Privacy statement

I. Name and address of the controller

The controller that is responsible for the data processing within the meaning of the General Data Protection Regulation (GDPR) and other national data protection legislation of the Member States as well as other data-protection related provisions is:

Wavefront Studios GmbH

Dachauer Straße 233

D-80637 München

PHONE: +49 (0) 89 5427080

Fax: +49 (0) 89 54270888

E-Mail:  info@wavefrontstudios.com

Website: www.wavefrontstudios.com

II. Name and address of the data protection officer

The controller’s data protection officer is:

Alternatively, in the event that there is no need for a data protection officer (when there are less than 10 employees that are entrusted with data processing):

There is no obligation to appoint a data protection officer. Any inquiries relating to data protection law may be sent to info@wavefrontstudios.com.

III. General information on data processing

1. Scope of the processing of personal data

As a rule, we only collect and use the personal data of our users to the extent to which this is necessary to provide a functional website as well as our content and services. Personal data are usually only processed after the user has given consent. Exceptions only apply in cases in which it is not possible to obtain prior consent for factual reasons and statutory provisions permit the processing of the data.

2. Legal basis for the processing of personal data

Insofar as we obtain consent from the data subject for any processing activities relating to personal data, Article 6(1)(a) of the GDPR serves as the legal basis.

In the context of the processing of personal data in cases where this is necessary for the performance of a contract to which the data subject is a party, it is Article 6(1)(b) of the GDPR that provides the legal basis for this. This also applies to any processing activities that are necessary in order to implement any pre-contractual measures prior to entering into a contract.

If the processing of personal data is necessary for complying with a legal obligation to which our company is subject, Article 6(1)(c) of the GDPR serves as the legal basis.

If interests essential for the life of the data subject or that of another natural person necessitate the processing of personal data, Article 6(1)(d) of the GDPR serves as the legal basis.

If processing is necessary to uphold the legitimate interests of our company or those of a third party and if the aforementioned interests are not outweighed by the interests or fundamental rights and freedoms of the data subject, Article 6(1)(f) of the GDPR serves as the legal basis for the processing.

3. Erasure of data and duration of storage

The personal data of the data subject will be erased or blocked as soon as the purpose for the storage is no longer applicable. Data may be stored for a longer period if this is provided for by European or national legislators in European Union regulations, laws, or other rules to which the controller is subject. Data will also be blocked or erased when a storage time limit prescribed by the abovementioned provisions expires unless continued storage of the data is necessary for the purpose of entering into a contract or fulfilling a contract.

IV. Provision of the website and creation of logfiles

1. Description and scope of data processing

Whenever our website is accessed, our system will automatically collect data and information from the computer system of the accessing computer.

The following data will be collected:

  1. Information about the browser type and version
  2. The user’s operating system
  3. The user’s internet service provider
  4. The user’s IP address (encrypted)
  5. Date and time of access
  6. Websites from which the user’s system reaches our website
  7. Websites which the user’s system accesses via our website

The data is also stored in our system’s log files. The data is not stored together with other personal data of the user.

2. Legal basis for the data processing

The legal basis for the temporary storage of the data and the log files is of Article 6(1)(f) of the GPDR.

3. Purpose of the data processing

The temporary storage of the IP address by the system is necessary for the purpose of delivering the website to the user’s computer. For this purpose, the user’s IP address needs to be stored for the duration of the session.

The data is stored in log files to ensure the proper functioning of the website. In addition, the data helps us to optimize the website and to ensure the security of our information technology systems. There will be no analysis of any data obtained in this connection for any marketing purposes. These purposes also constitute our legitimate interest in data processing pursuant to Article 6(1)(f) of the GDPR.

4. Duration of storage, Possibility of objection and removal

The data will be deleted as soon as they are no longer needed to achieve the purpose for which they were collected. With respect to data that is collected for the purpose of making the website available, this is the case as soon as the corresponding session is terminated.

If the data is stored in log files, this will occur not later than after 90 days. It is possible that data may be stored beyond this period. In this case, the IP addresses of the users will be deleted or anonymized, so that it is no longer possible to identify the accessing client.

The collection of data for the provision of the website and the storage of data in log files is imperatively necessary for the operation of the website. Consequently, the user has no opportunity to object.

