Privacy Policy

Below you will find our privacy policy, which applies to our website https://cert4trust.de/.

We hereby inform you about how we process your personal data and about your rights and entitlements under data protection legislation.

1. Data controller

2. Company Data Protection Officer

If you have any questions about our website, please do not hesitate to contact our Data Protection Officer.

Milomir Mikulovic

Phone: +49 8031 230010 910
E-Mail: m.mikulovic@data-security.one

DATA Security GmbH
Carl-Jordan-Straße 14
83059 Kolbermoor
Managing director: Dominik Mikulovic
https://data-security.one

3. Sources and data relating to the processing of personal data

We collect and process personal data that you have provided to us, for example via our contact form, or that we obtain through your use of our online services.

This may include the following types of data:

Personal details (name, address).
Contact details (email, telephone numbers).
Content data (text entries, photographs, videos).
Usage data (webpages visited, interest in content, access times).
Meta/communication data (device information, IP addresses).

Furthermore, we may process other data comparable to the categories mentioned.
Data is also stored in server log files, which are collected and automatically stored by the provider and are, for the most part, transmitted to us by your browser. These are:

Referrer URL
Hostname of the accessing computer
Date and time of the server request
Name of the requested file
Page from which the relevant file was requested
Web browser and operating system used
(Full) IP address of the requesting computer
Amount of data transferred

We may process further data comparable to the categories mentioned.

The legal basis for the temporary storage of this data and the log files is Article 6(1)(f) of the GDPR. We collect the data listed in order to ensure that the website connects smoothly and to enable users to use our website conveniently. The log file is used to assess system security and stability, as well as for administrative purposes.

We currently also offer the following social media channels: LinkedIn

The legal basis for collecting data when using social media is Article 6(1)(f) of the GDPR. Through the use of social media, we can obtain statistical usage data from the respective social media company. This may include, amongst other things, information on page views and activity, views of individual articles, videos and services, etc.

4. Hosting

Our hosting provider is:

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen

E-Mail: info@hetzner.com

We make use of the following hosting services: infrastructure and platform services, computing capacity, storage space, database services, security services and technical maintenance services for the purpose of operating this online service. On the basis of our legitimate interest, we process master data, contact details, content data, contractual data, usage data, metadata and communication data relating to customers, prospective customers and visitors to this online service in accordance with Article 6(1)(f) of the GDPR in conjunction with Article 28 of the GDPR, in order to be able to provide you with an efficient and secure online service. The hosting provider collects data on every access to the server on which this service is hosted (so-called server log files). The data logged includes the name of the webpage accessed, the file, the date and time of access, the volume of data transferred, confirmation of successful access, the browser type and version, the user’s operating system, the referrer URL (the previously visited page), the IP address and the requesting provider. This log file information is stored for security reasons (e.g. to investigate cases of misuse or fraud) for as long as is necessary to fulfil the purpose for which it was collected, and is subsequently deleted. Data whose continued retention is required for evidential purposes is exempt from deletion.

You may find the privacy policy of our hosting provider here: https://www.hetzner.com/de/legal/privacy-policy/

5. Purpose of processing and legal basis

We process personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).
Where necessary, we process your data beyond the actual fulfilment of the contract in order to safeguard our legitimate interests or those of third parties. We collect the data listed above to ensure that the website connects smoothly and to enable users to use it conveniently. The log file is used to assess system security and stability, as well as for administrative purposes. We also store your data for technical security reasons, in particular to defend against attempts to attack our web server.

Provision of the online service, its functions and content,
Responding to enquiries and communicating with users,
Reviewing and optimising processes for needs analysis and direct customer engagement;
Advertising or market and opinion research, e.g. through the use of cookies, provided you have not objected to the use of your data;
Asserting legal claims and defending against legal disputes;
Ensuring IT security and IT operations;
Measures for business management and the further development of services and products.

