Privacy policy

Data protection is of particular importance to Five12 GmbH (hereinafter: the Provider). Use of the Provider's websites is generally possible without providing any personal data. However, if a data subject wishes to use special services offered through our website, it may become necessary to process personal data. If the processing of personal data is necessary and there is no legal basis for such processing, we generally obtain the consent of the data subject.

The processing of personal data, such as the name, address, email address, or telephone number of a data subject, is always carried out in accordance with the General Data Protection Regulation (GDPR) and in compliance with the applicable national data protection regulations for the Provider. Through this privacy statement, our company aims to inform the public about the nature, scope, and purpose of the personal data we collect, use, and process. Furthermore, this privacy statement is intended to inform data subjects about their rights.

As the data controller, the Provider has implemented numerous technical and organizational measures to ensure the most comprehensive protection of personal data processed through this website. However, internet-based data transmissions may generally have security vulnerabilities, so absolute protection cannot be guaranteed. For this reason, each data subject is free to transmit personal data to us by alternative means, such as via email.

Definitions

The Provider's privacy statement is based on the terminology used by the European legislator in the enactment of the General Data Protection Regulation (GDPR). Our privacy statement is intended to be both easily readable and understandable for the public as well as for our customers and business partners. To ensure this, we would like to explain the terminology used in advance. We use the following terms in this privacy statement, among others.

Personal Data

Personal data means any information relating to an identified or identifiable natural person (hereinafter "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more specific factors, expressing the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

Data Subject

A data subject is any identified or identifiable natural person whose personal data is processed by the controller.

Processing

Processing is any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Restriction of Processing

Restriction of processing is the marking of stored personal data with the aim of limiting its processing in the future.

Profiling

Profiling is any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements of that natural person.

Pseudonymization

Pseudonymization is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures ensuring that the personal data is not attributed to an identified or identifiable natural person.

Controller or Data Controller

The controller or data controller is the natural or legal person, authority, agency, or other body that alone or jointly with others determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union law or the law of the Member States, the controller or the specific criteria for its designation may be provided for by Union law or the law of the Member States.

Processor

A processor is a natural or legal person, authority, agency, or other body that processes personal data on behalf of the controller.

Recipient

A recipient is a natural or legal person, authority, agency, or other body to whom personal data is disclosed, whether or not a third party. However, authorities that may receive personal data under a specific inquiry in accordance with Union law or the law of the Member States are not considered recipients.

Third Party

A third party is a natural or legal person, authority, agency, or other body other than the data subject, the controller, the processor, and the persons who, under the direct authority of the controller or the processor, are authorized to process the personal data.

Consent

Consent is any freely given, specific, informed, and unambiguous indication of the data subject's wishes, either by a statement or by a clear affirmative action, which signifies agreement to the processing of personal data relating to them.

Name and Address of the Data Controller

The controller in terms of the General Data Protection Regulation, other applicable data protection laws in the Member States of the European Union, and other data protection provisions is:

Five12 GmbH

Kapellenstraße 12

86441 Zusmarshausen

Germany

Email: info@five12.de

Website: https://five12.de

Cookies

The provider’s website uses cookies. Cookies are text files that are placed and stored on a computer system via an internet browser.

Numerous websites and servers use cookies. Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier for the cookie. It consists of a string of characters that allows websites and servers to assign the specific internet browser where the cookie was stored. This enables the visited websites and servers to distinguish the individual browser of the affected person from other internet browsers that contain other cookies. A particular internet browser can be recognized and identified by its unique cookie ID.

By using cookies, the provider can offer users of this website more user-friendly services that would not be possible without setting cookies.

Cookies allow the information and offers on our website to be optimized according to the user's needs. As mentioned, cookies help us recognize users of our website. The purpose of this recognition is to make it easier for users to use our website. For example, a user of a website that uses cookies does not need to enter login credentials every time they visit the website, as this is managed by the website and the cookie stored on the user's computer system. Another example is the cookie of a shopping cart in an online store. The online store remembers the items a customer has placed in the virtual shopping cart using a cookie.

