Data privacy

We are delighted that you are interested in our company. Data protection is extremely important to the management team at Beurer GmbH. When you visit our website, we process your personal data (all information which relates to an identified or identifiable natural person) as far as we are permitted to do so under legal provisions or your consent. This data protection information is intended to detail the particulars of our processing of your personal data (referred to as just “data processing” from here on) and your rights as a data subject. In the event of questions regarding the collection, processing or use of your personal data, the disclosure, rectification, restriction or erasure of data as well as revocation of consent that has been granted or objection to a specific use of data, please contact us directly via the contact details in our imprint.

Table of contents

A. Party responsible for processing the data
B. Contact information of the data protection officer
C. Operation and hosting of our website
D. Overview of our processing
E. Contract fulfilment
F. Website usage
G. Communication
H. Your additional rights as a data subject
J. Data security

A. Party responsible for processing the data

The following is responsible for data processing on this website:

Beurer GmbH
Management Board: Marco Bühler, Sebastian Kebbe, Oliver Neuschl
Söflinger Straße 218
89077 Ulm
Germany
Tel.: +49 731-3989-0
E-Mail: shop@sanitas-online.de

B. Contact information of our data protection officer

In the event of questions regarding the collection, processing or use of your personal data, the disclosure, rectification, restriction or erasure of data as well as revocation of consent or objection to a specific use of data, please contact us directly via the following contact details:

Data protection officer
Beurer GmbH
Söflinger Straße 218
89077 Ulm
Germany

Telefon: +49 731-3989-144
E-Mail: datenschutz@beurer.de

C. Operation and hosting of our website

Our website is operated in our name and on our behalf (Art. 28 GDPR) by a full-service e-commerce service provider; they carry out all our data processing related to usage of our website for us. This data processing takes place on the servers of a hosting service provider, which connects the website to the Internet on our behalf. Both service providers are located in Germany.

D. Overview of our data processing

We process data in the following respects:

• When purchasing from us, we process your data that is necessary for establishing and fulfilling a purchase contract (“contract fulfilment”) (details on this below under E.)
• When accessing and surfing on our website (“website usage”), we process your data from and on your end device, which in part may allow for identification of you (details on this below under F.)
• Finally, we process your data if you wish to contact us (“Communication”) for instance by subscribing to our newsletter, rating an item or sending a message to us via the communication methods we provide (details on this below under G.)

E. Contract fulfilment

I. General information about data processing

In the course of your purchase in our online shop, we will ask you for the following information about you:

• Title
• First name;
• Surname;
• Billing/shipping address;
• E-mail address;
• Bank details or credit card details

II. Scope and purposes of processing

The personal data requested from you is processed by us for the following purposes:

• to send you confirmation of receipt and, if necessary, order confirmation with the statutory required information as well as status notifications regarding shipping of the ordered goods
• to process your payment
• to provide you with the invoice for an order
• to send the ordered goods to you
• if need be, to assign cancellations, complaints and other post-contractual queries made by you to be able to assign them to you and your order and process your matter.

If you have voluntarily created a customer account under “Sign in - Register now” we also process this data in order to register you as a customer of Beurer GmbH for future potential visits or purchases in our online shop; this way, you do not need to enter the information required for contract fulfilment again for each subsequent order, and are able to view purchases which have already been processed in your customer account, at any time. In your customer account you can, after logging in, also save products from our online shop as favourites so that you can purchase them at a later date if need be.

III. Data transfer/recipient

The data recipients are the technical operator and hosting service provider for our website (see above under C.). Provided it is necessary for contract fulfilment, your data is also transferred to the companies contracted by us to receive and process your order. Specifically, these are:

• Shipping providers for the purposes of shipping, delivery or pick-up of goods
• The relevant banking establishment/credit institution involved with the payment

If you have selected one of the PayPal payment types or a credit card as the payment type, then for the purposes of further processing of your payment and in the context of assigning our payment claim to PayPal, it will also be necessary to transfer the following personal data to PayPal (Europe) S.á.r.l. & Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg:

• Invoice number;
• Invoice amount;
• Name and delivery address;
• Name and billing address.

