We are very pleased that you are interested in our company. Data protection is of a particularly high priority for the management of the GiB – Gesundheit in Bewegung GmbH. You can basically use the website of GiB – Gesundheit in Bewegung GmbH without providing any personal data. However, if a data subject wants to use special company services via our website, processing of personal data could become necessary. If the processing of personal data is necessary and there is no legal basis for such processing, we generally obtain the consent of the person concerned. The processing of personal data, such as the name, address, e-mail address, or telephone number of a data subject shall always be in line with the General Data Protection Regulation (GDPR), and in accordance with the country-specific data protection regulations applicable to GiB - Gesundheit in Bewegung GmbH. By means of this data protection declaration, our company would like to inform the public about the type, scope and purpose of the personal data we collect, use and process. Furthermore, data subjects are informed of the rights to which they are entitled by means of this data protection declaration. As the controller responsible for the processing, GiB – Gesundheit in Bewegung GmbH has implemented numerous technical and organizational measures to ensure the most complete protection possible for the personal data processed via this website. Nevertheless, Internet-based data transmissions can generally have security gaps, so that absolute protection cannot be guaranteed.
1. Definitions
The data protection declaration of GiB – Gesundheit in Bewegung
GmbH is based on the terms used by the European legislator for the
adoption of the General Data Protection Regulation (GDPR). Our data
protection declaration should be legible and understandable for the
general public as well as for our customers and business partners. To
ensure this, we would like to explain the terms used in advance.
We use the following terms, among others, in this data protection
declaration:
a) Personal Data
Personal data is any information relating to an identified or
identifiable natural person (hereinafter "data subject"). A natural
person is considered to be identifiable if, directly or indirectly, in
particular by means of assignment to an identifier such as a name,
an identification number, location data, an online identifier or to one
or more special features, the expression of the physical,
physiological, genetic, psychological, economic, cultural or social
identity of this natural person can be identified.
b) Data Subject
Data subject is any identified or identifiable natural person whose
personal data is processed by the data controller.
c) Processing
Processing is any process carried out with or without the help of
automated procedures or any such series of processes in connection
with personal data such as collecting, recording, organizing,
arranging, storing, adapting or changing, reading out, querying,
using, disclosure by transmission, distribution or any other form of
making available, matching or linking, restriction, deletion or
destruction.
d) Restriction of Processing
Restriction of processing is the marking of stored personal data with
the aim of restricting their future processing.
e) Profiling
Profiling is any type of automated processing of personal data, which
consists in using this personal data to evaluate certain personal
aspects relating to a natural person, in particular aspects relating to
work performance, economic situation, health, personal preferences,
interests, reliability, behaviour, whereabouts or relocation.
f) Pseudonymization
Pseudonymization is the processing of personal data in such a way
that the personal data can no longer be assigned to a specific data
subject without the use of additional information, provided that this
additional information is kept separately and is subject to technical
and organizational measures that ensure that the personal data not
assigned to an identified or identifiable natural person.
g) Controller or Data Controller
The person responsible or responsible for processing is the natural or
legal person, authority, institution or other body that alone or jointly
with others decides on the purposes and means of processing
personal data. If the purposes and means of this processing are
specified by Union law or the law of the Member States, the person
responsible or the specific criteria for his naming can be provided for
by Union law or the law of the Member States.
h) Processors
Processor is a natural or legal person, public authority, institution or
other body that processes personal data on behalf of the person
responsible.
i) Recipient
Recipient is a natural or legal person, public authority, institution or
other body to which personal data is disclosed, regardless of whether
it is a third party or not. However, authorities that may receive
personal data in the context of a specific investigation mandate
under Union or Member State law are not considered recipients.
j) Third Party
Third party is a natural or legal person, public authority, agency or
body other than the data subject, the controller, the processor and
the persons who, under the direct responsibility of the controller or
the processor, are authorized to process the personal data.
k) Consent
Consent is any expression of will voluntarily given by the data
subject in an informed manner and unequivocally for the specific
case in the form of a declaration or other clear confirmatory action
with which the data subject indicates that they consent to the
processing of their personal data is.