The affected person can prevent the setting of cookies by our website at any time through a corresponding setting in the internet browser used and thus permanently object to the setting of cookies. Additionally, cookies that have already been set can be deleted at any time through an internet browser or other software programs. This is possible in all common internet browsers. If the affected person disables the setting of cookies in the internet browser used, not all functions of our website may be fully usable.

Collection of General Data and Information

The provider’s website collects a range of general data and information with each access by an affected person or an automated system. This general data and information are stored in the server’s log files. The following can be collected: (1) the types and versions of the browsers used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (so-called referrer), (4) the subpages that are accessed via an accessing system on our website, (5) the date and time of access to the website, (6) an Internet Protocol (IP) address, (7) the Internet Service Provider of the accessing system, and (8) other similar data and information that serve to avert dangers in the event of attacks on our information technology systems.

When using this general data and information, the provider does not draw any conclusions about the affected person. This information is needed to (1) deliver the contents of our website correctly, (2) optimize the contents of our website and the advertisements for these, (3) ensure the long-term functionality of our information technology systems and the technology of our website, and (4) provide law enforcement authorities with the necessary information in the event of a cyber attack. Therefore, the provider evaluates this anonymized data and information statistically and aims to increase data protection and data security in our company to ultimately ensure an optimal level of protection for the personal data we process. The anonymized data in the server log files are stored separately from all personal data provided by an affected person.

Registration on Our Website

The affected person has the option to register on the website of the controller responsible for processing by providing personal data. The personal data transferred to the controller during registration is determined by the respective input mask used for registration. The personal data entered by the affected person is collected and stored exclusively for internal use by the controller and for their own purposes. The controller may arrange for the transfer to one or more processors, such as a parcel service provider, who will also use the personal data solely for internal purposes attributable to the controller.

Through registration on the website of the controller, the IP address assigned by the Internet Service Provider (ISP) of the affected person, as well as the date and time of registration, are stored. This data is stored to prevent misuse of our services and to enable the clarification of any criminal offenses that may have been committed. Thus, the storage of this data is necessary for the protection of the controller. This data is not generally disclosed to third parties, unless there is a legal obligation to disclose it or the disclosure is necessary for law enforcement purposes.

The registration of the affected person with voluntary provision of personal data serves the controller to offer the affected person contents or services that can only be offered to registered users due to their nature. Registered individuals are free to change the personal data provided during registration at any time or to have it completely deleted from the data inventory of the controller.

The controller provides each affected person with information on request about which personal data is stored about them. Furthermore, the controller corrects or deletes personal data at the request or notification of the affected person, as long as there are no legal retention obligations to the contrary. All employees of the controller are available to the affected person as contacts in this regard.

Subscription to Our Newsletter

On the provider’s website, users are given the option to subscribe to the company’s newsletter. The personal data transmitted to the controller when ordering the newsletter is determined by the input mask used for this purpose.

The provider regularly informs its customers and business partners about offers from the company via a newsletter. The company’s newsletter can generally only be received if (1) the affected person has a valid email address and (2) the affected person has registered for the newsletter. A confirmation email is sent to the email address first registered for the newsletter due to legal reasons in a double opt-in procedure. This confirmation email is used to verify whether the owner of the email address, as an affected person, has authorized the receipt of the newsletter.

When registering for the newsletter, we also store the IP address assigned by the ISP of the computer system used by the affected person at the time of registration, as well as the date and time of registration. The collection of this data is necessary to trace possible misuse of the affected person’s email address at a later date and therefore serves the legal protection of the controller.

The personal data collected during registration for the newsletter is used solely for sending our newsletter. Furthermore, subscribers to the newsletter may be informed by email if this is necessary for the operation of the newsletter service or for a related registration, such as in the case of changes to the newsletter offer or changes in the technical conditions. There is no transfer of personal data collected in the course of the newsletter service to third parties. The subscription to our newsletter can be canceled by the affected person at any time. The consent to the storage of personal data provided for the newsletter can be revoked at any time. For the purpose of revoking consent, there is a corresponding link in every newsletter. Additionally, there is the option to unsubscribe from the newsletter directly on the controller’s website or to inform the controller of this in another way.

