Privacy policy | roana.design

1. An overview of data protection

General information

The following information gives you an easy to understand overview of what happens to your personal data when you visit this website. The term “personal data” covers all data that can be used to identify you personally. Detailed information on data protection can be found in our privacy policy, which we have included below this text.

Data collection on this website

Who is responsible for the collection of data on this website (that is, the “controller”)?

The data on this website is processed by the operator of the website, whose contact information can be found in the section “Information about the controller (the “controller” under the GDPR)” in this privacy policy.

How do we collect your data?

We collect your data because you provide it to us, for example through entries in the contact form. Further data is collected automatically by our IT systems when you visit the website, or after your consent. This is mainly technical data such as internet browser, operating system or the time of the page view. Collection takes place automatically as soon as you enter this website.

What rights do you have regarding your data?

You have the right to receive information about the source, recipients and purposes of your stored personal data at any time, free of charge. You also have the right to request the correction or deletion of your data. If you have consented to the processing of data, you can revoke this consent at any time, which affects all future data processing. In addition, you have the right to request the restriction of the processing of your data under certain circumstances. You also have the right to lodge a complaint with the competent supervisory authority.

Please do not hesitate to contact us at any time if you have questions about these or other data protection matters.

Analytics tools and third-party tools

There is a possibility that your browsing patterns will be analyzed statistically when you visit this website. Such analyses are mainly carried out using so-called analytics programs.

For detailed information about these analytics programs, please consult our privacy policy below.

2. Hosting

External hosting

Our website is hosted by an external service provider:

Bluehost, Inc
5335 Gate Parkway
Jacksonville, FL 32256
USA

All personal data collected via this website is stored on the servers of our hosting provider. This may include, among other things, IP addresses, contact requests, meta and communication data, contract and contact data, website access data and other data generated through the use of this website.

An external hosting service provider is used in order to provide our online offering securely, reliably and efficiently. The processing of personal data by the hosting provider is based on our legitimate interest in a professional provision of our web offering pursuant to Art. 6(1)(f) GDPR and, where relevant, on the fulfilment of contractual obligations (Art. 6(1)(b) GDPR).

Insofar as you have given your consent for certain processing operations, for example for cookies or device tracking, processing takes place on the basis of Art. 6(1)(a) GDPR in conjunction with section 25(1) TDDDG. You can revoke your consent at any time with effect for the future.

Data processing

We have concluded a data processing agreement (DPA) for the use of the service named above. This is a contract required by data protection law which guarantees that the personal data of our website visitors is processed only on the basis of our instructions and in accordance with the GDPR.

3. General information and mandatory information

Data protection

The operators of this website and its pages take the protection of your personal data very seriously. We therefore treat your personal data as confidential information and in accordance with the statutory data protection provisions and this privacy policy.

Various personal data is collected when you use this website. Personal data includes data that can be used to identify you personally. This privacy policy explains what data we collect and for what purposes we use this data. It also explains how and for what purpose the information is collected.

We point out that the transmission of data over the internet (that is, via e-mail communication) may have security gaps. It is not possible to protect data completely against access by third parties.

Information about the controller (the “controller” under the GDPR)

The party responsible for data processing on this website is:

roana.design GmbH
In der Knackenau 5
82031 Grünwald
Germany

E-mail: [email protected]

The controller is the natural or legal person who, alone or jointly with others, takes decisions about the purposes and means of the processing of personal data (for example names, e-mail addresses and so on).

Storage period

Unless a more specific storage period is stated in this privacy policy, your personal data remains with us until the purpose for which it was collected no longer applies. If you assert a justified request for deletion or revoke your consent to data processing, your data will be deleted, unless we have other legally permissible grounds for storing your personal data (for example retention periods under tax or commercial law); in that case deletion takes place as soon as these grounds no longer apply.

General information on the legal basis for data processing on this website

If you have consented to the data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR where special categories of data pursuant to Art. 9(1) GDPR are processed. In the case of express consent to the transfer of personal data to third countries, the data processing is also based on Art. 49(1)(a) GDPR. If you consent to the storage of cookies or to access to information on your end device (for example through device fingerprinting), the data processing is additionally based on section 25(1) TDDDG. Consent can be revoked at any time. If your data is required for the fulfilment of a contract or for the performance of pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, if your data is required for the fulfilment of a legal obligation, we process it on the basis of Art. 6(1)(c) GDPR. In addition, data processing may be carried out on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR. Information on the relevant legal basis in each individual case is given in the following paragraphs of this privacy policy.