2. Name and Address of the Person responsible for Processing
The person responsible within the meaning of the General Data
Protection Regulation, other data protection laws applicable in the
member states of the European Union and other provisions of a data
protection nature is:
GiB – Gesundheit in Bewegung GmbH
Hinschenfelder Strasse 34a
22041 Hamburg
Germany
Tel.: 040 650 330 10
E-Mail: info@gib-gesundheit.de
You can reach our data protection officer at:
Confidential to the data protection officer
Hinschenfelder Strasse 34a
22041 Hamburg
Mail: datenschutz@gib-gesundheit.de
3.Cookies
Like many other websites, this website of GiB - Gesundheit in
Bewegung GmbH also uses so-called "cookies" and other forms of
storage of temporary and technical data in your browser (e.g. "Local
Browser Storage", "WebSQL" and others). Cookies are small text files
that are stored on your computer. They contain information about
your visit to our website, which is transmitted to GiB. Cookies are
usually set or read automatically each time you visit our website.
Important to know
No data is stored in the cookies that allows conclusions to be drawn
about the person visiting our website. The information stored in the
cookies is stored separately from any other data provided to us. We
do not merge this data with other data sources.
This website uses session cookies. The term "session" refers to an
Internet session that ends at the latest when the web browser is
closed.
3.1 Session-Cookies
Session cookies are used to store session data. Session cookies store
a so-called session ID, with which various requests from your
browser can be assigned to a session. This allows your computer to
be recognized when you return to the website.
The lifespan of a session cookie is limited to the respective session.
This means that as soon as you close the browser completely, the
cookie becomes invalid and can no longer be used. The same
happens if you have not performed any action on the landing page
for more than 30 minutes.
3.2 Deletion
You can delete cookies already stored on your device at any time. If
you want to prevent the storage of cookies, you can do this via the
settings in your Internet browser. You can find instructions for
common browsers here: Internet Explorer, Firefox, Google Chrome,
Google Chrome mobile, Microsoft Edge, Safari, Safari mobile.
Alternatively, you can also install so-called ad blockers. Please note
that individual functions of our website may not work if you have
deactivated the use of cookies.
4. Use of Google Analytics with anonymization Function
The GiB - Gesundheit in Bewegung GmbH website does not use Google
Analytics, a web analysis service provided by Google LLC.
5. Collection of General Data and Information
When using the website for information purposes only, we only collect the
personal data that your browser transmits to our server. If you wish to
view our website, we collect the following data, which is technically
necessary for us to display our website to you and to ensure stability and
security:
The collection of this data is technically necessary in order to display our website to you and to ensure stability and security. We (and our service provider) regularly do not know who is behind an IP address. We do not combine the data listed above with other data. The legal basis is Art. 6 Para. 1 S. 1 lit. f GDPR; insofar as absolutely necessary access to information stored in the user's terminal equipment takes place, also § 25 Para. 2 No. 2 TTDSG. Since the collection of data for the provision of the website and the storage in log files is absolutely necessary for the operation of the website and for protection against misuse, our legitimate interest in data processing prevails at this point.
6. Contact Option via Website
Due to legal regulations, the website of GiB - Gesundheit in
Bewegung GmbH contains information that enables quick electronic
contact to our company and direct communication with us, which
also includes a general address for so-called electronic mail (e-mail
address). If a person concerned contacts the person responsible for
processing by e-mail or via a contact form, the personal data
transmitted by the person concerned will be automatically saved.
Such personal data transmitted on a voluntary basis by a data
subject to the data controller are stored for the purpose of
processing or contacting the data subject. This personal data will not
be passed on to third parties without active consent.
7. Routine Deletion and Blocking of Personal Data
The person responsible processes and stores the personal data of
the person concerned only for the period of time necessary to
achieve the purpose of storage or if this is required by the European
directive and regulation giver or another legislator in laws or
regulations which the person responsible for processing subject, was
provided. If the purpose of storage no longer applies or if a storage
period prescribed by the European directive and regulation authority
or another responsible legislator expires, the personal data will be
blocked or deleted as a matter of routine and in accordance with the
statutory provisions.
