Privacy Policy

This privacy policy informs you about the nature, scope and purpose of the processing of personal data (“data”) within our online offering and the associated websites, functions and content, as well as external online presences (e.g. our social media profiles). For terms such as “processing” or “controller”, we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).

1. Controller

23SpotsGroup
Porto Montenegro
Montenegro/Europe
Email: info@23spotsgroup.com
Managing director: Thomas Hofmann

2. Types of data processed, data subjects and purposes

• Master data (e.g. names, addresses)
• Contact data (e.g. email, phone numbers)
• Content data (e.g. text entries, photographs, videos)
• Usage data (e.g. pages visited, interest in content, access times)
• Meta and communication data (e.g. device information, IP addresses)
• Contract and payment data (for customers, prospects and business partners)

Data subjects are visitors and users of the online offering as well as customers, prospects and business partners. Purposes: providing the online offering, answering enquiries and communication, contract processing, security measures and needs-based design of the offering.

3. Relevant legal bases

Unless we state a legal basis separately, the following applies: consent – Art. 6(1)(a) and Art. 7 GDPR; performance of a contract and pre-contractual measures, answering enquiries – Art. 6(1)(b) GDPR; legal obligation – Art. 6(1)(c) GDPR; legitimate interests – Art. 6(1)(f) GDPR; vital interests – Art. 6(1)(d) GDPR.

4. Security measures

In accordance with Art. 32 GDPR, taking into account the state of the art, implementation costs and the nature, scope, circumstances and purposes of processing, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk. These include safeguarding the confidentiality, integrity and availability of data by controlling access, input, disclosure and separation. We have also set up procedures to handle data subject rights, deletion of data and responses to data threats. We consider data protection already during the development and selection of hardware and software (data protection by design and by default, Art. 25 GDPR).

5. Cooperation with processors and third parties

If we disclose or transmit data to other persons and companies (processors or third parties) or give them access to it, this only happens on the basis of a legal permission (e.g. transmission to payment service providers to perform a contract under Art. 6(1)(b) GDPR), if you have consented, if a legal obligation requires it, or on the basis of our legitimate interests (e.g. when using agents or web hosts). Where we commission third parties on the basis of a data processing agreement, this is done in accordance with Art. 28 GDPR.

6. Transfers to third countries

If we process data in a third country (outside the EU or EEA) or do so when using third-party services, this only happens to perform (pre-)contractual obligations, on the basis of your consent, due to a legal obligation or on the basis of our legitimate interests – and only if the special requirements of Art. 44 et seq. GDPR are met, e.g. on the basis of an adequacy decision of the EU Commission or standard contractual clauses.

7. Hosting and collection of access data (server log files)

The hosting services we use comprise infrastructure and platform services, computing capacity, storage space, database services, email dispatch, security and maintenance services. In doing so, we or our hosting provider process master, contact, content, contract, usage, meta and communication data on the basis of our legitimate interests in an efficient and secure provision of the online offering (Art. 6(1)(f) in conjunction with Art. 28 GDPR).

We or our hosting provider collect data on every access to the server (server log files): name of the page accessed, file, date and time of access, amount of data transferred, notification of successful access, browser type and version, operating system, referrer URL, IP address and requesting provider. For security reasons (e.g. to investigate abuse), log files are stored for a maximum of 7 days and then deleted. Data that must be retained as evidence is excluded from deletion until the incident has been clarified.

8. Cookies

“Cookies” are small files stored on users’ devices. Temporary cookies (“session cookies”) are deleted when you close your browser; persistent cookies remain stored afterwards (e.g. for login status).

Our website only uses technically necessary cookies, for example to store your language setting, for the login area or – if the online shop is used – for the shopping cart. No cookies are set for audience measurement or marketing. The legal basis is our legitimate interest in a functioning website (Art. 6(1)(f) GDPR, § 25(2) no. 2 TDDDG).

You can deactivate or delete cookies in your browser settings. This may limit functionality.

9. Contacting us and contact form

When you contact us (e.g. via contact form, email, phone or social media), we process your details to handle the enquiry in accordance with Art. 6(1)(b) GDPR. For the contact form, the fields marked as mandatory are required; the data is sent to us by email. Your details may be stored in a customer relationship management (CRM) system or a comparable enquiry organisation. We delete enquiries as soon as they are no longer required and review this every two years; statutory archiving obligations remain unaffected.

10. Consulting, agency and training services

We process our customers’ data in the course of our contractual services, which include conceptual and strategic consulting, workshops, training and certification services, data analysis and the implementation of processes and measures. In doing so, we process master, contact, content, contract, payment, usage and meta data. We generally do not process special categories of personal data unless they are part of a commissioned processing. Data subjects are customers, prospects as well as their customers, users, employees and other third parties.

