Privacy policy

General information

The following notes explain how we process personal data when you visit our website or contact us. Personal data is information relating to an identified or identifiable person, for example your name, your email address or your IP address.

Who is responsible for data processing?

The controller for data processing on this website is HVH 360 GmbH. You will find the full contact details in section 3 of this privacy policy.

How do we collect your data?

We receive data that you give us, for example through a contact form, when subscribing to a newsletter, by email or by phone.

When you use our website, technical data is also processed to the extent necessary to provide and secure the website. This may include your IP address, information about your browser and operating system, and the time of access.

Further processing by optional services takes place as described in this privacy policy and, where required, only after your consent.

What do we use your data for?

We process data to provide and secure our website, to handle your enquiries and to carry out pre-contractual measures or existing contracts.

Where you consent, we also use data for the optional functions described and for sending the newsletter.

What rights do you have?

Within the scope of the legal requirements, you have the rights of access, rectification, erasure, restriction of processing and data portability. You can withdraw consent and object to certain processing.

You can also lodge a complaint with a data protection supervisory authority. Details can be found in section 3.

External hosting

Our website is operated by an external service provider:

ALL-INKL.COM (Neue Medien Münnich), Hauptstraße 68, 02742 Friedersdor

During hosting, data is processed that is necessary to provide the website and its functions. This may include IP addresses, access data and data that you transmit via the website.

The processing for the secure and reliable provision of our website is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR (DSGVO).

Where the processing is necessary to perform a contract or to handle a pre-contractual enquiry initiated by you, it takes place pursuant to Art. 6(1)(b) GDPR.

Server log data

When you access our website, the following data in particular may be recorded in server logs:

• IP address
• date and time of access
• page or file requested
• amount of data transferred and HTTP status
• browser type and operating system
• previously visited page, where it is transmitted as a referrer

The processing serves the technical provision of the website, error analysis and the defence against attacks. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in a secure and functioning website.

Retention period: 6 months.

Controller

The controller for the processing of personal data on this website is:

HVH 360 GmbHBartelsstraße 120357 HamburgGermanyRepresented by the managing director André KeevePhone: +49 5451 95497-0Email: info@handelsvertreter-heroes.de

The controller is the natural or legal person who decides on the purposes and means of the processing of personal data.

Legal bases for processing

We process personal data in particular on the following bases:

• Art. 6(1)(a) GDPR: where you have given consent.
• Art. 6(1)(b) GDPR: where the processing is necessary for the performance of a contract or for pre-contractual measures at your request.
• Art. 6(1)(c) GDPR: where the processing is necessary for compliance with legal obligations.
• Art. 6(1)(f) GDPR: where the processing is necessary for the purposes of legitimate interests and your interests and fundamental rights do not override them.

The relevant legal basis is stated for each individual processing operation.

Recipients and service providers

Within our company, only those persons receive personal data who need it for their tasks.

External service providers may process data to the extent necessary for the purposes described. Where a service provider acts as a processor, a contract under Art. 28 GDPR is required.

Further disclosures may take place to comply with legal obligations or to establish, exercise or defend legal claims.

Transfers of data to third countries

For individual services, personal data may be processed outside the European Union or the European Economic Area. Details on recipients, countries and transfer bases are given for the respective service.

A transfer may in particular be based on an adequacy decision pursuant to Art. 45 GDPR or appropriate safeguards pursuant to Art. 46 GDPR.

For US companies that are validly certified for the processing concerned under the EU-US Data Privacy Framework, the corresponding adequacy decision may be relied on. For other recipients, EU standard contractual clauses and, where applicable, supplementary safeguards may be required, for example.

Consent to the use of a service does not automatically replace the required basis for a transfer to a third country.

Retention period

We store personal data only for as long as it is necessary for the respective purpose or statutory retention obligations apply.

After that, we delete the data unless another legal basis permits its further processing. Where data is needed to establish, exercise or defend legal claims, further storage may be necessary.

Specific retention periods are stated for the respective processing operations.

Withdrawal of your consent

You can withdraw any consent you have given at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected.

You can declare the withdrawal using the function offered in each case or via our contact details above.

Objection to the processing of your data

Where we process personal data on the basis of Art. 6(1)(e) or (f) GDPR, you can object at any time on grounds relating to your particular situation. This also applies to profiling based on these provisions.

We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You can object to the processing of your data for direct marketing at any time without giving reasons. This also applies to related profiling. After your objection, we will no longer use the data concerned for direct marketing.

Access, rectification and erasure

Under Art. 15 GDPR, you can request information about the processing of your personal data.

Under Art. 16 GDPR, you can have inaccurate data rectified and incomplete data completed.

Under the conditions of Art. 17 GDPR, you can request the erasure of your data. Statutory retention obligations and other statutory exceptions may prevent erasure.

Restriction of processing

Under the conditions of Art. 18 GDPR, you can request a restriction of processing. This applies in particular if:

• you contest the accuracy of your data, for the duration of our verification;
• the processing is unlawful and you request restriction instead of erasure;
• we no longer need the data but you need it for legal claims;
• you have objected under Art. 21(1) GDPR and the balancing of interests is still pending.

Restricted data may – apart from being stored – only be processed further under the statutory conditions.

Data portability

Under the conditions of Art. 20 GDPR, you can receive data that you have provided to us and that we process by automated means on the basis of consent or a contract in a structured, commonly used and machine-readable format.

You can also request that the data be transmitted directly to another controller, where technically feasible.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority, in particular in the place of your habitual residence, your place of work or the place of the alleged infringement.

For companies based in Hamburg, the following authority is generally responsible:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information)Website: https://datenschutz-hamburg.deEmail: mailbox@datenschutz.hamburg.de

Encryption

Our website uses HTTPS for the encrypted transmission of data between your browser and the web server.

