A. General information on data processing
1. Person responsible and data protection officer
2. Principles of data processing and storage period
3. Your rights
4. Safety standards
B. Data processing on the WESTKÜSTE100 Website
1. Log data/log files
2. Cookies, pixels and similar technologies
3. Contact form
Unless another data controller is expressly named for individual services, the data controller within the meaning of the GDPR as well as all other applicable EU data protection provisions (“Controller“) is:
Raffinerie Heide GmbH
Meldorfer Street 43
Every Data Subject can also contact our data protection officer directly at any time with all questions and suggestions regarding data protection. You can reach the data protection officer at the above address and at email@example.com.
Personal data is all data that can be related to you personally, such as your title, name, address, email address, IP address, etc. Your personal data will only be collected and processed by us in accordance with the provisions of the EU General Data Protection Regulation (“GDPR“) and other provisions of European and applicable national data protection law.
Insofar as we obtain your consent for the processing of personal data, Art. 6 (1) (a) GDPR is the legal basis for the processing of personal data. Any consent can be withdrawn by you with effect for the future.
When processing personal data that is required to fulfil a contract with you or your company, Art. 6 (1) (b) GDPR is the corresponding legal basis. This also applies to processing operations that already become relevant pre-contractually.
Insofar as the processing of your personal data is necessary for the fulfilment of a legal obligation, Art. 6 (1) (c) GDPR in conjunction with the relevant national or Union law basis serves as the legal basis for the processing. The national or EU legal basis is specified at the relevant point.
If the processing is necessary to protect a legitimate interest of our company or a third party and your interests, fundamental rights and freedoms do not outweigh our legitimate interest, Art. 6 (1) (f) GDPR serves as the legal basis for the processing.
Supplementary information on specific data processing via the WESTKÜSTE100 Website can be found in the following sections of the data protection declaration.
- Storage and deletion of data
As a matter of principle, we only store personal data for as long as the specific purpose of the storage requires. If the purpose of storage ceases to apply, your data will be deleted or its processing will be restricted.
In addition, it may be that European regulations, applicable national laws or other regulations require us to store the data we process for a longer period. If these storage periods expire, we will delete your data or restrict the processing thereof.
- Recipients of data
We will generally only disclose your personal data to service providers, business partners and other third parties within the framework of the applicable data protection laws and inform you of this in accordance with the legal requirements.
We may disclose personal data to service providers and require them to perform services on our behalf (commissioned processing). In doing so, we comply with the strict applicable national and European data protection regulations. The service providers are subject to our instructions and are subject to strict contractual restrictions regarding the processing of personal data. Accordingly, processing is only permitted insofar as it is necessary for the performance of the services on our behalf or to comply with legal requirements. The rights and obligations of the service providers regarding personal data are specified by us in advance.
We may disclose personal data to another third party if required to do so by law or judicial proceedings, or to provide the services we offer on the WESTKÜSTE100 Website. We may also be required to provide data to a law enforcement or other authority. If the forwarding of data is necessary for the cooperation and thus the provision of services to you or if you declare your consent, we are also authorised to disclose data.
- Web hosting
Our WESTKÜSTE100 Website and thus also your data are hosted by us at Raidboxes GmbH, Hafenstraße 32, 48153 Münster (“Raidboxes“), among others. Raidboxes may only access the data within the scope of our instructions (commissioned processing).
Raidboxes also takes strict technical measures to protect your personal data. Raidboxes will not disclose your personal data to third parties unless the disclosure is necessary for the performance of the agreed services or Raidboxes is required to do so to comply with the law or a valid and binding order of a governmental or regulatory authority. The data transferred for this purpose will be limited to the minimum necessary.
We store the data for no longer than the statutory retention periods.
For more information on data protection at Raidboxes, please visit: https://raidboxes.io/legal/privacy/
- Other categories of recipients
Personal data may be transferred to the following recipients or categories of recipients:
- Courts, authorities or other state institutions, insofar as legal obligations exist
- Internal company recipients (e.g. for purpose-specific processing within the responsible departments)
- Cooperation partners with whom Raffinerie Heide provides services
- Processors within the meaning of Art. 28 GDPR
- Project partners of the WESTKÜSTE100 project
Insofar as we process your personal data, you are a “Data Subject” within the meaning of the GDPR. As a Data Subject, you have the following rights vis-à-vis us:
- Right of access regarding processing
You can request information from us at any time within the framework of the legal provisions as to whether personal data is being processed by us. If this is the case, you have the right to request information about the scope of the data processing (cf. Art. 15 GDPR). Please note that the right of access may be restricted in certain legal circumstances.
