Privacy Policy digitall.hamburg.de

We are pleased at your interest in digitall.hamburg.de. In order to be able to offer digitall.hamburg.de, we of course also require some data about you. We take the protection of personal data very seriously in the process and always process this in agreement with applicable data protection law, especially of the EU General Data Protection Regulation. We want to completely inform you about the type, scope and purpose of the personal data we process and of your rights as a data subject with this data protection declaration.

1. Responsible instance and general notes

Your data are processed by hamburg.de GmbH & Co. KG, Rothenbaumchaussee 80b, 20148 Hamburg, telephone: +49 40 68 87 57 600, e-mail: info@hamburg.de (service provider in the sense of the German Teleservices Act (TMG) and responsible instance in the sense of the General Data Protection Regulation (GDPR)). This is also what we mean when we use formulations like “we” or “us”. Under “hamburg.de”, we in this document understand digitall.hamburg.de, including all of the sub-pages, content and functions available there. Individual parts of digitall.hamburg.de are also designated in the following as “online services”. We also mean this when a website is referred to in the following or when we refer to an app.
Our services are conceived of for the general public and not for children. We do not knowingly gather any personal data from users who apply as children as defined by national legislation.

2. Acquisition and processing of personal data

You can generally use online services for which no payment or registration is necessary without entering personal data. In certain cases we do, however, process the personal data listed in Number 3. This principally only occurs to the extent that this is necessary to provide a functional website or app, as well as our content and services. We also process personal data in connection with the use of digitall.hamburg.de when you provide this of your own accord, for example, in the context of registration, a contest, an enquiry submitted to us, an application or when concluding a subscription, or because another legal basis for this applies (see Number 4.). Should you not wish this, you can unfortunately not use our services or use them to the full extent. 4.). Sollten Sie dies nicht wünschen, können Sie unsere Dienste leider nicht oder nicht in vollem Umfang in Anspruch nehmen.

3. Categories of processed data

As soon as you use digitall.hamburg.de, our system automatically gathers information from the computer system of the activating computer. The following data, inter alia, can be compiled in the process:

Information about the browser type and the version used
Operating system of the user
Mobile device ID
Date and time of day of the access
Web analysis data / pseudonymous usage profiles (cookie ID, ad ID, etc.)
Websites from which the user reached our website
Websites that the user accesses via our website

4. Legal basis and purposes of processing

We exclusively process your data on the basis of one or more of the possible legal foundations.
Pursuant to the GDPR, personal data can in particular be processed on the basis of a contract or to carry out pre-contractual measures, when consent has been provided, on the basis of a legitimate interest or a law, as well as for the protection of essential or public interests.
In the Internet, each device requires a distinct address for the transmission of data, the so-called IP address. The at least temporary storage of the IP address is technically necessary in order to enable the delivery of the website to the computer of the user. In the process, we abbreviate the IP addresses prior to any processing and only process these in an anonymised form. There is no saving or further processing of the unabbreviated IP addresses. By this means, we can also present content with a regional character on all of our websites that are accessed from a particular region. This so-called geolocation, meaning the assigning of a website access to the location of the access, takes place exclusively on the basis of the anonymised IP address and only to the geographical level of federal states / regions. Under no circumstances can an inference to the concrete whereabouts of a user be drawn from the geographical information acquired in this way. Our servers also save your IP address for 14 days for our own security purposes.
In the case of processing procedures not covered by any of the previously named legal bases, processing takes place when it is necessary for the preservation of a legitimate interest and your interests, basic rights and basic freedoms do not outweigh as determined by a comprehensive weighing of interests (Art. 6 Par. 1 lit. f GDPR). A legitimate interest is presumed when the data subject is a customer of the responsible instance. When the processing of personal data is based on this, our legitimate interest is in particular the carrying out of our business activity in support of the well-being of all of our employees and our shareholders.
You may object to processing on the basis of a legitimate interest at any time (see Number 13).
Where processing for a purpose other than that for which the personal data have been collected takes place, a compatibility test shall be carried out on the basis of Art. 6 Par. 4 GDPR. Further processing is then only permitted when the original purpose is compatible with the new purpose or is permitted on a separate legal basis. Recognised compatible purposes are, inter alia, the assertion, exercising or defence of claims according to civil law, insofar as no preponderant interest of the data subject applies. In this case, we will inform you of the change of purpose. If the new purpose is not compatible with the purpose indicated when the data were collected, new collection takes place on a new legal basis. Here too, we will inform you of the change of purpose.

5. Place of processing

We ourselves do not transmit your personal data to countries outside of the European Economic Area, except in cases in which this is permitted pursuant to the GDPR. We have no knowledge of or influence upon whether third parties with which you have your own contractual relationship (for example, with Facebook, if you have a Facebook account) transmit data to countries outside of the European Economic Area.
We also process data in countries outside of the European Economic Area (“EEA”). In order to also ensure the protection of your personal rights in the context of these data transmissions, we make use of the standard contractual clauses of the EU Commission pursuant to Art. 46 Par. 2 lit. c GDPR for the drafting of contractual relationships with recipients in third countries. These can be called up under http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2010:039:0005:0018:DE:PDF at any time. Alternatively, you can also request these documents from us through the contact options indicated below.
For the USA, the European Commission reached the decision with the resolution of 12.7.2016 that an appropriate level of data protection exists under the rulings of the EU-U.S. Privacy Shield (Adequacy decision, Art. 45 GDPR). You can receive further information, including about the certification of the service providers we employ, under https://www.privacyshield.gov. We exclusively employ US service providers that are certified in accordance with the EU-U.S. Privacy Shield.

