookie on the user's information technology system. In addition, a cookie already set by Google Analytics can be deleted at any time via the Internet browser or other software programs.

Furthermore, users have the option of objecting to the collection of data generated by Google Analytics and related to the use of this website, as well as to the processing of this data by Google, and to prevent such processing. For this purpose, the user must download and install a browser add-on via the link https://tools.google.com/dlpage/gaoptout This browser add-on tells Google Analytics via JavaScript that no data or information about website visits may be transmitted to Google Analytics. The installation of the browser add-on is considered by Google as an objection. If the user's information technology system is deleted, formatted or reinstalled at a later time, the user must reinstall the browser add-on in order to deactivate Google Analytics. If the browser add-on is uninstalled or deactivated by the user or another person within their control, it is possible to reinstall or reactivate the browser add-on. Alternatively, users can declare their objection by setting an opt-out cookie. To do this, visit the following link:Disable Google Analytics. If the user deletes this opt-out cookie, it may be necessary to set the cookie again.

The data is deleted as soon as it is no longer required for the purpose for which it was collected. In the Google Analytics settings, Foto Erhardt has selected the option to have all pseudonymised user profiles deleted 14 months after the last activity.

Foto Erhardt has integrated Google Remarketing services on this website. Google Remarketing is a function of Google AdWords that enables a company to display advertisements to Internet users who have previously visited the company's website. The integration of Google Remarketing thus allows a company to create user-related advertising and consequently to display advertisements that may be of relevant interest to the Internet user. Google Remarketing sets a cookie on the user's information technology system. It has already been explained above what cookies are. Setting the cookie enables Google to recognise the visitor to our website when they subsequently visit websites that are also members of the Google advertising network. Each time a website is accessed on which the Google Remarketing service has been integrated, the user's Internet browser will automatically identify itself to Google. As part of this technical process, Google obtains knowledge about personal data, such as the IP address or the surfing behaviour of the user, which Google uses, for example, to display advertising that may be of relevant interest.

Personal information, such as the Internet pages visited by the user, is stored by means of the cookie. This means that each time you visit our website, personal data, including the IP address of the Internet connection used by you, is transmitted to Google in the United States of America. This personal data is stored by Google in the United States of America. Google may share this personal data, which was collected through the technical process, with third parties.

The operating company of the Google Remarketing services is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

You can find more information about Google's data protection here: http://www.google.com/intl/en/policies/privacy and https://services.google.com/sitestats/en.html. Alternatively, you can visit the Network Advertising Initiative (NAI) website at http://www.networkadvertising.org.

Transfers to non-EU countries are possible. Standard contractual clauses pursuant to Art. 46 GDPR were entered into as suitable guarantees. More information can be found here: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu_de.

The legal basis for the processing of personal data by Google Remarketing is Art. 6 (1) lit. f GDPR.

The purpose of Google Remarketing is to display advertising that is of relevant interest. Google Remarketing makes it possible to display advertisements via the Google advertising network or to have them displayed on other websites, which are tailored to the individual needs and interests of Internet users.

Google Remarketing sets a cookie on the user's information technology system. It has already been explained above what cookies are. Setting the cookie enables Google to recognise the visitor to our website when they subsequently visit websites that are also members of the Google advertising network. Each time a website is accessed on which the Google Remarketing service has been integrated, the user's Internet browser will automatically identify itself to Google. As part of this technical process, Google obtains knowledge about personal data, such as the IP address or the surfing behaviour of the user, which Google uses, for example, to display advertising that may be of relevant interest.

Personal information, such as the Internet pages visited by the user, is stored by means of the cookie. This means that each time you visit our website, personal data, including the IP address of the Internet connection used by you, is transmitted to Google in the United States of America. This personal data is stored by Google in the United States of America. Google may share this personal data, which was collected through the technical process, with third parties.

The user can prevent cookies from being set by our website, as already described above, at any time by means of an appropriate setting of the Internet browser used and thus permanently object to the setting of cookies. Such a setting of the Internet browser used would also prevent Google from setting a cookie on the user's information technology system. In addition, a cookie already set by Google Analytics can be deleted at any time via the Internet browser or other software programs.

Furthermore, users have the option to object to interest-based advertising by Google. For this purpose, the user must access the link www.google.com/settings/ads from each of the Internet browsers used by them and make the desired settings there.

The data is deleted as soon as it is no longer required for the purpose for which it was collected.

Foto Erhardt has integrated Google AdWords on this website. Google AdWords is an Internet advertising service that allows advertisers to place ads both in Google's search engine results and in the Google advertising network. Google AdWords allows an advertiser to specify certain keywords in advance, which are used to display an advert in Google's search engine results specifically when the user calls up a keyword-relevant search result using the search engine. Ads are distributed on topic-relevant websites by means of an automatic algorithm and in compliance with the previously defined keywords in the Google advertising network.

If a user accesses our website via a Google ad, a 'conversion cookie' is stored by Google on the user's information technology system. It has already been explained above what cookies are. A conversion cookie loses its validity after thirty days and is not used to identify the user. The conversion cookie is used to track whether certain subpages, such as the shopping basket of an online store system, have been accessed on our website, unless the cookie has already expired. The conversion cookie allows both Foto Erhardt and Google to track whether a user who arrived on the website via an AdWords ad generated a sale, i.e. completed or cancelled a purchase.

The data and information collected through the use of the conversion cookie is used by Google to compile visitor statistics for our website. These visitor statistics are in turn used by us to determine the total number of users who were referred to us via AdWords ads, i.e. to determine the success or failure of the respective AdWords ad and to optimise our AdWords ads for the future. Neither our company nor other advertising customers of Google AdWords shall receive information from Google that could be used to identify the users.

Personal information, such as the web pages visited by the users, is stored by means of the conversion cookie Each time the user visits our website, personal data, including the IP address of the Internet connection used by the user, is transmitted to Google in the United States of America. This personal data is stored by Google in the United States of America. Google may share this personal data, which was collected through the technical process, with third parties.

