G&L Geißendörfer & Leschinsky GmbH Privacy Policy

 

1. General information

We are very pleased about your interest in our company. Data protection is of particular importance to us. In this privacy policy we inform you about the data processing in our company, as far as this data processing concerns your data.

If you would like to read an introduction to the topic of data protection and general information on the terms used in the General Data Protection Regulation, you will find further information on the website of the Federal Data Protection Officer, available at https://www.bfdi.bund.de/DE/Datenschutz/datenschutz-node.html (German language only).

2. Information regarding controller and data protection officer

2.1. G&L Geißendörfer & Leschinsky GmbH, Maarweg 149-161, 50825 Cologne, is the ‘controller’ and as such responsible for the processing of your personal data. You can reach us for general questions either by phone at +49 221 99809-0 or by e-mail at kontakt@gl-systemhaus.de. Further information may be found on our website at www.choirmanager.com.

2.2. For questions on data protection or exercising your rights under data protection law (see Section 4), you may contact our data protection officer either by post at our address given above or by email at datenschutz@gl-systemhaus.de.

3. Activities, in which we process your personal data

3.1. Visiting our website (without registration)

If you visit our website without logging in, registering or otherwise filling in the input fields on the website, we process your personal data as follows:

3.1.1. For the purpose of providing our website, we process the IP address, access time, browser information, operating system, language setting, and screen resolution of all website visitors. The processing is technically necessary to enable the use of our website (Art. 6 (1) lit. b GDPR). The data is deleted after the end of your visit to our website, unless specific data is processed for one of the following purposes.

3.1.2. Cookies

We use cookies on our website. Cookies are small text files. They allow us to store specific user-related information in the context of the use of our website.

We use the following cookies on our website:

For the analysis of visitor behaviour by Google Analytics we store cookies on the device of the website visitors. Thus, the IP address (shortened and anonymised by anonymization function) of the visitor, from which website the visitor is forwarded to a website (so-called referrer), what subpages of the website are accessed or how often and for how long a subpage is viewed, are transferred to Google Inc., 1600 Amphitheater Pkwy, Mountain View, CA 94043-1351, USA as our processor (Art. 28 GDPR) and processed there. The processing there is mainly used for the optimisation of our website and for the cost-benefit analysis of internet advertising. Among other things, Google uses the data and information obtained to evaluate the use of our website, to compile online reports on the activities on our website for us, and to provide other services related to the use of our website. This processing is required to pursue our legitimate interests (Art. 6 (1) lit. f GDPR) to provide website visitors with a website experience that is tailored to their personal preferences and to provide product recommendations and advertising for our company and our products that are tailored to their interests. The transfer to the United States of America is based on an adequacy decision by the EU Commission (Art. 45 GDPR) due to the recipient's participation in the "EU-US Privacy Shield". The cookies are deleted at the latest after two years, or earlier in accordance with the settings of your web browser (e.g. when closing the browser window).

All cookies are allowed, blocked and deleted according to the settings stored in your web browser (e.g. when closing the browser window). If cookies are disabled entirely for our website, it may not be possible to fully use all functions of the website.

You may object the processing described in this Section 3.1.2 at any time in accordance with Section 4.2.3, if the conditions of Art. 21 GDPR are met. You can also prevent the storage and processing described in this Section 3.1.2 by setting preferences in your browser, for example, by turning on the measures offered there to protect against tracking of your activities.

3.2. Use of our “Choir Manager” service

3.2.1. For the provision of the web-based “Choir Manager” service and fulfilment of the service agreement, we process the following data categories of all users registered as manager of a choir: name, first name, email address, password hash, language and time zone, choir name, short choir name, choir size and choir voices. We process the following data categories of all users registered as singers in a choir: name, first name, email address, password hash, names of all choirs the singer is a member of, and choir voice. Additionally, all users may freely enter their postal address, date of birth, and upload a photograph. Furthermore, we process data created in the normal use of the “Choir Manager” service, in particular appointment topics and confirmations. Users may also upload files of any type, which may contain any categories of personal data, for sharing with the other members of a choir. We process the data given by users to provide user management and authentication in our “Choir Manager” service, enable communication between the members of a choir, and to provide the overall functionality of the service (e.g. scheduling of meetings, management of contact details, and availability of files for download). Personal data is transferred to recipients or categories of recipients as follows:

a) All aforementioned personal data are made available for view and download by the manager and all singers of choir, which the user is a member of, to enable the use of all features of the “Choir Manager” service.