IV. Storage duration

If you do not create an account, your data will be blocked following fulfilment of the individual purchase contract, i.e. it is processed by us in only a restricted capacity. This is necessary firstly in the event that you assert claims against us within the statutory limitation periods (generally three years), which we have to assign to you and the business transaction involving you. Secondly, we are commercially and in terms of tax law obligated to store commercial documents which may contain your information for a period of a maximum of ten years. Once these purposes have been fulfilled or the periods have expired, we will erase your data.

If you have voluntarily created a customer account, we process your data therein until you have us delete the customer account.

V. Legal bases for processing

Data processing takes place because it is necessary for contract fulfilment (Art. 6(1)(b) GDPR).

It also takes place in part (sending confirmation of receipt and sharing of required information in distance selling or for consumer credits, transmission for credit assessment) for the purpose of fulfilling a corresponding legal obligation.

If you have created a customer account, we also process your data based on the consent you have granted at the same time (Article 6(1)(a) GDPR).

VI. Right to withdraw

You can withdraw your consent as part of the management of your customer account at any time with effect for the future by notifying us at one of the contact addresses listed above under A. We will then delete your customer account.

F. Website usage

For every visit to our website we process specific personal data from and in part also on your computer/end device. This processing can be divided into the following categories:

• Logging your visit/deployment of functional cookies (details on this below under I.)
• Website usage analysis with Google Analytics (details on this below under II.)
• Implementing tracking technologies for Salesforce (details on this below under V.)
• Integration of SEMKNOX product search (detail on this below under IX.)

I. Logging your visit/deployment of functional cookies

1. General information about data processing

Every time our website is accessed and every time a file is downloaded from our website, the following log data is automatically processed by us:

• Host name of your computer/end device (IP address)
• Date and time of access/download
• Accessed page
• If need be, the name of the downloaded file
• Browser type used
• Operating system of your end device
• The website from which you are visiting us

Additionally, we use functional cookies for the operation of our website. These are small text files which are saved on your computer/end device by us. Firstly, there are session cookies which are only set for the duration of your visit to our website. Persistent cookies are also used. These remain on your computer/end device for longer. Both cookie types contain a characteristic alphanumeric character string which, in the case of persistent cookies, allows for recognition of your browser in the event of a subsequent visit to our website.

2. Scope and purposes of processing

The data is processed by us for the following purposes:

• for identification and defence against attacks on our website
• for determining if your Internet browser supports cookies
• to prevent pop-ups from being shown to you multiple times
• to show you our website in the selected language
• to show you the version of our web page for your selected delivery region

3. Data transfer/recipient

The data recipients are the technical operator and hosting service provider for our website (see above under C.).

4. Storage duration

The data is stored for the following duration:

• Log data: until purpose is fulfilled, maximum three months
• Session cookies: until leaving our website
• Persistent cookies: one year

5. Legal basis

Processing takes place on the basis of our interest in the functionality and security of our website. According to our weighing up of interests, this legitimate interest is not in opposition to prevailing interests or basic rights and basic freedoms of data subjects (Art. 6(1)(f) GDPR). On request we will provide you with additional information about our weighing up of interests

6. Right to object

You have the right to object at any time against this processing due to grounds relating to your particular situation. We will then stop processing the data for these purposes, unless we are able to prove compelling legitimate grounds for processing, which outweigh your interests, rights and freedoms, or the processing is intended for the assertion, execution or defence of legal claims. You can submit your objection to us via the contact information listed above under A. Alternatively, you can manage whether/which type of cookies can be set via your Internet browser's settings. If you do not accept the use of functional cookies, this can result in restrictions to the functionality of our website.

II. Website usage analysis with Google Analytics

1. General information about processing

We use Google Analytics, a web analysis service from Google Ireland Limited (“Google”).

Google uses cookies. These are text files which are saved on your computer/end device and which allow for analysis of your usage of our website. The following information is processed here:

• Browser type
• Operating system
• Last visited website
• Host name of your computer/end device (IP address, shortened)
• Time of request on our server

2. Scope and purposes of data processing

On our behalf, Google processes the information collected via the cookie in order to evaluate your usage of our website, to compile reports on website activities and to render additional services linked to website and Internet usage to us. In doing so, we forego the processing of data which can be used to identify you. In particular, the set cookie contains no user ID. The IP address transferred within the scope of Google Analytics from your browser is not linked with other Google data.

