Privacy Policy of PITSS GmbH
Thank you for your interest in PITSS GmbH. Data protection is of utmost importance to the management of PITSS GmbH. While it is possible to use the PITSS GmbH Website without providing any personal data, it may become necessary to process personal data if you wish to use special services provided by the company via the company homepage. In case the processing of personal data is required, although there is no legal basis for such processing, PITSS GmbH will always seek the prior consent of the data subject.
Personal data, such as a data subject’s name, address, email address, or telephone number, will always be processed under the General Data Protection Regulation (GDPR) and the national data protection regulations applicable to PITSS GmbH. With this Privacy Policy, the company aims to inform the public about the nature, scope, and purpose of the personal data collected, used, and processed by PITSS GmbH. Furthermore, this Privacy Policy informs data subjects of their rights.
PITSS GmbH, as the Data Controller (or “Controller” in short), has implemented numerous technical and organisational measures to ensure seamless protection of personal data processed via its Website (the “Website”). Nonetheless, Internet-based data transfers may be subject to security vulnerabilities, meaning that absolute protection cannot be guaranteed. For this reason, every data subject can transmit personal data to PITSS GmbH by alternative means, such as by telephone.
1. Definitions
The Privacy Policy of PITSS GmbH relies on the terminology adopted by the European legislators in Article 4 of the General Data Protection Regulation (GDPR). It is intended to be easily read and understood by the public, customers, and business partners.
2. Name and address of the Controller
The Controller, as defined in the General Data Protection Regulation, other data protection laws applicable in the Member States of the European Union, and other provisions related to data protection, is:
PITSS GmbH
Wankelstrasse 3
70563 Stuttgart
Germany Phone: +49 711/914012-0
Email: vertrieb@pitss.de
3. Contact details of the Data Protection Officer
The Data Protection Officer of the Controller can be contacted at:
PITSS GmbH
Michael Kröz Wankelstrasse 3
70563 Stuttgart
Germany
Phone: +49 711/914012-16
Email: datenschutz@pitss.de
Any data subject may, at any time, contact the Data Protection Officer of PITSS GmbH directly in all matters relating to data protection.
4. Cookies
PITSS GmbH’s Website uses cookies. Cookies are text files stored on a local computer system by an Internet browser.
Numerous websites and servers use cookies. Many cookies contain a unique identifier called a cookie ID. This ID consists of a character string through which Internet pages and servers can be assigned to the specific Internet browser in which the cookie was stored. Thus, visited Internet sites and servers can distinguish the individual browser of the data subject from other Internet browsers with different cookies. Internet browsers can be recognised and identified using the unique cookie ID.
Using cookies enables PITSS GmbH to provide the users of this Website with more user-friendly services that would otherwise not be possible.
Cookies can be used to optimise the information and offers provided on a website for the user. As mentioned, cookies enable PITSS GmbH to recognise its Website users. Its purpose is to help users navigate the Website. For example, visitors to a website using cookies do not have to re-enter their access data each time they revisit it, as this is handled by the website and the cookie stored on the user’s computer system. Shopping baskets in online shops are another example of cookies. By using a cookie, the online shop keeps track of the items visitors place in the virtual shopping basket.
Data subjects can prevent a website from setting cookies at any time by adjusting the settings on their web browser accordingly, thereby permanently objecting to the setting of cookies. Furthermore, already set cookies can be deleted anytime via an Internet browser or other software. This is possible in all common Internet browsers. However, not all the functions of the PITSS GmbH Website might be fully usable if the data subject chooses to deactivate the use of cookies in his or her web browser.