b) All aforementioned personal data are transferred to Amazon Web Services Inc., 410 Terry Avenue North, Seattle WA 98109, United States as our data processor (Art. 28 GDPR) to provide the technical availability of the “Choir Manager” service (hosting). The servers are located in Germany.

c) Name, first name, email address and email content are transferred to SendGrid Inc. 1801 California Street, Suite 500, Denver, CO 80202, USA as our data processor (Art. 28 GDPR) to enable the feature of sending emails to other choir members and to send service emails for user management purposes. The transfer to the United States of America is based on an adequacy decision by the EU Commission (Art. 45 GDPR) due to the recipient's participation in the "EU-US Privacy Shield".

d) User name and email address of users who submitted a request for support, as well as other data related to the individual support case, are transferred to Zendesk Inc., 1019 Market St, San Francisco, CA 94103, USA as our data processor (Art. 28 GDPR) to enable us to receive and attend to support requests. The transfer to the United States of America is based on an adequacy decision by the EU Commission (Art. 45 GDPR) due to the recipient's participation in the "EU-US Privacy Shield".

e) User name and email address of users who are affected by a technical malfunction or similar incident are transmitted to Sentry, 132 Hawthorne St, San Francisco, CA 94107, USA as our data processor (Art. 28 GDPR) to detect errors in the software or its operation and to provide technical information for error correction to our programmers. The transfer to the United States of America is based on an adequacy decision by the EU Commission (Art. 45 GDPR) due to the recipient's participation in the "EU-US Privacy Shield".

f) User name and email address of users who are affected by a technical malfunction or similar incident are transmitted to Atlassian Pty Ltd., 341 George Street, Sydney, NSW, 2000, Australia as our data processor (Art. 28 GDPR) to exchange information about incidents, problems or malfunctions of the “Choir Manager” service within our team. The servers are located in the United States of America and in Ireland. The transfer to the United States of America is based on an adequacy decision by the EU Commission (Art. 45 GDPR) due to the recipient's participation in the "EU-US Privacy Shield".

g) User name and email address of users who are affected by a technical malfunction or similar incident, or who have submitted a support request are transmitted to Slack Technologies, Inc, 500 Howard Street, San Francisco, CA 94105, USA as our data processor (Art. 28 GDPR) to exchange information about problems or malfunctions of the “Choir Manager” service and the content of support request within our team. The transfer to the United States of America is based on an adequacy decision by the EU Commission (Art. 45 GDPR) due to the recipient's participation in the "EU-US Privacy Shield".

h) User name and email address of users who are affected by a technical malfunction or similar incident, or who have submitted a support request are transmitted via the Google-Mail service to Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA as our data processor (Art. 28 GDPR) to send email notifications about new support requests and detected incidents to our employees. The transfer to the United States of America is based on an adequacy decision by the EU Commission (Art. 45 GDPR) due to the recipient's participation in the "EU-US Privacy Shield".

The aforementioned processing is necessary for the fulfilment of the service agreement (Art. 6 (1) b GDPR). The data that is stored and processed in the user account, and transferred in accordance with lit. a) and b), is deleted within 90 days after deletion of the user account by the user, if all mutual claims are finally fulfilled. This shall not apply to files uploaded by the user and shared with other choir members; these files will only be deleted, if either the user who uploaded them or a manager of the choir deletes them manually. The data that is processed and transferred in accordance with lit. c) to h) is deleted automatically at the end of the third calendar year after the completion of the respective processing activity (e.g. support request) on the systems of the recipients of the data, without regard to whether the user account has been deleted or not.

3.2.2. Cookies used in the “Choir Manager” service

To provide the functionality of the “Choir Manager” service, we store the following cookies. A SessionID cookie stores a random unique identifier to recognize a correctly authenticated user and to distinguish users accessing the service simultaneously. Another cookie stores the language preference of the user (e.g. German or English), and a CSRF (cross-site request forgery) cookie stores a different random unique identifier to secure the data connection between the user and the server against certain types of attack. This processing is necessary to enhance security of the use of the service (Art. 6 (1) b GDPR). The data is not transmitted to third parties. The cookies are deleted at the end of the web-browser session (i.e. upon closing the browser application), unless the web-browser settings stipulate a different retention period.

