Data protection
A. Basic information
The protection of your privacy is very important to us. We attach great importance to the protection of your personal data and your right to informational self-determination. In the following, we provide information about the collection and processing of personal data when you use our website or our online offering at www.norika.de. Personal data refers to all data that can be related to you personally, e.g. name, address, e-mail address.
1. responsible person
Responsible under data protection law pursuant to Art. 4 No. 7 of the EU General Data Protection Regulation (GDPR):
Norika – Nordring Kartoffelzucht- und Vermehrungs-GmbH Groß Lüsewitz, Parkweg 4, 18190 Sanitz /OT Groß Lüsewitz
Phone: +49 38209 47600
Fax: +49 38209 47666
E-mail:
Further information and contact details can be found in our legal notice at www.norika.de/impressum.
3. data security
We secure our website and other systems through technical and organizational measures against loss, destruction, access, modification or dissemination of your data by unauthorized persons.
In connection with access to our website, data that may allow identification (e.g. IP address) is temporarily stored on our servers for data and system security purposes, but generally for no longer than 30 days. The processing of potentially personal data for data and system security purposes is carried out on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR and our legitimate interest in securing our systems and preventing misuse.
4. principles for the storage and deletion of personal data
Personal data is only processed for the period of time required to achieve the respective storage purpose or if this is provided for in laws or regulations applicable to us, e.g. retention obligations under commercial or tax law. If a storage purpose no longer applies or if a legally prescribed storage period expires, the personal data concerned is routinely deleted in accordance with the statutory provisions or its processing is restricted, e.g. limited processing within the scope of commercial or tax retention obligations.
The processing of personal data due to a legal obligation, namely the fulfillment of statutory retention obligations, is based on Art. 6 para. 1 sentence 1 sentence 1 lit. c GDPR. Insofar as personal data is processed for the purpose of preserving evidence in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR, these processing purposes cease to apply after expiry of the statutory limitation periods; the regular statutory limitation period is three years.
B. Visiting our website
1. technical realization
When you visit our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure the stability and security of our online offering:
- IP address
- Date and time of the request
- Time zone difference to Greenwich Mean Time (GMT)
- Content of the request (specific page)
- Access status/HTTP status code
- Amount of data transferred in each case
- Website from which the request comes
- Browser
- Operating system and its interface
- Language and version of the browser software.
The legal basis for this collection and processing is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest lies in the provision of a functional website and its system security. We also use the aforementioned data in non-personalized form for statistical purposes and to improve our online offering.
The website is hosted by [name, address], which receives the above-mentioned data as a processor.
The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the technical realization of the website, this is the case after a maximum of […].
2. Cookies
In addition to the above-mentioned data, we use technical aids for various functions when you use our website, which can be stored on your end device. When you access our website and at any time thereafter, you have the choice of whether you wish to allow the use of individual or all additional functions in general. You can make changes in your browser settings or via our Consent Manager.
In the following, we first describe the technical functions before going into more detail about your individual selection options by describing technically necessary functions and functions that you can voluntarily select or deselect.
We use technical functions to provide you with additional services, mainly cookies. Cookies are text files or information in a database that are stored on your hard disk and assigned to the browser you are using so that certain information can flow to the location that sets the cookie. Cookies cannot execute programs or transfer viruses to your computer, but are primarily used to make the website faster and more user-friendly and to recognize you on a subsequent visit. You can view the cookies that have been set and their duration at any time in your browser settings and delete them manually.
Mandatory functions that are technically necessary to display the website:
The technical structure of the website requires us to use technologies, in particular cookies. In particular, our website cannot be displayed (completely correctly) without these technologies. These are basically transient cookies that are deleted at the end of your visit to the website, at the latest when you close your browser. You cannot deselect these cookies if you wish to use our website. The individual cookies can be seen in the Consent Manager. The legal basis for this processing is Art. 6 para. 1 sentence 1 lit. f GDPR.
Optional functions:
We only use various cookies or other technologies with your consent, which you can select via the Consent Manager. The functions are only activated with your consent and can be used in particular to enable us to analyze and improve visits to our website and to make it easier for you to use it via different browsers or end devices. The individual cookies can be seen in the Consent Manager with the specified storage period. The legal basis for this processing is Art. 6 para. 1 sentence 1 lit. a GDPR.