The operating company of the Google Remarketing services is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

You can find more information about Google's data protection here: http://www.google.com/intl/en/policies/privacy and https://services.google.com/sitestats/en.html. Alternatively, you can visit the Network Advertising Initiative (NAI) website at http://www.networkadvertising.org.

Transfers to non-EU countries are possible. Standard contractual clauses pursuant to Art. 46 GDPR were entered into as suitable guarantees. More information can be found here: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu_de.

The legal basis for the processing of personal data by Google AdWords is Art. 6 (1) lit. f GDPR.

The purpose of Google AdWords is to advertise the website by displaying advertisements of relevant interest on the websites of third-party companies and in the search engine results of the Google search engine and to display third-party advertisements on our website.

If a user accesses our website via a Google ad, a 'conversion cookie' is stored by Google on the user's information technology system. It has already been explained above what cookies are. A conversion cookie loses its validity after thirty days and is not used to identify the user. The conversion cookie is used to track whether certain subpages, such as the shopping basket of an online store system, have been accessed on our website, unless the cookie has already expired. The conversion cookie allows both Foto Erhardt and Google to track whether a user who arrived on the website via an AdWords ad generated a sale, i.e. completed or cancelled a purchase.

The user can prevent cookies from being set by the website, as already described above, at any time by means of an appropriate setting in the Internet browser used and thus permanently object to the setting of cookies. Such a setting of the Internet browser used would also prevent Google from setting a conversion cookie on the user's information technology system. In addition, a cookie already set by Google AdWords can be deleted at any time via the Internet browser or other software programs.

Furthermore, users have the option to object to interest-based advertising by Google. For this purpose, the user must access the link www.google.com/settings/ads from each of the Internet browsers used by them and make the desired settings there.

The data is deleted as soon as it is no longer required for the purpose for which it was collected.

Foto Erhardt has integrated the Google Tag Manager ('GTM' for short) component on this website. GTM is a tag management system that makes it possible to integrate tags centrally via a user interface. Tags are small sections of code that are used to track activities on a website. GTM offers the function of integrating script codes from other tools and enables control over when certain tags are triggered. With GTM, website operators can efficiently and flexibly manage and customise their tracking and analysis tools.

The operating company as the processing company is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

This service may transfer the collected data to another country. It should be noted that this country may not offer an adequate level of data protection. If the data is transferred to the USA, there is a risk that US authorities could process this data for monitoring and control purposes without any legal remedies being available to you. Below you will find a list of the countries to which the data may be transferred. For more information on the security guarantees, please refer to the website provider's privacy policy or contact the website provider directly.

• Singapore
• Taiwan
• Chile
• United States of America

The legal basis for the processing of personal data is Art. 6 para. 1 lit. f GDPR. The purpose of the GTM component is the integration of code sections with the help of which more comprehensive analysis tools are integrated (see also the section on Google Analytics). With the help of the aggregated data via the tag triggering, the use of our website is analysed by other services in order to compile online reports for us, which show the activities on our website, and to provide further services in connection with the use of our website. This also constitutes Foto Erhardt's legitimate interest in data processing.

The user can prevent the setting of cookies by our website, as already described above, at any time by means of a corresponding setting of the Internet browser used and thus permanently object to the setting of cookies. Such a setting of the Internet browser used would also prevent Google from placing a cookie on the user's IT system.

The data is deleted as soon as it is no longer required to fulfil the purpose for which it was collected.

Users have the option of registering on the Foto Erhardt website by providing personal data. Which personal data is transmitted to Foto Erhardt in the process is determined by the respective input mask used for registration. The personal data entered by the user is collected and stored exclusively for internal use at Foto Erhardt and for our own purposes. Foto Erhardt may arrange for the transfer of data to one or more processors, see clauses 10, 11 and 12.

The IP address assigned by the user's Internet service provider (ISP), along with the date and the time of registration are also stored when a user registers on Foto Erhardt's website Data is stored based on the premise that this is the only way to prevent the misuse of our services, and that this data makes it possible to clarify any offences that may have been committed. In this respect, this data has to be stored for the protection of Foto Erhardt. As a matter of principle, this data is not passed on to third parties unless there is a legal obligation to pass it on or it is passed on for the purpose of criminal prosecution.

The registration of the user by voluntarily providing personal data allows Foto Erhardt to offer the user contents or services which, due to the nature of the matter, can only be offered to registered users. Registered users have the option, at any time, to change the personal data provided during registration or to have it completely deleted from Foto Erhardt's database.

The legal basis for the processing of data transmitted by means of an input mask is Art. 6 (1) lit. f GDPR. If the purpose of making contact is to enter into a contract, the additional legal basis for the processing is Art. 6 (1) lit. b GDPR.

If you submit a leasing application to us, your address data, contact data, account details and item data (shopping basket with value) will be forwarded to the leasing bank ALBIS Leasing AG, Ifflandstrasse 4, 22087 Hamburg, Germany, when you submit your application.
For more information, visit https://www.albis-leasing.de/datenschutz.

We cooperate with the company ZEISS in order to handle employee sales for ZEISS employees. For this purpose, as soon as and only if you log in as a ZEISS employee, your first name, last name, address, personnel number, ZEISS business unit, product(s), order number, sales price after deduction of employee discount (gross), current Foto Erhardt Shop price, ZEISS MSRP and voucher code used will be transmitted to Carl Zeiss AG, Carl-Zeiss-Strasse 22, 73447 Oberkochen.
For more information, visit www.zeiss.co.uk/data-protection/

Upon request, Foto Erhardt will inform any user at any time which of the user's personal data is stored. Furthermore, Foto Erhardt will amend or delete personal data at the request or notice of the user, provided that this does not conflict with any legal obligations to retain data. A Data Protection Officer named in this Privacy Policy and the entire staff of Foto Erhardt are available to the user as contact persons in this context.