Information on data transfer to third countries without an adequate level of data protection and to US companies not certified under the EU-US Data Privacy Framework

Recipients of personal data

In the course of our business activities we work together with various external partners. In some cases it is also necessary to pass on personal data to these external partners. We transfer personal data to external parties only where this is necessary for the fulfilment of a contract, where we are legally obliged to do so (for example passing data on to tax authorities), where we have a legitimate interest in the disclosure pursuant to Art. 6(1)(f) GDPR, or where another legal basis permits the disclosure of this data. When using processors, we transfer personal data of our customers only on the basis of a valid data processing agreement. In the case of joint processing, a joint controllership agreement is concluded.

Revocation of your consent to data processing

A large number of data processing operations is possible only with your express consent. You can revoke any consent already given at any time. This does not affect the lawfulness of the data processing carried out up to the revocation.

Right to object to data collection in special cases; right to object to direct marketing (Art. 21 GDPR)

IF DATA IS PROCESSED ON THE BASIS OF ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS ARISING FROM YOUR PARTICULAR SITUATION. THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. TO DETERMINE THE LEGAL BASIS ON WHICH THE DATA PROCESSING IS BASED, PLEASE READ THIS PRIVACY POLICY. IF YOU LODGE AN OBJECTION, WE WILL NO LONGER PROCESS THE PERSONAL DATA CONCERNED, UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE DATA PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PURPOSE OF THE PROCESSING IS THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF THE PERSONAL DATA CONCERNED FOR THE PURPOSES OF DIRECT MARKETING. THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS CONNECTED WITH DIRECT MARKETING. IF YOU LODGE AN OBJECTION, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR THE PURPOSES OF DIRECT MARKETING (OBJECTION PURSUANT TO ART. 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, their place of work or the place of the alleged infringement. The right to lodge a complaint exists irrespective of other administrative or judicial remedies.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or for the fulfilment of a contract transferred to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done where it is technically feasible.

Information about, correction and deletion of data

Within the scope of the applicable statutory provisions, you have the right at any time to request information about your archived personal data, its origin and recipients, and the purpose of the processing of your data. You also have the right to have your data corrected or deleted. If you have questions on this subject or other questions on the subject of personal data, you can contact us at any time.

Right to request restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time for this purpose. The right to restriction of processing applies in the following cases:

If you dispute the accuracy of the data we store about you, we usually need some time to verify this claim. During this time you have the right to request that we restrict the processing of your personal data.

If the processing of your personal data has taken place or is taking place unlawfully, you have the option of requesting the restriction of the processing of your data instead of demanding its deletion.

If we no longer need your personal data and you need it for the establishment, exercise or defence of legal claims, you have the right to request the restriction of the processing of your personal data instead of its deletion.

If you have lodged an objection pursuant to Art. 21(1) GDPR, your rights and our rights must be weighed against each other. As long as it has not been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data, with the exception of its archiving, may be processed only with your consent or for the establishment, exercise or defence of legal claims, or for the protection of the rights of other natural or legal persons, or for reasons of important public interest of the European Union or of an EU member state.

SSL and/or TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the operator of the website, this website uses either an SSL or a TLS encryption program. You can recognize an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and the padlock symbol appears in the browser line.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

4. Collection of data on this website

Cookies

Our web pages and sites use so-called “cookies”. Cookies are small data packages that do no harm to your device. They are stored either temporarily for the duration of a session (session cookies) or permanently on your device (permanent cookies). Session cookies are deleted automatically as soon as you end your visit. Permanent cookies remain stored on your device until you actively delete them or they are deleted automatically by your web browser.

Cookies can be set by us (first-party cookies) or by third-party companies (so-called third-party cookies). Third-party cookies allow certain services of third-party companies to be integrated into web pages (for example cookies for handling payment services).

Cookies have a variety of functions. Many cookies are technically necessary, because without these cookies certain functions of the website would not work (for example the shopping cart function or the display of videos). Other cookies can be used to analyze user behaviour or for advertising purposes.

Cookies that are necessary for carrying out electronic communication processes, for providing certain functions that you wish to use (for example the shopping cart function), or that are necessary for optimizing the website (necessary cookies) (for example cookies that provide measurable insights into the web audience) are stored on the basis of Art. 6(1)(f) GDPR, unless another legal basis is stated. The operator of the website has a legitimate interest in storing necessary cookies in order to guarantee the technically error-free and optimized provision of the operator’s services. If your consent to the storage of cookies and similar recognition technologies has been obtained, the processing takes place exclusively on the basis of the consent given (Art. 6(1)(a) GDPR and section 25(1) TDDDG); this consent can be revoked at any time.

You have the option of setting your browser so that you are notified each time cookies are set and to allow the acceptance of cookies only in certain cases. You can also exclude the acceptance of cookies in certain cases or generally, or activate the delete function so that cookies are deleted automatically when the browser is closed. If cookies are deactivated, the functions of this website may be limited.

Please refer to this privacy policy for which cookies and services are used on this website.

You can revoke or adjust your consent at any time in the cookie settings.