You can withdraw your consent at any time without this affecting the lawfulness of processing up to the point of withdrawal. The easiest way to withdraw your consent is via our Consent Manager.
The functions we use are described below.
3. web tracking using Google Analytics
We use Google Analytics, a web tracking service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The purpose of our use of the tool is to enable us to analyze your user interactions on the website and to use the statistics and reports obtained to improve our offer and make it more interesting for you as a user.
We record the interactions between you as a user of the website and our website primarily using cookies, device/browser data, IP addresses and website or app activities. In Google Analytics, your anonymized IP addresses are also recorded to ensure the security of the service and to provide information about the region of the respective user (so-called “IP location determination”). With the anonymization function (“IP masking”), Google shortens the IP addresses by the last octet within the EU/EEA.
Google acts as a processor and we have concluded a corresponding contract with Google. The information obtained about your use of this website and the anonymized IP addresses are generally transferred to a Google server in the USA and processed there. For these cases, Google has submitted to the EU-U.S. Privacy Framework.
The legal basis for the processing of the information (which takes place for a maximum of […] months) is your consent (Art. 6 para. 1 sentence 1 lit. a GDPR). You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. The easiest way to withdraw your consent is via our Consent Manager or by installing the Google browser add-on, which can be accessed via the following link:
https://tools.google.com/dlpage/gaoptout?hl=de/
You can find more information on the scope of services provided by Google Analytics at: https://marketingplatform.google.com/about/analytics/terms/de/
Google provides information on data processing when using Google Analytics at the following link: https://support.google.com/analytics/answer/6004245?hl=de/
General information on data processing, which according to Google should also apply to Google Analytics, can be found in Google’s privacy policy at: https://www.google.de/intl/de/policies/privacy/
4. google maps
We use Google Maps, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This allows us to show you interactive maps directly on the website and enables you to use the map function conveniently. The legal basis for the use of the maps is Art. 6 para. 1 sentence 1 lit. a GDPR, i.e. the integration only takes place with your consent.
When you visit the website, Google receives the information that you have accessed the corresponding subpage of our website. In addition, the above-mentioned basic data such as IP address and time stamp are transmitted. This occurs regardless of whether Google provides a user account through which you are logged in or whether no user account exists.
If you are logged in to Google, your data will be assigned directly to your account. If you do not wish your data to be associated with your Google profile, you must log out before activating the button. Google processes your data (even for users who are not logged in) as usage profiles and uses them for the purposes of market research, needs-based advertising, designing its website and/or informing other users of the social network about your activities on our website.
You have the right to object to the creation of these user profiles, whereby you must contact Google to exercise this right.
The information collected is processed on Google servers, including in the USA. In these cases, the provider has submitted to the EU-U.S. Privacy Framework.
Further information on the purpose and scope of data collection and its processing by the plug-in provider can be found in the provider’s privacy policy. There you will also find further information on your rights in this regard and setting options to protect your privacy:
www.google.de/intl/de/policies/privacy/
5. social media plug-ins
We use the following social media plug-ins: LinkedIn, Facebook and Instagram. These are only loaded if you have previously activated the function with your consent. We offer you the opportunity to interact with the social networks and other users via the plug-ins. The legal basis for the use of the plug-ins is Art. 6 para. 1 sentence 1 lit. a GDPR, i.e. the integration only takes place with your consent.
The plug-in provider processes the data collected about you as usage profiles and uses these for the purposes of advertising, market research and/or the needs-based design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to display needs-based advertising and to inform other users of the social network about your activities on our website.
You have the right to object to the creation of these user profiles, whereby you must contact the respective plug-in provider to exercise this right. Data is passed on regardless of whether you have an account with the plug-in provider and are logged in there.
If you are logged in with the plug-in provider, your data collected by us will be directly assigned to your existing account with the plug-in provider. If you click the activated button and, for example, link the page, the plug-in provider also saves this information in your user account and shares it publicly with your contacts.
We recommend that you log out regularly after using a social network, but especially before activating the button, as this will prevent you from being assigned to your profile with the plug-in provider.
The information collected is stored on the provider’s servers, including outside Europe. In these cases, the providers have submitted to the EU-U.S. Privacy Framework.
