Privacy Policy

Privacy Policy

We are very pleased that you are interested in our company. Data protection is of particularly high importance to the management of CAPRIUM. In principle, CAPRIUM's websites can be used without providing any personal data. However, if a data subject wishes to use special services offered by our company via our website, the processing of personal data may be required. If the processing of personal data is required and there is no legal basis for such processing, we generally obtain the consent of the data subject.
The processing of personal data, such as a data subject's name, address, email address, or telephone number, is always carried out in accordance with the General Data Protection Regulation and in compliance with the data protection regulations applicable to CAPRIUM in the relevant country. Through this privacy policy, our company wishes to inform the public about the type, scope, and purpose of the personal data we collect, use, and process. Furthermore, this privacy policy informs data subjects about their rights.
As the data controller, CAPRIUM has implemented numerous technical and organizational measures to ensure the most comprehensive possible protection of the personal data processed via this website. Nevertheless, internet-based data transmissions may generally contain security vulnerabilities, so that absolute protection cannot be guaranteed. For this reason, every data subject is free to submit personal data to us by alternative means, for example by telephone.

1. Definitions

CAPRIUM's privacy policy is based on the terminology used by the European legislator when enacting the General Data Protection Regulation (GDPR). Our privacy policy is intended to be easy to read and understand for both the public and our customers and business partners. To ensure this, we would like to explain the terminology used in advance.

We use the following terms in this privacy policy, among others:

a) Personal data
Personal data means any information relating to an identified or identifiable natural person (hereinafter "data subject"). A natural person is considered identifiable if they can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.

b) Data subject
A data subject is any identified or identifiable natural person whose personal data is processed by the data controller.

c) Processing
Processing means any operation or set of operations carried out whether or not by automated means relating to personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval or consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

d) Restriction of processing
Restriction of processing means marking stored personal data with the aim of restricting its future processing.

e) Profiling
Profiling means any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

f) Pseudonymisation
Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without additional information, provided that such additional information is kept separately and is subject to technical and organisational measures ensuring that the personal data are not attributed to an identified or identifiable natural person.

g) Controller or data controller
A controller or data controller is the natural or legal person, authority, body or other entity that alone or jointly with others determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are laid down by Union or Member State law, the controller may be designated in accordance with Union or Member State law, or the criteria for its designation may be laid down in accordance with Union or Member State law.

h) Processor
A processor is a natural or legal person, authority, body or other entity that processes personal data on behalf of the controller.

i) Recipient
A recipient is a natural or legal person, authority, body or other entity to whom personal data is disclosed, regardless of whether it is a third party or not. However, authorities that may receive personal data under a specific investigation mandate under Union or Member State law are not considered recipients.

j) Third party
A third party is a natural or legal person, authority, body or other entity other than the data subject, controller, processor, and persons authorised to process the personal data under the direct responsibility of the controller or processor.

k) Consent
Consent means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they signify agreement to the processing of personal data relating to them, expressed by a statement or by a clear affirmative action.

2. Name and contact details of the data controller and the company data protection officer
This privacy notice applies to data processing by:

CAPRIUM
Cavit Ilgöy
Egerstraße 1
63667 Nidda
Telephone: 06043 9849389
Web: https://www.caprium.de/
Email: info@caprium.de
Managing Director: Cavit Ilgöy
Competent court: Amtsgericht Büdingen

CAPRIUM's company data protection officer can be reached at the above address or by email at info@caprium.de.

3. Collection and storage of personal data, as well as the type and purpose of its use

a) When visiting the website

When you access our website www.caprium.de, information is automatically sent to our website's server by the browser used on your device. This information is temporarily stored in a so-called log file. The following information is collected without your involvement and stored until it is automatically deleted:

  • IP address of the requesting computer,
  • Date and time of access,
  • Name and URL of the file accessed,
  • Website from which access was made (referrer URL),
  • browser used and, if applicable, your computer's operating system and the name of your access provider.

We process the data mentioned above for the following purposes:

  • Ensuring a smooth connection to the website,
  • Ensuring a convenient use of our website,
  • Evaluating system security and –stability,
  • Statistical analysis
  • Ensuring the continuous functionality of information technology systems and technology

The legal basis for data processing is Art. 6(1) lit. f GDPR. Our legitimate interest follows from the purposes of data collection listed above. In no case do we use the collected data for the purpose of drawing conclusions about you.
Furthermore, we use cookies and analysis services when you visit our website. Further explanations on this can be found in sections 4 and 5 of this privacy policy.