Contact form

If you send us enquiries via the contact form, your details from the form, including the contact data you provide there, are stored by us for the purpose of processing the enquiry and in case of follow-up questions. We do not pass this data on without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR where your enquiry is connected with the performance of a contract or is necessary for carrying out pre-contractual measures. In all other cases the processing is based on our legitimate interest in the effective handling of the enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR), where this has been obtained; consent can be revoked at any time.

The data you enter in the contact form remains with us until you ask us to delete it, revoke your consent to storage, or the purpose for storing the data ceases to apply (for example after your enquiry has been dealt with). Statutory provisions, in particular retention periods, remain unaffected.

Enquiry by e-mail, telephone or fax

If you contact us by e-mail, telephone or fax, your enquiry including all personal data arising from it (for example name, request) is stored and processed by us for the purpose of dealing with your request. We do not pass this data on without your consent.

The data you send us remains with us until you ask us to delete it, revoke your consent to storage, or the purpose for storing the data ceases to apply (for example after your enquiry has been dealt with). Statutory provisions, in particular statutory retention periods, remain unaffected.

5. Social media

Functions and content of the social network LinkedIn may be integrated into our website. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

If you call up a page that contains a LinkedIn link or plugin (for example a “Follow” button or a link to our profile), a connection to LinkedIn’s servers may be established. In doing so, personal data, in particular your IP address and information about the use of this website, may be transferred to LinkedIn. If you are logged in to LinkedIn at the same time, LinkedIn can assign the visit to our website to your user account.

Insofar as we use embedded LinkedIn elements (for example plug-ins or embeds), these are loaded only after your consent. The legal basis is Art. 6(1)(a) GDPR in conjunction with section 25(1) TDDDG; revocation is possible at any time in the cookie settings.

Insofar as a transfer to the USA takes place, this is made to recipients certified under the DPF, in particular LinkedIn Corporation; if no certification exists, we use the standard contractual clauses of the EU Commission. Further information on data processing by LinkedIn can be found in LinkedIn’s privacy policy at: https://www.linkedin.com/legal/privacy-policy.

Instagram

Functions of the Instagram service may be integrated into our website. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

If you call up one of our pages into which Instagram content (for example posts, images or videos) is integrated, a connection to Instagram’s servers is established. In doing so, data (for example your IP address and information about your user behaviour on this website) may be transferred to Instagram. This also applies if you do not have an Instagram account yourself or are not logged in.

If you are logged in to Instagram at the same time, Instagram can assign the visit to our website to your Instagram account. Instagram content is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and section 25(1) TDDDG, where this has been obtained via our cookie banner. Consent can be revoked at any time with effect for the future.

Further information on data processing by Instagram can be found in Instagram’s privacy policy: https://privacycenter.instagram.com/policy.

Facebook

Elements of the social network Facebook may be integrated into this website. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

If you call up one of our pages into which a Facebook plugin is integrated (for example a Like button or posts), a direct connection is established between your browser and the Facebook server. Facebook thereby receives the information that you have visited our website with your IP address. If you are logged in to your Facebook account at the time, Facebook can assign the visit to our website to your user account. If you interact with the plugins (for example click the “Like” button), the corresponding information is also transferred to Facebook.

We point out that we, as the provider of this website, receive no knowledge of the content of the transmitted data or of its use by Facebook. Further information on this can be found in Facebook’s privacy policy at: https://www.facebook.com/privacy/policy.

Facebook plugins are used on the basis of your consent pursuant to Art. 6(1)(a) GDPR in conjunction with section 25(1) TDDDG. You can revoke this consent at any time with effect for the future.

If joint controllership with Meta arises in the course of use (Art. 26 GDPR), the corresponding agreement applies: https://www.facebook.com/legal/controller_addendum

Further information on data transfer to third countries (in particular the USA) and on the protective measures (for example EU standard contractual clauses) can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum

7. Newsletter

Newsletter data

If you would like to receive the newsletter offered on this website, we require an e-mail address from you as well as information that allows us to verify that you are the owner of the e-mail address provided and that you agree to receive the newsletter (double opt-in procedure). Further data is collected only on a voluntary basis.

The data entered in the registration form is processed exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR. You can revoke the consent given to the storage of the data and the e-mail address, and to their use for sending the newsletter, at any time, for example via the “unsubscribe” link in the newsletter. The lawfulness of the data processing already carried out remains unaffected by the revocation.

The data you have deposited with us for the purpose of receiving the newsletter is stored until you unsubscribe from the newsletter and is deleted after you cancel the newsletter, provided that no statutory retention obligations prevent deletion.

Where we use service providers (for example newsletter dispatch via providers such as Mailchimp, Brevo, CleverReach and so on), this takes place on the basis of a data processing agreement pursuant to Art. 28 GDPR.

