Privacy Policy

I. General information
1. The controller’s contact details

zwei.7 Equity GmbH
Heger-Tor-Wall 26
49078 Osnabrück
0541 933 979 0
info@zweipunkt7.com

II. Specific information about the collection of personal data
1. Visiting the website
a) Purpose for which data is processed

Access data will be saved in a log file whenever a user accesses a webpage and any time a file saved on our website is accessed. Every data record consists of:
(1) The page from which the file was requested
(2) The name of the file
(3) The date and time of the request
(4) The data volume transferred
(5) The access status (transfer file, file not found etc.)
(6) A description of the type of operating system and webbrowser used
(7) Hostname of the computer accessed
(8) The client IP address
We use this data to operate our website, in particular to identify the website’s capacity and website’s error functions and undertake changes or make improvements. The client IP address is used for the purpose of transferring the requested data; it is anonymised after the technical requirements have ceased to apply by deleting the last block of characters (Ipv4) or the last octet (Ipv6).

b) Period of storage

The data is stored each time our website is accessed by a user and is erased, as soon as it is no longer required for the purpose of the collection, which is the case at the latest at the end of 10 weeks following the user’s visit to the website.

c) Legal basis

The aforesaid data is stored on the legal basis of point f of Art. 6(1) EU General Data Protection Regulation (hereinafter “GDPR”). The justified interest lies in the provision of our website and checking for any misuse.

d) Option to object and remove

The data subject can object to processing by not using our website and demand that any data that it collects in this way be erased subject to the conditions for erasure described in more detail in the section “Rights” by means of an informal statement.

2. Cookies
a) Purpose for which data is processed

To visit our website and to make the order process technically feasible, we transfer cookies to the data subject’s end device. Cookies are tiny files that are used to identify the data subject’s end device, whereby the domain name, from which the cookie data was sent, information about the age of the cookie and an alphanumeric identification code are recorded. As the cookie is cached on the end device used, without being entered onto the operating system, it is recognised again and enables us to make any presettings that may be required straight away. We use this information in order to adapt our website and the services we offer to your needs and accelerate access to our website.

b) Period of storage

The storage period of the different cookies varies, although is a maximum of two years. They are cached on your local end device, not on our server, which is why the actual period for erasure depends on your browser’s software configuration. Please take how you can erase the cookies set by us for a specific purpose or automatically from your browser software’s user manual.

c) Legal basis

The legal basis for collection of the aforesaid data is Art. 6 (1) f GDPR. The justified interest for setting cookies is to be able to optimise the quality of our website, on the one hand, and on the other, to enable our website to be visited; in particular, several functions on our website cannot be used, as the user and the settings the user has already made would otherwise not be recognised, language settings would be lost, and it would not be possible to carry out searches. Data is stored, furthermore, on the legal basis of Art. 6 1 b GDPR for implementing the contract.

d) Option to object and remove

The data subject is able to block the use of cookies in the end device used or erase these after use. Under certain circumstances, however, it may not be possible to use individual functions of our website. How cookies are blocked and cookies already stored are erased, can be taken from the browser software’s instruction.

3. Making contact / object enquiry
a) Purpose for which data is processed

A user is able to make contact with us by,email, contact form, fax orby phone. We store the data transferred by us and specified by the data subject in order to process the enquiry. This data is name, address, if necessary, the requested object, email address, telephone and/or fax number, data and time of the request and the description of the matter, contractual data, if the request is being made as part of drafting for processing a contract.
This data shall not be forwarded to any third parties. Its purpose is to process the data subject’s contact request.

b) Period of storage

As soon as the data is no longer required to achieve the purpose, it will be erased, which is the case if the conversation has been finally completed and the matter has been clarified, and there are no contractual retention periods or periods under fiscal law that oppose this. This period is five years for personal data that is subject to Section 147 of the German Fiscal Code and ten years for personal data that is subject to Section 257 of the German Civil Code (HGB). The terms start with the end of the calendar year in which the data was collected.

c) Legal basis

The legal basis for collection of the aforesaid data is point f of Art. 6 (1) GDPR as part of a contract initiation or fulfilment and pursuant to point f of Art. 6 (1) GDPR. The controller’s justified interest lies in being able to process the contact enquiry and prevent misuse of the contact enquiry.

d) Option to object and remove

The data subject is able to object to their data being stored at any time. The data stored up to the operation will then be erased. Should a contract be signed, the aforesaid statements apply to the key word “contract conclusion”.

III. Rights of the data subject

If the user’s personal data is processed on our website, the person affected (data subject) has the following rights vis-à-vis the controller pursuant to GDPR.

1. Right to information based on Art. 15 GDPR

The data subject has the right to the following information:
a) the purposes of the processing;
b) the categories of personal data that is processed;
c) the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular for recipients in third countries or for international organisations;
d) if possible, the planned period for which the personal data is to be stored, or, if this is not possible, the criteria for establishing this period;
e) the existence of a right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
f) the right to lodge a complaint with a supervisory authority;
g) where the personal data is not collected from the data subject, any available information as to its source;
h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject;
i) if personal data is sent to a third country or an international organisation, the data subject has the right to be notified about suitable the guarantees pursuant to Art. 46 GDPR in connection with the disclosure.
We will provide the data subject with a copy of the personal data that is the object of processing. The controller can demand reasonable compensation for all further copies that the data subject has applied for on the basis of the administrative costs.

