The use of our website is possible without the provision of personal data as a rule. If personal data are collected when you visit our websites, we will process these data exclusively in compliance with the stipulations of the General Data Protection Regulation (VO (EU) 2016/679; GDPR) and the German Federal Data Protection Act (BDSG), as well as the German Telemedia Act (TMG). Personal data are processed solely in compliance with this privacy statement. This privacy statement is valid for the use of the website at the address: http://dev.insta.de, as well as the various sub-domains. For the linked contents of other providers, the privacy statement deposited on the linked website is relevant.

Controller

The following company is responsible for the processing of personal data in the scope of the use of this website:

Insta GmbH
Hohe Steinert 10
58509 Lüdenscheid
Germany
Phone: + 49 2351 936-0
info@insta.de
dev.insta.de

Management:
Dipl.-Ing. Alexander Burgbacher
Alfred Vrieling

Data protection officer

We have appointed the following person as data protection officer:
Dr. Gregor Scheja
Data protection officer
Adenauerallee 136
D-53113 Bonn
Germany
Phone: +49 (0) 228-227 226-0
Fax: +49 (0) 228-227 226-26
Contact: www.scheja-partner.de/kontakt/kontakt.html
www.scheja-partner.de

Hosting

When you visit our website, automated data are collected and stored in log files on the server of our hosting provider. These data can indicate references to persons. The collected data include:
– name of the website called up
– date and time of call up
– IP addresses (anonymised)

The legal basis for the processing of data is Art. 6(1)(f) GDPR.
We process the collected data to operate the website and to ensure IT security. If necessary, the log files are subsequently analysed in case of concrete indications.
The data are automatically deleted after 7 days.

Contact possibilities (form / e-mail)

There is a possibility to contact us per e-mail / contact form on our website. In this connection, your personal data are stored and processed for the purpose of communication. The data collected for this purpose (name, address, telephone number, e-mail address) are not passed on to third parties. The data are not merged with other data collected on this website. If required, the data are stored as part of the Customer Relations Management (CRM) if you are already a customer of our company. The legal basis for data collection in accordance with Art. 6(1)(1) GDPR is: the consent you have given (lit. a); if necessary, the processing of information for the contractual performance or contract initiation (lit. b), if necessary, the fulfilment of a legal obligation (lit. b) as well as the justified interest of our company in the communication you initiated (lit. f). The data are deleted as soon as the objective of the communication has been achieved.

Newsletter

On our website you have the possibility to subscribe for a newsletter that is sent per e-mail. The newsletter is sent to your e-mail address on the basis of your personal registration with subsequent confirmation (double opt-in), where you consent to receiving the newsletter. The legal basis for the processing of the data is Art. 6(1)(a) GDPR.
To send the newsletter we save your e-mail address as well as your first name and surname and the lists you have subscribed to. The data is not passed on to third parties.

Our newsletter system has a function that allows us to track at what time which recipients have opened the newsletter. These data are stored and used for an evaluation of the reach of individual campaigns.
The data are passed on to our service provider MailChimp to send the newsletter.
MailChimp is a service of:
The Rocket Science Group, LLC
675 Ponce de Leon Ave NE
Suite 5000, Atlanta, GA 30308 USA

With regard to this service, we have concluded an agreement with MailChimp, which you can view here.

Revocation of consent: You can revoke your consent to the processing of your data for sending the newsletter at any time with effect for the future. You will find a possibility to unsubscribe from the newsletter at the end of every newsletter mail or at this link: »Revoke consent«

Google Tag Manager

This website uses the Google Tag Manager. Google Tag Manager is a solution that allows marketers to manage website tags using a single interface. The tool itself (that implements the tags) is a cookie-less domain and does not store any personal data. The tool triggers other tags, which in turn may collect data. Google Tag Manager does not access these data. If a deactivation has been made at domain or cookie level, this will remain in place for all tracking tags implemented with Google Tag Manager. The legal basis for the processing of data is Art. 6(1)(f) GDPR.

