marktguru Deutschland GmbH, Sendlinger Straße 23, 80331 Munich, office@marktguru.de, hereinafter referred to as “marktguru” or “we” or “us”, is the controller within the meaning of data protection law.

Any exceptions are explained in this privacy policy.

You can find our contact details and those of our Data Protection Officer in section 11 ”Contact”.

General

Personal data is any information relating to an identified or identifiable natural person. Processing personal data means collecting, storing, using, transferring it to others, or deleting it, among other things.

The categories of personal data we process about you depend on how you use our online product. We have listed possible categories for you below.
‍

Categories of personal data

Contact data: When you contact us (e.g., via a contact form or email), we process the data you provide (usually your first and last name, email address and/or phone number, and the content of your inquiry) as well as any subsequent communication.

Giveaway data: If you participate in one of our giveaways or raffles, we process data such as name, address, email address, consent to the participation terms, participation details.

Sociodemographic data: If you participate in a voluntary survey or market survey, we process information provided by you such as age group, gender, level of education, household size, household income, nationality, employment status, main contributor in the household.

Log data from third-party surveys: If you participate in a market survey arranged by us and conducted by a third party, we receive information from that third party as to whether the survey has been completed (however, we do not receive any information regarding the details you provided in the respective market survey conducted by a third party).

Online usage data: Every time you communicate via the Internet, online usage data is generated. This includes data such as your IP address, search queries, timestamps, browser data, device information, cookie ID, device ID, referrer URL, geolocation/location data, user ID, click history.

Log files: Whenever you use an online product, your device automatically transmits what is known as online usage data. This data is temporarily stored in log files to ensure technical security and functionality.

Ad blocker data: Information on whether ad blockers are present.

‍

Data processed in connection with cookies:

• Online usage data and email address
• Consent to the use of cookies (and related data processing operations)

The following data is processed in connection with cookies and similar technologies (“cookies”):

3.1   Transfer of data to third parties

We only disclose your personal data to third parties if this is necessary for the fulfillment of the contract, if we or a third party have a legitimate interest in the disclosure, if you have granted your consent for this, or if this is necessary to fulfill a legal obligation.
Details on third parties can be found in section 4 “Why do we process your personal data, on what legal basis, what are our legitimate interests, who receives your personal data?” that follows.
We may disclose personal data to a third party in particular

• if we are required to do so in individual cases due to legal requirements, orders by law enforcement or court orders;
• in connection with legal disputes (to courts or to our lawyers) or tax audits (to auditors);
• in connection with possible criminal offenses to the competent investigating authorities;
• in the event of a sale of the business (to the purchaser and their legal and tax advisors).

In the case of a transfer based on consent, the explanation may also be provided when consent is obtained.
‍

3.2  Transfer of data to service providers

We reserve the right to deploy service providers when collecting or processing data. Service providers only receive the personal data required for their specific activities from us. For example, your email address may be passed on to a service provider so that they can deliver a newsletter you are subscribed to. Service providers may also be commissioned to provide server capacity. Service providers are generally deployed as so-called processors who may only process the personal data of users of this online product in accordance with our instructions.
Details on the service providers we deploy can be found in section 4 “Why do we process your personal data, on what legal basis, what are our legitimate interests, who receives your personal data?” that follows.

We also transfer personal data to third parties or processors based in non-EEA countries.
Prior to such data transfers, we ensure that the recipient maintains an adequate level of data protection – for example:

• on the basis of an adequacy decision by the European Commission (Art. 45 GDPR),
• by entering into EU Standard Contractual Clauses (Art. 46 GDPR, Module 1 or 2), including carrying out a transfer impact assessments (TIA), and, where necessary, by implementing additional technical or organisational safeguard measures.

Where possible, we specifically select providers that operate data centres in the EU or the EEA for the processing and storage of personal data.

This involves third parties, or data processors, in the following countries: USA; Israel; Armenia.

With regard to the USA, the European Commission has concluded that an adequate level of data protection exists there, provided that the data recipient participates in the Data Privacy Framework (DPF) and holds a valid certification. Where the recipients of your personal data are based in the USA and participate in the DPF, we therefore rely on this adequacy decision (Art. 45 GDPR).

To which countries outside the European Economic Area (if you are located within the EEA) do we disclose data?

We disclose personal data to third parties or processors in the following countries with an adequate level of data protection under applicable law: USA (if the recipient is certified under the EU-U.S. Data Privacy Framework), Israel (Data Processing Addendum).

Furthermore, we disclose personal data to third parties or processors in the countries listed below in which, under applicable law, there is no adequate level of data protection. The transfer or disclosure is based on the respective security measure or exemption provision specified: USA (based on Standard Contractual Clauses if the recipient is not certified under the EU-U.S. Data Privacy Framework), Armenia (Standard Contractual Clauses).

You can request that we provide you with an overview of the recipients in third countries and a copy of the specific arrangements agreed to ensure an adequate level of data protection. Please use the contact details provided in section 11 “Contact” for this purpose.

We store your data for as long as is necessary to provide our online product and the associated services, or for as long as we have a legitimate interest in further storage (e.g. due to an ongoing legal dispute). In all other cases, we delete your personal data with the exception of data that we must retain in order to comply with statutory retention periods (e.g., tax or commercial law).

