We greatly appreciate your interest in our company. Data protection is of particular importance to the management of K&M Unternehmensberatung UG. The use of the internet pages of K&M Unternehmensberatung UG is generally possible without providing any personal data. However, if a data subject wishes to use special services offered by our company via our website, processing of personal data may become necessary. If the processing of personal data is required and there is no legal basis for such processing, we will generally obtain the consent of the data subject.
The processing of personal data, such as the name, address, email address, or telephone number of a data subject, is always carried out in compliance with the General Data Protection Regulation (GDPR) and in accordance with the country-specific data protection regulations applicable to v8 fitness GmbH. With this privacy policy, we aim to inform the public about the nature, scope, and purpose of the personal data we collect, use, and process. Furthermore, this privacy policy explains the rights of data subjects.
K&M Unternehmensberatung UG, as the data controller, has implemented numerous technical and organizational measures to ensure the most complete protection possible for personal data processed through this website. However, internet-based data transmissions can generally have security gaps, so absolute protection cannot be guaranteed. For this reason, every data subject is free to transmit personal data to us via alternative means, such as by telephone.
1. Definitions
The privacy policy of v8 fitness GmbH is based on the terminology used by the European legislator when adopting the General Data Protection Regulation (GDPR). Our privacy policy should be easy to read and understand for both the public and our customers and business partners. To ensure this, we would like to explain the terms used in advance.
Definitions
In this privacy policy, we use the following terms:
A) Personal Data
Personal data refers to any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”). A natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
B) Data Subject
A data subject is any identified or identifiable natural person whose personal data is processed by the data controller.
C) Processing
Processing refers to any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.
D) Restriction of Processing
Restriction of processing is the marking of stored personal data with the aim of limiting its future processing.
E) Profiling
Profiling refers to any form of automated processing of personal data that involves using this data to evaluate certain personal aspects relating to a natural person, particularly to analyze or predict aspects concerning work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements of that natural person.
F) Pseudonymization
Pseudonymization is the processing of personal data in such a manner that the data can no longer be attributed to a specific data subject without the use of additional information, provided that this additional information is kept separately and is subject to technical and organizational measures that ensure the personal data is not attributed to an identified or identifiable natural person.
G) Controller or Data Controller
The controller or data controller is the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of processing personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its designation may be provided for by Union or Member State law.
H) Processor
A processor is a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.
I) Recipient
A recipient is a natural or legal person, public authority, agency, or other body to whom personal data is disclosed, whether or not they are a third party. However, public authorities that may receive personal data in the framework of a specific investigative task under Union or Member State law are not considered recipients.
J) Third Party
A third party is a natural or legal person, public authority, agency, or other body other than the data subject, the controller, the processor, and those persons who, under the direct authority of the controller or processor, are authorized to process personal data.
K) Consent
Consent is any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.
2. Name and Address of the Data Controller
The controller, within the meaning of the General Data Protection Regulation, other applicable data protection laws in the member states of the European Union, and other provisions of a data protection nature, is:
Birekgroup
28 Kinira
8011 Paphos
Cyprus
Email: office@birekgroup.de
Website: www.birkgroup.de
3. Name and Address of the Data Protection Officer
The company has appointed Mr. Nenad Birek from Birekdatasystems as an external data protection officer. He carries out his activities in accordance with Articles 38 and 39 of the GDPR.
You can contact our data protection officer at any time regarding data protection concerns:
Email: verwaltung@birek.de
Website: www.fitnessstudioschlüsselfertig.com
Any data subject can contact our data protection officer at any time with questions or suggestions regarding data protection.
4. Cookies
The websites of K&M Unternehmensberatung UG use cookies. Cookies are text files that are stored and saved on a computer system via an internet browser.
Numerous websites and servers use cookies. Many cookies contain a unique identifier known as a cookie ID. A cookie ID is a unique string of characters that allows websites and servers to associate the cookie with the specific internet browser in which it was stored. This enables the visited websites and servers to distinguish the user’s browser from other browsers that contain different cookies. A specific browser can therefore be recognized and identified using its unique cookie ID.
