Privacy policy for our social media

We appreciate your interest in our social media presence. We operate profiles on social networks (hereinafter also referred to as “fan pages”) in order to present our offers, products and our company to you and to get in touch with you. With the following explanations, we provide you with information about what kind of personal data we process and to what extent, as well as for what purpose this is done.

1. Responsibility and data protection officer

1.1     For the processing of your personal data, we are the “controller” within the meaning of Art. 4 No. 7 GDPR:

Schlafender Hase GmbH
Westerbachstr. 47
60489 Frankfurt
Germany
Tel.: +49 69 / 44 810
E-Mail: TVT@sh-p.de

Commercial register entry number: HRB 87542, Frankfurt
Register court: Frankfurt
Managing Director: Frank Heßler

1.2     You can reach our data protection officer as follows:
E-Mail: jason.komninos@bbservices.gmbh
Address: Beiten Burkhardt Services GmbH, Ganghoferstraße 33, 80339 München, Germany

2. General

2.1     We maintain publicly accessible profiles on social networks. Your visit to these profiles initiates a variety of data processing operations. In the following, we provide you with an overview of which of your personal data is collected, used and stored by us when you visit our profiles on social networks. Personal data is information that can be assigned to you as a specific person (e.g. name, age, address, photos, e-mail addresses, and possibly also IP addresses). Furthermore, we inform you about your rights with regard to the processing of your personal data. You are not obliged to provide us with your personal data. However, this may be necessary for individual functionalities of our profiles in social networks. These functionalities will not be available to you or only to a limited extent if you do not provide us with your personal data.

2.2     When you visit our profiles, your personal data will be collected, processed and used not only by us, but also by the operators of the respective social network. This happens even if you yourself do not have a profile in the respective social network. We have no influence on and no precise knowledge of how the operators process the data from your visit to our fan page and from your interactions with our posts for their own purposes, how long they are stored and whether the data are passed on to third parties. The data processing may differ depending on whether you are registered and logged in to the social network or visit the page as a non-registered and/or non-logged-in user. When you access the fan page or a post, the IP address assigned to your terminal device is transmitted to the operator of the respective social network. If you are currently logged into the social network, a cookie on your end device can be used to track how you have moved around the Internet. Buttons embedded in websites enable the operators of the respective social network to record your visits to these websites and assign them to your respective profile. Based on this data, content or advertising can be offered tailored to you. If you want to avoid this, you should log out or deactivate the “stay logged in” function, delete the cookies present on your device and restart your browser.

2.3     For details on the collection and storage of your personal data as well as the type, scope and purpose of its use by the operator of the respective social network, please refer to the privacy policies of the respective operator and the following statements.

3. Your data subject rights

3.1     In accordance with Art. 15 (1) GDPR, you have the right to obtain free information on your stored personal data.

3.2     In addition, you have a right to rectification (Art. 16 GDPR), deletion (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR) of your personal data if the legal requirements are met.

3.3     If the data processing is based on Art. 6 (1) lit. e or f GDPR, you have the right to object on grounds arising from your particular situation in accordance with Art. 21 GDPR. If you object to data processing, it will not be carried out in the future, unless we can demonstrate compelling legitimate grounds for further processing that outweigh your interest in objecting, or the processing serves the assertion, exercise or defense of legal claims.

3.4     If you have provided us with the processed data, you have a right to data portability pursuant to Art. 20 GDPR. However, in the case of social media presences, you can generally only assert this against the operator of the respective social network, as only the latter has access to your profile data.

3.5     If the data processing is based on consent pursuant to Art. 6 (1) lit. a or Art. 9 (2) lit. a GDPR, you may revoke your consent at any time with effect for the future without affecting the lawfulness of the previous processing.

3.6     In addition, you have the right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR if you are of the opinion that the data processing by us violates the statutory provisions.

3.7     If you would like to exercise your data subject rights with regard to a specific data processing over which we have an influence, or if you have any other questions, please contact us or our data protection officer in writing or by e-mail. We will then review your request (e.g. request for information or objection) ourselves or, if necessary, forward your request to the relevant social network, if your request concerns data processing by the operator of the social network.