The legal bases are Art. 6(1)(b) GDPR (contractual services) and Art. 6(1)(f) GDPR (analysis, optimisation, security). Disclosure to external parties only takes place where necessary within an assignment. Data entrusted to us within an assignment is processed on the client’s instructions and in line with the requirements for commissioned processing (Art. 28 GDPR) exclusively for the commissioned purposes. We delete data after statutory warranty and comparable obligations have expired; we review the necessity of retention every three years. Where statutory archiving obligations apply, deletion takes place after they expire (6 years under § 257(1) HGB, 10 years under § 147(1) AO). Data from an assignment is deleted as specified in the assignment, generally after it ends.

11. Online shop, order processing and customer account

If you order from our online shop (e.g. the book), we process your data to enable you to select, order, pay for and receive the chosen products. This covers master, communication, contract and payment data of customers, prospects and business partners. For this we use session cookies for the shopping cart and, where applicable, persistent cookies for the login status. The legal bases are Art. 6(1)(b) (order processing) and (c) GDPR (legally required archiving). The details marked as required are necessary to establish and perform the contract. We only pass data on to third parties for delivery, payment or within the scope of legal permissions and obligations (e.g. to legal advisers and authorities). We only process data in third countries where necessary to perform the contract.

You can optionally create a customer account in which you can view your orders. The mandatory details (name, email address, password) are processed. Accounts are not public and are not indexed by search engines. After you close your account, the data is deleted, subject to commercial and tax retention obligations (Art. 6(1)(c) GDPR); please back up your data yourself before closing. On registration, login and use of the account we store the IP address and time of the action to protect against misuse (legitimate interest); IP addresses are anonymised or deleted after 7 days at the latest. We review the necessity of retention every three years; for statutory archiving obligations, deletion takes place after they expire (commercial law 6 years, tax law 10 years).

12. External payment service providers

To process payments we use external payment service providers (e.g. PayPal, credit card providers, banks); the payment methods offered are shown during the ordering process. This is based on Art. 6(1)(b) GDPR to perform contracts and otherwise on our legitimate interests in effective and secure payment options (Art. 6(1)(f) GDPR).

The payment service providers process, among other things, master data (name, address), bank data (e.g. account or credit card numbers), passwords, TANs, checksums as well as contract, amount and recipient details. This information is required to carry out the transaction and is processed and stored only by the payment service providers; we receive no account or card information, only confirmation or rejection of the payment. Providers may transmit data to credit agencies for identity and credit checks. The terms and conditions and privacy notices of the respective providers apply; we also refer to these for rights of withdrawal, access and other data subject rights.

13. Administration, accounting, office organisation, contact management

We process data in the course of administrative tasks, organising our business, accounting and complying with legal obligations such as archiving (Art. 6(1)(c) and (f) GDPR). Customers, prospects, business partners and website visitors are affected. We transmit data to the tax authorities, advisers such as tax advisers or auditors, as well as other fee offices and payment service providers. In addition, on the basis of our business interests we store details of suppliers, organisers and other business partners, e.g. for later contact; this predominantly company-related data is generally stored permanently.

14. Embedded content, social media and external links

This website does not automatically embed fonts, maps, videos, tracking or social media services from external providers; all fonts and graphics are delivered from our own server. For links to external sites (e.g. LinkedIn or YouTube), the privacy notices of the respective providers apply from the moment you click. Should we embed third-party services in future, we will supplement this policy.

We maintain online presences in social networks and platforms in order to communicate with customers, prospects and users active there and to inform them about our services. The terms and data processing policies of the respective operators apply there. Unless stated otherwise, we process users’ data when they communicate with us there, e.g. by writing posts or sending messages.

15. Deletion of data

The data we process is deleted or its processing restricted in accordance with Art. 17 and 18 GDPR. Unless expressly stated, we delete data as soon as it is no longer required for its purpose and no statutory retention obligations apply. If data is not deleted for other legally permitted reasons, its processing is restricted (blocking). This applies, for example, to data that must be retained for commercial or tax reasons: in Germany 10 years under § 147(1) AO and § 257(1) nos. 1 and 4, (4) HGB (books, records, accounting vouchers, commercial books, tax-relevant documents) and 6 years under § 257(1) nos. 2 and 3, (4) HGB (commercial letters).

16. Rights of data subjects

• Access to the data processed and a copy of the data (Art. 15 GDPR)
• Rectification or completion of inaccurate or incomplete data (Art. 16 GDPR)
• Erasure of data (Art. 17 GDPR) or restriction of processing (Art. 18 GDPR)
• Data portability: receiving the data you provided and transmitting it to other controllers (Art. 20 GDPR)
• Lodging a complaint with the competent supervisory authority (Art. 77 GDPR)

Right of withdrawal

You have the right to withdraw consent given under Art. 7(3) GDPR with effect for the future.

Right to object

You may object to the future processing of your data under Art. 21 GDPR at any time, in particular to processing for direct marketing purposes.

17. Data protection contact

For questions about data protection or to exercise your rights, write to us at info@23spotsgroup.com.

18. Changes

We adapt this privacy policy when our data processing or the legal situation changes. The current version on this page applies.