By using cookies, K&M Unternehmensberatung UG can provide users with more user-friendly services that would not be possible without cookies.
Through cookies, information and offers on our website can be optimized to benefit the user. As mentioned above, cookies allow us to recognize visitors to our website. The purpose of this recognition is to make the use of our website easier for users. For example, a website that uses cookies eliminates the need for a user to enter login credentials every time they visit, as this information is handled by the website and the cookie stored on the user’s computer. Another example is a shopping cart cookie in an online store, which remembers the items placed in the cart.
Users can disable the use of cookies at any time by adjusting their internet browser settings, thereby permanently rejecting cookies. Additionally, already stored cookies can be deleted at any time through the internet browser or other software programs. This is possible in all common internet browsers. However, if users disable cookies in their browser, some features of our website may not function properly.
5. Collection of General Data and Information
Each time a user or an automated system accesses the K&M Unternehmensberatung UG website, a series of general data and information is collected. This general data and information are stored in the server log files and may include:
The browser types and versions used
The operating system used by the accessing system
The website from which the user accessed our website (so-called referrer)
The subpages visited on our website
The date and time of access
An Internet Protocol (IP) address
The internet service provider of the accessing system
Other similar data and information that serve to protect our IT systems in the event of cyberattacks
When using this general data and information, K&M Unternehmensberatung UG does not draw any conclusions about the data subject. Instead, this information is required to:
Correctly deliver the content of our website
Optimize the content of our website and related advertisements
Ensure the long-term functionality of our IT systems and website technology
Provide law enforcement authorities with the necessary information in case of a cyberattack
These anonymously collected data and information are statistically analyzed by K&M Unternehmensberatung UG to improve data protection and security, ultimately ensuring an optimal level of protection for the personal data we process. The anonymous data from the server log files is stored separately from all personal data provided by users.
6. Contact Options via the Website
Due to legal regulations, the K&M Unternehmensberatung UG website includes contact information that allows users to quickly reach our company electronically, including a general email address. If a data subject contacts the controller via email or a contact form, the personal data transmitted voluntarily by the data subject will be automatically stored.
Such personal data transmitted to the controller will be stored for the purpose of processing or contacting the data subject. These personal data will not be disclosed to third parties.
7. Routine Deletion and Blocking of Personal Data
The controller processes and stores personal data only for the period necessary to achieve the purpose of storage or as required by European directives, regulations, or other legal provisions to which the controller is subject.
If the storage purpose ceases to apply or a legally required retention period expires, personal data will be routinely blocked or deleted in accordance with legal requirements.
8. RIGHTS OF THE DATA SUBJECT
A) Right to ConfirmationEvery data subject has the right granted by the European legislator to obtain confirmation from the controller as to whether personal data concerning them is being processed. If a data subject wishes to exercise this right, they may contact any employee of the controller at any time.
B) Right to AccessEvery data subject affected by the processing of personal data has the right, granted by the European legislator, to obtain free information at any time from the controller regarding the personal data stored about them and to receive a copy of this information. Furthermore, the European legislator has granted the data subject access to the following information:
The purposes of processing
The categories of personal data processed
The recipients or categories of recipients to whom the personal data has been or will be disclosed, particularly recipients in third countries or international organizations
If possible, the planned duration of data storage or, if not possible, the criteria used to determine that duration
The existence of a right to rectification or erasure of personal data concerning them, or to restrict processing by the controller, or to object to such processing
The existence of a right to lodge a complaint with a supervisory authority
If personal data was not collected from the data subject: all available information on the data source
The existence of automated decision-making, including profiling as per Article 22(1) and (4) GDPR, and—at least in these cases—meaningful information about the logic involved and the scope and intended impact of such processing for the data subject
Additionally, the data subject has the right to be informed whether their personal data has been transferred to a third country or an international organization. If so, the data subject also has the right to be informed about the appropriate safeguards related to the transfer.
If a data subject wishes to exercise this right of access, they may contact any employee of the controller at any time.