4. Purpose of data processing / legal basis

4.1     The purpose of data processing by us on our social media presences is to inform our customers or other interested persons about our offers, products, services, promotions, factual topics and company news, to interact with visitors to our social media presences on these topics and to respond to corresponding queries, praise or criticism.

4.2     The processing of your personal data on the occasion of visiting our social media presences is based on our legitimate interests in effectively informing users and communicating with users pursuant to Art. 6 (1) lit. f GDPR. Overriding conflicting interests on your part are not identifiable if you use the social networks voluntarily and in full knowledge of the respective terms of use and privacy notices, especially since we always provide the content via alternative communication channels, such as our website, whenever possible. If you yourself are registered with the social networks, the processing is also carried out in accordance with the terms of use that apply between you and the social network pursuant to Art. 6 (1) lit. b GDPR.

4.3     We only reserve the right to delete content if this should be necessary. If applicable, we share your content on our site if this is a function of the social network and communicate with you via the platform.

5. Transfer of data / transfer to third countries

5.1     As a matter of principle, your data will only be transferred to third parties if you have given us your consent to do so in accordance with Art. 6 (1) lit. a GDPR, which you can freely revoke at any time with effect for the future. This may be the case, for example, if we conduct sweepstakes together with third-party providers via our social media presences, where you are requested to accept the conditions of participation and consent to the associated data processing in the event of participation. The transfer to state institutions and authorities entitled to receive information only takes place within the scope of the legal obligations to provide information or if we are obliged to provide information by a court decision. In this case, the transfer of your data is required by Art. 6 (1) lit. c GDPR to fulfill a legal obligation to which we are subject.

5.2     External service providers who process data on our behalf are carefully selected by us and strictly bound by contract. The service providers work according to our instructions, which is ensured by strict contractual regulations, by technical and organizational measures and by supplementary controls.

5.3     We would like to point out that during data processing by the operators of the social networks, user data may be processed in so-called third countries outside the EU or the European Economic Area. In these cases, the level of data protection in the third country may not have been determined by the EU Commission in accordance with Art. 45 GDPR, and there may also be no suitable guarantees as defined in Art. 46 GDPR. It is therefore possible that a level of data protection exists in the third country that is not equivalent to that of the GDPR. Data may be used for commercial interests, for example, to display specific advertising to users. Risks may also arise for users because, for example, it may be more difficult to enforce their rights. For details, please refer to the privacy statements of the social networks and the explanations below.

6. General storage period and deletion

6.1     We store your personal data for as long as it is necessary to fulfill the intended purpose or for justified reasons within the meaning of Art. 17 (3) GDPR, such as statutory retention periods. As long as legal retention obligations, such as tax and commercial law regulations, prevent the deletion of your personal data, we restrict the processing of your data; subsequently, your data will be deleted in accordance with the legal regulations.

6.2     All public posts by you on our social media presences remain in the timeline indefinitely, unless we delete them due to an update of the underlying topic or a legal violation or you delete the post yourself. With regard to the deletion of your data by the operator itself, we have no means of influencing this. Therefore, the data protection provisions of the respective operator apply in addition.

7. Facebook

Our Facebook page is accessible through the platform of Facebook (www.facebook.com), which is operated in the European Union by:

Meta Platforms Ireland Ltd (“Meta”), 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

7.1     Independent processing of usage data by Meta

When you visit our Facebook page, Meta collects usage data. Meta is solely responsible for this data processing under data protection law. Meta provides information on this in its data policy and the cookie policy.

The data collected about you in this context will be processed by Meta and, if necessary, transferred to countries outside the EU. Meta describes which information it receives and how it is used in its data usage guidelines. There you will also find information on how to contact Facebook or Meta and on the settings options for advertisements.

When you access a Facebook page, the IP address assigned to your end device is transmitted to Meta. According to information from Meta, this IP address is anonymized. Meta also stores information about the end devices of its users (e.g. as part of the “login notification” function); this may enable Meta to assign IP addresses to individual users.