On the order confirmation page, our website uses a graphic pixel from Solute GmbH, Zeppelinstr. 15, 76185 Karlsruhe, Germany, for order tracking and billing purposes for customers who find us through the billiger.de site or other partners of Solute GmbH. For this purpose, Solute GmbH stores information in 'server log files', which your browser automatically transmits to Solute GmbH. These are: browser type and version, operating system used, referrer URL, host name of the accessing computer, time of server request and IP address. The server log files are automatically deleted after 30 days.
The graphic pixel generates a 'referrer URL'. From this, Solute GmbH collects and stores the store ID, order numbers and the total shopping cart value, in particular, for billing purposes with the partner store.

The data is stored and analysed based on Art. 6 para. 1 lit. f GDPR. The store operator has a legitimate interest in analysing information about orders placed in order to use the data to optimise the range of goods and to bill the services used for this purpose. The Privacy Policy can be found at https://www.solute.de/eng/privacy/ .

The data is deleted as soon as it is no longer required for the purpose for which it was collected.

We cooperate with Flixmedia in order to be able to show you video, image and text information of the respective manufacturer on our website for the products we offer. For this purpose, your IP address is sent to Flixmedia Ltd, 70-100 City Road, London, EC1V 9BR, United Kingdom, and from there media and text files are embedded in our website. The transmission of your IP address is technically necessary to display the content. When you leave our website, the data at Flixmedia is automatically deleted.

Further information can be found at http://flixmedia.eu/privacy-policy/.

We use the loadbee platform to present high-quality product information on some of our web pages. The loadbee platform is operated by loadbee GmbH, whose registered office is at Nikolaus-Otto-Str. 13, 70771 Leinfelden-Echterdingen, Germany.

When you access a web page on our website that is provided with the loadbee platform, a connection is established to the servers of loadbee to display the corresponding product information to you. loadbee collects your IP address for this communication and to determine your geo-location, as well as information about which product information provided by loadbee was displayed to you. After the product information has been played out and the geo-location has been collected, your IP address is deleted by loadbee, so that none of your personal data is stored. Your IP address will only be transferred to third parties, such as subcontractors of loadbee, if you have explicitly given your consent for this beforehand.

Further information on data processing and notes on data protection by loadbee can be found at https://company.loadbee.com/de/datenschutz.

The legal basis for the processing of data by Flixmedia and loadbee is Art. 6 para. 1 lit. f GDPR.

This website uses geolocation software developed by MaxMind (MaxMind Inc., 14 Spring Street, 3rd Floor, Waltham, MA 02451, USA) to provide you with special services (e.g. to provide you with offers from the store nearest to you). This software analyses IP addresses to determine your approximate location. You can prevent the transmission of the IP to MaxMind by opting out:Disable MaxMind Geo-Targeting

MaxMind information: https://www.maxmind.com/en/privacy_policy.

In addition, this website uses the Google Maps API, a map service provided by Google Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA ("Google"), to display an interactive map. The use of Google Maps means that information about your use of this website (including your IP address) may be transmitted to and stored by Google on servers in the United States. Google may transfer the information obtained through Analytics & Maps to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google. Nevertheless, it would be technically possible for Google to identify at least individual users on the basis of the data received. You have the possibility to deactivate the Google Maps service in a simple way and thus prevent the data transfer to Google: To do this, disable JavaScript in your browser. However, we would like to point out that in this case you will not be able to use the map display.

For more information: https://policies.google.com/privacy/update?hl=de.

The legal basis for processing data within the scope of the geolocation services is Art. 6 para. 1 lit. f GDPR.

Our online store uses the "Website Custom Audiences" pixel from Facebook, so that we can advertise via the social network. When you visit our store, a direct connection between your browser and the Facebook server is established via this pixel. If you are a Facebook user and do not delete the cookies before logging in there, Facebook can assign your visit to our website to your user account. We can only select which segments of Facebook users (such as age, interests) should be shown our ads. No data records, in particular, no e-mail addresses of our users – neither encrypted nor unencrypted – are transmitted to Facebook in the process. For more information, please see Facebook's Privacy Policy: https://www.facebook.com/about/privacy.

Please click the following link if you, as a Facebook user, do not wish to have data collected via "Custom Audiences": https://www.facebook.com/settings?tab=ads.

On Foto Erhardt's website, users are given the opportunity to subscribe to the company newsletter. The only personal data transmitted to Foto Erhardt when a user orders the newsletter is the e-mail address.

Foto Erhardt issues a newsletter at regular intervals to keep its customers and business partners informed about the company's offers. Our company's newsletter can only be received by users if they have a valid e-mail address and register to receive the newsletter. For legal reasons, the double opt-in procedure is followed by sending a confirmation e-mail to the e-mail address provided for the first time by a user when registering for the newsletter. This confirmation e-mail is used to verify that the owner of the e-mail address, as a user, has authorised receipt of the newsletter.

When a user registers for the newsletter, Foto Erhardt also stores the IP address of the computer system used by the user at the time of registration, as well as the date and time of registration, which is assigned by the Internet service provider (ISP). This data is collected in order to be able to trace the (possible) misuse of a user's e-mail address at a later date and therefore serves as legal protection for Foto Erhardt.

If you would like to receive the newsletter offered on the website, we require an e-mail address from you as well as information that allows us to verify that you are the owner of the specified e-mail address and that you agree to receive the newsletter.
We use the double opt-in procedure to ensure that the newsletter is sent out with the user’s consent. During this procedure, the potential recipient can be added to a distribution list. Subsequently, a confirmation e-mail allows the user to confirm the registration in a legally secure manner. The address will be actively added to the distribution list only if the confirmation is received.
We use this data exclusively to send the requested information and offers.
Sendinblue is used as the newsletter software. Your data will be transmitted to Sendinblue GmbH. Sendinblue is prohibited from selling your data or using it for purposes other than for sending newsletters. Sendinblue is a German certified provider, which was selected in accordance with the requirements of the General Data Protection Regulation and the Federal Data Protection Act. For more information, click here: en.sendinblue.com/information-newsletter-receivers/ .
You can withdraw your consent to your data and e-mail address being stored and used for sending the newsletter, at any time, via the "Unsubscribe" link in the newsletter, for example.
The data protection measures are always subject to technical updates. For this reason, we ask you to familiarise yourself with our data protection measures at regular intervals by consulting our Privacy Policy.