- Right of rectification
You have the right to have us correct and/or complete your data if the personal data processed about you is incorrect or incomplete (cf. Art. 16 GDPR).
- Right to restrict processing
If the conditions are met, you can demand the restriction of the processing of your personal data (cf. Art. 18 GDPR).
- Right to erasure
You can demand that we delete the personal data concerning you without delay, provided that the conditions for this are met. The right to erasure does not exist, for example, insofar as the processing is necessary (cf. Art. 17 GDPR).
- Right to information
If you have asserted the right to rectification, erasure or restriction of processing against us, we are obliged to notify all recipients to whom the personal data relating to you has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort. We will inform you of these recipients if you request us to do so (cf. Art. 19 GDPR).
- Right to data portability
You have the right to receive the personal data concerning you that you have provided to us in a structured, common and machine-readable format. You also have the right to transfer this data to another company without hindrance from us, provided that the conditions for this are met (cf. Art. 20 GDPR).
- Right of objection
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6 (1) (f) GDPR (Article 21 (1) of the GDPR). The consequence of the objection is that Raffinerie Heide will no longer process the personal data concerning you, unless Raffinerie Heide can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.
You can inform us about your objection under the following contact details:
Raffinerie Heide GmbH
Meldorfer Street 43
- Right to withdraw consent under data protection law
If you have given consent under data protection law, you can withdraw your consent at any time. The withdrawal of the consent does not affect the lawfulness of the processing carried out on the basis of the consent until the withdrawal (cf. Art. 7 GDPR).
- Right to complain to a data protection supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes applicable data protection laws.
We have implemented appropriate physical, technical and administrative security standards to protect personal data from loss, misuse, alteration or destruction. All service providers and affiliates are contractually bound to maintain the confidentiality of personal data. In addition, they may not use the data for purposes that have not been authorised by us.
Because the security of your data is important, your entire visit is conducted over a secure TLS connection. If personal data is collected, the data transfer is also TLS-encrypted. The TLS encryption process protects your data from unauthorised access on its way through the internet.
Each time you visit the WESTKÜSTE100 Website, our system automatically collects data and information from your device. In particular, the following data is collected:
- the IP address of the requesting device
- the date and time of access
- the website from which the requested file was accessed (referrer URL)
- a description of the browser
- the installed operating system
- the name of the file and the URL of the requested file
- a description of the access provider you use
- your dwell time
- the volume of data transferred
- the access status (i.e. whether the file was transferred or possibly not found, etc.)
The aforementioned data is stored in the log files of our system. As a rule, this data is not stored together with other personal data.
The legal basis for the temporary storage of the data and log files is Art. 6 (1) (f) GDPR. The temporary storage of the data is necessary to enable the delivery of the website. Furthermore, this data is used to optimise our website and to ensure the functionality of the website and the security of our information technology systems. An evaluation of the log files for marketing purposes does not take place.
We will only process the data in log files for as long as necessary for the purpose of the data collection. The data is stored for reasons of system security, e.g. to be able to clarify incidents of misuse, security or malfunctions. Data from log files whose further storage is necessary for evidentiary purposes are generally excluded from deletion until the final clarification of the respective incident and may be passed on to investigating authorities in individual cases if necessary.
Cookies are used when you use our WESTKÜSTE100 Website. Cookies are small text files that are stored on your device when you visit our WESTKÜSTE100 Website. Various information flows to us through the setting of the cookies.
Insofar as we obtain consent for the storage of this information in your terminal device, Section 25 (1) German Telecommunications-Telemedia Data Protection ACT (abbreviated in in German to ‘TTDSG’) is the relevant legal basis for this. The same also applies insofar as the information is accessed that is already stored in your device.
If the sole purpose of the storage or access is to carry out the transmission of a message via a public telecommunications network, the legal basis is Section 25 (2) No. 1 TTDSG.
If the storage or access is absolutely necessary so that we can provide a service that you have expressly requested, Section 25 (2) No. 2 TTDSG is the relevant legal basis.
In the following, we will inform you about the relevant legal bases in the specific case. For the subsequent processing of personal data, we base the processing on one of the legal bases of the GDPR specified in section A.,2.,2.1.
We use the types of cookies listed below on our WESTKÜSTE100 Website.
Technically required cookies
Certain cookies are technically necessary for the proper operation and functioning of our WESTKÜSTE100 Website and the proper display of its content. These “technically necessary cookies” cannot be deselected because without them our website cannot be offered.
- Consent Management Platform – Real Cookie Banner (WordPress Plugin)
To control the cookies and to fulfil our data protection documentation obligations regarding the consent to cookies, we use the Real Cookie Banner consent management platform on the WESTKÜSTE100 Website. The use of the Real Cookie Banner service serves to obtain effective consent.