Recipient:
Information of the third-party provider: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. So-called standard contractual clauses in accordance with Art. 46 GDPR have been concluded with this service provider as suitable guarantees. You will find further information here

Use of Vimeo

On our website we use components of the provider Vimeo. The service is provided by Vimeo LCC, 555 West 18th Street, New York, New York 10011, USA. Every time you call up our web pages that are linked with such a component, this component causes the browser you use to download a corresponding display of the component from Vimeo. If you call up such a Vimeo component on our web pages and are logged in to Vimeo during this process, Vimeo recognises through the information collected by the component which specific page you are visiting and assigns this information to your personal account with Vimeo. If you press the “Play” button or make corresponding comments, this information will be transmitted to your personal Vimeo member account, where it will be stored. Moreover, the information that you have visited our web pages is passed on to Vimeo. This happens regardless of whether you click the components and issue comments or not.
You can prevent this by logging out of your Vimeo member account before visiting our website.

The legal basis for the processing of data is your consent in accordance with Art. 6(1)(a) GDPR.
Further information on data protection, especially on the collection and use of the data by Vimeo, is provided by Vimeo under the following link: https://vimeo.com/privacy

Smartlook

This website uses Smartlook, provider is Smartlook.com, s.r.o., Šumavská 524/31, 602 00 Brno., Czech Republic. Smartlook is a tool to analyse your user behaviour on this website. The legal basis for the processing of data is your consent in accordance with Art. 6(1)(a) GDPR. You can influence the data collection by Smartlook in advance via the cookie banner for cookie control. You can find more detailed information about Smartlook and the collectable data under the following link: https://help.smartlook.com/docs/privacy-policy
If you do not want Smartlook to record your user behaviour, you can deactivate it via the following link: https://www.smartlook.com/opt-out/
With Smartlook this website only records anonymously your mouse and scroll movements as well as clicks. Based on this information, Smartlook creates so-called heatmaps that are used to determine which website sectors are preferentially viewed by website visitors. Moreover, we can establish how long you remain on a page and when you have exited the page. We can also determine at which point you have cancelled your entries in a contact form (so-called conversion funnels). In addition, Smartlook can be used to obtain direct feedback from website visitors. This function serves to improve the web offers of the website owner. Smartlook uses technologies that enable the recognition of the user for the purpose of analysing of the user behaviour (e.g. cookies or the use of device fingerprinting). The collected data are stored for a period of 180 days and then deleted.

Smartlook

Diese Website nutzt Smartlook, Anbieter ist Smartlook.com, s.r.o., Šumavská 524/31, 602 00 Brno., Czech Republic. Smartlook ist ein Werkzeug zur Analyse Ihres Nutzerverhaltens auf dieser Website. Rechtsgrundlage der Datenverarbeitung ist Ihre Einwilligung gem. Art. 6 Abs. 1 lit. a DSGVO. Sie können die Datenerfassung durch Smartlook vorab über den Cookie Banner zur Cookie-Steuerung beeinflussen.
Nähere Informationen über Smartlook und zu den erfassbaren Daten entnehmen Sie dem folgenden Link: https://help.smartlook.com/docs/privacy-policy
Wenn Sie keine Aufzeichnung Ihres Nutzerverhaltens durch Smartlook wünschen, können Sie diese über folgenden Link deaktivieren:
https://www.smartlook.com/opt-out/
Mit Smartlook werden auf dieser Seite ausschließlich Ihre Maus- und Scrollbewegungen sowie Klicks anonymisiert aufgezeichnet. Aus diesen Informationen erstellt Smartlook sogenannte Heatmaps, mit denen sich feststellen lässt, welche Websitebereiche vom Websitebesucher bevorzugt angeschaut werden. Des Weiteren können wir feststellen, wie lange Sie auf einer Seite verblieben sind und wann Sie sie verlassen haben. Wir können auch feststellen, an welcher Stelle Sie Ihre Eingaben in ein Kontaktformular abgebrochen haben (sog. Conversion-Funnels). Darüber hinaus können mit Smartlook direkte Feedbacks von Websitebesuchern eingeholt werden. Diese Funktion dient der Verbesserung der Webangebote des Websitebetreibers. Smartlook verwendet Technologien, die die Wiedererkennung des Nutzers zum Zwecke der Analyse des Nutzerverhaltens ermöglichen (z.B. Cookies oder Einsatz von Device-Fingerprinting). Die erhobenen Daten werden für einen Zeitraum von 180 Tagen gespeichert und sodann gelöscht.