If you are currently logged in to Facebook as a user, a cookie with your Facebook ID is located on your end device. This enables Meta to track that you have visited the respective page and how you have used it. This also applies to all other Facebook pages. Via Facebook buttons embedded in websites, it is possible for Meta to record your visits to these websites and assign them to your Facebook profile. Based on this data, content or advertising can be offered tailored to you.

If you want to avoid this, you should log out of Facebook or disable the “stay logged in” feature, delete the cookies present on your device, and exit and restart your browser. In this way, Facebook information through which you can be directly identified will be deleted. This will allow you to use the Facebook fan page without revealing your Facebook identifier. When you access interactive features of the page (like, comment, share, message, etc.), a Facebook login screen will appear. After any login, you will again be recognizable to Facebook as a user.

According to Meta, it stores the data until it is no longer needed to provide the services and Facebook products or until the respective user account is deleted, whichever comes first. This depends on the circumstances of the individual case, in particular the type of data, why it is collected and processed, and the relevant legal or operational storage needs.

In connection with the above-mentioned functions, Meta may also transfer the data processed in the process to servers outside the EU, in particular to Meta Platforms Inc. in the USA, insofar as this is necessary to provide these services. For the USA, there is an adequacy decision of the EU Commission in the form of the EU-U.S. Data Privacy Framework, which certifies to certified companies an adequate level of data protection within the meaning of the GDPR. Meta Platforms Inc. is certified under the EU-U.S. Data Privacy Framework and is also entered in the list maintained by the U.S. Department of Commerce (Data Privacy Framework List). A consistently high level of data protection is therefore guaranteed when data is transferred to Meta Platforms Inc. servers in the USA. Insofar as a transfer of data to the USA takes place, such a third country transfer is based on Art. 45 (1) sentence 1 GDPR.

7.2     Processing of usage data under joint responsibility

When you visit our Facebook page, Meta also uses certain usage data (e.g., whether you have marked certain posts with “Like” or commented on them) to provide us with aggregate usage statistics (so-called “page insights”). Usage statistics do not allow any conclusions to be drawn about the behavior of individual users, but merely give us an overview of the use of the Facebook page (e.g. which posts were clicked on particularly frequently). We ourselves have no access to the personal data processed for the creation of the statistics. Which usage actions are logged by Facebook is determined solely by Meta and cannot be set up, changed or otherwise influenced by us.

We let Meta provide us with usage statistics in order to improve the posts published on Facebook and make them as interesting as possible for users.

Meta and we are jointly responsible for the processing of personal data for the creation of these usage statistics pursuant to Art. 26 GDPR.

Facebook’s information on Page Insights describes what data is processed under shared responsibility and includes the “Page Insights Addendum” in which Meta and we have contractually agreed on who fulfills which obligations under the GDPR.

7.3     Processing of your data when communicating via Facebook

If you contact us via the Facebook page, for example by commenting on a post or writing us a message via Facebook Messenger, we process your related personal data (e.g. your name and the communication content) in order to process your request.

8. Instagram

Our Instagram page is accessible through the Instagram platform (www.instagram.com), which is operated in the European Union by:

Meta Platforms Ireland Ltd (“Meta”), 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

8.1     Independent processing of usage data by Meta

When you visit our Instagram page, Meta collects usage data. Meta is solely responsible for this data processing under data protection law. Meta provides information on this in its data policy and the cookie policy.

The data collected about you in this context will be processed by Meta and, if necessary, transferred to countries outside the EU. Meta describes which information it receives and how it is used in its data usage guidelines. There you will also find information on how to contact Instagram or Meta and on the settings options for advertisements.

When you access an Instagram page, the IP address assigned to your end device is transmitted to Meta. According to information from Meta, this IP address is anonymized. Meta also stores information about the end devices of its users (e.g. as part of the “login notification” function); this may enable Meta to assign IP addresses to individual users.

If you are currently logged in to Instagram as a user, a cookie with your Instagram ID is located on your end device. This enables Instagram to track that you have visited the respective page and how you have used it. This also applies to all other Instagram pages. Via Instagram buttons embedded in websites, it is possible for Instagram to record your visits to these websites and assign them to your Instagram profile. Based on this data, content or advertising can be offered tailored to you.