C) Right to RectificationEvery data subject affected by the processing of personal data has the right, granted by the European legislator, to demand immediate rectification of inaccurate personal data concerning them. Additionally, the data subject has the right to request the completion of incomplete personal data—including by means of a supplementary statement—considering the purposes of processing.
If a data subject wishes to exercise this right to rectification, they may contact any employee of the controller at any time.
D) Right to Erasure (Right to be Forgotten)Every data subject affected by the processing of personal data has the right, granted by the European legislator, to request the immediate erasure of personal data concerning them, provided one of the following reasons applies and processing is not required:
The personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
The data subject withdraws their consent on which the processing was based as per Article 6(1)(a) GDPR or Article 9(2)(a) GDPR, and there is no other legal basis for processing.
The data subject objects to processing as per Article 21(1) GDPR, and there are no overriding legitimate grounds for processing, or the data subject objects to processing as per Article 21(2) GDPR.
The personal data was processed unlawfully.
The erasure of personal data is necessary to comply with a legal obligation under EU or Member State law to which the controller is subject.
The personal data was collected concerning information society services offered per Article 8(1) GDPR.
If one of the above reasons applies and a data subject wishes to request the erasure of personal data stored by K&M Unternehmensberatung UG, they may contact any employee of the controller at any time. The employee of K&M Unternehmensberatung UG will ensure that the request for deletion is complied with immediately.
E) Right to Restriction of ProcessingEvery data subject affected by the processing of personal data has the right, granted by the European legislator, to request the controller to restrict processing if one of the following conditions is met:
The accuracy of the personal data is disputed by the data subject for a period enabling the controller to verify the accuracy of the personal data.
The processing is unlawful, and the data subject opposes the deletion of the personal data and instead requests the restriction of its use.
The controller no longer needs the personal data for processing purposes, but the data subject requires it to assert, exercise, or defend legal claims.
The data subject has objected to processing per Article 21(1) GDPR, and it is not yet clear whether the controller’s legitimate interests override those of the data subject.
If one of these conditions is met and a data subject wishes to request the restriction of personal data stored by K&M Unternehmensberatung UG, they may contact any employee of the controller at any time. The employee will arrange for processing to be restricted.
F) Right to Data PortabilityEvery data subject affected by the processing of personal data has the right, granted by the European legislator, to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used, and machine-readable format. They also have the right to transfer this data to another controller without hindrance from the controller to whom the personal data was originally provided, provided that processing is based on consent per Article 6(1)(a) GDPR or Article 9(2)(a) GDPR or on a contract per Article 6(1)(b) GDPR and processing is carried out by automated means.
Furthermore, in exercising their right to data portability under Article 20(1) GDPR, the data subject has the right to have their personal data transmitted directly from one controller to another where technically feasible and provided that this does not adversely affect the rights and freedoms of others.
G) Right to ObjectEvery data subject affected by the processing of personal data has the right, granted by the European legislator, to object at any time, for reasons arising from their particular situation, to the processing of personal data concerning them under Article 6(1)(e) or (f) GDPR. This also applies to profiling based on these provisions.
If K&M Unternehmensberatung UG processes personal data for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data for such marketing. This also applies to profiling related to direct marketing. If the data subject objects to processing for direct marketing purposes, K&M Unternehmensberatung UG will no longer process the personal data for these purposes.
Each data subject has the right, granted by the European legislator, not to be subject to a decision based solely on automated processing — including profiling — which produces legal effects concerning them or similarly significantly affects them, provided that the decision (1) is not necessary for entering into or performing a contract between the data subject and the controller, or (2) is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the rights, freedoms, and legitimate interests of the data subject, or (3) is based on the explicit consent of the data subject.
If the decision (1) is necessary for entering into or performing a contract between the data subject and the controller, or (2) is based on the explicit consent of the data subject, v8 fitness GmbH shall implement suitable measures to safeguard the rights and freedoms and legitimate interests of the data subject, including at least the right to obtain human intervention on the part of the controller, to express their point of view, and to contest the decision.
