Any form of processing of personal data requires a legal basis that allows us to do so. The legal basis primarily results from the purpose for which the data is processed. The lawfulness within a legal basis is regularly measured according to the specific scope of the data processing and the measures we have taken to protect your data.

Legal bases for data processing arise from Article 6(1) GDPR and for particularly sensitive data such as health data from Article 9(2) GDPR. These two regulations name the preparation or fulfilment of contractual, legal or also social obligations as the most important legal bases for data processing. In addition, many data processing operations are carried out in our legitimate interest, unless the interests of the data subjects prevail in view of the specific circumstances. If one of the aforementioned types of legal basis is relevant, the processing does not require any further consent from you.

In addition, data processing may be carried out on the basis of consent from you (Article 7 GDPR) or for persons under the age of 16 when using information society services (e.g. websites, online games, social media platforms) by the children or young people in conjunction with the consent of a parent or guardian (Article 8 GDPR).

We would like to expressly point out that none of our offers are aimed at persons under the age of 16.

In part, our obligation to ask for your consent does not, or not solely, result from the GDPR but from the stricter law under the EU ePrivacy Directive of 2002 (often called the “Cookie Directive”). The provisions of this directive apply in Germany via the German Telecommunication Telemedia Data Protection Act (TTDSG) and the Unfair Competition Act (UWG). We have taken into account the obligations arising from these laws without explicitly referring to them in the following.

If a data transfer to a state outside the European Economic Area (EEA) takes place, we ensure that data protection is secured in the sense of Articles 44 – 49 GDPR.

5.1 Visiting our website

5.1.1 Provision of our website

Description: In order for a web server to make our website available to your browser, the server must collect technical data about the device you are using, your browser and your internet access. This is referred to as a log file or weblog. This is the same data that you necessarily leave behind with every internet page that you call up. At the centre is the IP address from which you call up our pages. The web server sends the data you want to see to this internet address.

Data categories: IP address from which our site was accessed; date and time of access; objects on our website accessed in the browser; type and version of Internet browser; type and version of operating system.

Data recipient (if applicable, third country transfer): Our hosting service provider, who is bound to data protection via an order processing agreement, is located in the EEA. In the event of attacks on our pages, data is passed on to forensic experts and investigating authorities commissioned by us. A transfer to third countries does not take place.

Purpose + legal basis: Provision of our website as well as investigations should unlawful access to our websites occur (e.g. a hacker attack). Legal basis is a legitimate interest, as the operation of a website is not possible without the collection of the weblog. In the specific case of an attack on our website, we have a legitimate interest in being able to provide investigators with evidence of how the attack took place.

Storage period: 7 days

Description: For all cookies requiring consent, we ask for your consent before storing them in your browser cache. The decisions you make will in turn be stored in a cookie on your device so that we do not have to ask for your consent again when you visit our website next time. You can revise your decision at any time by deleting the corresponding cookie from your device via your browser settings.

Data categories: Consent status (Yes/No)

Data recipient (if applicable, third country transfer): None

Purpose + legal basis: Legally compliant consent management for cookies. Legal basis is a legitimate interest, as saving the cookie decision only slightly restricts the rights of visitors and at the same time simplifies the use of the pages on repeated visits. This cookie may also be set without your consent according to § 25 TTDSG, as the cookie choice is to be considered an essential function.

Storage period: Until the corresponding cookie is deleted from your browser cache or until the expiry date of the cookie is reached

Taking pictures with the Selfie X-Box

Description: The camera of the SelfieX box captures people standing in front of the box from the moment the touch screen is activated by touch. During the selection of the desired SelfieX portrait, the Box does not yet save any images or other forms of personal data.

A SelfieX portrait is saved when the corresponding button on the touch screen is tapped. The technology in the SelfieX box saves the portrait as it was displayed on the screen as a montage of the camera shot and the selected accompanying subject. The SelfieX portrait is stored on an Internet server via an SSL-encrypted connection and is available from there for downloading, which is also SSL-encrypted.

A QR code is displayed on the screen for a short time, which can be resolved as an Internet address via corresponding QR code readers. Most smartphones automatically offer the individual download page for the portrait when the smartphone camera is pointed at the QR code. Depending on the browser used, the image file is automatically offered for download into one’s own photo collection or this process can be started, for example, by tapping on the image for a longer period of time.

After downloading the file, the use of the image is the responsibility of the user. The person portrayed is responsible for ensuring that only he or she retrieves his or her QR code and, if necessary, saves it or independently passes it on to third parties or makes it public.

The image file is stored on the SelfieX server for 24 hours and then automatically deleted. After that, the download link leads nowhere. The storage takes place on a self-operated server in a German data centre. The image file is not passed on to anyone by the provider of the SelfieX box, unless criminal investigation authorities can prove corresponding rights of surrender.

Data categories: Image recording

Data recipient (if applicable, third country transfer): The hosting service provider for the server, which is obligated to data protection via a data processing agreement, and its data centre are located in Germany. A third country transfer does not take place. In the event of a lawful order to hand over the data, it will be passed on to the investigating authorities.

Purpose + legal basis: Provision of a photo box for self-portraits in connection (montage) with supplementary photo motifs. The legal basis is the fulfilment of a contract, as the SelfieX-Box is a service that is actively and specifically used by users to create and obtain selfie montages.

Storage period: 24 hours

Description: In order for the SelfieX server to be able to transfer the selfie to your browser (download), the server must collect technical data about your device used for this purpose, your browser and your internet access. This is called the logfile or weblog. This is the same data that you necessarily leave behind with every internet page that you call up. At the centre is the IP address from which you call up the pages. To this Internet address, the server sends you the data that you want to see or download.

Data categories: IP address from which our site was accessed; date and time of access; objects on our website accessed in the browser; type and version of internet browser; type and version of operating system.

Data recipient (if applicable, third country transfer): The hosting service provider for the server, which is bound to data protection via an data processing agreement, and its data centre are located in Germany. A third country transfer does not take place. In the event of attacks on our server, data is passed on to forensic experts commissioned by us. In the event of a lawful order to hand over the data, it will be passed on to the investigating authorities.

Purpose + legal basis: Provision of the download option as well as investigations in the event of unlawful access to our server (e.g. a hacker attack). Legal basis is a legitimate interest, as the operation of a website is not possible without the collection of the weblog. In the specific case of an attack on our server, we have a legitimate interest in being able to provide investigators with circumstantial evidence of how the attack took place.

Storage period: 7 days