If you want to avoid this, you should log out of Instagram or disable the “stay logged in” feature, delete the cookies present on your device, and exit and restart your browser. This way, Instagram information through which you can be directly identified will be deleted. This will allow you to use the Instagram fan page without revealing your Instagram identifier. When you access interactive features of the page (like, comment, share, message, etc.), an Instagram login screen will appear. After any login, you will again be recognizable to Instagram as a user.

According to Meta, it stores the data until it is no longer needed to provide the services and Instagram products or until the respective user account is deleted, whichever comes first. This depends on the circumstances of the individual case, in particular the type of data, why it is collected and processed, and relevant legal or operational storage needs.

In connection with the above-mentioned functions, Meta may also transfer the data processed in the process to servers outside the EU, in particular to Meta Platforms Inc. in the USA, insofar as this is necessary to provide these services. For the USA, there is an adequacy decision of the EU Commission in the form of the EU-U.S. Data Privacy Framework, which certifies to certified companies an adequate level of data protection within the meaning of the GDPR. Meta Platforms Inc. is certified under the EU-U.S. Data Privacy Framework and is also entered in the list maintained by the U.S. Department of Commerce (Data Privacy Framework List). A consistently high level of data protection is therefore guaranteed when data is transferred to Meta Platforms Inc. servers in the USA. Insofar as a transfer of data to the USA takes place, such a third country transfer is based on Art. 45 (1) sentence 1 GDPR.

8.2     Processing of usage data under joint responsibility

When you visit our Instagram page, Meta also uses certain usage data (e.g., whether you have marked certain posts with “Like” or commented on them) to provide us with aggregated usage statistics (so-called “page insights”). Usage statistics do not allow any conclusions to be drawn about the behavior of individual users, but merely give us an overview of the use of the Instagram page (e.g., which posts were clicked on particularly frequently). We ourselves do not have access to the personal data processed for the creation of the statistics. Which usage actions are logged by Instagram is determined solely by Meta and cannot be set up, changed or otherwise influenced by us.

We let Meta provide us with usage statistics in order to improve the posts published on Instagram and make them as interesting as possible for users.

Meta and we are jointly responsible for the processing of personal data for the creation of these usage statistics pursuant to Art. 26 GDPR.

Meta’s information on Page Insights describes what data is processed under shared responsibility and includes the “Page Insights Supplement” in which Meta and we have contractually agreed on who fulfills which obligations under the GDPR.

8.3     Processing of your data when communicating via Instagram

If you contact us via the Instagram page, for example by commenting on a post or writing us a message via Instagram Messenger, we will process your related personal data (e.g., your name and the communication content) to address your request.

9. LinkedIn

Our LinkedIn page is accessible via the LinkedIn platform (www.linkedin.com), which is operated in the European Union by:

LinkedIn Ireland Unlimited Company (“LinkedIn”), Wilton Place, Dublin 2, Ireland

9.1     Independent processing of usage data by LinkedIn

When you visit our LinkedIn page, LinkedIn collects usage data. LinkedIn alone is responsible for this data processing under data protection law. LinkedIn provides information on this in its privacy policy and the cookie policy.

LinkedIn processes, on the one hand, the data you voluntarily entered during registration, such as your name, e-mail address, telephone number, as well as your payment and billing information, if you have registered for a premium service, or the contacts in your address book, if you have uploaded or synchronized it. Likewise, LinkedIn processes the personal information you publish on your profile, such as education, work experience, skills, photo or other demographic data, if you provide, post or upload it on the network’s services.

Second, LinkedIn evaluates the content you share to determine what topics you are interested in, stores and processes confidential messages you send directly to other users, and may determine your location using geolocation data such as GPS, wireless network information, or through your IP address to serve you advertising or other content.

Finally, LinkedIn also receives information when you view content, for example, even if you have not created an account. This so-called “log data” can be the IP address, the browser type, the operating system, information about the previously accessed website and the pages you viewed, your location, your mobile provider, the terminal device you use (including device ID and application ID), the search terms you used and cookie information.

Via LinkedIn buttons or widgets embedded in websites and the use of cookies, it is possible for LinkedIn to record your visits to these websites and assign them to your LinkedIn profile. Based on this data, content or advertising can be offered tailored to you.