6. Origin of the data

In bestimmten Fällen erhalten wir auch Daten, weil Sie in die Übermittlung an uns eingewilligt haben.Wie Sie wissen, werden Apps regelmäßig auf den Seiten dritter Anbieter (wie iTunes, Google etc.) zum Herunterladen bereitgestellt. Wenn nach den anwendbaren Nutzungsbedingungen eines solchen Anbieters die hamburg.de GmbH & Co. KG Ihr Vertragspartner für den Erwerb der App wird, verarbeiten wir die Daten, die uns der Drittanbieter zur Verfügung stellt, in dem zur Vertragserfüllung erforderlichen Umfang, damit Sie die App auf Ihr mobiles Endgerät her-unterladen können.

7. Sharing your data with third parties

We only transmit your personal data to third parties when transmission is necessary to fulfil our contractual obligations to you and this obviously takes place at or together with another provider (e.g. in cooperative ventures), we are otherwise legally authorised or obligated to share, or you have provided us with the corresponding consent.
In order to provide our service, selected personal data can be provided to certain departments within our company.
In certain cases, we also deploy external service providers or affiliated companies that we commission to process data for us in a framework bound by instructions. We contractually engage such service providers in accordance with the strict specifications of the GDPR as order processors, and they may not use your data for any other purposes. The order processors we deploy provide the following services for us in particular: subscription administration, registration service(s), payment service(s), content recommendation, contest processing, hosting, collection / debt management, customer service, newsletter shipping, prize shipping, survey/comment service(s) and web/app analysis.
The sharing of data with order processors takes place on the basis of Art. 28 Par. 1 GDPR, alternatively on the basis of our legitimate interest in the economic and technical advantages related to the use of specialised order processors , Art. 6 Par. 1 lit. f GDPR.
Insofar as we are legally obligated to do this this or this is permitted by data protection law, we transmit personal data to authorities, for example, to the police or the public prosecution department (Art. 6 Par. 1 lit. c GDPR). This data is shared on the basis of our legitimate interest in combating abuse, the prosecution of criminal acts and the securing, enforcement and assertion of claims, and that your rights and interests in the protection of your personal data do not outweigh, Art. 6 Par. 1 lit. f GDPR.

8. Cookies and similar technologies

We use cookies. Cookies are small files that your browser files on your device in a directory provided for this purpose. These can be used to, among other things, determine whether you have already visited a website. Insofar as you consent to this, login data for an online service can also be stored in these, so that you do not have to enter this login data each time you access the site. Many cookies contain a so-called cookie ID. A cookie ID is a distinct identifier of the cookie. It consists of a string, through which websites and servers can be assigned to the specific Internet browser in which the cookie was saved. This makes it possible for the visited websites and servers to distinguish the individual browser of the data subject from Internet browsers that contain other cookies. A particular Internet browser can be recognised and identified via the distinct cookie ID.
We use two types of cookies. First, technically necessary cookies, without which the functionality of our website would be limited, as well as optional cookies for designing our website to be more user-friendly. The user data collected through technically necessary cookies are not used to create user profiles. The analysis cookies are used to improve the quality of our website and its contents. We determine how the website is used through the analysis cookies and can thus constantly optimise our offering. You can find more information on the individual analysis services in number 9 of this data protection information.
You can prevent us from setting cookies at any time with a corresponding setting of the Internet browser used and thus permanently reject the setting of cookies. Already set cookies can also be deleted at any time by way of an Internet browser or other software program. This is possible in all standard Internet browsers. If you deactivate the setting of cookies in the Internet browser used, it might be the case that not all functions of our website can be used in their entirety.
Cookies cannot identify you as a person. In any case, the use of cookies is justified on the basis of our legitimate interest in a design compatible with needs, as well as in the statistical evaluation of hamburg.de (Art. 6 Par. 1 lit. f GDPR).