  1. b) When signing up for our newsletter

If you have expressly consented in accordance with Art. 6(1) lit. a GDPR, we use your email address to regularly send you our newsletter. Providing an email address is sufficient to receive the newsletter.
When signing up for the newsletter, we also store the IP address assigned by the internet service provider (ISP) to the computer system used by the data subject at the time of sign-up, as well as the date and time of sign-up. The collection of this data is necessary to trace the (possible) misuse of a data subject's email address at a later time and therefore serves to legally protect the data controller. The personal data collected as part of a newsletter sign-up is used exclusively to send our newsletter. Furthermore, newsletter subscribers may be informed by email if this is necessary for the operation of the newsletter service or for a related registration, such as in the event of changes to the newsletter offer or changes in the technical circumstances. No personal data collected as part of the newsletter service is passed on to third parties. The data subject can cancel the subscription to our newsletter at any time. The consent given by the data subject to us for the storage of personal data for the purpose of sending the newsletter can be revoked at any time. Unsubscribing is possible at any time, for example via a link at the end of every newsletter. Alternatively, you can also send your request to unsubscribe to info@caprium.de by email at any time.

  1. b) When using our contact form

For any questions, we offer you the option of contacting us via a form provided on the website. A valid email address is required so that we know who the request came from and can answer it. Further information may be provided voluntarily. The processing of data for the purpose of contacting us is carried out on the basis of your voluntarily given consent in accordance with Art. 6(1) lit. a GDPR. The personal data we collect for the use of the contact form will be automatically deleted after we have dealt with your request.

 

  1. c) Registration on our website

The data subject has the option to register on the data controller's website by providing personal data. Which personal data is transmitted to the data controller in this context is evident from the respective input mask used for registration. The personal data entered by the data subject is collected and stored exclusively for internal use by the data controller and for its own purposes. The data controller may arrange for the transmission of the personal data to one or more processors, for example a parcel service provider, which also uses the personal data exclusively for internal purposes attributable to the data controller.
Registration on the data controller's website also stores the IP address assigned by the data subject's internet service provider (ISP), the date, and the time of registration. This data is stored on the basis that this is the only way to prevent the misuse of our services, and that this data may enable the investigation of committed crimes if necessary. In this respect, the storage of this data is necessary to protect the data controller. This data is generally not passed on to third parties unless there is a legal obligation to do so or the disclosure serves the prosecution of crimes.
The registration of the data subject by voluntarily providing personal data allows the data controller to offer the data subject content or services that, due to the nature of the matter, can only be offered to registered users. Registered persons are free to change the personal data provided during registration at any time or have it completely deleted from the data controller's data records.
The data controller will provide every data subject with information upon request at any time about which personal data about the data subject is stored. Furthermore, the data controller will correct or delete personal data at the request or indication of the data subject, unless there are legal retention obligations to the contrary. The entire staff of the data controller is available to the data subject as a contact person in this context.

  1. Routine deletion and blocking of personal data

The data controller only processes and stores the data subject's personal data for the period necessary to achieve the purpose of storage or as provided for by the European legislator or another legislator in laws or regulations to which the data controller is subject.

If the purpose of storage no longer exists or a storage period prescribed by the European legislator or another competent legislator expires, the personal data will be routinely blocked or deleted in accordance with legal requirements.

  1. Data transfer

Your personal data is not transmitted to third parties for purposes other than those listed below.

  1. a) Order processing

Order processing is carried out by the service provider "Afterbuy" (VIA Online GmbH in Krefeld). Your personal data is passed on to "Afterbuy" exclusively for the purpose of processing the online order. Details on data protection at Afterbuy and the privacy policy of VIA Online GmbH can be viewed at the following link: Privacy Policy of VIA Online GmbH.