Personal data that is subject to a retention period is blocked until the retention period expires.

Specifically, the following retention periods apply to the personal data processed within the scope of this online product:

• Contact data: Until of the communication and then for a further three years, beginning at the end of the calendar year.
• Data processed in connection with cookies: Details on the retention periods for personal data can be found in the CMP linked above. Under “Vendors”, you will find information on how long the personal data collected is retained.
• Log files: Up to 10 days, as long as there has been no security incident that requires longer storage.
• Data processed in connection with surveys/feedback: Until the completion of the survey/feedback and then for a further six months, beginning at the end of the calendar year. 
• Conducting giveaways/raffles on social media: Three years from the end of the calendar year in which the corresponding giveaway/raffle was completed, with the exception of data that we are required to retain in order to comply with statutory retention periods.

In principle, you are not obliged to provide us with your personal data. However, you might be required to provide personal data to be able to use certain services of this online product, e.g., if you want to to register or to participate in a giveaway. If this is the case, we will inform you accordingly. Mandatory fields are usually marked with an asterisk (*). If you do not wish to provide us with the necessary data, you will unfortunately not be able to use the corresponding services.

This online product uses cookies.

Cookies are small text files that are sent when you visit a website and stored in the browser of the user device. When the corresponding website is visited again, the browser sends the content of the cookies back, enabling the user device to be recognised. Certain cookies are automatically deleted after the browser session ends (known as session cookies), while others are stored in the browser of the user device for a specified period of time or permanently, and then are deleted automatically (known as temporary or permanent cookies).

Cookies do not store any data that could identify you as a person (e.g., no names, email addresses, or IP addresses). Instead, cookies typically contain a code (known as an identifier) as well as information about the storage period and, in some cases, certain technical features (e.g., security functions).

How can you exercise your rights?

To assert your rights, please use the contact details provided in section 11 “Contact”. Please ensure that we are able to clearly identify you.

‍

Your right of access and right to rectification

You have the right to request that we confirm whether we process personal data relating to you, and you have a right to information regarding the data we process. If your data is incorrect or incomplete, you can request that your data be corrected or completed. If we transfer your data to third parties, we will inform them of the correction, insofar as this is required by law.

‍

Your right to erasure (“right to be forgotten”)

Provided the legal requirements are met, you have the right to request that we delete your personal data immediately. This is particularly the case if

• your personal data is no longer required for the purposes for which it was collected;
• the legal basis for processing was solely your consent and you have revoked this;
• you have objected to processing for advertising purposes (“objection to direct marketing purposes”);
• you have objected to processing on the basis of legitimate interest for personal reasons, and we cannot demonstrate compelling legitimate grounds for this processing;
• your personal data has been processed unlawfully; or
• your personal data must be deleted to comply with legal requirements.

Should your data be shared with third parties, we will inform them of the deletion, insofar as this is required by law.

Please note that your right to erasure is subject to restrictions. For example, we are not required or allowed to erase data that we are still required to retain due to statutory retention periods. Data that we require to assert, exercise, or defend legal claims is also excluded from your right to erasure.

‍

Your right to restriction of processing

Provided the legal requirements are met, you have the right to request that we restrict processing. This is particularly the case if

• the accuracy of your personal data is disputed by you, and then until we have had the opportunity to verify its accuracy;
• the processing is not lawful, and you request restriction of use instead of erasure (see previous section);
• we no longer need your data for the purposes of processing, but you need it to assert, exercise, or defend your legal claims;
• you have objected on personal grounds, and until it is determined whether your interests prevail.

If the right to restrict processing is confirmed, we will mark the data concerned accordingly to ensure that it is only processed within the narrow limits that apply to such restricted data (namely, for the defense of legal claims or with your consent).

‍

Your right to data portability

You have the right to receive personal data that you have provided to us for the performance of a contract or on the basis of consent in a structured, commonly used, and machine-readable format. In this case, you may also request that we transmit this data directly to a third party, provided this is technically feasible.

‍

Your right to withdraw consent

If you have given us your consent to process your data, you can revoke this consent at any time with effect for the future. The lawfulness of the processing of your data until revocation remains unaffected.

10.1 Privacy policy for the Bonsy app

The privacy policy for the Bonsy app can be found at https://www.bonsy.com/en/privacy-policy-app.

‍
10.2 Privacy notice for social media channels

The privacy notice for Bonsy’s social media channels is available at https://www.bonsy.com/en/social-media-privacy-policy.

For information and suggestions on the subject of data protection, please contact us or our data protection officer at datenschutz@bonsy.com. 

You can also contact our data protection officer at the following postal address:

Maximilian Hartung
eDSB – Datenschutzbeauftragter
SECUWING GmbH & Co. KG | Datenschutz-Agentur.de
Frauentorstraße 9
86152 Augsburg, Germany
epost@datenschutz-agentur.de
T +49 (0) 821 90786450

If you would like to contact us by other means, you can also reach us as follows:

marktguru Deutschland GmbH
Sendlinger Straße 23
80331 Munich, Germany