The personal data collected during registration for the newsletter will be used exclusively for sending the newsletter. Furthermore, subscribers to the newsletter will be contacted by e-mail if this is necessary for the operation of the newsletter service or a related registration, as would be the case in the event of changes to the newsletter offer or changes in technical circumstances. No personal data collected as part of the newsletter service will be passed on to third parties.

The legal basis for the processing of data after a user has registered for the newsletter is Art. 6 para. 1 lit. a GDPR if the user has given their consent.

The subscription to our newsletter can be cancelled by the user at any time. The user’s consent to the storage of personal data for the newsletter dispatch may be withdrawn at any time. A corresponding link can be found in each newsletter for the purpose of withdrawing consent. Furthermore, it is possible to unsubscribe from the newsletter at any time directly on the website or to inform Foto Erhardt in another way.

The newsletters of Foto Erhardt contain 'tracking pixels'. A tracking pixel is a thumbnail graphic that is embedded in such e-mails that are sent in HTML format to enable log file recording and log file analysis. This allows a statistical evaluation of the success or failure of online marketing campaigns. By means of the embedded tracking pixel, Foto Erhardt can see whether and when an e-mail was opened by a user, whether and why the newsletter could not be delivered, and which links in the e-mail were accessed by the user.

Such data collected via the tracking pixels contained in the newsletters is stored and evaluated by Foto Erhardt to optimise the newsletter service. This personal data will not be disclosed to third parties.

The legal basis for the processing of data after a user has registered for the newsletter is Art. 6 para. 1 lit. a GDPR if the user has given their consent.

Users are entitled at any time to withdraw the separate declaration of consent, which was submitted in this regard using the double opt-in procedure. This data will be deleted by Foto Erhardt after receipt of a withdrawal request. Foto Erhardt automatically regards unsubscribing from receiving the newsletter as a withdrawal.

Foto Erhardt has integrated Klarna components on this website. Klarna is an online payment service provider that enables purchase on account or flexible instalment payment. Furthermore, Klarna offers additional services, such as buyer protection or an identity and credit check.

Klarna's operating company is Klarna AB, Sveavägen 46, 111 34 Stockholm, Sweden.

If the user selects either "Purchase on account" or "Instalment purchase" as a payment option during the ordering process in our online store, the user's data is automatically transmitted to Klarna. By selecting one of these payment options, the user consents to the transfer of the personal data required for processing the invoice or instalment purchase or for identity and credit checks.

The personal data transmitted to Klarna is usually first name, last name, address, date of birth, gender, e-mail address, IP address, telephone number, mobile phone number and other data necessary to process an invoice or instalment purchase. Certain personal data associated with each order is also necessary for processing the purchase contract. In particular, there may be a mutual exchange of payment information, such as bank details, card number, expiry date and CVC code, number of items, item number, data on goods and services, prices and tax charges, information on previous purchasing behaviour, or other information on the user's financial situation.

The legal basis for the processing of personal data by Klarna is, after consent has been given, Art. 6 para. 1 lit. a GDPR.

The transmission of the data is aimed, in particular, at identity verification, payment administration and fraud prevention. Foto Erhardt will transfer personal data to Klarna, in particular, if there is a legitimate interest for the transfer. The personal data exchanged between Klarna and Foto Erhardt will be transmitted by Klarna to credit agencies. The purpose of this transmission is to check the user’s identity and creditworthiness.

Klarna also discloses personal data to affiliated companies (Klarna Group) and service providers or subcontractors to the extent necessary to fulfil contractual obligations or to process the data on behalf of Klarna.

In order to reach a decision regarding the establishment, execution or termination of a contractual relationship, Klarna collects and uses data and information about the user's past payment behaviour as well as probability values for their behaviour in the future ('scoring'). The scoring is calculated on the basis of scientifically recognised mathematical-statistical methods.

The user has the option to withdraw the consent for Klarna to handle their personal data, at any time. A withdrawal shall not affect personal data that has to be processed, used or transmitted for (contractual) payment processing.

Klarna's applicable Privacy Policy can be found at https://cdn.klarna.com/1.0/shared/content/policy/data/de_de/data_protection.pdf.

In case of payment via PayPal, credit card via PayPal, direct debit via PayPal or – if offered – "purchase on account" or "instalment payment" via PayPal, we pass on your payment data to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter referred to as "PayPal") as part of payment processing.

The transfer shall be made in accordance with Art. 6 para. 1 lit. b GDPR and only insofar as this is necessary for payment processing.

PayPal reserves the right to conduct a credit check for the payment methods "credit card via PayPal", "direct debit via PayPal" or, if offered, "purchase on account" or "instalment payment via PayPal". For this purpose, your payment data may be passed on to credit agencies in accordance with Art. 6 para. 1 lit. f GDPR on the basis of PayPal's legitimate interest in determining your solvency.

PayPal uses the result of the credit check, in terms of the statistical probability of non-payment, for the purpose of deciding whether to provide the respective payment method. The credit report may contain probability values ('score values'). Insofar as score values are included in the result of the credit report, they have their basis in a scientifically recognised mathematical-statistical procedure. The calculation of the score values includes, but is not limited to, address data.

The user has the option to withdraw the consent to their personal data being handled by PayPal, at any time. A withdrawal shall not affect personal data that has to be processed, used or transmitted for (contractual) payment processing.

PayPal's applicable privacy policy can be found at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

If you choose the payment method paydirekt, the payment will be processed by the payment service provider paydirekt GmbH, Hamburger Allee 26-28, 60486 Frankfurt am Main.

Your payment data (e.g. payment amount, details of the payee) and your confirmation that the payment data is correct will be collected, processed and transmitted to your bank by paydirekt GmbH for the purpose of carrying out the paydirekt payment in accordance with Art. 6 Para. 1 lit. b GDPR.

Data shall only be processed insofar as this is actually necessary to make payment. paydirekt GmbH then authenticates the payment using the authentication procedure stored for you at your bank.