You can withdraw your consent at any time without this affecting the lawfulness of the processing up to the point of withdrawal. The easiest way to withdraw your consent is via our Consent Manager or via the functions of the social media providers.
Further information on the purpose and scope of data collection and its processing by the plug-in provider can be found in the data protection declarations of these providers provided below. There you will also find further information on your rights and settings options to protect your privacy.
Addresses of the respective plug-in providers and links to the privacy policies:
LinkedIn
LinkedIn Ireland Unlimited Company
Wilton Place
Dublin 2, Ireland
Privacy Policy:
https://de.linkedin.com/legal/privacy-policy
Facebook
Meta Platforms Ireland Limited
ATTN: Privacy Operations
Merrion Road
Dublin 4, D04 X2K5
Ireland
Privacy Policy:
https://www.facebook.com/privacy/policy/
Instagram
Meta Platforms Ireland Ltd.
4 Grand Canal Square
Grand Canal Harbour
Dublin 2
Ireland
Privacy Policy:
https://help.instagram.com/155833707900388
C. Use of contact options
On our website, we offer you various options for contacting us and sending us messages. You can contact us by telephone, e-mail or via a contact form.
If you contact us, we will store and process the data you provide (e.g. your email address, possibly your name and telephone number) in order to process your request. The legal basis in the event of contact by telephone or e-mail is Art. 6 para. 1 sentence 1 lit. b and f GDPR. Our legitimate interests lie in the efficient and structured recording and processing of customer inquiries.
We delete the resulting data after storage is no longer required, or restrict processing if there are statutory retention obligations.
The legal basis in the case of contact via the contact form is your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.
To process contact requests, we use Salesforce(salesforce.com Germany GmbH), Erika-Mann-Str. 31, 80636 Munich, and snapAddy (snapAddy GmbH), Haugerkirchgasse 7, 97070 Würzburg, which receive the above-mentioned data as processors. We have concluded corresponding contracts with Salesforce and snapAddy for this purpose.
D. Rights of data subjects
We are happy to inform you about your rights under the GDPR as a “data subject”. The GDPR provides for the following rights with regard to personal data concerning you:
- Right to information (Art. 15 (1), (2) GDPR)
- Right to rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object to the processing (Art. 21 GDPR)
- Right to withdraw consent (Art. 7 (3) GDPR)
- Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
In addition, we summarize the key points of the rights of data subjects under the GDPR for you as follows, whereby this presentation does not claim to be exhaustive, but merely addresses the main features of the rights of data subjects under the GDPR:
The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed.
The data subject has the right of access to personal data concerning him or her and to the following information:
- the purposes of processing;
- the categories of personal data that are processed;
- the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
- where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
- the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
- the existence of a right of appeal to a supervisory authority;
- if the personal data are not collected from the data subject, all available information about the origin of the data;
- the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject;
- if personal data is transferred to a third country or to an international organization, to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.
The data subject has the right to be provided with a copy of the personal data concerning him or her that is the subject of processing.
Right to rectification
The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to restriction of processing
The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:
- the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data,
- the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
- the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims, or
- the data subject has objected to processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.
Right of deletion
The data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay where one of the following grounds applies, subject to the legal necessity of data processing (see Art. 17 (3) GDPR for the exception):
- The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
- The data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2) GDPR, and where there is no other legal ground for the processing.
- The data subject objects to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21 (2) GDPR.
- The personal data was processed unlawfully.
- The deletion of personal data is necessary to fulfill a legal obligation under Union law or the law of the Member States to which the controller is subject.
- The personal data was collected in relation to information society services offered in accordance with Art. 8 para. 1 GDPR.
Right to data portability
The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent or on a contract pursuant to point (b) of Article 6(1) GDPR and the processing is carried out by automated means.
In exercising his or her right to data portability, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
Right of withdrawal
The data subject has the right to withdraw any consent given at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Right to lodge a complaint with a supervisory authority
Each data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.
The data protection supervisory authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern, Werderstraße 74a, 19055 Schwerin, e-mail:
Reference to rights of objection pursuant to Art. 21 (1), (2) GDPR
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions.
If you object, your personal data will no longer be processed unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.
Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.