3. Data transfer/recipient

The information generated via the cookie about your usage of our website will be transferred to Google Ireland Limited and in general also to a server of Google LLC (which is associated with Google Ireland Limited) in the USA and stored there. By deactivating the user ID function and activating IP anonymisation (shortening of IP address by the last octet), the data can no longer be associated with your connection or computer/end device.

Google LLC is certified under the so-called EU-U.S. Privacy Shield. Due to a decision by the European Commission, personal data may be transferred to correspondingly certified companies with an adequate level of protection.

4. Storage duration

The processed data is stored for a duration of 14 months and then erased by Google.

5. Legal basis for processing

Data processing takes place based on our interest in the statistical evaluation of usage and the efficiency of our website derived from it. According to our weighing up of interests, this legitimate interest is not in opposition to prevailing interests or basic rights and basic freedoms of data subjects (Art. 6(1)(f) GDPR). On request we will provide you with the information used as the basis of the weighing up of interests.

6. Right to object

You have the right, due to grounds arising from your particular situation, to submit an objection to this processing at any time. We will then stop processing the data for these purposes, unless we are able to prove compelling legitimate grounds for processing, which outweigh your interests, rights and freedoms, or the processing is intended for the assertion, execution or defence of legal claims. You can prevent the collection of data which is generated through the cookie and related to your usage of the website as well as its processing by Google by moving the slider for website usage analysis in the cookie banner (appears when our website is accessed; is also located above on this page) from right (green) to left (grey), or by downloading and installing the browser plug-in from the link below: http://tools.google.com/dlpage/gaoptout?hl=de. Alternatively or in browsers on mobile devices, you can also click here to prevent collection by Google Analytics on this website for the future (the opt-out function only works in the browser and only for this domain). In doing so, the opt-out cookie is saved to your end device. If you delete your cookies in this browser, you must click on the link again. Finally, there is the option to prevent cookies from being set in your browser settings. If you do not accept the use of functional cookies, this can result in restrictions to the functionality of our website.

III. Use of tracking technologies from Salesforce

1. General information about data processing

We use salesforce.com EMEA Limited, a supplier of cloud computing solutions for companies, which is located in London. Salesforce uses cookies. These are text files which are saved on your computer/end device and which allow for analysis of your usage of our website. In doing so, actions, movements on the website as well as information about the cart are collected.

2. Scope and purposes of data processing

On our behalf, Salesforce and the service providers used process the information collected via the cookie in order to evaluate your usage of our website, to compile reports about website activities and to render additional services linked with the website and Internet usage to us.

3. Data transfer/recipient

The information generated via the cookie about your usage of our website is generally transferred to a server of Salesforce and stored there. Currently (as of January 2019) the data is stored in one of the data centres of Salesforce listed here:

• Chicago, Illinois, United States (USA)
• Dallas, Texas, United States (USA)
• Frankfurt, Germany (GER)
• Kobe, Japan (JPN)
• London, United Kingdom (UK): London, UK (North) & London, UK (West)
• Paris, France (FRA)
• Phoenix, Arizona, United States (USA)
• Tokyo, Japan (JPN)
• Washington, DC, United States (USA)

Additional information on this can be found at:
https://help.salesforce.com/articleView?id=000257307&language=en_US&type=1

4. Storage duration

The duration of storage is 12 months.

5. Legal basis for processing

Data processing occurs on the basis of your consent (Art. 6 (1)(a) GDPR).

6. Right to withdraw

Your consent to the use of tracking cookies for advertising based on interests applies until it is withdrawn; you can declare this at any time with effect for the future, including as follows: You can prevent the use of tracking cookies for advertisement based on interests by moving the slider for “Marketing” and/or “Analysis” from the left to the right respectively. You can also manage whether tracking cookies are saved at all yourself via your browser settings by refusing cross-website tracking there.

IV. Use of Google reCAPTCHA

1. General information about processing

Im Rahmen von Formularabfragen auf unserer Website verwenden wir den Dienst reCAPTCHA der Google Ireland Ltd. (Google). Dabei werden folgende Daten von Ihnen verarbeitet:

2. Scope and purposes of processing

The service (using the above-listed collected data and, if need be, the image detection tasks presented) is used by us in order to ensure that subsequent form entries are from a natural person and not from a bot.