8. Plug-ins and tools

Vimeo

This website embeds videos from the Vimeo platform. The provider is Vimeo.com, Inc., 555 West 18th Street, New York, NY 10011, USA.

A connection to Vimeo’s servers is established only after your consent; in doing so, technical data (for example IP address, device and browser information, page called up) may be transferred. If you are logged in to Vimeo, Vimeo can assign the page view to your account.

The integration takes place only after your consent via our consent banner. The legal basis is Art. 6(1)(a) GDPR in conjunction with section 25(1) TDDDG. You can revoke your consent at any time with effect for the future in the cookie settings.

Insofar as a transfer to the USA takes place, this is made to recipients certified under the EU-US Data Privacy Framework (DPF), in particular Vimeo.com, Inc.; insofar as they are not covered by the DPF, we base transfers on the standard contractual clauses (SCC) of the EU Commission.

Further information on data protection at Vimeo: https://vimeo.com/legal/privacy/policy

YouTube

This website embeds videos from the YouTube platform. The provider for users in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A connection to YouTube servers is established only after your consent. In doing so, technical data such as IP address, device and browser information and the page called up may be transferred. If you are logged in to YouTube, YouTube can assign the page view to your account. (Where possible we use the extended data protection mode via youtube-nocookie.com; data transfers may nevertheless occur during playback.)

Insofar as a transfer to the USA takes place, this is made to recipients certified under the EU-US Data Privacy Framework (DPF), in particular Google LLC. Insofar as the recipient is not covered by the DPF, we base the transfer on the standard contractual clauses (SCC) of the EU Commission.

Further information on data protection at Google and YouTube: https://policies.google.com/privacy

Google Maps

This website uses Google Maps to display maps and for route planning. The provider (EU) is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A connection to Google servers is established only after your consent; in doing so, technical data such as IP address, device and browser information and the page called up may be transferred. The integration takes place only after your consent via our consent banner. The legal basis is Art. 6(1)(a) GDPR in conjunction with section 25(1) TDDDG. You can revoke your consent at any time with effect for the future in the cookie settings.

Insofar as a transfer to the USA takes place, this is made to recipients certified under the EU-US Data Privacy Framework (DPF), in particular Google LLC; otherwise we base transfers on the standard contractual clauses (SCC) of the EU Commission. Further information on data protection at Google: https://policies.google.com/privacy

Wordfence

This website uses the Wordfence security plugin to protect against unauthorized access, hacker attacks and other security-relevant threats. The provider is Defiant, Inc., 800 5th Ave Ste 4100, Seattle, WA 98104, USA.

Wordfence uses cookies and stores IP addresses in order to detect and block malicious access attempts. In doing so, personal data (in particular IP addresses) may also be transferred to servers in the USA. Wordfence is used in the interest of the security of this website and therefore on the basis of Art. 6(1)(f) GDPR (legitimate interest).

In the event of a transfer of personal data to the USA, Wordfence relies on the standard contractual clauses (SCC) of the EU Commission to ensure an adequate level of data protection.

Further information on data collection and processing by Wordfence can be found in Wordfence’s privacy policy: https://www.wordfence.com/privacy-policy/.

9. Individual services

Handling of applicant data

We offer visitors to our website the opportunity to apply to us (for example by e-mail, by post or via an online application form). Below we inform you about the scope, purpose and use of the personal data collected in the course of the application process. We assure you that the collection, processing and use of your data takes place in accordance with the applicable data protection laws and is treated in strict confidence.

Purpose and legal basis of the data processing

If you send us an application, we process the associated personal data (for example contact and communication data, application documents, interview notes and so on) insofar as this is necessary for the decision on the establishment of an employment relationship. The legal basis for this is section 26 of the German Federal Data Protection Act (BDSG) (initiation of an employment relationship), Art. 6(1)(b) GDPR (general initiation of a contract) and, where corresponding consent exists, Art. 6(1)(a) GDPR. Consent given can be revoked at any time with effect for the future.

Within our company, your personal data is passed on only to persons who are involved in processing your application.

If an employment relationship arises following your application, the data you have submitted is stored in our data processing system in accordance with section 26 BDSG and Art. 6(1)(b) GDPR for the purpose of carrying out the employment relationship.

Storage period of the data

If we do not make you a job offer, or if you reject such an offer or withdraw your application, we reserve the right to retain the data you have submitted on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR for up to 6 months from the end of the application procedure (rejection or withdrawal). After that the data is deleted and physical application documents are destroyed. The retention serves in particular as evidence in the event of legal disputes.

If it is foreseeable that the data will still be needed after the 6 months have expired (for example because of an impending or ongoing legal dispute), deletion takes place only when the purpose of further storage no longer applies.

Longer storage may also take place if you have expressly consented pursuant to Art. 6(1)(a) GDPR or if statutory retention obligations prevent deletion.

This English version is a translation for information purposes. The German version is legally binding.