Privacy Policy Social Networks

Social media privacy policy

This page outlines how we handle your data on our social media sites in accordance with Article 13 of the EU General Data Protection Regulation (GDPR).

1.    Controller

The controller responsible for the collection and processing of data described below is in some cases us, 
PreZero Stiftung & Co. KG, Stiftsbergstraße 1, 74172 Neckarsulm, Germany
and in some cases the operator of the relevant social media platform ("platforms"). 

For certain types of processing, we and the platform operator act as joint controllers as defined in Article 26 GDPR (processing pursuant to section 4). 
We, PreZero Stiftung & Co. KG ("PreZero International"), maintain sites on the following social media services ("sites"):

• Facebook: https://www.facebook.com/PreZeroINT
• Instagram: https://www.instagram.com/prezero_int 
• Twitter: https://twitter.com/PreZeroINT
• YouTube: https://www.youtube.com/channel/UCWZ4ro9pkchUI_23PNXinF
• LinkedIn: https://www.linkedin.com/company/prezero-international/

2.    The platform operator as controller

We have only limited control over the processing of data by the operators of the platforms (e.g., the management of members and the information shared). In the situations in which we are able to exert influence, we endeavor to ensure within the confines of the options available to us that the platform operator deals with the data in accordance with data protection law requirements. In many cases, however, we are unable to influence the way in which platform operators process data and also do not know exactly which data they process. 

Platform operators operate the entire IT infrastructure of the service, have their own privacy policies and maintain their own user agreements with you (where you are a registered user of the social media service). The operator is also solely responsible for all questions relating to the data that makes up your user profile, which we as a company have no access to. 

You will find further information about the data processing performed by platform operators and your rights to object in the individual operator's privacy policy.
•    Facebook: https://www.facebook.com/privacy/explanation
•    Instagram: https://help.instagram.com/519522125107875
•    Twitter: https://twitter.com/en/privacy
•    YouTube: https://policies.google.com/privacy?hl=en&gl=en
•    LinkedIn: https://www.linkedin.com/legal/privacy-policy?_l=en

Within the scope of platform use, your personal data is also generally processed by the respective platform operator on servers in third countries, in particular in the United States and the United Kingdom.

3.    Our responsibility

a) Our social media sites

Purpose of the processing we perform and legal basis
We process data on our sites for the purpose of providing information to customers about offers, products, services, promotions, prize draws, specific topics and latest company news, to interact with visitors to our sites on these topics, and to respond to relevant inquiries and positive or negative feedback.

We reserve the right to delete content if it becomes necessary to do so. This would be the case, for example, for posts that infringe rights or violate the law, comments that incite hatred, offensive comments (sexually explicit content) or attachments (e.g., images or videos), which may be in violation of copyright laws, moral rights/rights of publicity, criminal law or PreZero's ethical principles.

We may share your content on our site if this is one of the functions of the platform, and communicate with you through the platform. The legal basis is Article 6(1)(f) GDPR. The processing is carried out for the purpose of our public relations work and communications.

Operators have no ability to influence PreZero's processing of your data in connection with customer communications or prize draws.

As already mentioned, where platform operators give us the option, we make sure we design our sites to be as compliant as possible with data protection laws.

The data entered by you on our sites, such as comments, videos, images, likes, public messages, etc., is published by the platforms and is not used or processed by us for other purposes at any time.

Recipients/categories of recipient:
We may share your content on our site if this is one of the functions of the platform, and communicate with you through the social media services. If you post an inquiry on the platform, we may also, depending on the required response, refer you to other more secure modes of communication that guarantee confidentiality. You always have the option of sending confidential inquiries to us at our address listed under section 1 above or in the "legal notice" section of our website.

Data that you send to us via a confidential channel (e.g. by private message, letter or e-mail) will not be transferred to third parties outside the PreZero Group. In exceptional cases, we will have a processor process the data on our behalf. Such processors are carefully selected, audited by us and bound by contract in accordance with Article 28 GDPR. Furthermore, it may be necessary for us to pass on excerpts of your confidential inquiry to contractual partners (e.g., suppliers in the case of product-specific inquiries) for the purpose of processing your inquiry. In these cases, however, your inquiry will be anonymized in advance, meaning that third parties will not be able to identify you. Should it be necessary to pass on your personal information in individual cases, we will notify you in advance and obtain your consent.

Storage time/criteria for determining storage time:
We delete or securely anonymize all information we receive from you when you make inquiries (positive/negative comments or suggestions) via a secure message no later than 90 days after the final response is sent to you. The information is retained for 90 days in case you contact us again as a customer after receiving a response from us on the same matter and we need to refer to our previous correspondence. Based on experience, we generally do not receive any questions concerning our responses after 90 days.

All public posts that you put on this site remain in the timeline for an indefinite period, unless we delete them as part of updating the information on the topic, they violate the law or breach our guidelines or policies, or you delete the post yourself.