| Name | Description | Storage duration | Category |
| Cookie notice & consent | Stores data on whether the visitor allowed cookies | unlimited | Function cookie |
Third-party Cookies (e.g., Google Analytics) | Name | Description | Data controller | Storage duration | Category |
| Google Analytics | Includes a user ID; web analytics to track page views and actions | Google | unlimited | Marketing (analytics & tracking cookie) |
| Leadfeeder | Includes a user ID; web analytics to track page views and actions | Dealfront | unlimited | Marketing (analytics & tracking cookie) |
| Google Tag Manager | Includes a user ID; web analytics to track page views and actions | Google | unlimited | Marketing (analytics & tracking cookie) |
| Google AdWords | Includes a user ID; web analytics to track page views and actions | Google | unlimited | Marketing (analytics & tracking cookie) |
5. General data and information collection The Website of PITSS GmbH collects a range of general data and information each time a data subject or an automated system accesses the Website. These general data and information are stored in the server log files. It may record (1) browser types and versions used, (2) the operating system used by the visiting system, (3) the website from which a visiting system comes to the Website (the “referrer”), (4) the subpages that are accessed via a visiting system on the Website, (5) date and time of access to the Website, (6) an Internet Protocol address (IP address), (7) the Internet service provider of the accessing system and (8) similar data and information serving to avert danger in the event of attacks on PITSS’s IT systems. When using these general data and information, PITSS GmbH does not draw any conclusions about the data subject. Instead, this information is required to (1) deliver the Website content correctly, (2) optimise the Website content and its advertising, (3) ensure long-term functionality of the Website’s technology and information technology systems, and (4) provide law enforcement authorities with the necessary information for prosecution in the event of a cyberattack. Therefore, PITSS GmbH analyses anonymously collected data and information statistically, aiming to increase our enterprise’s data protection and security and ensure optimal protection for the personal data we process. Anonymous data from server log files is stored separately from all personal data a data subject provides. 6. Data security When you visit our Website, PITSS GmbH uses the Secure Socket Layer (SSL) protocol with the highest level of encryption supported by your browser. Typically, this is 256-bit encryption. If your browser does not support 256-bit encryption, PITSS GmbH will use 128-bit v3 technology instead. The closed padlock icon in your browser’s status bar tells you whether an individual page of the PITSS Website is being transmitted in encrypted form. PITSS GmbH also uses appropriate technical and organisational security measures to protect your data against intentional or unintentional manipulation, partial or complete loss, destruction, or unauthorised access by third parties. PITSS GmbH is continuously improving its security measures in line with technological developments. 7. Use of a content delivery network: Cloudflare PITSS GmbH uses the Content Delivery Network (CDN) from Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich, Germany (Cloudflare) to increase the Website’s security and delivery speed. According to Article 6(1)(f) GDPR, this serves PITSS’s legitimate interests. A CDN is a network of [globally] distributed servers designed to deliver optimised content to website users, involving processing personal data in Cloudflare server log files. Cloudflare receives your personal data and acts as a processor for PITSS GmbH. In line with the legitimate interest as defined in Article 6(1)(1)(f) GDPR, we have no interest in operating a content delivery network ourselves. You are entitled to object to the processing. Whether an objection is successful requires a balancing of interests. Data processing for the purposes set out in this section is not required by law or by contract. However, the Website’s proper functioning cannot be guaranteed without said processing. Cloudflare will store your personal data for as long as required for the purposes described. Further information on objection and erasure options vis-à-vis Cloudflare can be found at Cloudflare DPA. Cloudflare has implemented compliance measures for international data transfers. These apply to all of Cloudflare’s activities worldwide, in which Cloudflare processes the personal data of individuals located in the EU. These measures are based on the EU standard contractual clauses (SCCs). For more information, please visit: https://www.cloudflare.com/en-gb/cloudflare-customer-scc/ 8. Subscription to the PITSS GmbH newsletter Visitors to the Website may wish to subscribe to the company newsletter. The input mask set up for this purpose determines the personal data transmitted to the Controller when registering for the newsletter. PITSS GmbH regularly informs its customers and business partners about company offers through a newsletter. The data subject can only receive the company newsletter if (1) the data subject has a valid email address and (2) the data subject registers to receive the newsletter. For legal reasons, a confirmation email will be sent to the email address entered by a data subject upon initial newsletter registration as part of the double opt-in