8. Rights of the Data Subject
a) Right to Confirmation
Every data subject has the right, granted by the European directive
and regulation giver, to request confirmation from the person
responsible for processing as to whether personal data relating to
them are being processed. If a data subject wishes to exercise this
right to confirmation, they can contact an employee of the data
controller at any time.
b) Right to Information
Every person affected by the processing of personal data has the
right, granted by the European directive and regulation giver, to
receive free information about the personal data stored about him
and a copy of this information from the person responsible for
processing at any time. Furthermore, the European legislator for
directives and regulations has granted the data subject access to the
following information: – the processing purposes – the categories of
personal data being processed – the recipients or categories of
recipients to whom the personal data have been or will be disclosed,
in particular recipients in third countries or international
organizations – if possible, the envisaged duration for which the
personal data will be stored or, if this is not possible, the criteria
used to determine that duration - the existence of a right to
correction or deletion of the personal data concerning you or to
restriction of processing by the person responsible or a right to
object to this processing – the existence of a right of appeal to a
supervisory authority – if the personal data are not collected from
the data subject: all available information about the origin of the
data – the existence of automated decision-making including
profiling in accordance with Article 22 (1) and (4) GDPR and - at least
in these cases - meaningful information about the logic involved and
the scope and intended effects of such processing for the data
subject Furthermore, the data subject has a right to information as to
whether personal data has been transmitted to a third country or to
an international organization. If this is the case, the person
concerned has the right to receive information about the appropriate
guarantees in connection with the transmission. If a data subject
wishes to exercise this right to information, they can contact an
employee of the data controller at any time.
c) Right to Rectification
Every person affected by the processing of personal data has the
right granted by the European directive and regulation giver to
demand the immediate correction of incorrect personal data
concerning them. Furthermore, the data subject has the right, taking
into account the purposes of the processing, to request the
completion of incomplete personal data - also by means of a
supplementary declaration. If a data subject wishes to exercise this
right to rectification, they can contact an employee of the data
controller at any time.
d) Right to Erasure (Right to be Forgotten)
Every person affected by the processing of personal data has the
right granted by the European directive and regulation giver to
demand that the person responsible delete the personal data
concerning them immediately if one of the following reasons applies
and if the processing is not necessary: – The personal data were
collected for purposes or otherwise processed for which they are no
longer necessary. – The data subject revokes their consent on which
the processing was based pursuant to Art. 6 (1) Letter a GDPR or Art.
9 (2) Letter a GDPR and there is no other legal basis for the
processing. – The data subject objects to the processing pursuant to
Art. 21 (1) GDPR and there are no overriding legitimate reasons for
the processing, or the data subject objects to the processing
pursuant to Art. 21 (2) GDPR the processing. – The personal data
have been processed unlawfully. – The personal data must be erased
for compliance with a legal obligation in Union or Member State law
to which the controller is subject. – The personal data was collected
in relation to information society services offered in accordance with
Art. 8 (1) GDPR. If one of the above reasons applies and a person
concerned wishes to have personal data stored at GiB - Gesundheit
in Bewegung GmbH deleted, he or she can contact an employee of
the person responsible for processing at any time. The employee of
GiB – Gesundheit in Bewegung GmbH will ensure that the request for
deletion is complied with immediately. If the personal data was made
public by GiB - Gesundheit in Bewegung GmbH and our company, as
the person responsible, is obliged to delete the personal data in
accordance with Art. 17 (1) GDPR Technology and the
implementation costs appropriate measures, also of a technical
nature, to inform other persons responsible for data processing who
process the published personal data that the person concerned has
requested the deletion of all links to this personal data by these
other persons responsible for data processing or has requested
copies or replications of this personal data, insofar as the processing
is not necessary. An employees of the GiB - Gesundheit in Bewegung
GmbH will arrange the necessary measures in individual cases.
e) Right to Restriction of Processing
Any person affected by the processing of personal data has the right,
granted by the European directive and regulation giver, to demand
that the person responsible restrict the processing if one of the
following conditions is met: – The accuracy of the personal data is
contested by the data subject, for a period enabling the controller to
verify the accuracy of the personal data. – The processing is
unlawful, the data subject refuses to have the personal data deleted
and instead requests that the use of the personal data be restricted.