Further information on the transfer and processing of your data can be found in the paydirekt data Privacy Policy, which you can view via the following link: https://www.paydirekt.de/agb/index.html

Payment via paydirekt is processed by the payment service provider BS PAYONE GmbH, Lyoner Strasse 9, 60528 Frankfurt/Main.

BS PAYONE offers business solutions for the automated and holistic handling of all payment processes in e-commerce.

The payment service provider is a company of the Savings Banks Finance Group and is licensed as a payment institution by the German Federal Financial Supervisory Authority.

BS Payone reserves the right to conduct a credit check. For details on data protection at BS Payone, please refer to the data protection information at https://www.payone.com/DE-en/data-protection-regulations.

Furthermore, we also allow you to make your payments by credit card (VISA and Mastercard). In this case, we transmit your data to our payment service provider, BS Payone GmbH, Lyoner Strasse 9, 60528 Frankfurt am Main, Germany (hereinafter referred to as BS Payone GmbH), which acts as a service provider to reconcile your payment data with the respective credit institutions (VISA or Mastercard). Your credit card will be charged via a payment form of the payment platform of BS Payone GmbH. BS PAYONE GmbH is a company of the Sparkassen-Finanzgruppe (Savings Banks Finance Group) that has more than 20 years of experience in processing cashless payments and always complies with the highest security standards. For example, the service provider has already been fully PCI-DSS certified for several years. This is the "Payment Card Industry Data Security Standard", which describes a list of binding rules for the protection of sensitive cardholder data. Companies must be able to guarantee this protection when they store, transmit or process credit card transactions.

Your credit card information is collected and processed directly by BS PAYONE and is not stored by us (Privacy Policy BS Payone GmbH).

When payment is made by credit card, the following data will be processed:
Master data
Communication data
Card type (VISA or Mastercard)
Cardholder name
Card number
Card security code
Validity period

If you have any further questions about the use of your personal data, you can contact BS Payone by e-mail (privacy@bspayone.com) or in writing (BS Payone GmbH, Lyoner Strasse 9, 60528 Frankfurt am Main, Germany).

Foto Erhardt has integrated components of Sofortüberweisung (instant bank transfer system) on this website. Sofortüberweisung is a payment service that enables cashless payment for products and services on the Internet. Sofortüberweisung represents a technical procedure through which the online merchant immediately receives a payment confirmation. This enables a merchant to deliver goods, services or downloads to the customer immediately after the order is placed.

The operating company of Sofortüberweisung is SOFORT GmbH, Fussbergstrasse 1, 82131 Gauting, Germany.

If a user selects "Sofortüberweisung" as the payment option during the ordering process in our online store, the user's data is automatically transmitted to Sofortüberweisung. By selecting this payment option, the customer agrees to the transmission of their personal data that is necessary for payment processing.

During the purchase transaction via Sofortüberweisung, the buyer transmits the PIN and the TAN to Sofort GmbH. Sofortüberweisung then carries out a transfer to the online merchant after a technical check of the account balance and retrieval of further data to check the account coverage. The online merchant is then automatically notified of the execution of the financial transaction.

The personal data exchanged with Sofortüberweisung are first name, last name, address, e-mail address, IP address, phone number, mobile phone number or other data necessary for payment processing. The purpose of transmitting the data is payment processing and fraud prevention. Foto Erhardt will also transmit other personal data to Sofortüberweisung if there is a legitimate interest for the transmission. The personal data exchanged between Sofortüberweisung and Foto Erhardt may be transmitted by Sofortüberweisung to credit agencies. The purpose of this transmission is to check the user’s identity and creditworthiness.

The legal basis for the processing of personal data by Sofortüberweisung is, after consent has been given, Art. 6 (1) lit. a GDPR.

Sofortüberweisung may pass on the personal data to affiliated companies and service providers or subcontractors, insofar as this is necessary to fulfil contractual obligations, or if the data is to be processed by a third party.

The user has the option to withdraw their consent for Sofortüberweisung to handle their data, at any time. A withdrawal shall not affect personal data that has to be processed, used or transmitted for (contractual) payment processing.

The applicable Privacy Policy of Sofortüberweisung can be found at https://www.klarna.com/sofort/datenschutz/.

Amazon Pay

The offer on our website includes the option of payment via "Amazon Pay" with the services of Amazon. The provider is Amazon Payments Europe S.C.A. 5, Rue Plaetis - 2338 Luxembourg (at R.C.S. Luxembourg registered number: B153265, Sales Tax Identification Number: LU24448288) (hereinafter "Amazon Pay").

If you choose to pay with Amazon Pay (Amazon Pay checkout solution), Amazon Pay will collect various personal data from you. The service allows users with Amazon Business Accounts or Amazon Personal Accounts to make payments to users with Merchant Accounts or Business Accounts, respectively, through an Internet or cell phone service or corresponding application (an "Application") and further allows users with Business Accounts to receive payments from users with Personal Accounts or Business Accounts. You can read details about this in the Amazon Pay privacy notice at: https://pay.amazon.co.uk/help/201751600. You can find the user agreement here: https://pay.amazon.co.uk/help/201751590

Mondu

If you order with one of the payment methods Mondu purchase on invoice, Mondu purchase with direct debit or Mondu installment payment, we assign the claim to the cooperating financial institution (Raisin Bank AG, Niedenau 61-63, 60325 Frankfurt am Main), which transfers the claim to Mondu Capital S.à r.l and to which you pay the purchase price. Mondu GmbH (Alexanderstraße 36, 10179 Berlin) (hereinafter referred to as "Mondu") enables purchase on account or in installments.

If you decide to pay via this service, we will pass on the data required for payment processing to Mondu in accordance with Art. 6 para. 1 lit. b GDPR: Your purchase details, the payment amount, company data and, if applicable, name, address, e-mail address, delivery and billing address, order data (including order details, shopping cart, order number). The data processing serves to process the selected payment method purchase on invoice, purchase with direct debit or installment payment.