Processing company: devowl.io GmbH, Tannet 12, 94539 Grafling, Germany
Data processing purposes:
- Compliance with legal obligations
- Storage of consents
- Storage of the reference to the documented consent
- Storage of consents in TCF partners, purposes, special purposes, functions and special functions (if consents are obtained in accordance with TCF)
- Randomly generated pseudonymous unique identification number (Unique User Identifier – UUID) on the server side
- Consent ID (Consecutive identification number of the documented consent)
- Opt-in and opt-out data
- All cookie banner settings at the time of consent
- User interactions with the cookie banner (e.g. click on buttons)
- Technical circumstances related to the consent management of the website visitor (e.g. size of the viewing area).
- Date and time of consent
- Device information
- Browser information (http agent, http referrer, browser type, browser language, browser version, resolution)
- Anonymised IP address
Legal basis: Art. 6 (1) (c) GDPR, Section 25 (2) TTDSG
Place of processing: The web space used by us for the WESTKÜSTE100 Website. Storage on servers of devowl.io GmbH does not take place.
Retention period: Data will only be retained for as long as necessary to fulfil the purpose for which it was collected.
Data protection provisions of the processing company: Further information on data protection at devowl.io can be found at: https://devowl.io/de/wissensdatenbank/real-cookie-banner-datenverarbeitung/ and https://devowl.io/de/datenschutzerklaerung/.
- Objection / Withdrawal
Cookies are stored on your device. You can decide at any time whether to delete the cookies from your device. Through the settings in your browser, you can determine yourself whether the transmission of cookies from your end device to us should be deactivated, restricted or the cookies should even be deleted completely. If you deactivate all cookies for our website, it may no longer be possible to use all the functions of the website to their full extent.
The following list provides more information on how to disable or manage your cookie settings in the browser you are using:
- Safari: http://help.apple.com/safari/mac/8.0/#/sfri11471
- iPhone, iPad or iPod: https://support.apple.com/de-de/HT201265
- Google Chrome: https://support.google.com/chrome/answer/95647?hl=de
- Internet Explorer/Edge: https://support.microsoft.com/de-de/windows/l%C3%B6schen-und-verwalten-von-cookies-168dab11-0753-043d-7c16-ede5947fc64d
- Firefox: https://support.mozilla.org/de/kb/verbesserter-schutz-aktivitatenverfolgung-desktop?redirectslug=enable-and-disable-cookies-website-preferences&redirectlocale=en-US
If you have given your consent to cookies and other technologies, you can therefore withdraw this at any time.
- Social plugins (Facebook, Twitter, LinkedIn and Xing)
Social plugins (“Plugins”) from social networks are used on the WESTKÜSTE100 Website (Facebook, Twitter, LinkedIn and Xing). To increase the protection of your data when visiting our website, the plugins are not integrated into the page without restriction, but only using a special HTML link (so-called “Shariff solution”). This integration ensures that when a page of our website containing such plugins is requested, no connection is yet established with the servers of the provider of the respective social network. If you click on one of the buttons, a new window of your browser opens and opens the page of the respective service provider on which you can click on the Like or Share button for example (if necessary after entering your login data). The purpose and scope of the data collection and the further processing and use of the data by the providers on their pages, as well as your rights in this regard and setting options for protecting your privacy, can be found in the data protection notices of the providers of the respective social networks.
Raffinerie Heide offers you the opportunity to contact Raffinerie Heide via a contact form on the website. If you contact us via the contact form, the data entered in the fields will be transmitted to us and stored. This may include the following personal data in particular:
- Your salutation, your name, your company
- Your email address
- Your enquiry and any personal data you may have entered there.
The following data is also stored at the time you send your message
- Your IP address
- Date and time you contacted us
In some cases, it is necessary to forward your data to third parties in order to be able to process your enquiry in the best possible way by the relevant contact person and the relevant department.
The legal basis for the processing and transmission of the data entered via the contact form is Art. 6 (1) (a), (b) or (f) GDPR. The processing and transmission of the personal data entered in the contact form serves us solely to process your request and contact you. This is in our interest. This may also be a matter of initiating a contract.
The additional personal data processed during the submission process is used to prevent misuse of the contact form and to ensure the security of our information technology systems. The legal basis for the processing of the data is Art. 6 (1) (f) GDPR. We will only process your data for as long as it is necessary for the purpose of the data collection and no legal or contractual archiving obligations conflict with this. The data will be used exclusively for processing the conversation.
The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected and if there are no legal or contractual archiving obligations to the contrary. Data processing for the purpose of processing the inquiry via the contact form is ended in any case when it can be inferred from the circumstances that the matter concerned has been conclusively clarified.