Privacy Policy
This privacy policy informs you about the nature, scope, and purpose of the processing of personal data (hereinafter referred to as "data") in the context of the provision of our services, as well as within our online offerings and the websites, functions, and content associated with it, and external online presences, such as our social media profiles (hereinafter collectively referred to as "online offerings"). With regard to the terms used, such as "processing" or "controller," we refer to the definitions in Article 4 of the General Data Protection Regulation (GDPR).
Controller
Gemeinschaftspraxis Stadtkoppel
Walter-Bötcher-Straße 11
21337 Lüneburg
Tel.: 04131 951500
Fax. 04131 951599
Email: info@chirurgen-lueneburg.de
PD Dr. med. Michael Siassi
Specialist in Surgery and Visceral Surgery
Proctology
Dr. Christian Schulze
Specialist in orthopaedics and trauma surgery
Specialist for surgery
Occupational Accident Doctor
Dr. med. Stefan Huber
Specialist for surgery
Special Trauma Surgery
Occupational Accident Doctor
Types of Processed Data
– Inventory Data (e.g., master personal data, names, or addresses).
– Contact Data (e.g., email, telephone numbers).
– Content Data (e.g., text entries, photographs, videos).
– Usage Data (e.g., visited websites, interest in content, access times).
– Meta/Communication Data (e.g., device information, IP addresses).
Categories of Data Subjects
Visitors and users of the online offering (hereinafter, we also collectively refer to the affected persons as "users").
Purpose of Processing
– Provision of the online offering, its functions, and content.
– Responding to contact inquiries and communicating with users.
– Security measures.
– Reach measurement/marketing.
Used Terminologies
"Personal data" are all information that refers to an identified or identifiable natural person (hereinafter referred to as "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie), or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
"Processing" refers to any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and includes virtually any handling of data.
"Pseudonymization" refers to the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures that ensure the personal data are not attributed to an identified or identifiable natural person.
„Profiling“ jede Art der automatisierten Verarbeitung personenbezogener Daten, die darin besteht, dass diese personenbezogenen Daten verwendet werden, um bestimmte persönliche Aspekte, die sich auf eine natürliche Person beziehen, zu bewerten, insbesondere um Aspekte bezüglich Arbeitsleistung, wirtschaftliche Lage, Gesundheit, persönliche Vorlieben, Interessen, Zuverlässigkeit, Verhalten, Aufenthaltsort oder Ortswechsel dieser natürlichen Person zu analysieren oder vorherzusagen.
The term "controller" refers to the natural or legal person, authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
"Processor" is a natural or legal person, authority, agency, or other body which processes personal data on behalf of the controller.
Relevant Legal Bases
In accordance with Article 13 of the GDPR, we inform you of the legal bases of our data processing activities. For users within the scope of the General Data Protection Regulation (GDPR), i.e., the EU and the EEA, the following applies if the legal basis is not mentioned in the privacy policy:
The legal basis for obtaining consents is Art. 6(1)(a) and Art. 7 GDPR.
The legal basis for processing for the performance of our services, execution of contractual measures, and responding to inquiries is Art. 6(1)(b) GDPR.
The legal basis for processing to fulfill our legal obligations is Art. 6(1)(c) GDPR;
In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6(1)(d) GDPR serves as the legal basis.
The legal basis for the necessary processing for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller is Art. 6(1)(e) GDPR.
The legal basis for processing to protect our legitimate interests is Art. 6(1)(f) GDPR.
The processing of data for purposes other than those for which it was collected is governed by the provisions of Art. 6(4) GDPR.
The processing of special categories of data (as per Art. 9(1) GDPR) is governed by the provisions of Art. 9(2) GDPR.
Security measures
In accordance with legal requirements, taking into account the state of the art, the costs of implementation, and the nature, scope, circumstances, and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
The measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical access to the data, as well as access to, entry of, transmission, availability, and separation of the data. Furthermore, we have established procedures that ensure the exercise of data subject rights, deletion of data, and response to data compromise. Additionally, we take into account the protection of personal data in the development or selection of hardware, software, and procedures, in accordance with the principle of privacy by design and privacy by default.
Collaboration with Processors, Joint Controllers, and Third Parties
Whenever we disclose data to other individuals and companies (processors, joint controllers, or third parties) in the context of our processing, transmit data to them, or otherwise grant them access to the data, this is only done on the basis of a legal permission (e.g., if a transfer of data to third parties, such as payment service providers, is necessary for contract performance), if users have consented, a legal obligation requires it, or based on our legitimate interests (e.g., when using agents, web hosts, etc.).
Whenever we disclose data to other companies within our corporate group, transmit it to them, or otherwise grant them access, this is particularly done for administrative purposes as a legitimate interest and, beyond that, based on a legal foundation that complies with statutory requirements.
