MainSent
MainSent GmbH

Privacy

Privacy information

This is the privacy policy of

MainSent GmbH
Obere Wende 5
33739 Bielefeld

Below, we explain in detail which personal data we collect on our websites and in connection with the services and offers described in this privacy policy, the purposes for which we collect it and how long it is stored. We then explain your rights in relation to data processing and how you can exercise them.

If you have any questions or comments about privacy on our website, please contact us at any time. For example, you can email datenschutz@mainsent.com to do so.

This privacy policy applies to the collection, processing and use (“use”) of your personal data when you use our online services and to any other goods or services you wish to obtain from us.

I. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the Member States and other data protection provisions is:

MainSent GmbH.
Obere Wende 5,
33739 Bielefeld

Email: info@mainsent.com
Telephone: +49 (0) 151 - 46368236

II. Data protection officer

You can contact our data protection officer at:

MainSent GmbH

Data protection officer
Obere Wende 5
33739 Bielefeld

datenschutz@mainsent.com

III. General information about data processing

1. Legal basis for processing personal data

Where we obtain the data subject’s consent to process personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) provides the legal basis. Where processing is necessary to perform a contract to which the data subject is a party, the legal basis is Article 6(1)(b) GDPR. This also applies to processing necessary to take steps before entering into a contract. Where processing is necessary to comply with a legal obligation to which our company is subject, the legal basis is Article 6(1)(c) GDPR. Where processing is necessary to protect the vital interests of the data subject or another natural person, the legal basis is Article 6(1)(d) GDPR. Where processing is necessary for the legitimate interests of our company or a third party, and the data subject’s interests, fundamental rights and freedoms do not override those interests, Article 6(1)(f) GDPR provides the legal basis.

2. Erasure and storage periods

The data subject’s personal data is erased or blocked as soon as the purpose for storing it no longer applies. Data may also be stored where this is provided for by European or national legislators in EU regulations, laws or other provisions to which the controller is subject. Data is also blocked or erased when a storage period prescribed by those provisions expires, unless continued storage is necessary to enter into or perform a contract.

IV. Providing the website and creating log files

1. Description and scope of data processing

Whenever our website is accessed, our system automatically collects data and information from the computer system of the device accessing it.

The following data is collected:

  1. Information about the browser type and version used
  2. The user’s operating system
  3. The user’s internet service provider
  4. The user’s IP address
  5. The date and time of access
  6. Websites from which the user’s system reaches our website
  7. Websites accessed by the user’s system through our website

The data is also stored in our system’s log files. This does not include the user’s IP addresses or other data that would allow the data to be associated with a user. This data is not stored together with other personal data relating to the user.

2. Legal basis for data processing

Article 6(1)(f) GDPR provides the legal basis for temporarily storing the data.

3. Purpose of data processing

The system needs to store the IP address temporarily in order to deliver the website to the user’s computer. The user’s IP address must therefore remain stored for the duration of the session.

These purposes also constitute our legitimate interest in processing the data under Article 6(1)(f) GDPR.

4. Storage period

The data is erased as soon as it is no longer needed to achieve the purpose for which it was collected. Where data is collected to provide the website, this is the case when the relevant session ends.

V. Email contact

1. Description and scope of data processing

Our website provides email addresses that can be used to contact us electronically. If a user makes use of this option, the personal data transmitted with the email is stored.

The data is not disclosed to third parties in this context. It is used exclusively to process the conversation.

2. Legal basis for data processing

Article 6(1)(f) GDPR provides the legal basis for processing data transmitted when contacting us. If the email contact is intended to lead to a contract, Article 6(1)(b) GDPR provides an additional legal basis.

3. Purpose of data processing

We process the personal data from the input form solely to handle the contact request.

4. Storage period

The data is erased as soon as it is no longer needed to achieve the purpose for which it was collected. For personal data from the contact form and data sent by email, this is the case when the conversation with the user has ended. A conversation has ended when the circumstances indicate that the matter concerned has been conclusively resolved.