Additional information about the scope of data processing and data protection when using Google products can be found here

3. Data transfer/recipient

Data recipient is Google Ireland Limited and Google LLC (associated with Google Ireland Limited) in the USA.

Google LLC is certified under the so-called EU-U.S. Privacy Shield. Due to a decision by the European Commission, personal data may be transferred to correspondingly certified companies with an adequate level of protection.

4. Storage duration

The data is stored until the purpose is fulfilled and then erased.

5. Legal bases for processing

Data processing takes place based on our interest in the security of our website and the exclusion of improper automated input of fake data. According to our weighing up of interests, this legitimate interest is not in opposition to prevailing interests or basic rights and basic freedoms of data subjects (Art. 6(1)(f) GDPR). On request we will provide you with additional information about our weighing up of interests.

6. Right to object

You have the right, due to grounds arising from your particular situation, to submit an objection to this processing at any time. We will then stop processing the data for these purposes, unless we are able to prove compelling legitimate grounds for processing, which outweigh your interests, rights and freedoms, or the processing is intended for the assertion, execution or defence of legal claims. You can submit your objection to us via the contact information listed above under A.

G. Communication

I. Newsletter

1. General information about processing

You can voluntarily subscribe to our e-mail newsletter service on our website by entering your personal information (including your e-mail address) in the input field and then clicking on the “Subscribe!” button.

Subscription to the newsletter and your consent required for this is first effective once you have confirmed it by clicking on the link which was sent to the e-mail address you entered (so-called double-opt-in process).

When you give your consent, this is logged by us in a log file. The following information is processed here:

2. Scope and purposes of processing

We process the e-mail address you confirmed in order to share information with you through our e-mail newsletter at irregular intervals, per the consent given to us.

The logging of your consent occurs so that we can prove we have received this.

3. Data transfer/recipient

The data recipients are the technical operator and hosting service provider for our website (see above under C.) and the newsletter service provider, salesforce.com EMEA Limited (located in London), commissioned by us (Art. 28 GDPR).

Currently (as of January 2019) the data is stored in one of the data centres of Salesforce listed here:

Additional information on this can be found at: https://help.salesforce.com/articleView?id=000257307&language=en_US&type=1

4. Storage duration

We save your e-mail address and the log data about your consent until you unsubscribe from the newsletter. The log data will then be saved by us for the duration of the statutory period of limitation for your claims (three years) plus a safety margin of one month for legal notifications, a total therefore of 37 months.

5. Legal basis for processing

Processing occurs on the basis of your consent (Art. 6 (1)(a) GDPR).

6. Right to withdraw

Your newsletter consent is valid until withdrawn; you can do this at any time with effect for the future, either through notifying us via the contact information listed under A. above, or by clicking on the unsubscribe link which you can find at the very bottom of each newsletter.

II. Establishment of contact

1. General information about processing

You can contact us via the contact information listed above under A. or via our contact form. In doing so, the data which you have shared with us in your message is processed by us, i.e. your specific matter and, for e-mail requests your e-mail address, for letters your postal address, for telephone calls your telephone number and, when using our contact form, the following data depending on the matter:

• Your name
• Your e-mail address
• Selected subject of the message
• Your message
• If need be, order number
• If need be, customer number
• If need be, item number(s)
• If need be, uploaded file(s)
• If need be, uploaded photo(s)

2. Scope and purposes of processing

We process your data in order to process your request and to contact you with the purpose of responding.

3. Data transfer/recipient

The data recipients are the technical operator and hosting service provider for our website (see above under C.).

4. Storage duration

We store your data for the duration of the statutory retention period for commercial letters of six years (Section 147 Fiscal Code of Germany).

5. Legal bases for processing

Processing occurs on the legal basis of the execution of pre-contractual measures or for contract fulfilment (Art 6(1)(b) GDPR). Insofar that it is not in regards to pre-contractual or contractual matters, the legal basis is our legitimate interest in the processing of your request. We assume that no prevailing interests or basic rights and freedoms of yours are in opposition (Art. 6(1)(f) GDPR). On request we will provide you with additional information about our weighing up of interests.

6. Right to object

You have the right to object at any time against this processing due to grounds relating to your particular situation. We will then no longer process the data for these purposes and, if need be, no longer answer your request. You can submit your objection to us via the contact information listed above under A.