If the data subject wishes to exercise their rights regarding automated decisions, they may contact an employee of the controller at any time.
I) RIGHT TO WITHDRAW DATA PROTECTION CONSENT
Every data subject has the right, granted by the European legislator, to withdraw their consent to the processing of personal data at any time.
If the data subject wishes to exercise their right to withdraw consent, they may contact an employee of the controller at any time.
DATA PROTECTION PROVISIONS REGARDING THE USE OF FACEBOOK
The controller has integrated components of the company Facebook on this website. Facebook is a social network.
A social network is an online social meeting place, a virtual community that generally enables users to communicate with each other and interact in virtual space. A social network can serve as a platform for exchanging opinions and experiences or allow the online community to provide personal or business-related information. Facebook allows users of the social network to create private profiles, upload photos, and connect via friend requests.
The operating company of Facebook is Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. If an affected person lives outside the USA or Canada, the controller for the processing of personal data is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Every time a page of this website, operated by the controller, is accessed and contains a Facebook component (Facebook plug-in), the internet browser on the affected person’s IT system is automatically prompted by the respective Facebook component to download a representation of that Facebook component from Facebook. An overview of all Facebook plug-ins can be accessed at https://developers.facebook.com/docs/plugins/?locale=en_US. Through this technical process, Facebook becomes aware of which specific subpage of our website the affected person is visiting.
If the affected person is logged into Facebook at the same time, Facebook recognizes with every visit to our website and during the entire duration of their stay on our website which specific subpage the affected person is visiting. This information is collected through the Facebook component and associated with the affected person’s Facebook account. If the affected person clicks one of the Facebook buttons integrated into our website, such as the "Like" button, or leaves a comment, Facebook assigns this information to the affected person’s personal Facebook user account and stores these personal data.
Facebook receives information through the Facebook component whenever the affected person visits our website while logged into Facebook, regardless of whether they click on the Facebook component or not. If the affected person does not wish for this data transfer to Facebook to occur, they can prevent it by logging out of their Facebook account before accessing our website.
Facebook’s published data policy, available at https://www.facebook.com/about/privacy/, provides information about the collection, processing, and use of personal data by Facebook. It also explains the settings Facebook offers to protect the privacy of the affected person. Additionally, various applications are available that allow users to suppress data transmission to Facebook. These applications can be used by the affected person to prevent data transmission to Facebook.
10. DATA PROTECTION REGULATIONS FOR THE USE OF GOOGLE ADWORDS
The controller has integrated Google AdWords on this website. Google AdWords is an online advertising service that allows advertisers to display ads in Google’s search engine results and the Google advertising network. Google AdWords enables an advertiser to predefine specific keywords, through which an advertisement is only displayed in Google’s search engine results when a user retrieves a keyword-relevant search result. In the Google advertising network, the ads are distributed to topic-related websites using an automatic algorithm and based on the predefined keywords.
The operating company of Google AdWords services is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.
The purpose of Google AdWords is to promote our website by displaying interest-based advertisements on third-party websites and in the search engine results of Google, as well as by displaying third-party advertisements on our website.
If an affected person reaches our website via a Google advertisement, a so-called conversion cookie is placed on the affected person’s IT system by Google. What cookies are has already been explained above. A conversion cookie expires after thirty days and is not used to identify the affected person. The conversion cookie allows tracking of whether certain subpages, such as the shopping cart of an online shop system, have been accessed on our website. Both we and Google can determine whether an affected person who arrived on our website via an AdWords advertisement generated a sale, meaning they completed or abandoned a purchase.
The data and information collected through the use of the conversion cookie are used by Google to create visit statistics for our website. These visit statistics, in turn, help us determine the total number of users referred to us via AdWords advertisements, assess the success or failure of each AdWords advertisement, and optimize our future AdWords campaigns. Neither our company nor other Google AdWords advertisers receive information from Google that could identify the affected person.