Where legislation imposes retention obligations, such as six years for received business correspondence under section 257(4) HGB, the data is erased after the relevant period expires.

VI. Data you provide when entering into, performing and terminating transactions or using services

1. Description and scope of data processing

In some areas, you may be asked to provide personal data to use the paid offers or free functions described, or to take part in special promotions. You will be told which information is required for those offers and which details you can provide voluntarily.

The data collected may include your name, address, bank details, password, date of birth, email address, telephone number, declarations of consent and information about the transaction concluded.

As part of the data arrangement, we also disclose your personal data to third parties, but only if and to the extent necessary to perform the respective contract (see also section 5 below).

2. Legal basis for data processing

If the data is collected with a view to entering into a contract, Article 6(1)(b) GDPR provides the legal basis. Data is also processed on the basis of consent you have given under Article 6(1)(a) GDPR.

3. Purpose of data processing

Data is processed to enable you to use the respective offers and functions. If you provide additional data voluntarily, we use it to tailor our services to your needs.

4. Storage period

The data is erased as soon as it is no longer needed to achieve the purpose for which it was collected. This will normally be the case when you unsubscribe from the service used, such as a newsletter or a personal user profile.

Where legislation imposes retention obligations, such as six years for received business correspondence under section 257(4) HGB, the data is erased after the relevant period expires.

VII. Data processing for advertising without consent

1. Description and scope of data processing

If you have entered into a contract with us for goods or services, we treat you as an existing customer using the data collected for that main purpose. In this case, we also process your postal contact details (name and address) without specific consent to send you information about new products and services. If we obtained your email address in connection with the sale of goods or services, we process it without specific consent to send you information about our own similar goods or services. We use any additional information you have provided voluntarily to select and tailor advertising to the target audience.

2. Legal basis for data processing

Article 6(1)(f) GDPR provides the legal basis for processing the data.

 

3. Purpose of data processing

Data is processed to advertise our own similar goods or services.

 

4. Storage period

The storage period depends on the main purpose for which the data was collected.

VIII. Hosting with Amazon Web Services (AWS)

1. Description and scope of data processing

We host our website with AWS. The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg (referred to below as AWS).

When you visit our website, your personal data is processed on AWS servers. Personal data may also be transferred to AWS’s parent company in the USA. Transfers to the USA are based on the EU standard contractual clauses. Details are available here:

https://aws.amazon.com/de/blogs/security/aws-gdpr-data-processing-addendum/.

Further information is available in AWS’s privacy policy: https://aws.amazon.com/de/privacy/?nc1=f_pr.

We have entered into a data processing agreement with AWS. This agreement is required under data protection law and ensures that AWS processes our website visitors’ personal data only on our instructions and in compliance with the GDPR.

 

2. Legal basis for data processing

We use AWS on the basis of Article 6(1)(f) GDPR. We have a legitimate interest in making our website as reliable as possible.

 

3. Purpose of data processing

Data is processed to provide our online services.

 

4. Storage period

AWS stores your personal data for as long as necessary for the purposes described.

IX. Cloudflare

1. Description and scope of data processing

We use the Cloudflare service, provided by Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (referred to below as Cloudflare). Cloudflare provides a globally distributed content delivery network with DNS. Information transferred between your browser and our website is routed through Cloudflare’s network. This enables Cloudflare to analyse traffic between your browser and our website and act as a filter between our servers and potentially malicious internet traffic. Cloudflare may use cookies or other technologies to recognise internet users, solely for the purpose described here. Cloudflare has implemented compliance measures for international data transfers. These apply to all worldwide activities in which Cloudflare processes personal data relating to individuals in the EU and are based on the EU standard contractual clauses (SCCs). Further information is available at: https://www.cloudflare.com/cloudflare_customer_SCCs-German.pdf.

 

2. Legal basis for data processing

Article 6(1)(f) GDPR provides the legal basis for processing the data.

