Data protection information for the social media channels

PRIVACY POLICY INSTAGRAM-FANPAGE

We appreciate your visit to our Instagram page and inform you in this privacy policy about how personal data is processed in connection with your visit or interactions with our Instagram page or its content. Instagram is an online service for sharing photos and videos that belongs to Facebook. Personal data is any information relating to an identified or identifiable natural person (hereinafter “data subject”).

The legal basis for data protection can be found in the General Data Protection Regulation (GDPR).

1. joint responsibility & contact details:

A controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

If you transmit personal data to us via our Instagram page and we alone decide on the purposes and means of processing, the following applies

SPH Betriebsgesellschaft mbH & Co. KG
Sonnenweg 4a
34508 Willingen (Upland)
Germany
Phone: +49 5632 4080
E-mail: info@schutzhuette.de

sole controller for the processing.

2. information on data processing by Meta Platforms Ireland Ltd

The Instagram Privacy Policy(https://help.instagram.com/519522125107875) specifies the categories of personal data that are processed when using Facebook products(https://www.facebook.com/help/1561485474074139?ref=dp)(see I.), describes in general terms the purposes for which this data is used (see II.) and specifies the categories of recipients to whom this data may be disclosed (see III., IV.). Under the link to the data policy provided, you will also find information on the legal basis for processing this data (see V.) and information on how you can withdraw your consent to the processing of personal data. Further information on the respective legal basis can be found at https://www.facebook.com/about/privacy/legal_bases. In the Data Policy, you will find information on how you can exercise your rights of access, rectification, portability and erasure against Meta Platforms Ireland Ltd (see VI.). In this section, you will also find information about your right to object to certain processing of personal data. You can find more information about your control options in this help article(https://www.facebook.com/help/2069235856423257). In the Data Policy you will also find information about the duration for which personal data is stored and information about the criteria for determining this duration and the possibility of blocking or deleting Instagram accounts (see VII.). The Data Policy refers to Meta Platforms Ireland Ltd’s intention to transfer data to third countries on the basis of the adequacy decisions issued by the European Commission(https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en).

3. information on the use of cookies by Meta Platforms Ireland Ltd

If you visit our Instagram page and your browser allows cookies to be stored, Meta Platforms Ireland Ltd stores information in the form of small text files in your browser’s memory (hereinafter “cookies”) and can access this information when you visit the Facebook platform or a website that integrates Facebook technologies. For more information on the purpose of the cookies used, the integration of these cookies by other websites and your control options in this regard, please refer to the information on Instagram cookies.

We would like to point out that Meta Platforms Ireland Ltd is able to track your user behavior (for registered users across devices) beyond the Instagram platform on other websites by means of the cookies used. This applies both to persons registered with the Instagram platform and to persons not registered there.

We would also like to point out that we have no influence on the data processing carried out by Meta Platforms Ireland Ltd in connection with cookies. It is also possible to visit our Instagram page if you configure your browser so that no cookies are stored by the Facebook platform. Information on how to adjust the settings for cookies in your browser can usually be found in the help section of the browser you are using.

If you are registered or logged in to the Instagram or Facebook platform and want to prevent Meta Platforms Ireland Ltd from linking your visit to our Facebook page to your Instagram or Facebook user account, you should log out of Facebook or deactivate the “stay logged in” function, delete the cookies on your device and close and restart your browser.

4. data processing for interactions on our Instagram page

Our Instagram page offers you the opportunity to react to our posts, comment on them and send us private messages. Please check carefully what personal data you share with us via our Instagram page. If you would like to avoid Facebook processing personal data that you have transmitted to us, please contact us by other means.

In addition to the content you submit, information about your profile, your likes and your posts will be visible to us depending on your privacy settings. You can find out how to change your privacy settings in this help article.

We process your data when you contact us or interact with our website or its content on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest lies in responding to your request. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 para. 1 sentence 1 lit. b GDPR.

We process the data provided by you in this context and which may be accessible to us in order to protect our legitimate interests in contacting and communicating with our interested parties, which predominate in the context of a balancing of interests. This also includes our legitimate interests in data processing in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR.

As far as possible, your data will be deleted when we cease operating our Instagram page. Any further storage of this data by Meta Platforms Ireland Ltd is governed exclusively by the provisions of the Instagram Privacy Policy(https://help.instagram.com/519522125107875) and Instagram Terms of Use(https://help.instagram.com/581066165581870).