III. Item rating

1. General information about data processing

You can share your opinion of individual items in our online shop using the link “Rate now!”. In doing so, the following data is processed by us:

• Number of stars you give the item
• Your e-mail address
• Your comment

2. Scope and purposes of data processing

We process your data in order to publish your rating on our website. We process your e-mail address to ensure that the rating is genuine, i.e. was made by a human and not a computer program (bot).

3. Data transfer/recipient

The data recipients are the technical operator and hosting service provider for our website (see above under C.).

4. Storage duration

Your rating is stored in the online shop for an indefinite period time. Your e-mail address will, however, be anonymised after two months.

5. Legal basis for processing

Data processing occurs due to our interest in increasing the attractiveness of our product presentation through supplementation with customer experience. This legitimate interest is not in opposition to your prevailing interests or basic rights and freedoms (Art. 6 (1)(f) GDPR). On request we will provide you with additional information about our weighing up of interests.

6. Right to object

You have the right to object at any time against this processing due to grounds relating to your particular situation. We will then stop processing the data for these purposes, unless we are able to prove compelling legitimate grounds for processing, which outweigh your interests, rights and freedoms, or the processing is intended for the assertion, execution or defence of legal claims. You can submit your objection to us via the contact information listed above under A.

IV. Item availability notification service

1. General information about processing

Should an item displayed in our online shop be temporarily unavailable, you can provide an e-mail address via the notification function to which we will send an automatic e-mail notification once the item in question becomes available again. When using the notification function, the following data is processed:

• Your e-mail address
• Item in question

The submission of your data is voluntary. If, however, you do not submit this data, we cannot make the notification function available to you.

2. Scope and purposes of processing

We process your personal data in order to process your request and to contact you for this purpose.

3. Data transfer/recipient

The data recipients are the technical operator and hosting service provider for our website (see above under C.).

4. Storage duration

We store the data you share with us until you have been answered. If the item in question does not become available again within six months, your data will automatically be erased and no notification will take place.

5. Legal bases for processing

Data processing takes place because it is necessary for carrying out pre-contractual measures (Art. 6(1)(b) GDPR). Insofar that it is not in regards to a pre-contractual matter, the legal basis is our legitimate interest in the processing of your request. We assume that no prevailing interests or basic rights and freedoms of yours are in opposition (Art. 6(1)(f) GDPR). On request we will provide you with additional information about our weighing up of interests.

6. Right to object

You have the right to object at any time against this processing due to grounds relating to your particular situation. We will then no longer process the data for these purposes and, if need be, no longer answer your request. You can submit your objection to us via the contact information listed above under A.

H. Your additional rights as data subject of data processing

In regards to your personal data you have (in addition to the rights listed above in the context of the respective data processing), the following additional rights as well:

• Right to access: you can request access to the personal data belonging to you which we have processed. The specifics regarding the scope of your right to access can be found in Art. 15 GDPR and Section 34 of the German Federal Data Protection Act (2018).
• Right to lodge a complaint with a supervisory authority: you can also contact a supervisory authority with a complaint. The specifics regarding your right to complain can be found in Art. 77 GDPR.
• Right to data portability: you can, under specific conditions, request that we transfer your personal data which you have already provided to us, either to you or another responsible party in a commonly used, machine-readable format. The specifics regarding the scope of your right to data portability can be found in Art. 20 GDPR.
• Right to restriction: you can, under specific circumstances, request the restriction of processing of your personal data by us. The specifics regarding the scope of your right to restriction can be found in Art. 18 GDPR.
• Right to erasure: you can, under specific conditions, request that we erase your personal data. The specifics regarding the scope of your right to erasure can be found in Art. 17 GDPR.
• Right to rectification: you can request that we rectify incorrect and complete incomplete personal data. The specifics regarding the scope of your right to rectification can be found in Art. 16 GDPR.

J. Data security

The personal data we request of you on our website will be transmitted to us via a secure SSL connection (secure socket layer) with 256-bit encryption, so that it is protected against unauthorised access.

We also take additional technical and organisational security precautions in order to prevent the loss, destruction and misuse of data. Access to the customer account you created (if applicable) is only possible through entry of your personal password. You yourself can contribute to the protection of your data by selecting as secure a password as possible (i.e. through a combination of letters, numbers and symbols) and keeping it strictly confidential.