2. Right to rectification based on Art. 16 GDPR

The data subject has the right to demand that the controller rectify any inaccurate personal data about them straight away. Taking account of the reasons for processing, the data subject has the right to demand the completion of incomplete personal data – even by means of a supplementary statement.

3. Right to erasure based on Art. 17 GDPR

The data subject has the right to demand that the controller erase any personal data about them straight away, and the controller is obliged to erase any personal data immediately, provided one of the following reasons apply:
a) the personal data is no longer required for the purposes for which it was collected or otherwise processed;
b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there are no other legal grounds for the processing;
c) the data subject objects to the processing pursuant to Article 21(1) GDPR, and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) GDPR;
d) the personal data has been unlawfully processed;
e) the personal data has to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
f) the personal data has been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

4. Right to restriction of processing based on Art. 18 GDPR

The data subject has the right to demand that the controller restrict processing if one of the following conditions apply:
a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead;
c) the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims, or
d) the data subject has objected to processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

5. Notification obligation based on Art. 19 GDPR

If the data subject has made a claim against the controller for rectification pursuant to Art. 16 GDPR, erasure Art. 17 (1) GDPR, or restriction of processing based on Art. 18 GDPR, and the controller has informed all recipients to whom the data subject’s personal data has been disclosed about the data subject’s request (provided this is not impossible or does not involve disproportionate expense), the data subject has the right to be informed by the controller who the recipients are.

6. Right to data portability pursuant to Art. 20 GDPR

The data subject has the right to receive the personal data about them that they have provided to a controller in a structured, current and machine-readable format, and they are entitled to have this data sent to another controller without any restriction being imposed by us, provided
a) the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and
b) the processing is carried out by automated means.
This shall not in any way affect the rights and freedoms of other persons.
When exercising the right to data portability pursuant to paragraph 1, the data subject has the right to have the personal data sent directly by us to another data controller, provided this is technically feasible.
Exercising the right to data portability does not affect the right to erasure in accordance with Art. 17 GDPR. The right to data portability does not apply to processing that is necessary in order to assume a task that is in the public interest or is carried out in exercise of official authority that has been bestowed on the controller.

7. Right to object pursuant to Art. 21 GDPR

The data subject has the right, for reasons that arise as a result of his particular situation, to object to processing of his personal data at any time that takes place based on points e) or f) of Art. 6 (1) GDPR; this also applies to profiling that is based on these conditions.
We will no longer process personal data, unless we are able to provide compelling reasons for processing that are worthy of protection, which outweigh the interests, rights and freedoms, or processing serves to claim, exercise or defend legal claims.
If personal data is processed to operate direct advertising, the data subject has the right to object to their personal data being processed for the purposes of such advertising; this also applies to profiling, unless it is associated with such direct advertising. If the data subject objects to processing for the purposes of direct advertising, the personal data will no longer be processed for these purposes.
A consent given by the data subject can be revoked at any time. Collection and processing that has taken place up to this point remains lawful, however.

8. Automated decisions in the individual case including profiling pursuant to Art. 22 GDPR

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them similarly significantly affects them.
This does not apply if the decision
a) is necessary in order to conclude or fulfil a contract between the data subject and ourselves;
b) is permitted because of the legal requirements of the Union or Member States, to which we are subject, and these legal requirements include reasonable measures to preserve the rights and freedoms, and the justified interests of the data subject, or
c) take place with the explicit consent of the data subject.
The decisions may not be based on particular categories of personal data pursuant to Art. 9 1 GDPR, unless point a or g of Art. 9(2) GDPR apply and reasonable measures were taken to protect the rights and freedoms, and the justified interests of the data subject.
In the cases mentioned under items a) and c) we take reasonable steps to preserve the rights and freedoms, and the justified interests of the data subject, to which at least the right to involve a person on our part, to disclose our own point of view and contest a decision forms part.

9. Right to object pursuant to Art. 77 GDPR

Notwithstanding other administrative or judicial remedy, each data subject has the right to lodge an objection with a supervisory authority, in particular in a Member State of their place of residence, their place of employment or the place of the alleged breach if the data subject is of the opinion that the processing of the personal data breaches GDPR.
The supervisory board, with whom the complaint was lodged, notifies the claimant of the progress and the results of the complaint including the possibility of a legal remedy pursuant to Art. 78 GDPR.

10. Right to an effective, judicial remedy pursuant to Art. 79 GDPR

Notwithstanding an available administrative or extrajudicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR, every data subject has the right to an effective legal remedy if they are of the opinion that the rights to which they are entitled based on GDPR have been breached because their personal data has been processed contrary to GDPR.
The courts of a Member State, in which we or order processors have a subsidiary, have jurisdiction for claims against us or against the data processor. Alternatively, such claims may also be brought before the courts of the Member State, in which the data subject has their place of residence, unless this is an authority of a Member State in our country or that of the order processor that has acted in exercise of its official powers.