This protects the transmission. However, it cannot guarantee complete protection of all communication, in particular ordinary emails.

Cookies and similar technologies

Our website may use cookies and similar technologies. Cookies are small files that are stored on your device.

Session cookies are usually deleted when the session ends. Other cookies remain stored for a set period or until they are deleted.

Storing information on your device or accessing it generally requires consent under Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act).

An exception applies in particular where the operation is strictly necessary to provide a digital service you have expressly requested (Section 25(2) no. 2 TDDDG).

The subsequent processing of personal data additionally requires a legal basis under the GDPR.

Where consent is required, we use optional analytics, marketing and embedding functions only after your approval. The legal bases are then Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

For necessary processing of personal data, Art. 6(1)(f) GDPR may in particular be relevant. Our legitimate interest lies in a functioning and secure website.

You can change or withdraw your consent via the cookie settings. You can also manage and delete cookies via your browser. Restricting necessary cookies may impair functions of the website.

Consent management

We process your consent decision and the data required to prove it, in order to respect your choice and to be able to prove required consents.

The legal basis for the required proof is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

Where storage on your device is strictly necessary for this purpose, Section 25(2) no. 2 TDDDG applies.

Contact form and contact by email or phone

When you contact us, we process your details and contact data in order to handle your enquiry and any follow-up questions.

Which details are required results from the respective form or your request. Without the details required for processing, we may not be able to answer your enquiry.

For contract-related enquiries or pre-contractual measures initiated by you, Art. 6(1)(b) GDPR is the legal basis.

For other enquiries, the processing is based on our legitimate interest in answering them pursuant to Art. 6(1)(f) GDPR.

We delete the data as soon as your enquiry has been finally dealt with and no further storage is necessary. Statutory retention obligations and storage required to safeguard legal claims remain unaffected.

Links to our profiles

With ordinary links to our social media profiles, no connection to the respective platform provider is established merely by displaying the link.

When you click the link, you leave our website. Data processing on the target platform is governed by its privacy notices.

Instagram embeds

The provider of the Instagram service for users in the European Economic Area is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Embedded Instagram content is only loaded after your consent. In particular, your IP address, browser information and information about your page visit may be transmitted to Meta.

If you are logged in to Instagram, Meta can assign the visit to your user account.

The legal basis is Art. 6(1)(a) GDPR and, where information is stored on or read from your device, Section 25(1) TDDDG.

You can withdraw your consent via the cookie settings.

Instagram privacy notices:

https://privacycenter.instagram.com/policy/

Subscription and sending

For the newsletter, we process your email address and any further data you provide voluntarily. The subscription is verified through a confirmation procedure.

The newsletter is sent on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

You can withdraw your consent at any time via the unsubscribe link in the newsletter or by sending us a message. The lawfulness of the sending carried out so far remains unaffected.

Newsletter service provider

• Provider: Brevo (Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany)
• Purpose: email marketing, newsletter sending, contact management (CRM) and analysis of opening and click behaviour.
• Data collected: email address, name (optional), IP address, time of registration and usage and click behaviour.
• Legal basis: Art. 6(1)(a) GDPR (consent on newsletter subscription) and Art. 6(1)(f) GDPR (legitimate interest in secure and efficient sending).
• Server location: Germany / European Union (EU).

Storage after unsubscribing

After you unsubscribe, your email address is removed from the active mailing list.

Where necessary, we may store proof of your consent to comply with statutory obligations to provide evidence or to defend against legal claims. Depending on the purpose, the legal bases are Art. 6(1)(c) or (f) GDPR.

Where a block list is used, it serves exclusively to prevent further unwanted mailings. The legal basis is our legitimate interest in respecting your unsubscription pursuant to Art. 6(1)(f) GDPR. The necessity of continued storage is reviewed.

If you are logged in to Google, Google can assign information to your account.

The legal basis is Art. 6(1)(a) GDPR and, where information is stored on or read from your device, Section 25(1) TDDDG.

You can withdraw your consent via the cookie settings.

Google privacy notices:

https://policies.google.com/privacy?hl=en

Google Analytics 4

With your consent, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). We use it to understand how our website is used and which pages and channels lead to an enquiry or registration.

Google Analytics is only loaded once you accept analytics in the cookie banner. Until then, no connection to Google is made. We use Google Consent Mode: your choice is passed on to Google, and Google processes data only within that choice.

The data processed includes page views, the source of the visit (e.g. search engine or link), interactions such as button clicks, device and browser information, and an approximate location. Google uses cookies or similar technologies for this. IP addresses are not logged or stored in Google Analytics 4. We do not send names, email addresses, user identifiers or form contents to Google. Google Signals and the collection of user-provided data are disabled.

We also report completions such as a registration or booking from our server to Google Analytics, but only if you have consented and a Google identifier is available. No personal details are transmitted.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw it at any time with effect for the future in the cookie settings. The lawfulness of processing carried out before withdrawal is not affected.

The recipient is Google Ireland Limited. Google may also transfer data to Google LLC in the USA. The transfer relies on the European Commission’s adequacy decision for the EU-US Data Privacy Framework or on standard contractual clauses. A data processing agreement under Art. 28 GDPR is in place with Google.

Data in Google Analytics is deleted after 14 months.

Our own source measurement

With your consent to analytics, we additionally store a random visitor identifier in your browser and in our database, together with details of where your visit came from (source, medium, campaign, referring page, landing page). This lets us see which channels lead to registrations and bookings. If you register later, we link this information to your account.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). The identifier is stored until you withdraw your consent. On withdrawal we delete it and detach it from events already recorded.