– The person responsible no longer needs the personal data for the
purposes of processing, but the data subject needs them to assert,
exercise or defend legal claims. – The data subject has lodged an
objection to the processing pursuant to Art. 21 (1) GDPR pending the
verification whether the legitimate grounds of the controller override
those of the data subject. If one of the above conditions is met and a
data subject wishes to request the restriction of personal data stored
at GiB - Gesundheit in Bewegung GmbH, they can contact an
employee of the data controller at any time. The employee of the
GiB - Gesundheit in Bewegung GmbH will arrange the restriction of
the processing.
f) Right to Data Portability
Every person affected by the processing of personal data has the
right, granted by the European directive and regulation giver, to
receive the personal data relating to them, which the person
concerned has provided to a person responsible, in a structured,
common and machine-readable format. You also have the right to
transmit this data to another person responsible without hindrance
from the person responsible to whom the personal data was
provided, provided that the processing is based on the consent in
accordance with Art. 6 (1) Letter a GDPR or Art. 9 (2) letter a GDPR
or on a contract according to Art. 6 (1) letter b GDPR and the
processing is carried out using automated procedures, provided that
the processing is not necessary for the performance of a task that is
in the public interest or takes place in the exercise of official
authority, which has been transferred to the person responsible.
Furthermore, when exercising their right to data portability in
accordance with Art. 20 (1) GDPR the rights and freedoms of other
persons are not impaired by this. In order to assert the right to data
transferability, the person concerned can contact an employee of
GiB – Gesundheit in Bewegung GmbH at any time.
g) Right to Object
Every person affected by the processing of personal data has the
right granted by the European directive and regulation giver, for
reasons arising from their particular situation, at any time against
the processing of personal data concerning them, which is based on
Art. 6 (1) letter e or f GDPR to file an objection. This also applies to
profiling based on these provisions. GiB – Gesundheit in Bewegung
GmbH will no longer process the personal data in the event of an
objection, unless we can demonstrate compelling legitimate grounds
for the processing which outweigh the interests, rights and freedoms
of the data subject, or the processing serves to assert the claim ,
exercise or defense of legal claims. If GiB - Gesundheit in Bewegung
GmbH processes personal data in order to operate direct advertising,
the person concerned has the right to object at any time to the
processing of personal data for the purpose of such advertising. This
also applies to profiling insofar as it is associated with such direct
advertising. If the data subject objects to the GiB – Gesundheit in
Bewegung GmbH to the processing for direct marketing purposes,
the GiB – Gesundheit in Bewegung GmbH will no longer process the
personal data for these purposes. In addition, the data subject has
the right, for reasons arising from their particular situation, against
the processing of personal data relating to them, which is carried out
at GiB - Gesundheit in Bewegung GmbH for scientific or historical
research purposes or for statistical purposes in accordance with Art.
89 (1) GDPR to object, unless such processing is necessary to fulfill a
task in the public interest. In order to exercise the right to object, the
data subject can directly contact any employee of GiB - Gesundheit
in Bewegung GmbH or another employee. The data subject is also
free, in connection with the use of information society services,
notwithstanding Directive 2002/58/EC, to exercise their right to
object by automated means using technical specifications.
h) Automated Decisions in individual Cases including Profiling
Any person affected by the processing of personal data has the right
granted by the European legislator for directives and regulations not
to be subject to a decision based solely on automated processing -
including profiling - which has legal effects on them or significantly
affects them in a similar way, if the decision (1) is not necessary for
entering into, or the performance of, a contract between the data
subject and the person responsible, or (2) is permissible on the basis
of Union or Member State legislation to which the person responsible
is subject and such legislation requires appropriate measures to
safeguard the rights and freedoms and legitimate interests of the
data subject or (3) is carried out with the express consent of the data
subject. If the decision (1) is necessary for entering into, or the
performance of, a contract between the data subject and a data
controller, or (2) it is based on the data subject's explicit consent,
the GiB - Gesundheit in Bewegung GmbH shall implement suitable
measures to safeguard the rights and safeguard the freedoms and
legitimate interests of the data subject, including at least the right to
obtain human intervention on the part of the controller, to express
his or her point of view and to contest the decision. If the data
subject wishes to assert rights relating to automated decisions, they
can contact an employee of the data controller at any time.