5. processing of anonymized data for statistical purposes

We have set up our Instagram page as a business profile and use anonymized page statistics (“Instagram Insights”) provided by Meta Platforms Ireland Ltd, which provide us with insights about visitors to our Instagram page and their interactions with our Instagram page and its content. We do not contribute to the decision on the means and purposes of processing event data used to generate page statistics. The statistics include the following information:

• Reach, page views, dwell time for video contributions
• Interactions such as marking a post with “Like”, commenting or sharing posts
• Demographic data on age, gender and location

We use this data to identify trends. It is not possible for us to link this data back to the individuals who triggered these events.

6 Rights of data subjects

We have summarized the rights of data subjects for you below. The full legal texts can be found in the articles mentioned. This summary does not give rise to any rights over and above those set out in the GDPR.
Data subjects have the following rights vis-à-vis the controller:
Amendment of these data protection provisions

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to implement changes to our services in the privacy policy. The new privacy policy will then apply to your next visit.

• Right to withdraw consent (Art. 7 para. 3 GDPR): You can withdraw your consent to the processing of data at any time with effect for the future
• Right to information (Art. 15 GDPR): You can request information about whether your personal data is being processed. In particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period or criteria for this, the existence of a right to rectification, erasure, restriction of processing, objection or the existence of the right to lodge a complaint. You can also request information about the origin of data that was not collected from you. You can also request to be informed whether there is automated decision-making, whether data is transferred to a third country or to an international organization and on the basis of which guarantees this is done. You may request a copy of the personal data concerning you, provided that this does not adversely affect the rights and freedoms of other persons
• Right to rectification (Art. 16 GDPR): You may request the immediate rectification of incorrect personal data or, taking into account the purposes of the processing, the completion of your stored personal data.
• Right to erasure (Art. 17 GDPR): You may request the deletion of your stored personal data if the purpose of the processing has ceased to exist due to the passage of time or other reasons, you have withdrawn your consent or objected to the processing and there are no overriding reasons for the processing or other legal bases, the legal basis for the data processing is missing or has ceased to exist and the processing is not necessary for the exercise of the right to freedom of expression and information, for the fulfillment of a legal obligation, for reasons of public interest or for the assertion, exercise or defense of legal claims. If we have made your data public, we are obliged to take reasonable steps to inform each recipient that you have requested the deletion of all links to or copies of the personal data concerned.
• Right to restriction of processing (Art. 18 GDPR): You have the right to restriction of processing if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data; the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead; we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims, or if you have objected to processing pursuant to Art. 21 GDPR and it is not yet certain whether our legitimate reasons outweigh your reasons.
• Right to data portability (Art. 20 GDPR): You have the right to receive the personal data you have provided to us on the basis of your consent or a contract concluded with us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller, provided that this does not adversely affect the rights and freedoms of others and is technically feasible.
• Right to object (Art. 21 GDPR): You have the right to object, on grounds relating to your particular situation, to processing which we are carrying out for the purposes of our legitimate interests, except where we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms. You have the right to object at any time to processing that we carry out for direct marketing purposes. Your data may then no longer be processed for these purposes.
• Right to lodge a complaint (Art. 77 GDPR): Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data relating to you infringes data protection regulations.

7. amendment of these data protection provisions

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to implement changes to our services in the privacy policy. The new privacy policy will then apply to your next visit.

PRIVACY POLICY FACEBOOK-FANPAGE

SPH Betriebsgesellschaft mbH & Co KG operates an online presence on Facebook, a so-called Facebook fan page. The following additional information on data processing applies to visits to our fan page. Information on data protection on Facebook in general can be found at https://www.facebook.com/about/privacy/.

1. joint responsibility & contact details:

We are jointly responsible with Facebook for the operation of our Facebook fan page in accordance with Art. 26 GDPR. For this purpose, we have concluded an agreement with Facebook to determine who fulfills which obligations with regard to data protection. This agreement can be accessed here. According to this agreement, Facebook is primarily responsible for providing the data subject with information about the joint processing and enabling them to exercise their data protection rights. Irrespective of this, we hereby inform you about your visit to our fan page.