procedure. This confirmation email is used to check whether the owner of the email address, as the data subject, has authorised the reception of the newsletter. During the newsletter registration process, PITSS GmbH also stores the IP address of the computer system used by the data subject at the time of registration and the date and time of registration. This data collection is necessary to legally protect the Controller by allowing him to trace any (possible) misuse of a data subject’s email address at a later date. Personal data collected during a newsletter registration is solely used to send the newsletter. Furthermore, newsletter subscribers may be informed by email as necessary for the operation of the newsletter service or registration, should any changes be made to the newsletter or technical conditions. No personal data collected in the context of the newsletter service will be passed on to third parties. The data subject may terminate their subscription to the newsletter at any time. Any consent from the data subject to store personal data to receive the newsletter can be withdrawn anytime. Each newsletter contains a corresponding link allowing you to revoke your consent. In addition, you can unsubscribe from the newsletter at any time directly on the Controller’s Website or inform the Controller accordingly by other means. 9. Contact via the Website By legal requirements, the PITSS GmbH Website contains information to enable quick electronic contact with the company and direct communication with PITSS GmbH, including a general email address. If a data subject contacts the Controller by email or a contact form, the personal data transmitted by the data subject will be automatically stored. Such personal data transmitted voluntarily by a data subject to the Controller is stored for processing or contacting the data subject. Such personal data will not be passed on to third parties. 10. Comment function of the Website blog PITSS GmbH has a blog on its Website that allows users to leave comments on individual blog posts. A blog is a web-based, publicly accessible portal usually maintained by one or more people called bloggers or web-bloggers, who post articles or thoughts in so-called blog posts. Third parties can usually comment on blog posts. If a data subject leaves a comment on the blog published on our Website, the comment made by the data subject is also stored and published, along with the time and date of the comment and the username (pseudonym) chosen by the data subject. In addition, the IP address assigned by the Internet service provider (ISP) to the data subject is also logged. We store the IP address for security reasons in case the data subject violates the rights of third parties or posts illegal content in a comment. Therefore, the Controller stores the personal data in its legitimate interest to fend off any accusations of unlawful behaviour. None of the personal data collected will be passed on to third parties unless such disclosure is required by law or serves the legal defence of PITSS GmbH as the Controller. 11. Regular erasure and blocking of personal data The Controller processes and stores the data subject’s personal data only for the period necessary to achieve the purpose of the storage or to the extent permitted by the European regulatory body or another legislative body to which the Controller is subject. Once the purpose for storing the personal data no longer applies, or if a retention period stipulated by the European regulator or another relevant legislator expires, the personal data is routinely locked or erased by legal requirements. 12. Rights of the data subject • a) Right of confirmation Under European law, data subjects have the right to request confirmation from the Controller on whether personal data relating to them is being processed. To exercise this right, the data subject may contact the Data Protection Officer or another employee of the Controller at any time. • b) Right of access Under European law, data subjects have the right to request information from the Controller about their personal data and obtain a copy free of charge. It also grants the data subject access to the following information: o the purposes of processing; o the categories of personal data concerned; o the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations; o where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; o the existence of the right to request from the Controller rectification or erasure of personal data, restriction of processing of personal data concerning the data subject, or to object to such processing; o where the personal data is not collected from the data subject: any available information as to its source; o the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject; o to lodge a complaint with a supervisory authority under Article 77 GDPR. As a rule, you can contact the supervisory authority at any time at your usual place of residence, place of work or the company’s registered office. For PITSS GmbH, this is The State Commissioner for Data Protection and Freedom of Information for Baden-Württemberg: https://www.baden-wuerttemberg.datenschutz.de/kontakt-aufnehmen/. In addition, the data subject is entitled to be informed whether personal data has been transferred to a third country or an international organisation. In such cases, the data subject shall also have the right to obtain information on the appropriate safeguards relating to the transfer. To exercise this right, the data subject may