 

3. Purpose of data processing

Data is processed to provide our online services.

 

4. Storage period

Cloudflare stores your personal data for as long as necessary for the purposes described.

X. Adobe Typekit Web Fonts

This website uses Adobe web fonts to display certain typefaces consistently. The provider is Adobe Systems Incorporated, 345 Park Avenue, San Jose, CA 95110-2704, USA (Adobe).

When you access this website, your browser loads the required fonts directly from Adobe so that they can be displayed correctly on your device. Your browser establishes a connection to Adobe’s servers in the USA. Adobe thereby learns that this website was accessed using your IP address. According to Adobe, no cookies are stored when providing the fonts.

The data is stored and analysed on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in consistent typography on the website. Where corresponding consent has been requested, such as consent to store cookies, processing takes place exclusively on the basis of Article 6(1)(a) GDPR. Consent can be withdrawn at any time.

Transfers to the USA are based on the European Commission’s standard contractual clauses. Details are available here: https://www.adobe.com/de/privacy/eudatatransfers.html.

Further information about Adobe Fonts is available at: https://www.adobe.com/de/privacy/policies/adobe-fonts.html.

Adobe’s privacy policy is available at: https://www.adobe.com/de/privacy/policy.html

XI. Imgur

1. Description and scope of data processing

Our website uses plugins from the online service Imgur. The provider is Imgur, Inc., 415 Jackson Street, 2nd Floor, Suite 200, San Francisco, CA 94111, USA.

When you visit one of our pages containing an Imgur plugin, a connection is established to Imgur’s servers. The Imgur server is informed which of our pages you have visited and obtains your IP address. This also applies if you are not logged into Imgur or do not have an Imgur account. The information collected by Imgur is transmitted to its server in the USA.

If you are logged into your Imgur account, you enable Imgur to associate your browsing behaviour directly with your personal profile. You can prevent this by logging out of your Imgur account.

Further information about how user data is handled is available in Imgur’s privacy policy at: https://imgur.com/privacy.

 

2. Legal basis for data processing

We use Imgur to present our online services in an appealing way. This constitutes a legitimate interest within the meaning of Article 6(1)(f) GDPR.

 

3. Purpose of data processing

Data is processed to provide our online services.

 

4. Storage period

Information about storage periods is available in Imgur’s privacy policy at: https://imgur.com/privacy

XII. Your rights as a data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and have the following rights in relation to the controller:

1. Right of access

You may ask the controller to confirm whether we process personal data relating to you.

If such processing takes place, you may request the following information from the controller:

  1. the purposes for which the personal data is processed;
  2. the categories of personal data processed;
  3. the recipients or categories of recipients to whom your personal data has been or will be disclosed;
  4. the intended storage period for your personal data or, where specific information is not possible, the criteria used to determine that period;
  5. the existence of a right to rectification or erasure of your personal data, a right to restriction of processing by the controller or a right to object to that processing;
  6. the existence of a right to lodge a complaint with a supervisory authority;
  7. all available information about the source of the data where it was not collected from the data subject;
  8. the existence of automated decision-making, including profiling, under Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved and the significance and envisaged consequences of the processing for the data subject.

You have the right to request information about whether your personal data is transferred to a third country or an international organisation. In that context, you may request information about the appropriate safeguards under Article 46 GDPR in connection with the transfer.

2. Right to rectification

You have the right to request rectification and/or completion from the controller if the personal data processed about you is inaccurate or incomplete. The controller must rectify it without undue delay.

3. Right to restriction of processing

You may request restriction of the processing of your personal data in the following circumstances:

  1. if you contest the accuracy of your personal data, for a period enabling the controller to verify its accuracy;
  2. if processing is unlawful and you oppose erasure, requesting restriction of the use of the data instead;
  3. if the controller no longer needs the personal data for processing purposes, but you need it to establish, exercise or defend legal claims; or
  4. if you have objected to processing under Article 21(1) GDPR and it has not yet been established whether the controller’s legitimate grounds override yours.