V. Use of cookies

1. Description and scope of the data processing

Our website uses cookies. Cookies are text files which are stored in the Internet browser or by the Internet browser on the user’s computer system. If a user accesses a website, a cookie may be stored on the user’s operating system. This cookie contains a distinctive character string which allows for unique identification of the browser when the website is accessed again.

We use the Borlabs Cookie to make our website more user friendly. Some features of our website require that the browser will still be recognized after pages were switched.

The Borlabs Cookie stores whether a user has given consent to the use of tracking features (e.g. when Google Maps are used). This means that it is not necessary to obtain the user’s consent yet again when the website is visited again.

2. Legal basis for the data processing

The legal basis for the processing of personal data using cookies is Article 6(1)(f) of the GDPR.

3. Purpose of the data processing

The purpose of using cookies which are technically necessary is to simplify the use of websites for the users. Some features of our website cannot be provided without using cookies. Such features require that the browser will still be recognized after pages were switched.

The user data collected by technically necessary cookies is not used to create user profiles.

These abovementioned purposes also constitute our legitimate interest in the processing of the personal data pursuant to Article 6(1)(f) of the GDPR.

4. Duration of storage, Possibility of objection and removal

Cookies are stored on the user’s computer and are transmitted from there to our website. Therefore you, as the user, also have complete control over the use of cookies. By changing the settings in your Internet browser, you may deactivate or restrict the transmission of cookies. Any cookies that have been already stored may be deleted at any time. This process can also be automated. If cookies are deactivated for our website, it may no longer be possible to use the full range of functions available on the website.

VI. Integration of Google Maps

1. Description and scope of the data processing

We use the features offered by Google Maps on this website.

A visit to the website means that Google will obtain the information that the user has accessed the corresponding sub-page of our website. Furthermore, the data listed in Section IV.1. of this Statement will be transmitted. This happens regardless of whether Google provides a user account and the user is logged into said account or whether there exists no user account. If the user is logged into Google, the data are attributed directly to the user’s account. Google stores the user’s data as user profiles and uses them for the purpose of advertising, market research and/or the needs-based design of its website. Such analyses will be carried out in particular (even in cases where users are not logged in) for the implementation of needs-based advertising and in order to inform other users of the social network about your activities on our website.

2. Legal basis of the data processing

We only use Google Maps if you have given consent thereto. The legal basis for the processing of the users’ personal data after they have given consent is Article 6(1)(a) of the GDPR.

3. Purpose of the data processing

Using Google Maps allows us to show you interactive maps directly our website, and this enables you to enjoy a convenient use of the map function.

4. Duration of storage, Possibility of objection and removal

If you do not want the data to be associated with your Google profile, you must log out before activating the button.

You have the right to object to the creation of such user profiles, if you intend to exercise this right, please contact Google.

Further information on the purpose and scope of the collection of data and its processing by the plug-in provider can be found in the provider’s privacy policy. In the privacy policy, you will also find further information on the rights and settings options you have for the protection of your privacy: http://www.google.de/intl/de/policies/privacy (https://policies.google.com/privacy?hl=en). Google also processes your data in the United States of America and is subject to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

VII. Contact by e-mail

1. Description and scope of the data processing

You can contact us by using the e-mail addresses provided. In this case, the user’s personal data that are transmitted with the e-mail will be stored.

In this context, the data will not be passed on to any third parties. The data will be used exclusively for the processing of the conversation.

2. Legal basis of the data processing

The legal basis for the processing of data transmitted in the course of sending an e-mail is Article 6(1)(f) of the GDPR. If the e-mail contact is aimed at the conclusion of a contract, then Article 6 (1)(b) of the GDPR constitutes an additional legal basis for the processing.

3. Purpose of the data processing

The processing of the personal data transmitted in the course of establishing contact serves us solely to process the establishment of contact. This also constitutes the required legitimate interest in the processing of the data.

4. Duration of storage

The data will be deleted as soon as they are no longer needed to achieve the purpose for which they were collected. With respect to the personal data that were transmitted with the e-mail, this is the case when the respective conversation with the user is terminated. The conversation is terminated when circumstances suggest that the respective issues have been resolved conclusively.