contact the Data Protection Officer or another employee of the Controller at any time. • c) Right to rectification Under European law, data subjects have the right to request the rectification of inaccurate personal data concerning them without undue delay. They also have the right to have incomplete personal data completed, including by providing a supplementary statement. To exercise this right, the data subject may contact the Data Protection Officer or another employee of the Controller at any time. • d) Right to erasure (right to be forgotten) Under European law, data subjects have the right to obtain from the Controller the erasure of personal data concerning them without undue delay where one of the following legal grounds applies, as long as the processing is not necessary: o The personal data is no longer necessary concerning the purposes for which they were collected or otherwise processed; o the data subject withdraws consent on which the processing is based on Article 6(1)(a), or Article 9(2)(a) GDPR, and where there is no other legal ground for the processing; o the data subject objects to the processing under Article 21(1) GDPR, and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing under Article 21(2) GDPR; o the personal data has been unlawfully processed; o the personal data has to be erased for compliance with a legal obligation in Union or Member State law to which the Controller is subject; o the personal data has been collected concerning the offer of information society services referred to in Article 8(1) GDPR. If one of the aforementioned reasons applies, and a data subject wishes to request the erasure of personal data stored by PITSS GmbH, he or she may, at any time, contact the Data Protection Officer or another employee of the Controller. The Data Protection Officer or another employee of PITSS GmbH will arrange for the prompt data erasure. If PITSS GmbH, as the Controller, has made the personal data public and is obliged under Article 17(1) GDPR to erase the personal data, PITSS GmbH, in consideration of the available technology and the implementation costs, will take reasonable steps, including technical measures, to inform other controllers processing the personal data that the data subject has requested that these other data controllers delete all links to the personal data or copies or replications of the personal data, unless the processing is necessary. The Data Protection Officer or another employee of PITSS GmbH will arrange the necessary measures based on the individual case. • e) Right to restriction of processing Under European law, data subjects have the right to obtain from the Controller restriction of processing where one of the following applies: o The accuracy of the personal data is contested by the data subject for a period, enabling the Controller to verify the accuracy of the personal data; o the processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; o the Controller no longer needs the personal data for the processing, but the data subject for establishing, exercising, or defence of legal claims requires them; o the data subject has objected to processing under Article 21(1) GDPR pending the verification of whether the Controller’s legitimate grounds override those of the data subject. If one of the aforementioned reasons applies, and a data subject wishes to request the restriction of personal data stored by PITSS GmbH, he or she may, at any time, contact the Data Protection Officer or another employee of the Controller. The Data Protection Officer or another employee of PITSS GmbH will arrange the processing restriction. • f) Right to data portability Under European law, data subjects have the right to receive the personal data concerning them, which they have provided to the Controller, in a structured, commonly used and machine-readable format. They also have the right to transmit those data to another controller directly from the Controller to which the personal data was provided, insofar as the processing is based on consent under Article 6(1)(a) GDPR or Article 9(2)(a) GDPR or on a contract under Article 6(1)(b) GDPR and the processing is carried out by automated means unless the processing is necessary for the performance of a task carried out in the public interest or to exercise official authority vested in the Controller. In addition, in exercising their right to data portability under Article 20(1) GDPR, the data subject is entitled to have the personal data transmitted directly from one controller to another, where technically feasible, provided that the rights and freedoms of others are not adversely affected. The data subject may, at any time, contact the Data Protection Officer or another employee of PITSS GmbH to exercise his or her right to data portability. • g) Right to object Under European law, data subjects have the right to object, on grounds relating to their particular situation, at any time to the processing of personal data concerning them based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. In the event of an objection, PITSS GmbH will no longer process personal data unless it demonstrates compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defence of legal claims. If PITSS GmbH processes personal data for direct marketing purposes, the data subject shall have the right to object at any time to the processing of personal data concerning him or her for such marketing. If the data subject objects to the processing for direct marketing purposes