Transfers to Third Countries
Whenever we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA), or the Swiss Confederation) or this occurs in the context of using third-party services or the disclosure or transmission of data to other persons or companies, it is done only if it is necessary to fulfill our (pre)contractual obligations, based on your consent, due to a legal obligation, or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or allow data to be processed in a third country only if the legal requirements are met. This means, for example, that processing is carried out on the basis of special guarantees, such as the officially recognized determination of a data protection level equivalent to that of the EU (e.g., for the USA through the "Privacy Shield") or compliance with officially recognized specific contractual obligations.
Rights of Data Subjects
You have the right to request confirmation as to whether relevant data is being processed, and to access this data as well as additional information and a copy of the data in accordance with legal requirements.
In accordance with legal requirements, you have the right to request the completion of data concerning you or the correction of incorrect data concerning you.
In accordance with legal requirements, you have the right to demand that relevant data be deleted immediately, or alternatively, to request a restriction of the processing of the data in accordance with legal requirements.
You have the right, in accordance with legal requirements, to receive the data concerning you that you have provided to us and to request their transmission to other controllers.
Furthermore, in accordance with legal requirements, you have the right to lodge a complaint with the competent supervisory authority.
Right of Withdrawal
You have the right to withdraw consents previously given, effective for the future.
Right to Object
You may object at any time to the future processing of data concerning you in accordance with legal requirements. The objection can be made in particular against processing for direct marketing purposes.
Cookies and Right to Object in Direct Marketing
Cookies are small files stored on users' computers. They can hold a variety of information. Primarily, a cookie is used to store information about a user (or the device on which the cookie is stored) during or after their visit to an online service. Temporary cookies, also known as "session cookies" or "transient cookies," are deleted once a user leaves an online service and closes their browser. These cookies can store information such as the contents of a shopping cart in an online store or a login status. Cookies described as "permanent" or "persistent" remain stored even after the browser is closed. For example, the login status can be retained when users visit after several days. Such cookies can also store user interests used for reach measurement or marketing purposes. "Third-party cookies" are those provided by vendors other than the operator of the online service (otherwise, if they are only the operator’s cookies, they are called "first-party cookies").
We may use temporary and permanent cookies, and we provide information about this in our privacy policy.
If users do not want cookies to be stored on their computer, they are asked to disable the corresponding option in their browser's system settings. Stored cookies can be deleted in the browser's system settings. Excluding cookies may lead to functional limitations of this online service.
A general objection to the use of cookies for online marketing purposes can be made on a number of services, particularly in the case of tracking, through the U.S. website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/ Additionally, the storage of cookies can be prevented by turning them off in the browser settings. Please note that if you do this, you may not be able to use all the features of this online service.
Data Deletion
The data processed by us are deleted in accordance with legal requirements or their processing is restricted. Unless expressly stated within this privacy policy, the data stored by us are deleted as soon as they are no longer required for their intended purpose and the deletion does not conflict with any statutory retention obligations.
If the data are not deleted because they are required for other legally permissible purposes, their processing is restricted. This means the data are locked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.
Changes and Updates to the Privacy Policy
We ask you to regularly inform yourself about the contents of our privacy policy. We adjust the privacy policy as soon as changes in the data processing we carry out make it necessary. We will inform you as soon as the changes require an action on your part (e.g., consent) or another individual notification is necessary.
Agency Services
We process our clients' data as part of our contractual services, which include conceptual and strategic consulting, campaign planning, software and design development/consulting or maintenance, implementation of campaigns and processes/handling, server administration, data analysis/consulting services, and training services.
In the course of providing our services, we process inventory data (e.g., customer master data such as names or addresses), contact data (e.g., email, telephone numbers), content data (e.g., text entries, photographs, videos), contract data (e.g., subject matter of the contract, duration), payment data (e.g., bank details, payment history), and usage and metadata (e.g., for the evaluation and success measurement of marketing measures). We generally do not process special categories of personal data unless they are part of a commissioned processing. The data subjects include our clients, prospects, their clients, users, website visitors, employees, and third parties. The purpose of processing is to provide contractual services, billing, and customer service. The legal bases for processing derive from Art. 6(1)(b) GDPR (contractual services) and Art. 6(1)(f) GDPR (analysis, statistics, optimization, security measures). We process data necessary for the establishment and fulfillment of contractual services and indicate the necessity of their provision. Disclosure to external parties occurs only when necessary within the context of a contract. In processing data entrusted to us within the scope of an assignment, we act in accordance with the instructions of our clients and the legal requirements of order processing according to Art. 28 GDPR, processing the data solely for the purposes specified in the contract.