In connection with the above-mentioned functions, LinkedIn may also transfer the data processed to servers outside the EU, in particular to LinkedIn Corp. in the USA, insofar as this is necessary for the provision of these services. For the USA, the EU-U.S. Data Privacy Framework is an adequacy decision of the EU Commission, which certifies an adequate level of data protection in terms of the GDPR for certified companies. However, LinkedIn Corp. has not yet been certified under the EU-U.S. Data Privacy Framework. According to LinkedIn, however, the standard data protection clauses of the EU Commission have been agreed between LinkedIn Ireland Unlimited Company and LinkedIn Corp. for data transfers to the USA. In this way, LinkedIn undertakes to guarantee the European data protection standards also for transfers to third countries such as the USA. Insofar as a transfer of data to the USA takes place, such a third country transfer is based on Art. 46 (2) lit. c GDPR.

9.2     Processing of usage data under joint responsibility

When visiting, following or engaging with our LinkedIn page, LinkedIn processes personal data to provide us with statistics and insights in anonymized form using analytics tools. This provides us with insights into the types of actions that users take on our site (so-called page insights). The data processed is that which you have already provided when registering or using LinkedIn. We have no influence on the use of such tools by LinkedIn. Also, only the anonymized, non-personal information about posting activity, such as the number of company page or link clicks by a particular post, is made visible to us. Thus, it is not possible for us to draw conclusions about individual users via the information of the page insights.

We have usage statistics made available to us in order to improve the posts published on LinkedIn and make them as interesting as possible for users.

For the processing of personal data for the purpose of creating these usage statistics, LinkedIn and we are joint controllers pursuant to Art. 26 GDPR.

In the Page Insights Joint Controller Addendum, LinkedIn and we have contractually defined which of us fulfills which obligations under the GDPR. It also describes which data is processed within the scope of joint responsibility.

9.3     Processing of your data when communicating via LinkedIn

If you contact us via the LinkedIn page, for example by commenting on a post or writing a message via LinkedIn messages, we process your data (e.g. your name and the communication content) in order to process your request.

Please note that the names of the logged-in LinkedIn users who have visited our LinkedIn page are visible to us. If you do not want to share this information, you can activate the so-called “private mode” in your profile settings on LinkedIn.

10. X (formerly Twitter)

Our X profile is accessible via the X or Twitter platform (www.twitter.com), which is operated in the European Union by:

Twitter International Unlimited Company (“Twitter”), One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland

10.1   Independent processing of usage data by Twitter

While you are viewing our X profile or even a third party’s profile on X and the posts there, Twitter collects information about your interactions with the profiles and content and processes this information independently for its own purposes in accordance with the Twitter Privacy Policy.

To our knowledge, Twitter evaluates this information in particular to identify topics in which you are potentially interested and uses this data to personalize the posts and advertising displayed to you on Twitter. For these purposes, Twitter usually also sets cookies on your computer and uses comparable technologies to recognize you. Twitter may also link this data to your Twitter account. Twitter carries out these aforementioned processing operations on its own responsibility and independently of our influence, without us being able to deactivate or restrict the processing operations.

You have options for restricting the processing of your data in the general settings of your Twitter account and under the item “Privacy and security”. In addition, you can restrict Twitter’s access to contact and calendar data, photos, location data, etc. on mobile devices (smartphones, tablet computers) in the settings options there. However, this depends on the operating system used. Further information on these points is available on the Twitter support page.

In connection with the above-mentioned functions, Twitter may also transmit the data processed in the process to servers outside the EU, in particular to X Corp. in the USA, insofar as this is necessary to provide these services. For the U.S., the EU-U.S. Data Privacy Framework is an adequacy decision of the EU Commission, which certifies that certified companies have an adequate level of data protection within the meaning of the GDPR. However, X Corp. has not yet been certified under the EU-U.S. Data Privacy Framework. According to information provided by Twitter, the standard data protection clauses of the EU Commission apply to data transfers to the U.S. or other third countries. In this way, Twitter undertakes to guarantee European data protection standards even in the case of transfers to third countries such as the USA. Insofar as a transfer of data to the USA or another third country takes place, such a third country transfer is based on Art. 46 (2) lit. c GDPR.