Our contact details are:

SPH Betriebsgesellschaft mbH & Co. KG
Sonnenweg 4a
34508 Willingen (Upland)
Germany
Phone: +49 5632 4080
E-mail: info@schutzhuette.de

You can reach Facebook at:

Meta Platforms Ireland Ltd
4 Grand Canal Square,
Grand Canal Harbour,
Dublin 2, Ireland

You can reach Facebook online at https://www.facebook.com/about/privacy/.

You can contact Facebook’s data protection officer at
https://www.facebook.com/help/contact/540977946302970.

2. collection and storage of personal data as well as type and purpose and their use:

a) Data collected by Facebook:
If you are a Facebook user, Facebook collects the data described in the Facebook data policy under “What types of information do we collect?”. If you are not a Facebook user, cookies with identifiers, small text files, may still be stored in your browser, which enable so-called tracking of your user behavior.

As a rule, user data is also processed by Facebook for market research and advertising purposes when you visit Facebook. Complex user profiles are created based on user behavior (including when visiting our fan page), which Facebook can use to display personalized advertisements to visitors inside and outside of Facebook. You can also find more information on this in the Facebook data policy.

If you do not agree to this, you can object here (opt-out).

b) Data used by us (“Page Insights”) and legal basis:
Facebook provides us with statistics and usage data that we can use to analyze the use of our fan page (so-called “Page Insights”). This enables us to continuously improve our offer on Facebook. As the operator, we do not make any decisions regarding the processing of Insights data and all other information resulting from Art. 13 GDPR, such as the storage duration of cookies on user devices. The primary responsibility under the GDPR for the processing of Insights data lies with Facebook and Facebook fulfills all obligations under the GDPR with regard to the processing of Insights data.

As the page administrator, we have no other way of evaluating user behavior on our fan page, not even via user tracking. It is also generally not possible for us to identify visitors to the fan page based on the page insights. In particular, in accordance with the agreement, we have no right to demand that Facebook disclose individual visitor data. Identification is only possible for us if we can assign individual profile pictures to “Like” information for the page; however, this is only possible if our fan page has been marked with “Like” by the corresponding visitor and the “Like” information is set to “public”.

You can find out what information Facebook uses to create Page Insights at https://www.facebook.com/legal/terms/information_about_page_insights_data.

The operation of the Facebook fan page and the use of page insights serves our legitimate interest in an effective external presentation and efficient communication with our customers and interested parties. This interest justifies the operation of the page both in relation to the legitimate interests of Facebook users and in relation to visitors to our fan page who do not have a Facebook account. The legal basis is therefore Art. 6 para. 1 sentence 1 lit. f) GDPR.

3. disclosure of data to third parties:

Data collected by Facebook is exchanged and processed within the entire Facebook Group. The Facebook Group also includes Instagram, WhatsApp and Oculus, for example. For example, information collected via Facebook is used to display personalized advertising to the user on Instagram, or information from WhatsApp is used to take action against accounts that send spam via WhatsApp on Facebook. You can find this information in the Facebook data policy(https://www.facebook.com/about/privacy/update) under “How do Facebook companies work together?”.

When Facebook processes data, user data may be transferred outside the European Economic Area (EEA), in particular to the USA.

4. right of objection:

If your personal data is processed on the basis of legitimate interests in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR, you have the right to object to the processing of your personal data in accordance with Art. 21 GDPR, provided that there are reasons for this arising from your particular situation or the objection is directed against direct advertising. In the latter case, you have a general right to object, which will be implemented by us without specifying a particular situation. If you wish to exercise your right of revocation or objection, simply send an e-mail to e-mail.

5. rights of data subjects:

You have the right to withdraw your consent from us at any time. As a result, we may no longer continue the data processing that was based on this consent in the future. In addition, you have the right of access under Art. 15 GDPR, the right to rectification under Art. 16 GDPR, the right to erasure under Art. 17 GDPR, the right to restriction of processing under Art. 18 GDPR and the right to data portability under Art. 21 GDPR. You also have the right to lodge a complaint with a competent data protection supervisory authority (Art. 77 GDPR in conjunction with Section 19 BDSG).

In principle, you can assert your data subject rights against both Facebook and us. Since only Facebook has direct access to your user data, you can assert your data subject rights most effectively against Facebook.