Social media companies use your usage behaviour to create so-called user profiles, which are used to display advertisements. Cookies are usually stored on your computer for this purpose.
The lawfulness of the processing of personal data for specific purposes (e.g. disclosure of data to third parties, analysis of data for marketing purposes) is based on your consent, provided you have given it to us in accordance with Article 6(1)(a) of the GDPR. Consent that has been given may be withdrawn at any time.
Please note that withdrawal of consent only takes effect for the future. Any processing carried out prior to the withdrawal is not affected by this.
Where you have given your consent to social media companies for specific data processing, such processing is carried out on the legal basis of Article 6(1)(a) of the GDPR.
We are also subject to legal requirements. Where data is processed in this context, this is done exclusively on the basis of statutory provisions.

6. Relevant legal basis

Consent, Article 6(1)(a) and Article 7 of the GDPR;
to provide our services and carry out contractual measures, as well as to respond to enquiries, Article 6(1)(b) of the GDPR;
to comply with legal obligations, Article 6(1)(c) of the GDPR;
where the vital interests of the data subject or of another natural person require the processing of personal data, Article 6(1)(d) of the GDPR;
for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Article 6(1)(e) of the GDPR;
to safeguard legitimate interests, Article 6(1)(f) of the GDPR.
The processing of data for purposes other than those for which it was collected is governed by the provisions of Article 6(4) of the GDPR.
The processing of special categories of data (in accordance with Article 9(1) of the GDPR) is governed by the provisions of Article 9(2) of the GDPR.

7. Disclosure of data

Within the company, your data is only disclosed to those departments that require it to fulfil our contractual and legal obligations. Data may also be disclosed to data processors (Art. 28 GDPR) engaged by us for the purposes stated. These are companies in the categories of IT services, telecommunications, advisory and consultancy services, and sales and marketing.
When disclosing data to recipients outside the company, please note that we will only disclose your data if permitted or required by law, if we have your consent, or if we are authorised to provide such information. In this context, recipients of personal data may include, for example, public authorities and institutions (e.g. the Crown Prosecution Service, the police, supervisory authorities) where there is a legal or regulatory obligation to do so.

8. Data transferal to third countries

Data will only be transferred to third countries or abroad if required by law, if you have given us your consent, or insofar as this is necessary for the fulfilment of our services. Should this be required by law, we will inform you of further details separately.

9. Cookies

You can adjust your consent to the use of cookies on our website at any time via the Consent Manager.

Our website only sets cookies for the YouTube video – which are stored by the browser on your device and contain certain settings relating to the use of the website (e.g. for the current session) – once consent has been given via the Consent Manager. Where individual cookies implemented by us also process personal data, such processing is carried out in accordance with Article 6(1)(b) of the GDPR, either for the performance of a contract, or in accordance with Article 6(1)(f) of the GDPR to safeguard our legitimate interests in ensuring the best possible functionality of the website and a user-friendly and effective experience for visitors. Cookies serve to make our website more user-friendly, effective and secure. Cookies are small text files that are stored on your computer and saved by your browser. Most of the cookies we use are so-called session cookies, which are automatically deleted when you close your browser. Other cookies remain stored on your device until you delete them or their storage period expires. These cookies enable us to recognise your browser the next time you visit.

In some cases, cookies are used to simplify website processes by storing settings (e.g. retaining previously selected options).

You can configure your browser so that you are notified when cookies are set and can choose to allow cookies only on a case-by-case basis, block cookies in specific cases or generally, and enable the automatic deletion of cookies when you close your browser. If you disable cookies, the functionality of this website may be restricted.

You can object in general to cookies used for online marketing purposes via the US website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/.
You can also disable the storage of cookies in your browser settings. Please note that, in this case, you may not be able to use all the features of this website.

10. Friendly Captcha

We use Friendly Captcha to protect our website, and in particular our forms, against malicious automated access and spam. When you access protected areas, a connection is established with Friendly Captcha’s services, including global.frcapi.com. Friendly Captcha is designed to distinguish automated access from human input without the need to solve traditional image puzzles. In the course of using the service, technically necessary data such as connection, device and interaction data may be processed. Further information on data processing, the legal basis and, where applicable, the recipients of the data can be found in our Privacy Policy.

