Privacy policy under the GDPR pursuant to Article 13 GDPR
Privacy policy and consent to data use
for the website www.markveys.com
Data protection is a matter of trust, and your trust matters to us. We respect your privacy and personal rights. Protecting your personal data and collecting, processing and using it lawfully is therefore important to us. To help you feel secure when visiting our websites, we strictly observe the statutory requirements when processing your personal data and explain our data collection and use here.
We are committed to complying with the GDPR and applicable national data protection laws. Data protection is a high priority throughout our company, and we work only with partners who can demonstrate an appropriate level of data protection in their processing activities. We process your data only if you have given your express consent, where this relates to a service contract or pre-contractual measures, or where applicable laws permit or require processing. The following privacy information covers both the current national legal framework and the requirements of the EU General Data Protection Regulation (GDPR), applicable throughout Europe from 25 May 2018. References to GDPR legal bases are authoritative from 25 May 2018. We never sell your data or disclose it to unauthorised third parties. Below, we explain in detail how our company handles your data.
You can print or save this document using your browser's usual functions. The following privacy policy explains which data is collected on our websites and how we process and use it.
I. Name and address of the controller
The controller within the meaning of the EU General Data Protection Regulation (GDPR), other national data protection laws of the Member States and other data protection provisions is:
mark veys GmbH & Co. KG
Dircksenstr. 41
10178 Berlin
T. +49 (30) 27 581 503
Responsible for website content:
Carsten Pasternack
T. +49 (30) 27 581 503
Email: hallo@markveys.com
II. Name and address of the data protection contact
Mr Carsten Pasternack
T. +49 (30) 27 581 503
Email: datenschutz@markveys.com
III. General information on data processing
1. Scope of personal data processing
As a rule, we collect and use our users' personal data only to the extent necessary to provide a functioning website and our content and services. Users' personal data is generally collected and used only with their consent. An exception applies where obtaining prior consent is not possible for practical reasons and processing is permitted by law.
2. Legal basis for processing personal data
Where we obtain the data subject's consent to process personal data, Article 6(1)(a) GDPR serves as the legal basis.
Where processing personal data is necessary to perform a contract to which the data subject is a party, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing necessary for pre-contractual measures.
Where processing personal data is necessary to comply with a legal obligation to which our company is subject, Article 6(1)(c) GDPR serves as the legal basis.
Where the vital interests of the data subject or another natural person require personal data processing, Article 6(1)(d) GDPR serves as the legal basis.
Where processing is necessary for a legitimate interest of our company or a third party, and the data subject's interests, fundamental rights and freedoms do not override that interest, Article 6(1)(f) GDPR serves as the legal basis.
3. Erasure and retention periods
The data subject's personal data is erased or blocked once the purpose of storage no longer applies. Data may also be retained where European or national legislation provides for this in EU regulations, laws or other provisions applicable to the controller. Data is also blocked or erased when a retention period prescribed by these provisions expires, unless continued storage is necessary to conclude or perform a contract.
IV. Hosting, website delivery and server logs
Hosting and location
We operate our website on a server provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. This server is located in Nuremberg, Germany. Hetzner provides the server infrastructure. We are responsible for the processing carried out in connection with our website.
Data processed and purpose
Your IP address is processed with each request so that the requested content can be delivered to your browser. Our web server logs the full IP address, any authentication name supplied, the date and time, HTTP method, requested URL path without query parameters, protocol version, response status and amount of data transferred. Additional error logs may be generated when technical errors occur.
These logs support troubleshooting, website availability and security. They are not analysed as visit statistics for marketing purposes. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the reliable and secure operation of the website.
Retention of server logs
Server logs are rotated daily when entries are present. Up to 52 archived log files are retained in addition to the current file. With daily use, this generally corresponds to about 53 days. No rotation occurs on days without new entries, which can extend retention in calendar days. Full IP addresses in these logs are not automatically anonymised.
Your rights
You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. Processing the IP address to deliver a requested page is technically unavoidable. Further information is provided in the section on the rights of the data subject.
V. Visit statistics and storage of your preferences
Visit statistics with your consent
With your consent, we use self-hosted Umami software to analyse how our content is used and how use of our website develops. Collection begins only after you agree. The website can also be used without consent.