5. Possibility of objection and removal

If a user contacts us by e-mail, he/she can object to the storage of his/her personal data at any time. In such a case, the conversation cannot be continued. All personal data stored in the course of contacting us will be deleted in this case.

VIII. Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights as against the controller:

1. Right of access

You may request a confirmation from the controller to confirm whether personal data concerning you are processed by the controller.

If such processing occurs, you can request the following information from the controller:

(1) the purposes for which personal data are processed;

(2) the categories of personal data that are processed;

(3) the recipients and/or the categories of recipients to whom the personal data concerning you have been or will be disclosed;

(4) the envisaged period for which the personal data concerning you will be stored, or, if it is not possible to disclose specific details about this, the criteria used to determine that period;

(5) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning you or to object to such processing;

(6) the right to lodge a complaint with a supervisory authority;

(7) where the personal data are not collected from the data subject, any available information as to their source;

(8) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You have the right to request information whether personal data concerning you are transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.

2. Right to rectification

You have a right of rectification and/or completion vis-à-vis the controller in the event that the personal data processed concerning you are incorrect or incomplete. The controller shall make the correction without undue delay.

3. Right to restriction of processing

You have the right to obtain from the controller restriction of processing of the personal data concerning you where one of the following applies:

(1) in the event that you contest the accuracy of the personal data concerning you, for a period enabling the controller to verify the accuracy of the personal data;

(2) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;

(3) the controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defense of legal claims, or

(4) you have objected to processing pursuant to Article 21(1) of the GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where processing of the personal data concerning you has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

Where processing has been restricted in accordance with the requirements listed above, you shall be informed by the controller before the restriction of processing is lifted.

4. Right to erasure

a) Obligation to erase

You have the right to obtain from the controller the erasure of personal data concerning you without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

(1) the personal data concerning you are no longer necessary in relation to the purposes for which they were collected or otherwise processed.

(2) you withdraw your consent on which the processing is based according to Article 6(1)(a) of the GDPR, or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing.

(3) you object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR.

(4) the personal data concerning you have been unlawfully processed.

(5) the personal data concerning you have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.

(6) the personal data concerning you have been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR.

b) Information that was provided to third parties

Where the controller has made the personal data concerning you public and is obliged pursuant Article 17 (1) of the GDPR to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you as a data subject have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

c) Exceptions

The right to erasure does not apply insofar as the processing is necessary

(1) for exercising the right of freedom of expression and information;

(2) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(3) for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) of the GDPR as well as Article 9(3) of the GDPR;

(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the GDPR in so far as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

(5) for the establishment, exercise, or defense of legal claims.

5. Right to be informed

If you have exercised your right to rectification, erasure, or restricted processing against the controller, the controller has an obligation to notify all recipients to whom your personal data was disclosed of such rectification, erasure, or restricted processing, unless this proves impossible or would involve a disproportionate effort.

You have the right to request information on those recipients from the controller.

6. Right to data portability

You have the right to receive the personal data concerning you which you have provided to a controller, in a structured, commonly used and machine-readable format. Moreover, you have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where

(1) the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR or on a contract pursuant to Article 6(1)(b) of the GDPR; and

(2) the processing is carried out by automated means.

In exercising your right to data portability, you furthermore have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. This shall not adversely affect the rights and freedoms of others.

The exercise of the right to data portability shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) of the GDPR, including profiling based on those provisions.

The controller shall no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.

Where personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Where you object to processing for direct marketing purposes, the personal data concerning you shall no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

8. Right to revoke the data processing consent declaration

You have a right to revoke your consent to data processing at any time. If you exercise your right of revocation, the lawfulness of data processing that was already implemented based on your consent before such revocation shall remain unaffected.

9. Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or which similarly significantly affects you. This shall not apply if the decision

(1) is necessary for entering into, or performance of, a contract between you and a data controller,

(2) is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or

(3) is based on your explicit consent.

However, such decisions shall not be based on special categories of personal data referred to in Article 9(1) of the GDPR, unless point (a) or (g) of Article 9(2) of the GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.

In the cases referred to in points (1) and (3), the controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express one’s own point of view and to contest the decision.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 of the GDPR.

Wavefront Lines