11.2   Processing of your data by us

As part of the use of our X profile, we receive extensive reports from Twitter about how users interact with our Twitter profile in general and with the individual posts on our profile. However, the reports do not contain any personal data, but only general statistics and summaries, such as the total number of views of our profile and individual posts. We also cannot filter the reports by user or user group or set such criteria for generating the reports. Accordingly, we are unable to determine whether a user has engaged in a particular interaction based on the reports and data that Twitter provides to us. We also cannot and do not create profiles on individual users. We ourselves do not have access to personal data that Twitter processes. Twitter alone determines which data is processed for statistics and summaries and how. We can neither legally nor actually influence the processing by Twitter. The reports are used by us to adapt our X profile according to user needs and thus to continuously optimize it.

Apart from that, we only process your data, which you may transmit to us via X, for the purpose of maintaining our X profile, in particular for answering questions or responding to your posts, comments and messages via X.

11. YouTube

Our YouTube channel is accessible via the YouTube platform (www.youtube.com), which is operated in the European Union by:

Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland

11.1   Independent processing of usage data by Google

When you visit our YouTube channel, Google collects usage data. Google is solely responsible for this data processing. Google provides information on this in the Google privacy policy.

We have no influence on the type and scope of the data processed by Google, the type of processing and use or the transfer of this data to third parties. We also have no effective control options in this respect.

When you use YouTube, your personal data is collected, transferred, stored, disclosed and used by Google and transferred to, and stored and used in, the United States, Ireland and any other country in which Google does business, regardless of your country of residence. There is a transfer to companies affiliated with Google as well as to other companies or persons who process them on behalf of Google.

Google processes on the one hand your voluntarily entered data such as name and username, email address, telephone number. Google also processes the content that you create, upload or receive from others when using the services. This includes, for example, photos and videos that you save, documents and spreadsheets that you create, and comments that you write on YouTube videos.

Second, Google evaluates the content you share to determine what topics you are interested in, stores and processes confidential messages you send directly to other users, and may determine your location using GPS data, wireless network information, or your IP address to serve you advertising or other content.

Finally, Google also receives information when you view content, for example, even if you have not created an account. This so-called “log data” can be the IP address, the browser type, the operating system, information about the website you visited previously and the pages you viewed, your location, your mobile provider, the terminal device you use (including device ID and application ID), the search terms you used and cookie information. Options to limit the processing of your data are available in the general settings of your Google account. In addition to these tools, Google also offers privacy settings specific to YouTube. You can learn more about this in Google’s Privacy Guide in Google products.

In connection with the above-mentioned functions, YouTube may also transmit the data processed in the process to servers outside the EU, in particular to Google LLC in the USA, insofar as this is necessary for the provision of these services. For the USA, the EU-U.S. Data Privacy Framework is an adequacy decision of the EU Commission, which certifies that certified companies have an adequate level of data protection within the meaning of the GDPR. Google LLC is certified under the EU-U.S. Data Privacy Framework and is also entered in the list maintained by the U.S. Department of Commerce (Data Privacy Framework List). A consistently high level of data protection is therefore guaranteed when data is transferred to Google LLC servers in the USA. Insofar as a transfer of data to the USA takes place, such a third country transfer is based on Art. 45 (1) sentence 1 GDPR.

12.2   Processing of your data by us

Google also uses certain data collected from users of the YouTube platform (e.g., which videos users watch) to create aggregated usage statistics and make them available to the respective operators of the YouTube channel (so-called “YouTube insights”). We also receive such aggregated usage statistics. The information we receive through YouTube Insights does not allow any conclusions to be drawn about individual users. We ourselves have no access to personal data that Google processes for YouTube Insights. Google alone determines which data is processed for YouTube Insights and how. We can neither legally nor actually influence the processing by Google. The reports serve us to adapt our YouTube channel according to user needs and thus to continuously optimize it.

If you contact us via our YouTube channel, e.g. by commenting on a video, we process your data (e.g. your name and the communication content) in order to process your request.

Last updated: September 2023