We collect pages viewed and page titles, timestamps, the referring website, browser, operating system, device type, browser language and screen size, as well as country, region and, where available, city. Locations are estimates based on a local GeoIP database. Query parameters and fragments are removed before sending; referral information is limited to the origin, consisting of the protocol, hostname and any port.
Pseudonymisation and hosting
The IP address is temporarily processed to estimate location and, together with technical browser characteristics, generate a hashed session identifier. This lets us group pageviews into visits. A monthly rotating salt and a secret key renewed at the start of each month make subsequent attribution more difficult. We treat visit data as pseudonymised data. Full IP addresses are not stored in the analytics database. Technical server logs must be considered separately.
We operate visit statistics on our own server hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, at its Nuremberg location. Data is processed on our instance at insights.markveys.com; we do not use Umami Cloud for this purpose.
Our Umami integration does not set tracking cookies. We do not assign personal user identifiers, enrich visits with company identities or record session replays.
Retention of visit data
After no more than 14 months, only aggregated statistics remain that do not allow individual visitors to be identified.
Legal basis and withdrawal
Processing is based on your consent under Article 6(1)(a) GDPR and, where information on your device is accessed, Section 25(1) TDDDG. You can withdraw consent at any time for future processing through “Privacy settings” in the footer. This integration will then collect no further visit data. Withdrawal does not affect the lawfulness of processing before withdrawal. Your other data protection rights remain unaffected.
Storage of your privacy choice
CookieConsent stores your privacy choice in the mv-consent cookie for 180 days. This includes a consent ID, your selection, timestamps, language and the consent version. Consent and refusal are stored for the same period. Storage allows us to respect your choice and document consent. Necessary device access is based on Section 25(2)(2) TDDDG. Where personal data is processed, this fulfils our data protection obligations under Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR.
Language and appearance
We store your explicitly selected language in the mv-language cookie for one year. Your chosen appearance is stored in local browser storage under mv-theme until you change it or delete the website data. These storage operations implement your selected preferences under Section 25(2)(2) TDDDG. Where personal data is processed, the legal basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in implementing your preferences.
VI. Rights of the data subject
Under the cited article in conjunction with Section 34 of the German Federal Data Protection Act (BDSG), you have an unrestricted right to free information about the data we hold about you and, under Section 35 BDSG, the right to erasure or blocking of unlawfully held data or correction of inaccurate data.
On request, we will inform you in writing whether we hold personal data about you and, if so, which data. Where possible, we will take appropriate measures to update or correct the data we hold promptly. Please send all requests for information or objections to data processing directly to our data protection officer by email, stating your full postal address.
If your personal data is processed, you are a data subject within the meaning of the GDPR and have the following rights against the controller:
1. Right of access
You may ask the controller to confirm whether we process personal data relating to you.
If such processing takes place, you may request information from the controller about:
the purposes for which the personal data is processed;
the categories of personal data processed;
the recipients or categories of recipients to whom your personal data has been or will be disclosed;
the planned retention period for your personal data or, where specific details cannot be provided, the criteria used to determine that period;
the existence of a right to rectification or erasure of your personal data, restriction of processing by the controller, or objection to such processing;
the existence of a right to lodge a complaint with a supervisory authority;
all available information about the source of the data where it was not collected from the data subject;
the existence of automated decision-making, including profiling, under Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of that processing for the data subject.
You have the right to request information about whether your personal data is transferred to a third country or international organisation. In this context, you may request information about the appropriate safeguards relating to the transfer under Article 46 GDPR.
2. Right to rectification
You have the right to ask the controller to rectify and/or complete your personal data if the processed data is inaccurate or incomplete. The controller must rectify it without undue delay.
3. Right to restriction of processing
You may request restriction of the processing of your personal data under the following conditions:
you contest the accuracy of your personal data for a period enabling the controller to verify its accuracy;
the processing is unlawful and you oppose erasure of the personal data, requesting restriction of its use instead;
the controller no longer needs the personal data for processing purposes, but you require it to establish, exercise or defend legal claims; or
you have objected to processing under Article 21(1) GDPR and it has not yet been established whether the controller's legitimate grounds override yours.