In addition, Mondu collects and processes the following data during payment: Your IP address, as well as your browser and device information (e.g. the operating system), server log files, telephone number and creditworthiness data. In the further course of the purchase process, Mondu carries out an identity and credit check and determines whether the customer concerned still has outstanding invoices via Mondu invoice or installment purchase or whether a payment limit has been exceeded. These processes are beyond our control. In this context, Mondu or partner companies commissioned by Mondu may transmit your personal data to credit agencies (credit agencies), e.g. SCHUFA Holding GmbH, and may receive creditworthiness information from these agencies. For this purpose, your payment data will be passed on to credit agencies in accordance with Art. 6 para. 1 lit. f GDPR on the basis of Mondu's legitimate interest in determining your solvency and fraud prevention. Mondu uses the result of the credit check in relation to the statistical probability of non-payment for the purpose of deciding on the provision of the respective payment method.

The applicable data protection provisions of Mondu may be retrieved at https://www.mondu.ai/gdpr-notification-for-buyers/.

VOLT

When making payments with VOLT, you agree to the privacy policy of the service provider Volt Technologies Holdings Limited. You can find out more about the complete privacy policy by clicking on the following link: https://www.volt.io/legal/user-privacy/

The website of Foto Erhardt contains legally required information that enables you to make quick electronic contact with our company and communicate directly with us; this also includes a general address of 'electronic mail' (e-mail address).

If a user contacts Foto Erhardt by e-mail or via a contact form, the user's personal data that is transmitted will be stored automatically.

This always includes the following data:
E-mail address
Reason for the request

In the case of a call-back request, the following are also relevant:
Salutation
Name
Phone number.

The user can optionally specify further data.

Such personal data transmitted to Foto Erhardt by a user on a voluntary basis will be stored for the purpose of processing or contacting the user. This personal data shall not be passed on to third parties.

The legal basis for the processing of data transmitted in the course of an e-mail being sent is Art. 6 (1) lit. f GDPR.

The data is deleted as soon as it is no longer required for the purpose for which it was collected. This is the case when the respective conversation with the user has ended. The conversation is ended when the circumstances indicate that the matter in question has been conclusively clarified.

Foto Erhardt collects and processes the personal data of applicants for the purpose of handling the application process. The processing may also be carried out electronically. This is particularly the case if an applicant submits corresponding application documents to Foto Erhardt electronically, for example, by e-mail or via a web form located on the website.

The following personal data of the applicant will be processed in the course of the application process:

Name and first name, title if applicable
Date and place of birth
Nationality;
Marital status, if applicable
Address, telephone number and e-mail address
Qualification-related information, such as degrees and training certificates, academic achievements and other information contained in the curriculum vitae, such as
stays abroad and social commitment
The applicant’s photo if applicable

Insofar as your data is required to carry out the application procedure, Art. 88 GDPR in conjunction with section 26 Federal Data Protection Act new version (BDSG) forms the legal basis for the processing of your data.

If your application was successful and an employment relationship is established, we will initially store your data for the duration of the employment relationship. We store your data for a maximum of six months after you leave Foto Erhardt, for purposes of preserving evidence.

If your application is unfortunately unsuccessful, we will store your personal data for a maximum of six months after completion of the application process, for the purpose of preserving evidence, and will then delete it.

If Foto Erhardt enters into an employment contract with an applicant, the transmitted data will be stored for the purpose of handling the employment relationship in compliance with the statutory provisions. If Foto Erhardt does not enter into an employment contract with the applicant, the application documents will automatically be deleted two months after notification of the rejection decision, provided that no other legitimate interests of Foto Erhardt oppose such deletion. Other legitimate interests in this sense, for example, include a duty to provide evidence in proceedings under the General Equal Treatment Act (AGG).

Unless otherwise stated in this Privacy Policy in individual cases, the following applies with regard to the legal basis of data processing:
Article 6 I lit. a GDPR serves Foto Erhardt as the legal basis for processing operations in which Foto Erhardt obtains consent for a specific processing purpose.

If the processing of personal data is necessary to perform a contract to which the Data Subject is a party, as is the case, for example, with processing operations that are necessary for the delivery of goods or the provision of any other service or consideration, processing shall be based on Article 6 I lit. b GDPR.

The same applies to such processing operations that are necessary for the implementation of pre-contractual measures, for example, in cases of enquiries about products or services. If Foto Erhardt is subject to a legal obligation as a result of which personal data has to be processed, such as for compliance with tax obligations, processing is based on Art. 6 I lit. c GDPR.

In rare cases, it may be necessary to process personal data to protect vital interests of the Data Subject or another natural person. This would be the case, for example, if a visitor is injured on the premises and, as a result, their name, age, health insurance information or other vital information must be disclosed to a doctor, hospital or other third party. In such a case, the processing is based on Art. 6 I lit. d GDPR.

Finally, processing operations may be based on Art. 6 I lit. f GDPR. Processing operations which are not covered by any of the aforementioned legal bases are based on this legal basis, if the processing is necessary to protect a legitimate interest of Foto Erhardt or a third party, unless such interest is overridden by the interests, fundamental rights or freedoms of the Data Subject.

Foto Erhardt processes and stores users' personal data only for the period of time necessary to achieve the purpose of storage, or provided for by the European Directive and Regulation Maker or another legislator in laws or regulations to which Foto Erhardt is subject.

If the purpose of storage no longer applies, or if a storage period prescribed by the European Directive and Regulation or another competent legislator expires, the personal data will be routinely blocked or deleted in accordance with the statutory provisions.

If personal data of the user is processed, the user is a Data Subject within the meaning of GDPR, and they are entitled to the following rights vis-à-vis Foto Erhardt:

25.1 Right to confirmation
Each Data Subject shall have the right to obtain confirmation from Foto Erhardt as to whether their personal data is being processed. If a Data Subject wishes to exercise this right, they may, at any time, contact our Data Protection Officer or another employee of Foto Erhardt.