The personal data we collect is passed on to the transport company commissioned with the delivery as part of contract fulfillment, insofar as this is necessary for the delivery of the goods. We pass on your payment data to the commissioned credit institution as part of payment processing.

b) PayPal

When paying via PayPal, by credit card via PayPal, by direct debit via PayPal, or by "purchase on account" via PayPal, we pass on your payment data as part of payment processing to PayPal (Europe) S.àr.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal"). PayPal reserves the right to perform a credit check for payment methods such as credit card via PayPal, direct debit via PayPal, or "purchase on account" via PayPal. PayPal uses the result of the credit check in terms of the statistical probability of payment default to decide on the provision of the respective payment method. The credit check may contain probability values (so-called score values). Insofar as score values are included in the result of the credit check, they are based on a scientifically recognized mathematical-statistical method. Address data, among other things, is included in the calculation of the score values. Further data protection information can be found in the PayPal Privacy Principles: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

  1. c) Newsletter

    When you sign up for our newsletter, we use the data required for this purpose or separately provided by you to regularly send you our email newsletter in accordance with your consent. Unsubscribing from the newsletter is possible at any time and can be done either by sending a message to the contact option described below or via a link provided for this purpose in the newsletter.

d) Credit check via Klarna and scoring

Klarna checks and evaluates your data entries and, where there is a legitimate interest and reason, maintains data exchange with other companies and credit reporting agencies. Your personal information is treated in accordance with the applicable data protection regulations and in accordance with the information in the Klarna Privacy Policy.

  1. e) Other

We only disclose your personal data to third parties if:

 

  • you have given your explicit consent pursuant to Art. 6(1)(a) GDPR,
  • disclosure is necessary pursuant to Art. 6(1)(f) GDPR for the establishment, exercise or defense of legal claims and there is no reason to believe that you have overriding grounds on which you would object to such disclosure,
  • disclosure is required by law pursuant to Art. 6(1)(c) GDPR, and
  • it is permitted by law and necessary pursuant to Art. 6(1)(b) GDPR for the performance of a contract with you.
  1. Cookies

    This website uses so-called "cookies", which serve to make our online presence more user-friendly, effective and secure overall - for example when it comes to speeding up navigation on our website. In addition, cookies enable us to measure the frequency of page views and general navigation. Cookies are small text files that are stored on your computer system. We inform you that some of these cookies are transferred from our server to your computer system, and these are usually so-called "session cookies". "Session cookies" are characterized by the fact that they are automatically deleted from your hard drive at the end of the browser session. Other cookies remain on your computer system and enable us to recognize your computer system on your next visit (so-called persistent cookies). Of course, you can reject cookies at any time, provided your browser allows this. Please note that certain functions of this website may not be available or may only be available in a limited capacity if your browser is set to not accept any cookies (from our website).

7. Social Media Plug-ins

We use social media plug-ins from the social networks Facebook, Twitter and Instagram on our website pursuant to Art. 6(1)(f) GDPR to make our law firm better known. The underlying advertising purpose is to be regarded as a legitimate interest within the meaning of the GDPR. The responsibility for data-compliant operation lies with their respective providers. We embed these plug-ins using the so-called two-click method to protect visitors to our website as best as possible.

Use of Facebook, Google+, Twitter, Instagram and Pinterest plugins.

So-called social plugins ("plugins") from the social networks Facebook and Google+, and the microblogging services Twitter and Instagram, are used on our website.

 

These services are offered by the companies Facebook Inc., Google Inc., Twitter Inc. and Instagram LLC. ("providers").

 

Facebook is operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (“Facebook”).

You can find an overview of Facebook's plugins and their appearance here

 

Google+ is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google").

You can find an overview of Google's plugins and their appearance here

 

Twitter is operated by Twitter Inc., 1355 Market St, Suite 900, San Francisco, CA 94103, USA ("Twitter").

You can find an overview of Twitter buttons and their appearance here

 

Instagram is operated by Instagram LLC., 1601 Willow Road, Menlo Park, CA 94025, USA ("Instagram").

You can find an overview of Instagram buttons and their appearance here

 

Pinterest is operated by Pinterest Inc., 808 Brannan Street, San Francisco, CA 94103, USA ("Pinterest")

You can find an overview of Instagram buttons and their appearance here


When you visit a page of our website

that contains such a plugin, your browser establishes a direct connection to the servers of Facebook, Google, Twitter or Instagram.

 

The content of the plugin is transmitted directly to your browser by the respective provider and embedded in the page. By embedding the plugins, the providers receive information that your browser has accessed the corresponding page of our website, even if you do not have a profile or are not currently logged in. This information (including your IP address) is transmitted directly by your browser to a server of the respective provider in the USA and stored there.

 

If you are logged in to one of the services, the providers can immediately associate your visit to our website with your profile on Facebook, Google+, Twitter or Instagram. If you interact with the plugins, for example by clicking the "Like", "+1", "Tweet" or "Instagram" button, the corresponding information is also transmitted directly to a server of the providers and stored there. The information is also published in the social network, on your Twitter or Instagram account and displayed there to your contacts. Please refer to the privacy notices of the providers for the purpose and scope of the data collection and the further processing and use of the data by the providers, as well as your rights and options regarding the protection of your privacy.