to PITSS GmbH, PITSS GmbH will no longer process the personal data for these purposes. In addition, the data subject has the right, on grounds relating to his or her particular situation, to object to the processing of personal data concerning him or her by the PITSS GmbH for scientific or historical research purposes or statistical purposes under Article 89(1) GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest. The data subject may, at any time, contact the Data Protection Officer or another employee of PITSS GmbH to exercise his or her right to object. In the context of using information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications. • h) Right to withdraw consent under data protection law Under European law, data subjects have the right to withdraw consent to processing personal data at any time. To exercise this right, the data subject may contact the Data Protection Officer or another employee of the Controller at any time. 13. Data protection for job applications and during the application process The Controller collects and processes the personal data of applicants to conduct recruitment procedures. Processing may also be carried out electronically. In particular, if an applicant submits relevant application documents to the Controller electronically, such as by email or via a web form on the Website. If the Controller enters into an employment contract with an applicant, the transmitted data will be stored and processed to process the employment relationship in compliance with the statutory provisions. Where no employment contract is concluded between the applicant and the Controller, the application documents will be automatically erased two months after notice of refusal, unless such erasure is contrary to any other legitimate interests of the Controller, such as a burden of proof in proceedings under the German General Act on Equal Treatment (AGG). 14. Terms of data protection for the deployment and use of Google Analytics (with anonymisation function) The Controller uses the Google Analytics component (with anonymisation function) on the Website. Google Analytics is a web analysis service. Web analysis is the collection and evaluation of data about the browsing behaviour of visitors on websites. Among other things, a web analysis service collects data about the referring website from which a data subject came to the Website (so-called referrer), which subpages of the Website were accessed or how often and for how long a subpage was viewed. Web analytics is mainly used to optimise a website and for cost-benefit analysis of Internet advertising. The operating company of the Google Analytics component is Google Ireland Limited (company registration number: 368047), Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), hereafter referred to as ‘Google’. The Controller uses the code ‘_gat._anonymizeIp’ for web analysis via Google Analytics. This way, Google will shorten and anonymise the IP address of the data subject’s Internet connection if the Website is accessed from within a Member State of the European Union or any signatory state to the Agreement on the European Economic Area. The purpose of the Google Analytics component is to analyse visitor flows on the Website. Among other things, Google processes the collected data and information to evaluate the Website’s use, compiles online reports for PITSS GmbH showing the Website’s activities, and provides other services related to the Website’s use. To do so, Google Analytics places a cookie on the data subject’s IT system. An explanation of what cookies are can be found above. With the placement of the cookie, Google will be able to analyse the use of the Website. For online analysis, each time a user accesses an individual page of the Website operated by the Controller and into which a Google Analytics component has been integrated, the web browser on the data subject’s IT system is automatically prompted by the Google Analytics component to transmit data to Google. Through this technical process, Google obtains knowledge of personal data, such as the data subject’s IP address, which Google uses, among other things, to track the origin of visitors and clicks and subsequently enable commission statements. The cookie stores personal data, such as the access time, the location from which the access was made, and the frequency of website visits by the data subject. Each time the Website is visited, this personal data, including the IP address of the Internet connection used by the data subject, is transmitted to Google in the United States of America. Google stores this personal data in the USA. Google may disclose personal data collected through this technical process to third parties. As stated above, data subjects can prevent the Website from setting cookies at any time by adjusting the settings on their web browser, thereby permanently objecting to the setting of cookies. Likewise, such Internet browser settings would prevent Google from placing a cookie on the data subject’s IT system. Cookies already in use by Google Analytics can be deleted at any time, either via the web browser or other software. Additionally, data subjects may object to and prevent the collection of data generated by Google Analytics relating to the use of this Website and the processing of such data by Google. Therefore, the data subject can download and install a browser add-on from the link https://tools.google.com/dlpage/gaoptout. This browser add-on uses JavaScript to tell Google Analytics that no information about website visits shall be transmitted to Google Analytics. Google considers the installation of the browser add-on an objection. If the data subject’s IT system is deleted, formatted, or reinstalled later, the data subject must reinstall the browser add-on to disable Google Analytics. If the browser add-on was uninstalled by the data subject or any other party within his or her sphere of influence or is disabled, it is possible to execute the reinstallation or reactivation of the browser add-on. You can find more information and Google’s current privacy policy at https://www.google.de/intl/de/policies/privacy/ and http://www.google.com/analytics/terms/de.html. Google Analytics is explained in more detail at https://www.google.com/intl/de_de/analytics/. 