We delete the data after the expiration of statutory warranty and similar obligations. The necessity of retaining the data is reviewed every three years; in the case of statutory archiving obligations, deletion occurs after their expiration (6 years according to § 257 para. 1 HGB, 10 years according to § 147 para. 1 AO). In the case of data disclosed to us by the client within the framework of a contract, we delete the data according to the specifications of the contract, generally after the end of the contract.
Contact Initiation
When contacting us (e.g., via contact form, email, telephone, or through social media), user information is processed for handling and responding to the contact request according to Art. 6(1)(b) GDPR (in the context of contractual/pre-contractual relationships) and Art. 6(1)(f) GDPR (other inquiries). User information may be stored in a Customer Relationship Management system ("CRM system") or similar request organization.
We delete inquiries once they are no longer necessary. We review the necessity every two years; furthermore, statutory archiving obligations apply.
Google Analytics
Based on our legitimate interests (i.e., interest in the analysis, optimization, and economic operation of our online service in accordance with Art. 6(1)(f) GDPR), we use Google Analytics, a web analytics service provided by Google LLC ("Google"). Google uses cookies. The information generated by the cookie about users' use of the online service is typically transmitted to and stored on a server in the USA by Google.
Google is certified under the Privacy Shield Agreement, which provides a guarantee to comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
Google will use this information on our behalf to evaluate users' use of our online offering, compile reports on activities within this online offering, and provide other services related to the use of this online offering and the internet to us. Pseudonymous user profiles can be created from the processed data.
Wir setzen Google Analytics nur mit aktivierter IP-Anonymisierung ein. Das bedeutet, die IP-Adresse der Nutzer wird von Google innerhalb von Mitgliedstaaten der Europäischen Union oder in anderen Vertragsstaaten des Abkommens über den Europäischen Wirtschaftsraum gekürzt. Nur in Ausnahmefällen wird die volle IP-Adresse an einen Server von Google in den USA übertragen und dort gekürzt.
Die von dem Browser des Nutzers übermittelte IP-Adresse wird nicht mit anderen Daten von Google zusammengeführt. Die Nutzer können die Speicherung der Cookies durch eine entsprechende Einstellung ihrer Browser-Software verhindern; die Nutzer können darüber hinaus die Erfassung der durch das Cookie erzeugten und auf ihre Nutzung des Onlineangebotes bezogenen Daten an Google sowie die Verarbeitung dieser Daten durch Google verhindern, indem sie das unter folgendem Link verfügbare Browser-Plugin herunterladen und installieren: http://tools.google.com/dlpage/gaoptout?hl=de.
For more information on how Google uses data, as well as settings and options to object, please refer to Google's privacy policy (https://policies.google.com/privacy) and the settings for displaying advertisements by Google (https://adssettings.google.com/authenticated).
The personal data of users is deleted or anonymized after 14 months.
Online Presence in Social Media
We maintain online presences within social networks and platforms to communicate with active customers, prospects, and users there and to inform them about our services.
We note that user data may be processed outside the European Union, which can pose risks because, for example, it could make it more difficult to enforce users' rights. Regarding US providers certified under the Privacy Shield, we point out that they are committed to complying with EU data protection standards.
Furthermore, user data is typically processed for market research and advertising purposes. For example, usage profiles can be created based on users' behavior and resulting interests. These usage profiles can then be used to place advertisements both within and outside the platforms that are likely to match the users' interests. For these purposes, cookies are usually stored on the users' computers, which record the users' behavior and interests. Additionally, data can be stored in the usage profiles independent of the devices used by the users, especially if the users are members of the respective platforms and are logged into them.
The processing of users' personal data is based on our legitimate interests in effectively informing and communicating with users according to Art. 6(1)(f) GDPR. If users are asked by the respective platform providers for consent to the data processing described above, the legal basis for processing is Art. 6(1)(a), Art. 7 GDPR.
For a detailed description of the respective processing activities and the options for objection (opt-out), we refer to the information provided by the providers linked below.
We also point out that requests for information and the assertion of user rights are most effectively made directly to the providers. Only the providers have access to the users' data and can take appropriate measures and provide information directly. Should you still require assistance, you are welcome to contact us.
– Facebook, - pages and, groups (operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) are managed based on a agreement on joint processing of personal data. – Privacy Policy: https://www.facebook.com/about/privacy/, specifically for pages: https://www.facebook.com/legal/terms/information_about_page_insights_data , Opt-Out: https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active.
– Google/ YouTube (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) – Privacy policy: https://policies.google.com/privacy, Opt-Out: https://adssettings.google.com/authenticated, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active.
– Instagram (Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA) – Datenschutzerklärung/ Opt-Out: http://instagram.com/about/legal/privacy/.
– Twitter (Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA) – Datenschutzerklärung: https://twitter.com/de/privacy, Opt-Out: https://twitter.com/personalization, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000TORzAAO&status=Active.