Where processing of your personal data has been restricted, the data may, apart from storage, be processed only with your consent, to establish, exercise or defend legal claims, to protect the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State.

If processing has been restricted under the conditions above, the controller will inform you before the restriction is lifted.

4. Right to erasure

a) Obligation to erase

You may ask the controller to erase your personal data without undue delay, and the controller must erase it without undue delay, where one of the following grounds applies:

  1. Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
  2. You withdraw the consent on which processing was based under Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal basis for processing.
  3. You object to processing under Article 21(1) GDPR and there are no overriding legitimate grounds, or you object under Article 21(2) GDPR.
  4. Your personal data has been processed unlawfully.
  5. Your personal data must be erased to comply with a legal obligation under Union or Member State law to which the controller is subject.
  6. Your personal data was collected in relation to information society services offered under Article 8(1) GDPR.

 

b) Informing third parties

If the controller has made your personal data public and is obliged to erase it under Article 17(1) GDPR, the controller must take reasonable steps, including technical measures, taking account of available technology and implementation costs, to inform other controllers processing that data that you, as the data subject, have requested the erasure of all links to, copies of or replications of that personal data.

c) Exceptions

The right to erasure does not apply where processing is necessary

  1. to exercise the right to freedom of expression and information;
  2. to comply with a legal obligation requiring processing under Union or Member State law to which the controller is subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller;
  3. for reasons of public interest in the area of public health under Article 9(2)(h) and (i) and Article 9(3) GDPR;
  4. for archiving in the public interest, scientific or historical research, or statistical purposes under Article 89(1) GDPR, where the right referred to in section a) is likely to make achieving those objectives impossible or seriously impair them; or
  5. to establish, exercise or defend legal claims.

 

5. Right to notification

If you have exercised your right to rectification, erasure or restriction of processing in relation to the controller, the controller must communicate that rectification, erasure or restriction to each recipient to whom your personal data has been disclosed, unless this proves impossible or involves disproportionate effort.

You have the right to ask the controller to inform you about those recipients.

6. Right to data portability

You have the right to receive the personal data you provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transmit that data to another controller without hindrance from the controller to which it was provided, where

  1. processing is based on consent under Article 6(1)(a) or Article 9(2)(a) GDPR or a contract under Article 6(1)(b) GDPR; and
  2. processing is carried out by automated means.

When exercising this right, you also have the right to have your personal data transmitted directly from one controller to another, where technically feasible. This must not adversely affect the rights and freedoms of others.

The right to data portability does not apply to processing necessary to perform a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Article 6(1)(e) or (f) GDPR. This also applies to profiling based on those provisions.

The controller will no longer process your personal data unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

If your personal data is processed for direct marketing, you have the right to object at any time to processing for such marketing, including profiling to the extent that it relates to that marketing.

If you object to processing for direct marketing, your personal data will no longer be processed for those purposes.

In connection with the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

8. Right to withdraw data protection consent

You have the right to withdraw your data protection consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before it was withdrawn.

9. Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

  1. is necessary to enter into or perform a contract between you and the controller;
  2. is authorised by Union or Member State law to which the controller is subject and that law includes appropriate measures to safeguard your rights, freedoms and legitimate interests; or
  3. is based on your explicit consent.

However, such decisions must not be based on special categories of personal data under Article 9(1) GDPR unless Article 9(2)(a) or (g) applies and appropriate measures to protect your rights, freedoms and legitimate interests are in place.

For the cases referred to in (1) and (3), the controller implements appropriate measures to safeguard your rights, freedoms and legitimate interests, including at least the right to obtain human intervention from the controller, to express your point of view and to contest the decision.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, workplace or the alleged infringement, if you consider that processing of your personal data infringes the GDPR.

The supervisory authority with which the complaint is lodged will inform you of its progress and outcome, including the possibility of a judicial remedy under Article 78 GDPR.

Last updated: March 2023