11. Matomo

We use Matomo to analyse and evaluate the usage of our website statistically. Matomo helps us to understand how visitors use our website, for example which pages are accessed and how users navigate through the site. For the purposes of this analysis, cookies are stored on your device and usage information is processed. As Matomo uses cookies in this configuration, it will only be activated once you have given your consent via the cookie settings. Consent that has been given may be withdrawn at any time with future effect. You can find detailed information on data processing, the retention period and your rights in our privacy policy.

12. Social Media Links to LinkedIn

We operate the following page on the social media platform LinkedIn, a service provided by LinkedIn Ireland Unlimited Company (“LinkedIn Ireland”), Wilton Place, Dublin, Ireland: linkedin.com/cert4trust
In accordance with Article 26 of the GDPR, we are jointly responsible for data protection with LinkedIn. This is based on LinkedIn’s ‘Joint Controller Addendum’. You can view this via the following link:
https://legal.linkedin.com/pages-joint-controller-addendum
The link to our company’s LinkedIn page enables us to publish feeds and share content of interest to users directly via our presence on that platform. Data processing in connection with the operation of the profile page is therefore carried out on the basis of our legitimate interest in accordance with Article 6(1)(f) of the GDPR. Where LinkedIn obtains visitors’ consent to data processing (e.g. by ticking a checkbox or clicking a button), the legal basis for data processing is Article 6(1)(a) of the GDPR.
LinkedIn stores data until it is no longer required to provide the services and LinkedIn products, or until the visitor’s account is deleted. This is determined on a case-by-case basis and depends on criteria such as the type of data, the reasons for its collection and processing, and the relevant legal or operational retention requirements.
Further information on this and the available settings can be found on the following LinkedIn Support pages:
https://www.linkedin.com/help/linkedin/answer/125463/managecookie-preferences?lang=de

13. Blockchain Infrastructure

Cert4Trust enables the simple and secure verification of digital documents using blockchain technology, which is operated on behalf of Cert4Trust e.V. by its members.

By storing a unique digital fingerprint (hash) on a trusted blockchain, it is possible to verify at any time whether a document is authentic and unaltered – without any personal data being stored or processed in the process.

To provide this technology, Cert4Trust works with individual members of Cert4Trust e.V. as data processors. Processing is carried out in accordance with the requirements of the General Data Protection Regulation (GDPR), in particular Article 28 of the GDPR, within the framework of an existing data processing agreement (DPA).
The operators implement technical and organisational measures to ensure a high level of data protection and to carry out processing exclusively in accordance with Cert4Trust’s instructions.

The Cert4Trust solution helps to strengthen trust in digital evidence and reliably prevent tampering or attempts at fraud. If you have any questions regarding data processing or your rights as a data subject, you can contact our Data Protection Officer at any time.

14. Contact form and E-Mail requests

Should you send us enquiries via the contact form or by email, we will store the details you provide in the enquiry form or in your email – including the contact details you provide there – for the purpose of processing your enquiry and in case of any follow-up questions. You are required to provide an email address and your name as contact details. This data will not be passed on without your consent. We process your data on the legal basis of our legitimate interest in responding to your enquiries in accordance with Article 6(1)(f) of the GDPR and, where applicable, Article 6(1)(b) of the GDPR, provided that your enquiry is aimed at concluding a contract. Once your enquiry has been processed, your data will be deleted, provided there are no statutory retention obligations. You may object to the processing of your data at any time in cases covered by Article 6(1)(f) of the GDPR.

15. Administration, financial accounting, office organisation

We process data in connection with administrative tasks, the organisation of our business, financial accounting and compliance with legal obligations, such as archiving. The data processed in this context is the same as that which we process in the course of providing our contractual services. The legal basis for the processing is Article 6(1)(c) of the GDPR and Article 6(1)(f) of the GDPR. Those affected by the processing include customers, prospective customers, business partners and website visitors. The purpose of the processing is administration, financial accounting, office organisation, data archiving, the performance of our duties and the provision of our services. To ensure this, data is passed on to the tax authorities, advisers (e.g. tax advisers or auditors) and other fee-charging bodies and payment service providers. Furthermore, based on our business interests, details of suppliers, event organisers and other business partners are stored for the purpose of possible future contact.