– Pinterest (Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA) – Datenschutzerklärung/ Opt-Out: https://about.pinterest.com/de/privacy-policy.
– LinkedIn (LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Irland) – Datenschutzerklärung https://www.linkedin.com/legal/privacy-policy , Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000L0UZAA0&status=Active.
– Xing (XING AG, Dammtorstraße 29-32, 20354 Hamburg, Deutschland) – Datenschutzerklärung/ Opt-Out: https://privacy.xing.com/de/datenschutzerklaerung.
– Wakalet (Wakelet Limited, 76 Quay Street, Manchester, M3 4PR, United Kingdom) – Datenschutzerklärung/ Opt-Out: https://wakelet.com/privacy.html.
– Soundcloud (SoundCloud Limited, Rheinsberger Str. 76/77, 10115 Berlin, Deutschland) – Datenschutzerklärung/ Opt-Out: https://soundcloud.com/pages/privacy.
Integration of Third-Party Services and Content
Within our online offering, based on our legitimate interests (i.e., interest in the analysis, optimization, and economic operation of our online service as per Art. 6(1)(f) GDPR), we utilize content or services offered by third-party providers to incorporate their content and services, such as videos or fonts (hereinafter uniformly referred to as "content").
This always presupposes that the third-party providers of this content recognize the IP address of the users since they could not send the content to their browsers without the IP address. Thus, the IP address is essential for displaying this content. We strive to use content whose providers use the IP address solely for the delivery of the content. Furthermore, third-party providers may use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. Through the "pixel tags," information such as visitor traffic on the pages of this website can be analyzed. The pseudonymous information may also be stored in cookies on the users' devices and include technical information about the browser and operating system, referring web pages, visit time, and other details about the use of our online offer, as well as being linked with such information from other sources.
Youtube
We embed videos from the platform "YouTube," provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Policy: https://www.google.com/policies/privacy/, Opt-Out: https://adssettings.google.com/authenticated.
Google Fonts
We incorporate the fonts ("Google Fonts") provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Policy: https://www.google.com/policies/privacy/, Opt-Out: https://adssettings.google.com/authenticated.
Google ReCaptcha
Wir binden die Funktion zur Erkennung von Bots, z.B. bei Eingaben in Onlineformularen (“ReCaptcha”) des Anbieters Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, ein. Datenschutzerklärung: https://www.google.com/policies/privacy/, Opt-Out: https://adssettings.google.com/authenticated.
Use of Facebook Social Plugins
We use, based on our legitimate interests (i.e., interest in the analysis, optimization, and economic operation of our online service as defined by Art. 6(1)(f) GDPR), social plugins ("Plugins") from the social network facebook.com, which is operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook").
This can include content such as images, videos, or texts, and buttons with which users can share content from this online service within Facebook. The list and appearance of Facebook Social Plugins can be viewed here: https://developers.facebook.com/docs/plugins/.
Facebook is certified under the Privacy Shield Agreement, thereby offering a guarantee to comply with European data protection laws (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active).
When a user accesses a feature of this online service that includes such a plugin, their device establishes a direct connection with Facebook's servers. The content of the plugin is transmitted directly from Facebook to the user's device and integrated into the online service. As a result, user profiles can be created from the processed data. Therefore, we have no control over the extent of the data that Facebook collects using this plugin and thus inform users according to our current level of knowledge.
By integrating the plugins, Facebook is informed that a user has accessed the corresponding page of the online service. If the user is logged into Facebook, Facebook can associate the visit with their Facebook account. When users interact with the plugins, for example, by clicking the Like button or leaving a comment, the relevant information is transmitted directly from their device to Facebook and stored there. Even if a user is not a member of Facebook, there is still the possibility that Facebook will learn and store their IP address. According to Facebook, only an anonymized IP address is stored in Germany.
The purpose and scope of data collection, as well as the further processing and use of the data by Facebook, and related rights and settings options to protect users' privacy, can be found in the privacy notices of Facebook: https://www.facebook.com/about/privacy/.
If a user is a Facebook member and does not want Facebook to collect data about them via this online service and link it to their membership data stored on Facebook, they must log out of Facebook before using our online service and delete their cookies. Additional settings and objections to the use of data for advertising purposes can be made within the Facebook profile settings at https://www.facebook.com/settings?tab=ads or through the US website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/These settings are platform-independent, meaning they apply to all devices, such as desktop computers or mobile devices.
Within our online service, functions and content of the service Instagram, offered by Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA, can be integrated. This may include content such as images, videos, or texts and buttons with which users can share content from this online service within Instagram. If users are members of the Instagram platform, Instagram can associate the access to the aforementioned content and functions with their profiles. Instagram's privacy policy: http://instagram.com/about/legal/privacy/.
