Data protection information for social media

3. What are the purposes for which we process your data and the legal basis?

We process your personal data in compliance with the provisions of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG):

a) Within the scope of a balance of interests (Art. 6(1) f) GDPR)

The legal basis for processing personal data via our social media channels is Art. 6(1) f) GDPR. We have a legitimate commercial interest in using social media platforms for marketing purposes. Specifically, we use our social media channels for the following purposes:

• for direct communication with customers and other users who are interested in our company and our products
• to identify trends, opinions and moods
• to develop and improve our products and services
• to present the company
• for advertising purposes

The data saved in the server logfiles is transferred to the respective social media company when our social media pages are viewed. We would like to point out that the social media companies create so-called usage profiles based on your usage behaviour that is also used e.g. for placing adverts. Usually, cookies are set for this. As mentioned above, we have no influence on how this data is processed (see section 2 above).

b) Based on your consent (Art. 6 (1) a) GDPR and Art. 49(1) a) GDPR)

As soon as you grant us consent to process personal data for certain purposes (e.g. publication of fan photos), we are legally allowed to process data on the basis of your consent. Consent that has been granted can be revoked at any time,

Art. 7(3) 1 S. GDPR. Please note that your revocation only applies to data that is processed in the future. It does not apply to data that was processed before the consent is revoked. If you have granted the social media companies consent for certain data processing, the data is processed based on Art. 6(1) a) GDPR and Art. 49(1) a) GDPR.

c) Based on statutory stipulations (Art. 6(1) c) GDPR) or for public benefit (Art. 6(1) e) GDPR)

We are also obliged to meet various legal obligations, i.e. statutory requirements. If data is processed for this purpose, this only occurs based on these regulations.

4. Who receives my data?

Within the company, those offices that require data to fulfil our contractual and statutory duties receive your data. Also, any companies we contract to process data (Art. 28 GDPR) may receive data for these specific purposes (IT service provider). Also, our customer service is able to respond to customer enquiries by means of the tools Facelift Cloud, Insights and Meltwater.

With respect to the transfer of data to recipients outside the company, please note that we only forward data if this is allowed or stipulated by law, if you have given your consent or we are authorised to issue information. In these cases, recipients of personal data could be: public offices and institutions (e.g. public prosecutor’s office, police, regulatory authorities), if there are statutory or official obligations. Other data recipients could be those offices for which you have granted your consent to transfer the data.

5. How long is my data saved?

To the extent permitted by law, we process and save your personal data as long as necessary to fulfil the respective purpose.

6. Is data sent to third countries or international organisations?

Please note that your user data that is collected when you visit our social media services can be processed outside the EU.

Data is only sent to third countries (states outside the European Economic Area - EEA), if this is necessary to provide our social media services or if prescribed by law, or if you have given us your consent. If prescribed by law, we will provide you with details separately.

7. What data protection rights do I have?

The following contains information about your rights as a data subject vis-à-vis the responsible body with respect to processing personal data pursuant to the valid data protection laws:

• the right to information, Art. 15 GDPR
• the right to correction, Art. 16 GDPR
• the right to deletion, Art. 17 GDPR
• the right to restrict processing, Art. 18 GDPR
• the right to data portability, Art. 20 GDPR
• the right to object to processing under the requirements of Art. 21 GDPR,
• the right to lodge a complaint with a supervisory body, Art. 77 GDPR
• the right to revoke previous consent, Art. 7(3) GDPR

Please note that the easiest way to enforce your data subject rights connected to your use of social media is to enforce claims directly against the affected social media company.

For Facebook, you will find more information at: https://www.facebook.com/legal/terms/information_about_page_insights_data

For Instagram, you will find more information at:

help.instagram.com/155833707900388

For Youtube, you will find more information at:

support.google.com/youtube/topic/2803240

The objection can be made informally and should be addressed to:

datenschutz@strauss.de

8. Am I obliged to provide data?

When using social media, you only need to provide personal data that is required for use or data we are obliged to collect by law. Full use of these services may be restricted or impossible without this data.

9. Are automated decision-making processes used in individual cases?

Pursuant to Art. 22 GDPR, fully automated decision making is not applied. If we do apply this process in individual cases, we will inform you separately, if we are obliged to do so by law.

10. To what extent is my data used for scoring?

We do not use your data with the objective of assessing certain personal aspects (profiling).

11. Miscellaneous

Here is some information about other ways to protect your rights, about setting options and how to protect your privacy in connection with social media companies.

Informations from Facebook:

facebook.com/about/privacy/

as well as in the "Information on Page Insights Data"::

facebook.com/legal/terms/information_about_page_insights_data

Opt-Out:

facebook.com/settings?tab=ads

and/or. youronlinechoices.com

Informations from Instagram:

instagram.com/about/legal/terms/api/

Informations from YouTube:

policies.google.com/privacy