1. general information

1.1. Objective and responsibility

1. This privacy policy informs you about the nature, scope and purpose of the processing of personal data of all visitors to our Instagram fanpage https://www.instagram.com/gemeinsamdeins/ (hereinafter referred to as “Fanpage”).
2. We, Kompass – Zentrum für Existenzgründungen Frankfurt am Main gGmbH (Hanauer Landstraße 521, 60386 Frankfurt am Main) – hereinafter referred to as “operator”, “we” or “us”, would like to explain to you below which data of yours we process as operator of the Fanpage.
3. Our data protection officer can be reached at the email address s.meyzis (at) itdsb.de.
4. The purpose of data processing on our Fanpage is to provide information about our products and services. Furthermore, users have the opportunity to interact with us in a targeted manner.

1.2. Shared responsibility

1. We have entered into a Shared Responsibility Agreement with Facebook Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) – hereinafter referred to as “Facebook” – pursuant to Article 26 of the General Data Protection Regulation (GDPR).
2. For details on delineation of responsibility, see the agreement at: https://www.facebook.com/legal/terms/page_controller_addendum.
3. Facebook assumes primary data protection responsibility for processing. Facebook’s privacy policy can be found here: https://www.facebook.com/privacy/explanation.
4. For more information about Facebook, visit https://www.facebook.com/policy.php.
5. You can contact Facebook’s privacy officer at https://www.facebook.com/help/contact/540977946302970.

1.3. Legal basis

We collect and process personal data based on the following legal bases:

1. Consent pursuant to Article 6(1) lit. a Basic Data Protection Regulation (GDPR). Consent is any voluntary, specific, informed and unambiguous expression of will in the form of a statement or other unambiguous affirmative act by which the data subject indicates his or her agreement to the processing of personal data relating to him or her.
2. Necessity for the performance of the contract or implementation of preparatory measures pursuant to Article 6(1) lit. b DSGVO, i.e. the data is necessary for us to fulfill our contractual obligations to you or we need the data to prepare a contract with you.
3. Processing for the fulfillment of a legal obligation pursuant to Article 6 (1) lit c DSGVO, i.e. that, for example, processing of the data is required by law or other regulations.
4. Processing for the protection of legitimate interests pursuant to Article 6(1) lit. f DSGVO, i.e. that the processing is necessary to protect legitimate interests on our part or those of third parties, unless such interests are overridden by the interests or fundamental rights and freedoms of you which require the protection of personal data.

1.4. Data subject rights

You are entitled to the following rights regarding data processing by us:

1. Right of appeal to a supervisory authority pursuant to Article 13(2) letter (d) GDPR and Article 14(2) letter e) GDPR.
2. Right of access according to Article 15 DSGVO
3. Right of rectification pursuant to Article 16 DSGVO
4. Right to erasure (“right to be forgotten”) pursuant to Article 17 DSGVO
5. Right to restriction of processing pursuant to Article 18 DSGVO
6. Right to data portability pursuant to Article 20 DSGVO
7. Right to object according to Article 21 DSGVO
   Note: Users can object to the processing of their personal data in accordance with the legal requirements at any time with effect for the future. The objection can be made in particular against the processing for purposes of direct advertising.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, workplace or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

1.5. Data deletion and storage period

The personal data of the data subject shall be deleted or blocked as soon as the purpose of the storage ceases to apply. In addition, storage may take place if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which the controller is subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data for the conclusion or fulfillment of a contract.

1.6. Processing safety

1. We have implemented appropriate and state-of-the-art technical and organizational security measures (TOMs).
2. The data processed in our area of responsibility is protected, for example, against accidental or intentional manipulation, loss, destruction and unauthorized access.