15. Leadfeeder PITSS GmbH uses Leadfeeder, a web analysis platform, on its Website. The service provider is the Finnish company Liidio Oy / Leadfeeder, Mikonkatu 17 C, 00100 Helsinki, Finland. Leadfeeder retrieves the list of website visitors’ IP addresses provided by Google Analytics and links this list with company information found online via the corresponding IP addresses. Since Google Analytics abbreviates the website visitors’ IP addresses, a link to a particular individual cannot be established. It may be possible, however, to identify a person upon examination of the linked company information. For more information about Leadfeeder and the data collected, please refer to www.leadfeeder.com/privacy/ and information about Leadfeeder and compliance with the General Data Protection Regulation at https://help.leadfeeder.com/en/articles/3561400-gdpr-privacy-and-security-summary. 16. Terms of data protection for the deployment and use of Google AdWords The Controller used the Google AdWords component on the Website. Google AdWords is an online advertising service that allows advertisers to place ads in Google’s search engine results and the Google advertising network. With Google AdWords, advertisers can specify specific keywords in advance that will trigger the display of an advert in Google’s search engine results only when the user uses the search engine to retrieve a keyword-relevant search result. In the Google advertising network, the ads are distributed on topic-relevant websites using an automatic algorithm based on the previously defined keywords. Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA, operates the Google AdWords service. The purpose of Google AdWords is to promote the Website by displaying interest-relevant advertising on the websites of third-party companies, in the search engine results of the Google search engine, and by displaying third-party advertising on the Website. If a data subject reaches a website via a Google ad, a so-called conversion cookie is placed on the data subject’s IT system by Google. An explanation of what cookies are can be found above. A conversion cookie loses its validity after thirty days and is not used to identify the data subject. Provided that it has not yet expired, the conversion cookie is used to track whether specific subpages, for example, the shopping cart from an online shop system, have been accessed on a website. The conversion cookie enables PITSS GmbH and Google to understand whether a person who reached the Website via an AdWords ad generated sales, i.e., completed or cancelled a purchase. Google uses the collected data generated by the conversion cookie to create visitor statistics for the Website. PITSS GmbH, in turn, uses these visit statistics to determine the total number of users referred to PITSS GmbH via AdWords ads, i.e., to determine the success or failure of the respective AdWords ad campaign and to optimise the AdWords ads for the future. Neither PITSS GmbH nor other Google AdWords advertisers receive information from Google that could be used to identify the data subject. The conversion cookie stores personal data, such as the Internet pages visited by the data subject. Each time the Website is visited, these personal data, including the IP address of the Internet connection used by the data subject, is transmitted to Google in the USA and stored there. Google may disclose personal data collected through this technical process to third parties. As stated above, data subjects can prevent the Website from setting cookies at any time by adjusting the settings on their web browser accordingly, thereby permanently objecting to the setting of cookies. Likewise, such Internet browser settings would also prevent Google from placing a conversion cookie on the data subject’s IT system. Cookies already in use by Google AdWords can be deleted at any time, either via the web browser or other software programmes. The data subject may also object to Google’s interest-based advertising. For this purpose, they can access the desired settings by visiting www.google.de/settings/ads using their preferred Internet browser. More information and Google’s applicable privacy policy can be found at https://www.google.de/intl/de/policies/privacy/. 