The conversion cookie stores personal information, such as the web pages visited by the affected person. Each time our website is accessed, personal data, including the IP address of the internet connection used by the affected person, is transmitted to Google in the United States of America. These personal data are stored by Google in the United States. Google may share these personal data collected through this technical process with third parties.
The affected person can prevent the placement of cookies by our website at any time through an appropriate setting in their internet browser, thereby permanently objecting to the placement of cookies. Such a setting would also prevent Google from placing a conversion cookie on the affected person’s IT system. Additionally, a cookie already set by Google AdWords can be deleted at any time via the internet browser or other software programs.
Furthermore, the affected person has the option to object to interest-based advertising by Google. To do this, they must access the link www.google.de/settings/ads from each internet browser they use and adjust the desired settings.
Further information and the applicable data protection regulations of Google can be found at https://www.google.de/intl/en/policies/privacy/.
11. LEGAL BASIS FOR PROCESSING
Article 6(1)(a) GDPR serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the affected person is a party, as is the case, for example, with processing operations required for the delivery of goods or the provision of another service or consideration, the processing is based on Article 6(1)(b) GDPR. The same applies to processing operations necessary for carrying out pre-contractual measures, such as inquiries about our products or services.
If our company is subject to a legal obligation requiring the processing of personal data, such as fulfilling tax obligations, the processing is based on Article 6(1)(c) GDPR. In rare cases, the processing of personal data may be necessary to protect the vital interests of the affected person or another natural person. This would be the case, for example, if a visitor were injured at our company and their name, age, health insurance details, or other vital information had to be disclosed to a doctor, hospital, or other third parties. In that case, the processing would be based on Article 6(1)(d) GDPR.
Finally, processing operations could be based on Article 6(1)(f) GDPR. This legal basis applies to processing operations that are not covered by any of the aforementioned legal bases, where processing is necessary for the purposes of legitimate interests pursued by our company or a third party, provided that the interests, fundamental rights, and freedoms of the affected person do not override those interests. Such processing operations are particularly permitted because they have been specifically mentioned by the European legislator. The legislator considered that a legitimate interest could be assumed if the affected person is a customer of the controller (Recital 47, Sentence 2 GDPR).
12. LEGITIMATE INTERESTS IN PROCESSING PURSUED BY THE CONTROLLER OR A THIRD PARTY
If the processing of personal data is based on Article 6(1)(f) GDPR, our legitimate interest is to conduct our business activities for the benefit of the well-being of all our employees and shareholders.
13. DURATION FOR WHICH PERSONAL DATA ARE STORED
The criterion for the duration of the storage of personal data is the respective statutory retention period. After the expiration of that period, the corresponding data are routinely deleted, provided they are no longer necessary for the fulfillment of a contract or the initiation of a contract.
14. LEGAL OR CONTRACTUAL REQUIREMENTS FOR PROVIDING PERSONAL DATA; NECESSITY FOR CONTRACT CONCLUSION; OBLIGATION OF THE AFFECTED PERSON TO PROVIDE PERSONAL DATA; POSSIBLE CONSEQUENCES OF NON-PROVISION
We inform you that the provision of personal data is partially required by law (e.g., tax regulations) or may also result from contractual provisions (e.g., details of the contractual partner).
Sometimes, it may be necessary for the conclusion of a contract that an affected person provides us with personal data, which must subsequently be processed by us. For example, the affected person is obliged to provide us with personal data when our company enters into a contract with them. The non-provision of personal data would result in the contract not being concluded with the affected person.
Before providing personal data, the affected person must contact one of our employees. Our employee will inform the affected person on a case-by-case basis whether the provision of personal data is legally or contractually required or necessary for the conclusion of the contract, whether there is an obligation to provide personal data, and what consequences the non-provision of personal data would have.
15. EXISTENCE OF AUTOMATED DECISION-MAKING
As a responsible company, we do not use automated decision-making or profiling.
This privacy policy was created using the privacy policy generator of DGD Deutsche Gesellschaft für Datenschutz GmbH, which operates as an external data protection officer in Düsseldorf, in cooperation with the Cologne-based data protection lawyer Christian Solmecke.