9. Social networks

You can also find us in the social networks of external companies, such as YouTube. We have also integrated individual functions of these networks into our online services. As a rule, you can only use both when you are registered with and logged into the respective social network. Please note that the conditions of use and data protection of this company apply for the usage of the respective social network, upon which we have no influence. However, we are happy to explain to you how such networks process your personal data in this context:

YouTube

We have integrated components of YouTube into this website. YouTube is an Internet video portal that enables video publishers the free uploading of video clips and other users the, also free, viewing, evaluation and commenting upon of these. YouTube allows the publication of all kinds of videos, which is why both complete film and television broadcasts but also music videos, trailers or videos produced by users themselves can be accessed via the Internet portal.
The operating company of YouTube is the YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. The YouTube, LLC is a subsidiary company of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.
With each view of one of the individual pages of this website, which is operated by us and in which a YouTube component (YouTube video) has been integrated, the Internet browser in the computer system of the data subject is automatically occasioned by the respective YouTube component to download a representation of the corresponding YouTube component from YouTube. You can access further information about YouTube at https://www.youtube.com/yt/about/de/. In the context of this technical procedure, YouTube and Google are informed of which concrete subpage of our website is being visited by the data subject.
When the data subject is simultaneously logged in at YouTube, YouTube recognises, with the accessing of a subpage containing a YouTube video, which concrete subpage of our website the data subject is visiting. This information is collected by YouTube and Google and assigned to the respective YouTube account of the data subject.
YouTube and Google always then receive information via the YouTube component that the data subject has visited our website when the data subject is simultaneously logged into YouTube at the point in time at which our website is accessed; this takes place independently of whether the data subject clicks on a YouTube video or not. If the data subject does not wish the transmission of this information to YouTube and Google of this kind, the data subject can prevent this by logging out of their YouTube account prior to visiting our website.
The data protection regulations published by YouTube, which can be accessed at https://www.google.de/intl/de/policies/privacy/, provide information about the collection, processing and use of personal data by YouTube and Google.
The previously named services are often not realised by plug-ins on smartphones and tablets, but instead by a “share” function internal to the device. In keeping with its settings, information can also be provided to other social media service providers. Please find details about this in your device information.

10. Other services

Other services we may use are:

Google Maps

We use Google Maps for the representation of maps. The integration presumes that Google can discern the IP addresses of users. The IP address is necessary to be able to send the content to the browser of the user. We point out that Google has its own data protection guidelines, which are independent of our own. Please inform yourself prior to using our website about the data protection provisions of Google at www.google.de/intl/de/policies/privacy/. Google Maps is based on a JavaScript code, so that you can prevent execution as a whole by deactivating JavaScript in the settings of your browser or installing a JavaScript blocker. Please note that our website may then not be correctly displayed.

11. Storage period

We only store personal data for as long as we are authorised to do so and as long as the processing purpose has not ceased to apply. The respective legal retention period applies for the duration of storage of personal data. Upon expiration of the term, the corresponding data are routinely deleted, insofar as they are no longer required for contract fulfilment or contract initiation.

12. Contact data and your rights as a data subject

You can address questions regarding matters of data protection law to the data protection officer responsible for the authority at the following address:

Behörde für Verkehr und Mobilitätswende
Der behördliche Datenschutzbeauftragte
Alter Steinweg 4
20459 Hamburg
Email: datenschutz@bvm.hamburg.de

Information and correction
You can receive information from us at any time at no charge about whether we have processed personal data concerning your person and about which specific data about you are being saved, as well as request a copy of the stored data. You can also have incorrect data corrected and supplemented.
Deletion, limitation and the right to be forgotten
You can request the deletion and limitation of your personal data. Please note that there are legal obligations of retention, for example, for contracts in return for payment, such as the purchase of a subscription to hamburg.de, and we therefore may not be allowed to completely delete your data in every case. In this case, your data will be marked with the goal of limiting your future processing.

Data portability
Where applicable, you also have the right to have the relevant personal data transmitted to you or another responsible instance in a structured, usual and machine-readable format, insofar as processing is based on consent or a contract and takes place with the help of automated processes. However, this does not apply when the processing is not required to conduct a task that is a matter of public interest or that takes place in the context of the exercising of public authority, which has been transferred to the responsible instance. You also have the right to arrange to have the personal data transferred directly from one responsible instance to another responsible instance, insofar as this is technically practicable and insofar as the rights and freedoms of other persons are not impaired by this.

Revocation / objection
You can revoke your provided consent at any time, taking effect for the future, at the contact address provided above. You also have the right, for reasons originating from your special situation, to object at any time to the processing of personal data concerning yourself that takes place on the basis of a legitimate or public interest. This also applies to profiling based on these provisions. We no longer process the personal data in the event of an objection, unless we can document urgent, protection-worthy reasons for the processing that outweigh the interests, rights and freedoms of the data subject, or when the processing serves the purpose of the assertion, exercising or defence of legal claims.
When we process personal data for purposes of direct advertising, you have the right at any time to submit an objection to the processing of personal data for purposes of advertising of this kind to the contact address provided above. This also applies to profiling, insofar as this is linked with such direct advertising. You also have the right, for reasons resulting from your special situation, to submit an objection to the processing of personal data relating to you that we perform for scientific or historical research or for statistical purposes, unless such processing is necessary for the fulfilment of a task lying in the realm of public interest.

Right of complaint
You also have a right of complaint with the responsible regulating authority, as well as the possibility to challenge a decision. The regulating authority to which the complaint has been submitted informs the complainant of the status and the results of the complaint, including the possibility of judicial legal remedy.
Existence of automated decision making
We refrain from automatic decision making or profiling.

Status: 23/09/2021