17. Terms of data protection for the deployment and use of YouTube The Controller used YouTube components on the Website. The online video portal YouTube allows publishers to upload video clips, and visitors can view, rate, and comment on them, all for free. YouTube permits the publication of all types of videos, so complete film and television programmes, music videos, trailers, or user-generated videos can be accessed via the Internet portal. YouTube is the operating company of Google Ireland Limited (‘Google’), Gordon House, Barrow Street, Dublin 4, Ireland. Its parent company is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Each time a user accesses individual pages of this Website operated by the Controller and incorporates a YouTube component (YouTube video), the respective YouTube component automatically triggers the Internet browser on the data subject’s IT system to download a representation of the corresponding YouTube component from YouTube. More information about YouTube can be found at https://www.youtube.com/intl/en/yt/about/. Through this technical process, YouTube and Google learn which specific subpage of the Website is visited by the data subject. Provided that the data subject is simultaneously logged into YouTube, YouTube recognises which specific subpage of the Website the data subject visits when a subpage containing a YouTube video is accessed. This information is collected by YouTube and Google and assigned to the data subject’s YouTube account. YouTube and Google obtain information through the YouTube component that the data subject has visited the Website if the data subject is logged in on YouTube at the time of the call to the Website; this happens regardless of whether the person clicks on a YouTube video. If data subjects do not want this information to be transmitted to YouTube and Google, they can prevent the transmission by logging out of their YouTube account before accessing the PITSS Website. YouTube’s privacy policy, available at https://www.google.com/intl/en/policies/privacy/, provides further information about YouTube and Google’s collection, processing, and use of personal data. 18. Lawfulness of the processing Article 6(1)(a) GDPR provides the legal basis for PITSS GmbH when obtaining consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is a party, like in the case of processing operations necessary for the supply of goods or to provide any other service or consideration, the processing is based on Article 6(1)(b) GDPR. The same applies to processing operations necessary to carry out pre-contractual measures, such as enquiries about PITSS products or services. Insofar as PITSS GmbH is subject to a legal obligation that requires the processing of personal data, such as for the fulfilment of tax obligations, the processing is based on Article 6(1)(c) GDPR. In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or another natural person. As an example, this would be the case if a visitor to PITSS GmbH were to be injured, and his name, age, health insurance details or other vital information would have to be passed on to a doctor, hospital, or other third party. Here, the processing would be based on Article 6(1)(d) GDPR. Ultimately, processing operations could be based on Article 6(1)(f) GDPR. On this legal basis, processing operations that are not covered by any of the aforementioned legal bases will be carried out if the processing is necessary to safeguard a legitimate interest of PITSS GmbH or a third party, provided that the interests, fundamental rights and freedoms of the data subject do not prevail. In particular, PITSS GmbH is permitted to carry out such processing operations because they have been mentioned explicitly under European law. In this respect, it took the view that a legitimate interest could be assumed if the data subject is a customer of the Controller (recital 47, clause 2, GDPR). 19. Legitimate interests of processing pursued by the Controller or a third party If the processing of personal data is based on Article 6(1)(f) GDPR, the legitimate interest is the performance of business activities for the benefit of all PITSS employees and shareholders. 20. Retention period for personal data Personal data is stored for the duration of the respective statutory retention period. Once the deadline has passed, the corresponding data is routinely deleted if it is no longer required for contract fulfilment or initiation. 21. Legal or contractual requirements to provide personal data; necessity for the conclusion of the contract; the data subject’s obligation to provide the personal data; possible consequences of non-provision Regarding the collection of personal data, PITSS GmbH hereby informs that the provision of personal data is partly required by law (e.g., tax regulations) or may result from contractual provisions (e.g., information on the contractual partner). To conclude a contract, a data subject may be required to provide PITSS GmbH with personal data that PITSS GmbH must subsequently process. For example, data subjects are obliged to provide personal data if PITSS GmbH signs a contract with them. Non-provision of the personal data would result in the contract not being concluded. Before the data subject provides any personal data, the data subject must contact the Data Protection Officer. The Data Protection Officer will inform the data subject on a case-by-case basis whether the provision of personal data is required by law or contract, or necessary for the conclusion of a contract, whether there is an obligation to provide the personal data, and what the consequences of not providing the personal data would be. 22. Validity and amendment of this Privacy Policy Further development of the Website and its offers or changes in legal or official requirements may require this Privacy Policy to be amended. Therefore, please access the Privacy Policy regularly when visiting the PITSS Website. This Privacy Policy is effective as of February 8, 2025.