We have no control over the deletion of your data by the operator itself. The privacy policy of the relevant operator therefore also applies in relation to the storage period.

b) Prize draws

Purposes of the processing/legal bases:
You can take part in various prize draws on our website, via our newsletter or on our social media sites. Unless otherwise provided in the given prize draw, or unless you have given us further explicit consent, the personal data you provide to us in the context of participating in the prize draw will be used solely for the purpose of conducting the prize draw (e.g., drawing and notifying winners, sending the prize, announcing winners anonymously, where applicable). If you use your real name on the relevant social media service or are recognizable in photos in your profile, we cannot rule out the possibility that you will be identified by other users.

The legal basis for the processing in the context of prize draws is generally Article 6(1)(b) GDPR. In the event that consent is given in the context of a prize draw, Article 6(1)(a) GDPR is the legal basis for any data processing carried out on the basis of such consent. Where you have given your consent in the context of a prize draw, you are entitled to withdraw that consent at any time with effect for the future.

Recipients/categories of recipient:
Data is only transferred to third parties where this is necessary for conducting the prize draw or sending the prize (e.g., sending the prize via a logistics company) or where you have given us you explicit consent to do so. Please note that on some social media sites, you may also be able to participate directly on the publicly visible websites (e.g., on the wall or via comments), so that other users will be able to see that you are participating when you publicly interact with us. In these cases it will also be apparent on the respective site when you win the prize draw. If you use your real name on the relevant social media service or are recognizable in photos in your profile, we cannot rule out the possibility that you will be identified by other users.

Storage time/criteria for determining storage time:
At the end of the prize draw and following the announcement of the winners, participants' personal data of will be deleted from the prize draw management portal within two weeks after the prize has been dispatched. In the event of non-cash prizes, the data of the winners will be stored for the duration of statutory warranty claims in order to initiate remedial steps or a replacement in the event of a defect, where relevant. If you participate in a prize draw on a site (e.g., by post or comment), we have no control over the deletion of your data by the operator. The privacy policy of the relevant operator of the social media site therefore also applies in relation to the storage period.

c) Social listening and social media monitoring

Purposes of the processing/legal bases:
In addition to the information you provide us directly via platforms, we also use "social listening" and social media monitoring tools to get a picture of how our marketing activities are perceived and to identify any opportunities for improvement. Posts on platforms are analyzed via search requests (e.g., for a new product line) or certain indicators (e.g., page views, number of clicks). Only those posts are viewed which you have made freely available to the public.

The scope of the data collected is primarily determined by the type and content of the respective post; thus, for example, a post in text form or an uploaded image file may be affected. In some cases, the specific user ID may also be relevant, for instance when PreZero wishes to offer assistance with any problems. Sometimes we also receive information from the respective platform operators about the coverage of the relevant posts.

The legal basis for processing personal data in the context of social listening and social monitoring is Article 6(1)(f) GDPR because we have a legitimate interest in being able to listen to what our audience is saying, identify any weaknesses in our products and services and respond to them appropriately.

Recipients/categories of recipient:
To the extent we use external processors in relation to social listening or social media monitoring, such processors will be bound by contract in accordance with Article 28 GDPR. In the context of our cooperation with Emplifi Group, the aforementioned data is generally also processed for social media monitoring purposes on servers located in the United States.

Storage time/criteria for determining storage time:
The relevant data will not be stored permanently by PreZero, it will only be analyzed for the specific purpose of identifying countermeasures that may need to be taken. Where necessary, we may continue to retain your data for annual comparative evaluations for up to two years if you have not already deleted your data from the platform yourself.

4.    Processing as joint controllers, Article 26(1) GDPR

A relationship is in place with the following platform operators in accordance with Article 26(1) GDPR (processing as joint controllers):

•    Facebook: https://en-gb.facebook.com/legal/terms/page_controller_addendum 
•    LinkedIn: https://legal.linkedin.com/pages-joint-controller-addendum 

We and the platform operator act as joint controllers with regard to the web tracking methods used by the platform operator. Web tracking can occur regardless of whether you are logged in or registered on the platform. As already explained, unfortunately we have almost no control over the web tracking methods used by platforms. We are unable, for example, to switch web tracking off.

The legal basis for the aforementioned web tracking methods is your consent pursuant to Article 6(1)(a) GDPR. 

For further information about recipients and categories of recipients and the storage time/criteria for determining storage time, please refer to the privacy policies of the platform operators. We do not have any control over this.

You will find information on the rights available to you to prevent these web tracking methods or to revoke your consent in the privacy policies of the platform operators set out in section 2. You can also contact the platform operators about this using the contact details provided in the legal notice section of their respective websites.

We have only a very limited ability to influence and prevent the provision of statistics to us by platform operators. However, we do make sure that we do not receive any additional optional statistics.

Please note also that the platform operator uses your profile and behavior data in accordance with its terms of use and privacy policy to analyze your habits, personal relationships and preferences. PreZero has no control over the processing or disclosure of your data by platform operators.