Where processing of your personal data has been restricted, that data may, apart from storage, be processed only with your consent, to establish, exercise or defend legal claims, to protect another natural or legal person's rights, or for reasons of important public interest of the Union or a Member State.
If processing has been restricted under the above conditions, the controller will inform you before the restriction is lifted.
4. Right to erasure
a) Obligation to erase
You may request that the controller erase your personal data without undue delay, and the controller is required to do so where one of the following grounds applies:
Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
You withdraw consent on which processing was based under Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal basis for processing.
You object to processing under Article 21(1) GDPR and there are no overriding legitimate grounds for processing, or you object under Article 21(2) GDPR.
Your personal data has been unlawfully processed.
Erasing your personal data is necessary to comply with a legal obligation under Union or Member State law applicable to the controller.
Your personal data was collected in relation to information society services offered under Article 8(1) GDPR.
b) Information to third parties
If the controller has made your personal data public and is obliged to erase it under Article 17(1) GDPR, the controller will, taking account of available technology and implementation costs, take reasonable steps, including technical measures, to inform controllers processing that data that you, as the data subject, have requested erasure of all links to, or copies or replications of, that personal data.
c) Exceptions
The right to erasure does not apply where processing is necessary
to exercise the right to freedom of expression and information;
to comply with a legal obligation requiring processing under Union or Member State law applicable to the controller, or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller;
for reasons of public interest in public health under Article 9(2)(h) and (i) and Article 9(3) GDPR;
for archiving in the public interest, scientific or historical research, or statistical purposes under Article 89(1) GDPR, where the right referred to in section a) is likely to make achieving the objectives of that processing impossible or seriously impair them; or
to establish, exercise or defend legal claims.
5. Right to be informed
If you have exercised your right to rectification, erasure or restriction of processing against the controller, the controller must communicate this to every recipient to whom your personal data was disclosed, unless this is impossible or involves disproportionate effort.
You have the right to be informed by the controller about those recipients.
6. Right to data portability
You have the right to receive the personal data you provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transmit it to another controller without hindrance from the controller to whom it was provided, where
(1) processing is based on consent under Article 6(1)(a) or Article 9(2)(a) GDPR, or on a contract under Article 6(1)(b) GDPR; and
(2) processing is carried out by automated means.
When exercising this right, you also have the right to have your personal data transmitted directly from one controller to another where technically feasible. This must not adversely affect others' rights and freedoms.
The right to data portability does not apply to processing necessary for a task carried out in the public interest or in the exercise of official authority vested in the controller.
7. Right to object
You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions.
The controller will no longer process your personal data unless it demonstrates compelling legitimate grounds overriding your interests, rights and freedoms, or processing serves to establish, exercise or defend legal claims.
Where your personal data is processed for direct marketing, you have the right to object at any time to processing for that purpose, including profiling related to such direct marketing.
If you object to processing for direct marketing, your personal data will no longer be processed for that purpose.
In connection with information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.
8. Right to withdraw data protection consent
You have the right to withdraw your consent to data processing at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
9. Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision
is necessary to enter into or perform a contract between you and the controller;
is authorised by Union or Member State law applicable to the controller, which provides suitable measures to safeguard your rights, freedoms and legitimate interests; or
is based on your explicit consent.
Such decisions must not be based on special categories of personal data under Article 9(1) GDPR unless Article 9(2)(a) or (g) applies and suitable measures are in place to safeguard your rights, freedoms and legitimate interests.
In cases (1) and (3), the controller takes suitable measures to safeguard your rights, freedoms and legitimate interests, including at least the right to obtain human intervention by the controller, express your point of view and contest the decision.
10. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, workplace or the alleged infringement, if you consider that processing your personal data infringes the GDPR.
The supervisory authority receiving the complaint will inform the complainant of its progress and outcome, including the possibility of a judicial remedy under Article 78 GDPR.
VII. Other information
Where parts of this website are offered in languages other than German, this is solely a service for our customers, prospective customers and employees who do not speak German.
Privacy policy last updated: May 2018