 

Facebook privacy notices here

 

Google privacy notices here

 

Twitter privacy notices here

 

Instagram privacy notices here

 

If you do not want Google, Facebook, Twitter or Instagram to immediately associate the data collected via our website with your profile in the respective service, you must log out of the corresponding service before visiting our website. You can also completely prevent the loading of the plugins with add-ons for your browser, e.g. with the script blocker "NoScript"

 
  1. Duration for which personal data is stored

The criterion for the duration of storage of personal data is the respective statutory retention period. After the expiry of the period, the corresponding data will be routinely deleted, unless it is no longer required for the performance or establishment of a contract.

10. Legitimate interests in processing pursued by the controller or a third party

If the processing of personal data is based on Art. 6(1)(f) GDPR, our legitimate interest is the conduct of our business activity for the benefit of all our employees and shareholders.

11. Data subject rights

You have the following rights:

a) Right of confirmation

Every data subject has the right granted by the European legislator to request confirmation from the controller of the processing whether their personal data is being processed. If a data subject wishes to exercise this right of confirmation, they can contact an employee of the controller at any time.

b) Right of access

Every person whose personal data is being processed has the right granted by the European legislator to obtain free of charge at any time from the controller information about the personal data stored about them and a copy of this information. Furthermore, the European legislator has granted the data subject the right to obtain information about the following:

 

  • the purposes of the processing
  • the categories of personal data being processed
  • the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations
  • if possible, the planned duration for which the personal data will be stored, or, if this is not possible, the criteria used to determine this duration
  • whether they have the right to rectification or erasure of their personal data or to restriction of processing by the controller, or the right to object to such processing
  • whether they have the right to lodge a complaint with a supervisory authority
  • if the personal data are not collected from the data subject: all available information about the source of the data
  • whether automated decision-making, including profiling, takes place pursuant to Art. 22(1) and (4) GDPR and—at least in such cases—meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject

 

Furthermore, the data subject has the right to obtain information about whether personal data have been transferred to a third country or an international organisation. If this is the case, the data subject also has the right to obtain information about the appropriate safeguards in connection with the transfer. If a data subject wishes to exercise this right of access, they can contact an employee of the controller at any time.

c) Right to rectification

Every person whose personal data is being processed has the right granted by the European legislator to request the immediate rectification of inaccurate personal data relating to them. Furthermore, the data subject has the right, taking into account the purposes of the processing, to request the completion of incomplete personal data—also by means of a supplementary statement.
If a data subject wishes to exercise this right of rectification, they can contact an employee of the controller at any time.

d) Right to erasure (right to be forgotten)

Every person whose personal data is being processed has the right granted by the European legislator to request the controller to erase their personal data without undue delay, provided that one of the following grounds applies and the processing is not necessary:

 

  • The personal data were collected for such purposes or otherwise processed for purposes for which they are no longer necessary.
  • The data subject withdraws their consent on which the processing is based pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing.
  • The data subject objects to the processing pursuant to Art. 21(1) GDPR, and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21(2) GDPR.
  • The personal data have been unlawfully processed.
  • The erasure of the personal data is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
  • The personal data were collected pursuant to Art. 8(1) GDPR in relation to information society services offered.

If one of the above grounds applies and a data subject wishes to arrange for the erasure of personal data stored by CAPRIUM, they can contact an employee of the controller at any time. The CAPRIUM employee will arrange for the request for erasure to be complied with without undue delay.

If the personal data have been made public by CAPRIUM and our company is obliged as the controller pursuant to Art. 17(1) GDPR to erase the personal data, CAPRIUM will, taking into account the available technology and the costs of implementation, take reasonable steps, including technical measures, to inform other controllers who are processing the published personal data that the data subject has requested from those other controllers the erasure of all links to such personal data or of copies or replications of such personal data, unless the processing is necessary. The CAPRIUM employee will do what is necessary in each individual case.

e) Right to restriction of processing

Every person whose personal data is being processed has the right granted by the European legislator to request the controller to restrict the processing if one of the following conditions applies:

 

  • The accuracy of the personal data is contested by the data subject for a period sufficient for the controller to verify the accuracy of the personal data.
  • The processing is unlawful, the data subject objects to the erasure of the personal data and instead requests the restriction of the use of the personal data.
  • The controller no longer needs the personal data for the purposes of the processing, but the data subject needs them for the establishment, exercise or defense of legal claims.
  • The data subject has objected to the processing pursuant to Art. 21(1) GDPR and it has not yet been established whether the controller's legitimate grounds override those of the data subject.