5.    Processing of data in a third country 

If we transfer data to recipients in a third country (located outside of the European Economic Area), this will be evident in the information on the recipients/categories of recipient in the description of the respective data processing. Some third countries have been certified by the European Commission through so-called adequacy decisions as having a level of data protection comparable to that offered in the European Economic Area. A list of these countries can be found at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en. Where no comparable data protection standard exists in a given country, we take other measures to ensure that an adequate level of data protection is guaranteed by other means, such as binding corporate rules, the European Commission's standard contractual clauses on the protection of personal data, certificates or recognized codes of conduct. For further information, please contact our data protection officer (section 8).

Your use of the platform may result in the operator processing your data in a third country (registered office outside of the European Economic Area). For further information on the processing of your data in a third country (which is outside PreZero's sphere of influence), please see the respective operators' privacy policies referred to in section 2: 

6.    Your rights as the data subject

a) Overview 

In addition, to the right to withdraw any consent you have granted to us, you have the following rights provided the respective statutory conditions are met:

•    right of access to your personal data stored with us pursuant to Article 15 GDPR;
•    right to rectification of inaccurate personal data and the right to have incomplete personal data completed pursuant to Article 16 GDPR;
•    right to erasure of your personal data stored with us pursuant to Article 17 GDPR;
•    right to a restriction of processing of your data pursuant to Article 18 GDPR;
•    right to data portability pursuant to Article 20 GDPR;
•    right to object pursuant to Article 21 GDPR.

b) Right of access pursuant to Article 15 GDPR 

Pursuant to Article 15(1) of the GDPR, you have the right to request information, free of charge, on the personal data stored about you. This includes in particular:

•    the purposes for which personal data is being processed;
•    the categories of personal data that are being processed;
•    the recipients or categories of recipient to whom personal data concerning you has been or will be disclosed;
•    the planned duration of the storage of the personal data concerning you or, if it is not possible to give any specific details, the criteria used to determine the storage duration;
•    the existence of a right to rectification or erasure of the personal data concerning you, a right to request from the controller that processing be restricted or a right to object to this processing;
•    the right to lodge a complaint with a supervisory authority;
•    all available information regarding the origin of the data if the personal data is not being collected from the data subject;
•    the existence of any automated decision-making processes including profiling pursuant to Article 22(1) and (4) GDPR and – at least in these cases – meaningful information regarding the logic involved as well as the significance and the envisaged consequences of such processing for the data subject.

If personal data is transferred to a third country or an international organization, you have the right to be notified about appropriate safeguards pursuant Article 46 GDPR in connection with the transfer.

c) Right to rectification pursuant to Article 16 GDPR 

You have the right to request the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

d) Right to erasure pursuant to Article 17 GDPR 

You have the right to have any personal data concerning you erased without undue delay where one of the following grounds applies:
•    the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
•    you withdraw your consent on which the processing pursuant to Article 6(1)(a) or Article 9(2)(a) GDPR was based and there is no other legal basis for the processing;
•    you object to the processing pursuant to Article 21(1) or (2) GDPR, and in the case of Article 21(1) GDPR there are no overriding legitimate grounds for the processing;
•    the personal data was unlawfully processed;
•    the erasure of personal data is necessary in order to comply with a legal obligation;
•    the personal data was collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

Where we have made the personal data public and are obliged to erase it, taking account of available technology and the cost of implementation we will take reasonable steps to inform any third parties processing your data of the fact that you have requested the erasure by such third parties of any links to, or copies or replications of, such personal data.

e) Right to restriction of processing pursuant to Article 18 GDPR 

You have the right to require us to restrict the processing where one of the following applies:

•    you contest the accuracy of the personal data;
•    the processing is unlawful and you request the restriction of the use of the personal data rather than its erasure;
•    the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defense of legal claims; or
•    you have objected to the processing pursuant to Article 21(1) GDPR and it is not yet clear whether the legitimate grounds of the controller override your interests.

f) Right to data portability pursuant to Article 20 GDPR 

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit that data to another controller without hindrance by us, where

•    the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) or on a contract pursuant to Article 6(1)(b) GDPR and
•    the processing is carried out by automated means.

In exercising your right to data portability you have the right to have the personal data transmitted directly from us to another controller where technically feasible.

g) Right to object pursuant to Article 21 GDPR 

Provided the requirements of Article 21(1) GDPR are met, you may object to the data processing on grounds relating to your particular situation.
The aforementioned general right to object applies to all processing grounds set out in this privacy policy, which are processed on the basis of Article 6(1)(f) GDPR. In contrast to the specific right to object regarding data processing for promotional purposes, we are only obliged to action such general right to object if you cite grounds of overriding importance, e.g., a possible risk to life or health. In addition, you have the option to contact the supervisory authority responsible for PreZero or PreZero's data protection officer.

h) Right to lodge a complaint with the data protection supervisory authority pursuant to Article 77 GDPR 

You also have a right to lodge a complaint with the competent data protection supervisory authority at any time. In order to do this, you can contact the data protection supervisory authority of the state where you have your place of residence or the authority of the state where the controller is domiciled.