3.3. Processing of requests by telephone

To process general or mandate-related telephone inquiries, we process names, first names, telephone numbers, customer number and other personal data communicated by the caller via telephone as well as details of the content of the telephone request. The processing is necessary to handle the request of the caller (Art. 6 (1) lit. b GDPR). Depending on the content of the request, processing will be restricted to processing for the specific purpose of the request immediately after completing the processing of the requestor's request (e.g. use of our products by the customer, promotion of our services in the context of new customer acquisition). The telephone numbers of all callers, as well as data, time and duration of calls are stored in our telephone system for a maximum of about three months (limited number of records, the oldest ones are overwritten) in order to be able to give evidence of past phone calls. After the fulfilment of the respective purpose, the data is deleted automatically.

3.4. Processing inquiries via social media

In order to process inquiries directed at us via our presence in the social networks Facebook, Twitter, LinkedIn, Xing or Google+, we process the personal data that you have published on the respective social network. The processing of your data is required to process your request (Art. 6 (1) lit. b GDPR). Depending on the content of the request, processing will be restricted to processing for the specific purpose of the request immediately after completing the processing of the requestor's request (e.g. use of our products by the customer, promotion of our services in the context of new customer acquisition). After the fulfilment of the request or inquiry as well as all legal obligations, in particular commercial and tax retention requirements, the data is deleted.

3.5. Processing email requests

To process all inquiries that reach us by email, we process the surname, first name, email address, customer number or user name of the sender, and other personal data communicated in the e-mail as well as information on the content of the request. These data are transferred via the Google-Mail service (email hosting) to Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA as our data processor (Art. 28 GDPR). The processing is necessary to handle the request or inquiry (Article 6 (1) lit. b GDPR). The transfer to the United States of America is based on an adequacy decision by the EU Commission (Art. 45 GDPR) due to the recipient's participation in the "EU-US Privacy Shield". Depending on the content of the request, processing will be restricted to processing for the specific purpose of the request immediately after completing the processing of the requestor's request (e.g. use of our products by the customer, promotion of our services in the context of new customer acquisition). After the fulfilment of the request or inquiry as well as all legal obligations, in particular commercial and tax law retention requirements, the data is deleted.

4. Your data subject rights

4.1. You may at any time exercise your rights as a data subject by contacting us by mail to our address mentioned in section 2.1 or by e-mail to the e-mail address mentioned in section 2.2. Please keep in mind that we do not answer any inquiries about personal data by telephone, because generally the identity of the caller cannot be determined with sufficient certainty.

4.2. You have the following rights with respect to your personal data:

4.2.1. You may exercise your right of access (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), the right to erasure (Art. 17 GDPR) and the right to restriction of processing, i. e. blocking for certain purposes, (Art. 18 GDPR) at any time, if the respective statutory prerequisites are met.

4.2.2. Your right to data portability (Art. 20 GDPR) also stipulates that, if the statutory prerequisites are met, you may demand that your personal data stored by us will be transferred to you – or insofar as technically feasible, to another controller designated by you – in a structured, commonly used and machine-readable format.

4.2.3. You have the right to object to processing (Art. 21 GDPR) for some processing purposes, in particular advertising purposes. Insofar as we process your data based on a balancing of interests (pursuant to Art. 6 (1) lit. f GDPR), you have the right to object to this processing at any time based on grounds related to your particular situation. Such grounds may be compelling, in particular, if they give special weight to your interests, which thereby outweigh our interests, for example if these reasons are not known to us and therefore could not be taken into account in the balancing of interests.

4.3. You also have the right to contact the competent data protection supervisory authority for questions or complaints regarding the processing of your personal data.

Our Address

Maarweg 149-161

D-50825 Köln


Tel: +49 (0) 221 998090

Fax: +49 (0) 221 99809109

Email: leschinsky@gl-systemhaus.de

Download Terms and conditions

Terms of Service

Privacy Policy