If one of the above conditions applies and a data subject wishes to request the restriction of personal data stored by CAPRIUM, they can contact an employee of the controller at any time. The CAPRIUM employee will arrange for the processing to be restricted.

f) Right to data portability

Every person whose personal data is being processed has the right granted by the European legislator to receive the personal data relating to them, which have been provided by the data subject to a controller, in a structured, commonly used and machine-readable format. They also have the right to transmit these data to another controller without hindrance from the controller to whom the personal data were provided, provided that the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and that the processing is carried out using automated means, provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, when exercising their right to data portability pursuant to Art. 20(1) GDPR, the data subject has the right to obtain from one controller the direct transmission of the personal data to another controller, provided that this is technically feasible and does not adversely affect the rights and freedoms of others. To exercise the right to data portability, the data subject can contact an employee of CAPRIUM at any time.

g) Right to object

Every data subject has the right granted by the European directives and regulations issuer to object at any time to the processing of personal data concerning them, based on reasons arising from their particular situation, which is carried out on the basis of Art. 6(1)(e) or (f) GDPR. This also applies to profiling based on these provisions.
CAPRIUM will no longer process the personal data in the event of an objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing is necessary for the establishment, exercise or defense of legal claims.
If CAPRIUM processes personal data for direct marketing, the data subject has the right to object at any time to the processing of personal data for such marketing purposes. This also applies to profiling in connection with such direct marketing. If the data subject objects to CAPRIUM processing for direct marketing purposes, CAPRIUM will no longer process personal data for these purposes.
In addition, the data subject has the right, based on reasons arising from their particular situation, to object to the processing of personal data concerning them that CAPRIUM carries out for scientific or historical research purposes or for statistical purposes pursuant to Art. 89(1) GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.
To exercise the right to object, the data subject may contact any employee directly. The data subject may also, regardless of Directive 2002/58/EC, exercise their right to object in connection with the use of information society services by means of automated procedures using technical specifications.

h) Right to withdraw consent to data processing

Every data subject has the right granted by the European directives and regulations issuer to withdraw consent to the processing of personal data at any time. If the data subject wishes to exercise their right to withdraw consent, they may contact an employee of the controller responsible for the processing at any time.

12. Right to object

If your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1) sentence 1(f) GDPR, you have the right, pursuant to Art. 21 GDPR, to object to the processing of your personal data if there are reasons arising from your particular situation or if the objection is directed against direct marketing. In the latter case, you have a general right to object, which we will implement without requiring you to state a particular situation.

If you wish to exercise your right of withdrawal or objection, simply send an email to info@caprium.de.

13. Data security

During your visit to the website, we use the widely used SSL (Secure Socket Layer) procedure in combination with the highest encryption level supported by your browser. This is usually 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. You can tell whether an individual page of our website is transmitted encrypted by the closed key or padlock symbol in the status bar at the bottom of your browser.
Furthermore, we use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties. Our security measures are continuously improved in accordance with technological developments.

14. Legal or contractual requirements for providing personal data; necessity for entering into a contract; data subject's obligation to provide personal data; possible consequences of not providing the data

We inform you that the provision of personal data is partly required by law (e.g. tax regulations) or may also arise from contractual arrangements (e.g. information about the contracting partner). In some cases, it may be necessary for the data subject to provide us with personal data that we subsequently have to process in order to enter into a contract. For example, the data subject is obliged to provide us with personal data if our company enters into a contract with them. Failure to provide the personal data would mean that the contract could not be concluded with the data subject. Before providing personal data, the data subject must contact one of our employees. Our employee will inform the data subject on a case-by-case basis whether the provision of personal data is required by law or contract, or is necessary for entering into a contract, whether there is an obligation to provide the personal data, and what the consequences of not providing the personal data would be.

15. Currency and changes to this privacy policy

This privacy policy is currently valid and is up to date as of May 2018. Due to the further development of our website and its offers, or due to changes in legal or regulatory requirements, it may become necessary to change this privacy policy. The current privacy policy can be accessed and printed at any time on the website at www.caprium.de/datenschutz/.