Newsletter Tracking

The provider’s newsletters contain so-called tracking pixels. A tracking pixel is a miniature graphic embedded in emails sent in HTML format to enable log file recording and log file analysis. This allows a statistical evaluation of the success or failure of online marketing campaigns. Using the embedded tracking pixel, the provider can determine whether and when an email was opened by the affected person and which links in the email were accessed by the affected person.

Such personal data collected via tracking pixels in newsletters is stored and evaluated by the controller to optimize the newsletter dispatch and to better tailor the content of future newsletters to the interests of the affected person. This personal data is not disclosed to third parties. Affected persons are entitled to revoke the separate consent given via the double opt-in procedure at any time. After revocation, this personal data will be deleted by the controller. Unsubscribing from the newsletter is automatically interpreted by the provider as a revocation.

Contact Possibility via the Website

The provider’s website contains information due to legal requirements that enables rapid electronic contact with our company as well as direct communication with us, which also includes a general address for electronic mail (email address). If an affected person contacts the controller by email or through a contact form, the personal data transmitted by the affected person is automatically stored. Such personal data voluntarily provided by an affected person to the controller is stored for the purpose of processing or contacting the affected person. There is no disclosure of this personal data to third parties.

Data Protection in Applications and Application Procedures

The data controller collects and processes applicants' personal data for the purpose of managing the application process. Processing may also occur electronically. This is particularly the case when an applicant submits application documents electronically, for example via email or through a web form on the website of the data controller. If the data controller concludes an employment contract with an applicant, the transmitted data will be stored for the purpose of managing the employment relationship, in compliance with legal regulations. If the data controller does not conclude an employment contract with the applicant, the application documents will be automatically deleted two months after notification of the rejection decision, unless there are other legitimate interests of the data controller that preclude deletion. Other legitimate interests in this sense include, for example, a duty to provide evidence in a procedure under the General Equal Treatment Act (AGG).

Routine Deletion and Blocking of Personal Data

The data controller processes and stores personal data of the affected person only for the period necessary to achieve the storage purpose or if this is provided by European regulations or other laws to which the data controller is subject.

Once the storage purpose ceases to apply or a storage period prescribed by European regulations or other applicable laws expires, personal data will be routinely and legally blocked or deleted.

Rights of the Affected Person

Right to Confirmation

Every affected person has the right granted by European regulations to request confirmation from the data controller as to whether personal data concerning them is being processed. If an affected person wishes to exercise this right to confirmation, they can contact an employee of the data controller at any time.

Right to Information

Every person affected by the processing of personal data has the right granted by European regulations to obtain from the data controller, at any time and free of charge, information about the personal data stored concerning them and a copy of this information. Furthermore, the European regulations grant the affected person the right to information about the following:

• The purposes of processing
• The categories of personal data being processed
• The recipients or categories of recipients to whom the personal data has been disclosed or will be disclosed, especially in the case of recipients in third countries or international organizations
• If possible, the planned duration for which the personal data will be stored or, if not possible, the criteria used to determine this duration
• The existence of a right to rectification or deletion of personal data concerning them or to restriction of processing by the controller, or a right to object to such processing
• The existence of a right to lodge a complaint with a supervisory authority
• If the personal data was not collected from the affected person: All available information about the source of the data
• The existence of automated decision-making including profiling under Article 22 (1) and (4) GDPR and — at least in these cases — meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the affected person

Furthermore, the affected person has the right to be informed whether personal data has been transferred to a third country or an international organization. If this is the case, the affected person also has the right to obtain information about the appropriate safeguards relating to the transfer.

If an affected person wishes to exercise this right to information, they can contact an employee of the data controller at any time.

Right to Rectification

Every person affected by the processing of personal data has the right granted by European regulations to request the immediate rectification of incorrect personal data concerning them. Furthermore, the affected person has the right to request, considering the purposes of processing, the completion of incomplete personal data — also by means of an additional statement.

If an affected person wishes to exercise this right to rectification, they can contact an employee of the data controller at any time.