25.2 Right to information
Any person affected by the processing of personal data has the right to obtain from Foto Erhardt, at any time and free of charge, information about the personal data stored about them and to receive a copy of this information. Furthermore, the European Directive and Regulation legislator has granted the Data Subject access to the following information:
a. the reasons for processing;
b. the categories of personal data that are processed;
c. the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular in the case of recipients in third countries or international organisations;
d. if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration;
e. the existence of a right to rectification or erasure of personal data concerning them or to restriction of processing by Foto Erhardt or a right to object to such processing;
f. the existence of a right of appeal to a supervisory authority;
g. if the personal data is not collected from the Data Subject: all available information about the origin of the data;
h. the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR and, at least in these cases, meaningful information about the logic involved and the scope and intended effects of such processing for the Data Subject.
i. Furthermore, the Data Subject shall have the right to be informed whether personal data has been transferred to a non-EU country or to an international organisation. If this is the case, the Data Subject also has the right to obtain information about the appropriate safeguards in connection with the transfer.

If a Data Subject wishes to exercise this right to information, they may, at any time, contact our Data Protection Officer or another employee of Foto Erhardt.

25.3 Right to rectification
Any person affected by the processing of personal data has the right to obtain rectification, without delay, of inaccurate personal data concerning them. Furthermore, the Data Subject has the right, taking into account the purposes of the processing, to request the completion of incomplete personal data – also by means of a supplementary declaration.
Möchte eine betroffene Person dieses Berichtigungsrecht in Anspruch nehmen, kann sie sich hierzu jederzeit an unseren Datenschutzbeauftragten oder einen anderen Mitarbeiter von Foto Erhardt wenden.

25.4 Right to erasure (right to be forgotten)
Any person affected by the processing of personal data has the right to require that Foto Erhardt erase, without delay, the personal data concerning them, where one of the following reasons applies and insofar as processing is not necessary:
a. The personal data was collected or otherwise processed for purposes for which it is no longer necessary.
b. The Data Subject withdraws their consent on which the processing was based pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing.
c. The Data Subject objects to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or the Data Subject objects to the processing pursuant to Article 21(2) of GDPR.
d. The personal data has been processed unlawfully.
e. The deletion of the personal data is necessary for compliance with a legal obligation under Union or Member State law to which Foto Erhardt is subject.
f. The personal data was collected in relation to information society services offered pursuant to Art. 8 (1) GDPR.

If one of the aforementioned reasons applies, and a Data Subject wishes to arrange for personal data stored by Foto Erhardt to be deleted, they may, at any time, contact our Data Protection Officer or another employee at Foto Erhardt. The Data Protection Officer of Foto Erhardt or another employee will arrange for the deletion request to be complied with immediately.
If the personal data has been made public by Foto Erhardt, and if our enterprise as the controller is obliged to erase the personal data pursuant to Article 17 (1) of the GDPR, Foto Erhardt shall, taking into account the available technology and the cost of implementation, take reasonable steps, including those of a technical nature, to inform other data controllers who are processing the published personal data that the Data Subject has requested that these other data controllers erase all links to the personal data and erase any copies or replications of the personal data, provided that the processing is not necessary. The Data Protection Officer at Foto Erhardt or another employee will arrange for what is necessary in the individual case.

25.5 Right to restriction of processing
Any person affected by the processing of personal data has the right to request Foto Erhardt to restrict the processing if one of the following conditions is met:
a. If the accuracy of the personal data is contested by a Data Subject, the restriction may be requested for a period enabling Foto Erhardt to verify the accuracy of the personal data.
b. The processing is unlawful; the Data Subject objects to the erasure of the personal data and requests instead the restriction of the use of the personal data.
c. Foto Erhardt no longer needs the personal data for the purposes of processing, but the Data Subject needs them for the assertion, exercise or defence of legal claims.
d. The Data Subject has objected to the processing pursuant to Article 21 (1) of the GDPR and it is not yet clear whether the legitimate grounds of Foto Erhardt override those of the Data Subject.

If one of the aforementioned conditions is met, and a Data Subject wishes to request the restriction of personal data stored by Foto Erhardt, they may, at any time, contact our Data Protection Officer or another employee of Foto Erhardt. The Data Protection Officer or another employee of Foto Erhardt will arrange the restriction of the processing.

25.6 Right to data portability
Any Data Subject has the right to receive the personal data concerning them, which has been provided by the Data Subject to a controller, in a structured, commonly used and machine-readable format. The Data Subject also has the right to transfer this data to another controller without hindrance from Foto Erhardt, to whom the personal data has been supplied, provided that the processing is based on consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR or on a contract pursuant to Article 6(1)(b) GDPR and the processing is carried out with the aid of automated procedures, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Foto Erhardt.
Furthermore, when exercising the right to data portability pursuant to Article 20 (1) GDPR, the Data Subject shall have the right to have the personal data transferred directly from Foto Erhardt to another controller, where technically feasible and provided that this does not adversely affect the rights and freedoms of other individuals.
In order to assert the right to data portability, the Data Subject may at any time contact the appointed Data Protection Officer or another employee of Foto Erhardt.

25.7 Right of objection
Any Data Subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them carried out on the basis of Article 6(1)(e) or (f) GDPR. This also applies to profiling that is based on these provisions. Foto Erhardt shall no longer process the personal data in the event of such an objection, unless compelling legitimate grounds for processing can be demonstrated which override the interests, rights and freedoms of the Data Subject, or processing serves the assertion, exercise or defence of legal claims.
If Foto Erhardt processes personal data for the purpose of direct marketing, the Data Subject shall have the right to object at any time to the processing of personal data for such marketing. This also applies to profiling, insofar as it is associated with such direct advertising. If the Data Subject raises an objection with Foto Erhardt about the processing for direct marketing purposes, Foto Erhardt shall no longer process the personal data for these purposes.
In order to exercise the right to object, the Data Subject may directly contact the Data Protection Officer or another employee of Foto Erhardt. The Data Subject is also free, in connection with the use of information society services, notwithstanding Directive 2002/58/EC, to exercise their right to object by means of automated procedures using technical specifications.

25.8 Automated individual decision-making, including profiling
Any Data Subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, where the decision
(1) is not necessary for the conclusion or performance of a contract between the Data Subject and Foto Erhardt, or
(2) is permitted by legal provisions of the Union or the Member States to which Foto Erhardt is subject, and these legal provisions contain appropriate measures to safeguard the rights and freedoms as well as the legitimate interests of the Data Subject, or
(3) takes place with the express consent of the Data Subject.