16. Contractual services

In order to be able to provide our contractual and pre-contractual services to our contractual partners, prospective clients, other clients, customers, or clients, we process data in accordance with Article 6(1)(b) of the GDPR. We process our contractual partners’ master data (e.g. names and addresses), contact details (e.g. email addresses and telephone numbers), contractual data (e.g. services used, contract terms, contractual correspondence, names of contact persons) and payment details (e.g. bank details, payment history). As a general rule, we do not process special categories of personal data, except where they form part of commissioned or contractual processing. We process only the data necessary for the establishment and fulfilment of contractual obligations. Data is disclosed to external individuals and organisations only where this is required under the terms of a contract. When processing data entrusted to us as part of a commission, we act in accordance with the client’s instructions and the statutory requirements. If our online services are used, we may store the IP address and the time of the respective user action. This storage is based on our legitimate interest, as well as the user’s interest in protection against misuse and other unauthorised use.

17. Retention period for personal data

To the extent permitted by law, we process and store your personal data, in particular for as long as this is necessary to fulfil the relevant purposes and provided that there are no statutory retention obligations preventing its erasure. If the data is not deleted because it is required for other, legally permissible purposes, its processing will be restricted. This means that the data will be blocked and will not be processed for any other purposes. This applies in particular to data that must be retained for commercial or tax law reasons. In accordance with statutory requirements, books, records, management reports, accounting documents, commercial ledgers and documents relevant for tax purposes are retained for 10 years in accordance with Sections 147(1) of the German Fiscal Code (AO), 257(1) nos. 1 and 4, and (4) of the German Commercial Code (HGB). A six-year retention period applies to commercial correspondence in accordance with Section 257(1)(2) and (3), and (4) of the German Commercial Code (HGB).

18. Your rights

We would like to inform you of the data subject rights you have vis-à-vis the data controller with regard to the processing of your personal data in accordance with the General Data Protection Regulation:

a. Right of access:
In accordance with Article 15 of the GDPR, you have the right to request information about your personal data processed by us.

b. Right to rectification:
In accordance with Article 16 of the GDPR, you have the right to request the rectification of inaccurate personal data or the completion of incomplete personal data held by us without undue delay.

c. Right to erasure:
In accordance with Article 17 of the GDPR, you have the right to request the erasure of your personal data stored by us, unless processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims.

d. Right to restriction of processing:
In accordance with Article 18 of the GDPR, you have the right to request the restriction of the processing of your personal data where you contest the accuracy of the data, where the processing is unlawful but you oppose its erasure, and where we no longer require the data but you need it to assert, exercise or defend legal claims, or where you have objected to the processing pursuant to Article 21 of the GDPR.

e. Right to data portability under Article 20 of the GDPR:
You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to request that it be transmitted to another controller, insofar as this is technically feasible.

f. Right to lodge a complaint:
You may lodge a complaint with a supervisory authority in accordance with Article 77 of the GDPR. As a rule, you may contact the supervisory authority of the federal state in which we are based or, where applicable, that of your usual place of residence or place of work.

g. Right to withdraw consent:
You may withdraw any consent you have already given in accordance with Article 7(3) of the GDPR. You also have the right to withdraw your consent to the processing of data at any time, with effect for the future. In the event of withdrawal, we will delete the relevant data without delay, unless further processing can be based on a legal basis that does not require consent. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent prior to its withdrawal.

h. Right to object
You may, on grounds relating to your particular situation, object at any time to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) of the GDPR (data processing in the public interest) and Article 6(1)(f) of the General Data Protection Regulation (data processing based on a balancing of interests). This also includes profiling based on this provision within the meaning of Article 4(4) of the GDPR.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

19. Obligation to provide data

When using the internet or social media, you are only required to provide the personal data that is necessary for such use or that we are legally obliged to collect. Without this data, meaningful use may be restricted or impossible.

20. External links

Where links to other websites are provided, we have no influence over or control of the linked content or the privacy policies of those websites. We recommend that, when visiting linked websites, you check their privacy policies to determine whether, and to what extent, personal data is collected, processed, used or disclosed to third parties.