i) Right to withdraw Consent under Data Protection Law
Every person affected by the processing of personal data has the
right granted by the European directive and regulation giver to
revoke consent to the processing of personal data at any time. If the
data subject wishes to assert their right to revoke consent, they can
contact an employee of the data controller at any time.
9. Legal Basis for Processing
Art. 6 I lit. a GDPR serves our company as the legal basis for
processing operations for which we obtain consent for a specific
processing purpose. If the processing of personal data is necessary
to fulfill a contract to which the data subject is party, as is the case,
for example, with processing operations that are necessary for the
delivery of goods or the provision of another service or
consideration, the processing is based on Art. 6 I lit. b GDPR. The
same applies to such processing operations that are necessary to
carry out pre-contractual measures, for example in the case of
inquiries about our products or services. If our company is subject to
a legal obligation which requires the processing of personal data,
such as the fulfillment of tax obligations, the processing is based on
Art. 6 I lit. c GDPR. In rare cases, the processing of personal data
could become necessary to protect the vital interests of the data
subject or another natural person. This would be the case, for
example, if a visitor were injured in our company and his name, age,
health insurance data or other vital information would have to be
passed on to a doctor, hospital or other third party. Then the
processing would be based on Art. 6 I lit. d GDPR. Ultimately,
processing operations could be based on Art. 6 I lit. f GDPR.
Processing operations that are not covered by any of the
aforementioned legal bases are based on this legal basis if the
processing is necessary to protect a legitimate interest of our
company or a third party, provided that the interests, fundamental
rights and fundamental freedoms of the person concerned do not
prevail. Such processing operations are permitted to us in particular
because they have been specifically mentioned by the European
legislator. In this respect, he took the view that a legitimate interest
could be assumed if the data subject is a customer of the person
responsible (recital 47 sentence 2 GDPR).
10. Legitimate Interests in Processing pursued by the Controller or a Third
Party
If the processing of personal data is based on Art. 6 I lit. f GDPR, our
legitimate interest is conducting our business for the benefit of all
our employees and our shareholders.
11. Duration for which the Personal Data will be stored
The criterion for the duration of the storage of personal data is the
respective statutory retention period. After the deadline has expired,
the corresponding data will be routinely deleted, provided that they
are no longer required to fulfill the contract or to initiate a contract.
12. Statutory or contractual Requirements for providing the Personal Data; Necessity for the
Conclusion of the Contract; Obligation of the Data Subject to provide the Personal Data; possible
Consequences of Non-provision
We clarify that the provision of personal data is partly required by
law (e.g. tax regulations) or can also result from contractual
regulations (e.g. information on the contractual partner). Sometimes
it may be necessary for a contract to be concluded that a person
concerned makes personal data available to us, which must then be
processed by us. For example, the data subject is obliged to provide
us with personal data if our company concludes a contract with
them. Failure to provide the personal data would mean that the
contract with the data subject could not be concluded. Before
personal data is provided by the data subject, the data subject must
contact one of our employees. Our employee clarifies to the data
subject on a case-by-case basis whether the provision of the
personal data is required by law or contract or is necessary for the
conclusion of the contract, whether there is an obligation to provide
the personal data and what the consequences would be if the
personal data were not provided.
13. Existence of automated Decision-making
As a responsible company, we do not use automatic decision-making
or profiling. This data protection declaration was created by the data
protection declaration generator of the DGD Deutsche Gesellschaft
für Datenschutz GmbH, which acts as the external data protection
officer for Kempten, in cooperation with the lawyer for IT and data
protection law Christian Solmecke.