If the decision (1) is necessary for entering into, or the performance of, a contract between the Data Subject and Foto Erhardt, or (2) if it is made with the explicit consent of the Data Subject, then Foto Erhardt GmbH shall implement measures to safeguard the rights and freedoms of the Data Subject, and to protect the Data Subject's legitimate interests, which include at least the right to obtain human intervention on the part of Foto Erhardt, to express an opinion on the matter, and to contest the decision.
If the Data Subject wishes to exercise rights concerning automated decision-making, they may, at any time, contact our Data Protection Officer or another employee of Foto Erhardt.

25.9 Right to withdraw consent under data protection law
Any person affected by the processing of personal data has the right, at any time, to withdraw consent to their personal data being processed.
If the Data Subject wishes to exercise the right to withdraw consent, they may, at any time, contact our Data Protection Officer or another employee of Foto Erhardt.

25.10 Right to complain to a supervisory authority
Without prejudice to any other administrative or judicial remedy, users shall have the right to lodge a complaint with a supervisory authority, in particular, in the Member State of the user's residence, place of work or place of the alleged infringement, if users consider that the processing of personal data concerning the user infringes GDPR.
The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR.

As a responsible company, we do not make use of automated decision-making or profiling.

When visiting our website, you have the option of subscribing to our push messages, which are sent by your browser (push notifications) to alert you about any news.

Consent is given in each case for the browser in which you are logged in. If you agree, you will receive push notifications from our website at regular intervals.
Clicking on the Push Notification will take you directly to the respective advertised website and/or promotion.
You have the option to unsubscribe from push notifications at any time if you no longer want them.
This is possible on our website as well as in the general browser/system settings (depending on the browser/system).

For the implementation we use the technology of the provider OneSignal, 2850 S Delaware St Suite 201, San Mateo, CA 94403, USA. The privacy information of the provider can be found here:https://onesignal.com/privacy_policy.The processing of data via OneSignal is based on the consent given according to Art. 6 para. 1 lit. a GDPR.

In order to send you the push notifications, it is necessary that non-personal data, such as a message, is transmitted to OneSignal's server.
It is necessary that a non-personal ID is assigned to uniquely assign the device, which does not allow OneSignal to draw any conclusions about the person.

You have the possibility to use chat or video chat functions by means of the tool "Acquire" via our website. This is a service provided by Acquire Inc, 1067 Market Street, Suite 3005, San Francisco, CA 94103, USA ("Acquire").

The party responsible for data processing by means of Acquire is exclusively
Brandfit Vertriebs GmbH, Kronprinzenstr. 5-7, 45128 Essen, Germany, Phone: +49 (0) 201 – 8399770
E-mail: info@brand-fit.de, representative of the responsible party: Marcus Lerche.

You can reach the Data Protection Officer of Brandfit Vertriebs GmbH as follows:
Björn Leineweber, Phone: +49 (0) 201 - 890 66 123, E-mail: leineweber@datenschutz-ruhr.de.

You can contact the aforementioned Data Protection Officer directly at any time with all questions and suggestions regarding data protection relating to the "Acquire" tool.

The required data is used to be able to establish contact and to ensure the usability of the chat and video function. This data includes the browser type and version used, the operating system used by the accessing system, the date and time the website was accessed, a truncated Internet protocol address (anonymised IP address) and the Internet service provider of the accessing system. Your data will of course be transmitted in encrypted form. If you provide additional data within the chat/video chat, you are free to decide which data to disclose. As a matter of principle, your data is processed to fulfil a contract or to implement pre-contractual measures (Art. 6(1)(b) GDPR) or based on your consent, insofar as no contractual relationship exists or is established (Art. 6(1)(a) GDPR). To some extent, the data may be used based on the legitimate interest in maintaining and improving the functionality of the "Acquire" tool (Art. 6 para.1 lit. f GDPR). Insofar as the processing of your data is necessary to conclude or perform the contract, the provision of your data is contractually required. Otherwise, the contractual services cannot be provided.

When the (video) chat tool is used, data is also sent to Acquire and stored on its servers. Acquire collects information such as chat and messaging transcripts and browsing information unless otherwise configured. Automatic information, such as the related web browser, IP address, operating system, browser types, page view statistics, and the type of device used, is also collected. The data is stored on servers in the USA. Acquire ensures compliance with the EU standard contractual clauses and thus processing in compliance with the requirements of GDPR. For more information and Acquire's privacy policy, please visit: www.acquire.io/security/ or www.acquire.io/privacy-policy/. Your data will not be stored beyond the use of the Acquire tool.

We use conversion tracking from Microsoft (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA). A cookie is set by Microsoft Bing Ads if our website is reached via a Microsoft Bing advert. In this way, Microsoft Bing and we can recognise that someone has clicked on an ad, has been redirected to our website and has reached a predetermined target page (conversion page). We only learn the total number of users who clicked on a Bing advert and were then forwarded to the conversion page. No personal information about the identity of the user is disclosed.

If you do not wish to participate in the tracking process, you can reject the setting of a cookie required for this by changing your browser settings. Further information on data protection and the cookies used can be found on the Microsoft website: https://privacy.microsoft.com/de-de/privacystatement

For the purpose of "analysis and personalisation - tracking", we work together with technology providers (as processors) where a transfer of your personal data to the USA is not excluded. We also cooperate with partners for the purpose of "(re-)marketing - data exchange with third parties", where a transfer of your personal data to the USA is not excluded. Where possible, we instruct our technology providers to process your personal data in data centres within the European Union. However, in the case of technology providers or partners who also have a branch in the USA or are based there with other companies in their group of companies, we cannot rule out the possibility of US security authorities gaining access to your personal data. This could take place, for example, via remote maintenance access or a legally binding instruction to our technology provider or partner. As a result, there is a particular risk for you that US security authorities could access your personal data without a specific reason and on a large scale and that you would not be able to take effective legal action against this in the USA.