1.7. Data transfer to third parties, subcontractors and third-party providers

1. Personal data is only transferred to third parties within the scope of legal requirements. We only disclose users’ data to third parties if this is necessary, for example, for billing purposes or for other purposes if the transfer is necessary to fulfill contractual obligations to users.
2. If we use subcontractors, we have taken suitable contractual precautions as well as appropriate technical and organizational measures vis-à-vis these companies.
3. If we use content, tools or other means from other companies (hereinafter collectively referred to as “third party providers“) and their named registered office is located in a third country, it is to be assumed that a data transfer takes place to the third party providers’ countries of domicile. The transfer of personal data to third countries by us will only take place if there is an adequate level of data protection, user consent or otherwise legal permission.

2. concrete data processing

2.1. Tell us your story

1. During participation in the “#gemeinsamdeins” initiative, we collect personal data; this includes in particular: Name and contact details, photo, personal experience as well as business model, services and products.
2. The purpose of the initiative is to publish the provided data on websites as well as social media channels.
3. The legal basis for this data processing is Article 6 (1) lit. a GDPR. Consent is given by submitting the form. The consent can be revoked at any time with effect for the future.

2.2. Use of Insights and Cookies

1. In connection with the operation of the fan page, we use the Insights function from Facebook to obtain anonymized statistical data on the users of our Instagram account. For this purpose, Facebook stores a cookie on the end device of the user who visits our Instagram account. The cookie contains a unique user code in each case and is active for a period of two years, unless it is deleted beforehand. The user code can be linked to the data of such users who are registered with Facebook. The Instagram Data Policy contains all information about data processing by Facebook when using Instagram: https://help.instagram.com/519522125107875
2. The information stored in the cookies is received, recorded and processed by Facebook, in particular when the user visits the Facebook services, services provided by other members of the Facebook group of companies and services provided by other companies that use the Facebook services. In addition, other entities such as Facebook partners or even third parties on Facebook services may use cookies to provide services to businesses advertising on Facebook. For more information on Facebook’s use of cookies, please see their Cookie Policy.
3. Purposes of processing:
   The processing of the information is intended to allow Facebook, on the one hand, to improve its system of advertising that it distributes through its network. On the other hand, it is intended to enable us, as the operator of the fan page, to obtain statistics that Facebook creates based on visits to our Instagram account. This is aimed at managing the marketing of our activities. For example, this allows us to gain knowledge of the profiles of visitors who like our Instagram account or use certain content on the account in order to provide them with more relevant content and develop features that may be of greater interest to them.
   In addition, to help us better understand how our Fan Page can better achieve our goals, demographic and geographic analyses are also created based on the information collected and made available to us. We may use this information to target interest-based advertisements without having direct knowledge of the visitor’s identity. If visitors use Facebook services (Facebook, Messenger, Instagram, WhatsApp) on multiple devices, the collection and analysis can also take place across devices if they are registered visitors who are logged into their own profiles.
4. The generated visitor statistics are transmitted to us exclusively in anonymized form. We do not have access to the underlying data. Only Facebook itself has this access.
5. Legal basis and legitimate interests:
   We operate this fan page to present ourselves to and communicate with Instagram users and other interested persons who visit our Instagram account. The processing of the users’ personal data is based on our legitimate interests in an optimized presentation of our company pursuant to Article 6 (1) lit. f GDPR.
6. Disclosure of data:
   It is conceivable that some of the information collected may also be used outside the European Union by Facebook Inc. based in the USA are processed. Facebook Inc. is certified under the U.S.-EU data protection agreement “Privacy Shield” and thus undertakes to comply with the European data protection requirements.
   We ourselves only pass on personal data on the basis of your separate consent.

3. changes to the privacy policy

1. We reserve the right to change this privacy policy with regard to data processing in order to adapt it to changed legal situations, changes to the Fanpage or changes to data processing.
2. Insofar as user consent is required or components of the data protection declaration contain provisions of the contractual relationship with the users, the changes shall only be made with the consent of the users.
3. Users are requested to inform themselves regularly about the content of this privacy policy.

Status: 01.04.2020