Right to Deletion (Right to be Forgotten)

Every person affected by the processing of personal data has the right granted by European regulations to request from the data controller the immediate deletion of personal data concerning them, provided one of the following reasons applies and processing is not necessary:

• The personal data was collected or processed for purposes for which it is no longer necessary.
• The affected person withdraws their consent on which the processing is based according to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR, and there is no other legal basis for the processing.
• The affected person objects to the processing according to Art. 21 (1) GDPR, and there are no overriding legitimate grounds for the processing, or the affected person objects according to Art. 21 (2) GDPR.
• The personal data has been unlawfully processed.
• Deletion of the personal data is necessary to comply with a legal obligation under Union or Member State law to which the controller is subject.
• The personal data was collected in relation to the offer of information society services according to Art. 8 (1) GDPR.

If one of the above reasons applies and an affected person wishes to request the deletion of personal data stored with the provider, they can contact an employee of the data controller at any time. The employee of the provider will ensure that the deletion request is fulfilled immediately.

If the personal data has been made public and the company is responsible as per Art. 17 (1) GDPR for deleting the personal data, the provider will, taking into account available technology and implementation costs, take appropriate measures, including technical measures, to inform other data controllers processing the published personal data that the affected person has requested the deletion of all links to these personal data or of copies or replications of these personal data, as far as the processing is not necessary. The employee of the provider will arrange the necessary actions on a case-by-case basis.

Right to Restriction of Processing

Every person affected by the processing of personal data has the right granted by European regulations to request from the data controller the restriction of processing if one of the following conditions is met:

• The accuracy of the personal data is contested by the affected person, for a period enabling the controller to verify the accuracy of the personal data.
• The processing is unlawful, the affected person opposes the deletion of the personal data and requests instead the restriction of its use.
• The controller no longer needs the personal data for the purposes of processing, but the affected person needs it for the establishment, exercise, or defense of legal claims.
• The affected person has objected to the processing according to Art. 21 (1) GDPR and it has not yet been determined whether the legitimate grounds of the controller override those of the affected person.

If one of the above conditions is met and an affected person wishes to request the restriction of personal data stored with the provider, they can contact an employee of the data controller at any time. The employee of the provider will arrange for the restriction of processing.

Right to Data Portability

Every person affected by the processing of personal data has the right granted by European regulations to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used, and machine-readable format. They also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that the processing is based on consent according to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or on a contract according to Art. 6 (1) (b) GDPR and the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, the affected person, when exercising their right to data portability according to Art. 20 (1) GDPR, has the right to have the personal data transmitted directly from one controller to another, where technically feasible, and provided that this does not adversely affect the rights and freedoms of other individuals.

To exercise the right to data portability, the affected person can contact an employee of the provider at any time.

Right to Object

Every person affected by the processing of personal data has the right granted by European regulations to object, on grounds relating to their particular situation, at any time to the processing of personal data concerning them, which is based on Art. 6 (1) (e) or (f) GDPR. This also applies to profiling based on these provisions.

The provider will no longer process the personal data in the event of such an objection, unless we can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the affected person, or the processing is necessary for the establishment, exercise, or defense of legal claims.

If the provider processes personal data for direct marketing purposes, the affected person has the right to object at any time to the processing of personal data for such marketing purposes. This also applies to profiling to the extent that it is related to such direct marketing. If the affected person objects to the processing for direct marketing purposes, the provider will no longer process the personal data for these purposes.

Furthermore, the affected person has the right to object, on grounds relating to their particular situation, to the processing of personal data concerning them, which is carried out for scientific or historical research purposes or statistical purposes according to Art. 89 (1) GDPR, unless the processing is necessary for the performance of a task carried out in the public interest.

To exercise the right to object, the affected person can contact any employee of the provider or another employee. The affected person may also exercise their right to object in the context of the use of information society services, notwithstanding Directive 2002/58/EC, through automated means where technical specifications are used.

Automated Individual Decision-Making, Including Profiling

Every person affected by the processing of personal data has the right granted by European regulations not to be subject to a decision based solely on automated processing — including profiling — that produces legal effects concerning them or similarly significantly affects them, unless the decision (1) is necessary

Special Privacy Regulations