Your rights and assertion of rights

You are entitled to the rights stated below. You may assert these rights against us. To assert your rights, please use the details given above under “Controller” or write us an e-mail to: datenschutz@insta.de.

Right to information: You have the right to obtain information on whether we process your personal data, for which purpose we process the data, which categories of your personal data we process, to whom the data are passed on, how long the data are stored and what your rights are.

Right to rectification: You are entitled to have any inaccurate personal data relating to you that is stored by us corrected. You also have the right to have an incomplete data record stored with us completed by us.

Erasure: You can demand that we delete personal data concerning you if (1) the data has been processed unlawfully, (2) the purpose for which the data were collected has been achieved, (3) you have revoked your consent to data processing and there is no other legal basis prevailing for the processing, (4) we are subject to a legal obligation to delete the data, (5) you are under the age of 16 or (6) you have objected to the processing and there are no primarily justified reasons prevailing for the processing on our part.

Right to restriction of processing: You can demand the restriction of processing in the following cases. In these cases, we will mark the data with a non-disclosure notice and discontinue the processing. (1) If you dispute the correctness of the personal data for the duration of our investigation. (2) If you have demanded deletion and we cannot or may not delete the data. (3) If you need the data for the assertion of claims, but we would be obligated to deletion because the purpose of the processing has been achieved. (4) If you have objected to the processing and a final decision has not yet been made.

Right to data portability: You have the right to request data from us that you have provided as part of a contract or on the basis of consent and that is processed automatically in a common machine-readable format (data record).

Revocation of consent: If you have given your consent for the processing of personal data, you may revoke your consent at any time with effect for the future. Please address your revocation to the details given above under “Controller” or send us an e-mail to: datenschutz@insta.de

Right to complain to the data protection supervisory authority: You have the right to submit a complaint, based on data protection regulations to the relevant supervisory authorities. The supervisory authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Officer for Data Protection and Freedom of Information North-Rhine Westphalia). The complaint can submitted to every supervisory authority regardless of responsibility.

Insta GmbH
Last update: July 2023

OUR HANDLING OF YOUR DATA AND YOUR RIGHTS:
INFORMATION according TO ART. 13, 14, 21 OF THE GENERAL DATA PROTECTION REGULATION (GDPR)

With the following information we provide you as our customer / supplier with information on the processing of your personal data by us and on your rights.

If you as our contractual partner and customer / supplier are not a natural person, please forward this information to the persons whose personal data we process, as they are our contact persons or are mentioned on documents such as invoices and delivery notes/AWBs.

1. Who is responsible for data processing and whom can I contact?

Responsible:
Insta GmbH
Hohe Steinert 10
58509 Lüdenscheid
Germany

Phone: +49 2351 936-0
E-mail: datenschutz@insta.de

Contact data of the data protection officer of Insta GmbH

Dr. Gregor Scheja
Scheja und Partner Rechtsanwälte mbB
Adenauerallee 136
53113 Bonn
Germany

Phone: +49 228 227226-0
Fax: +49 228 227226-26

Contact: https://www.scheja-partner.de/kontakt/kontakt.html
www.scheja-partner.de

2. What are the sources and data we use?

We process data that you provide us with or that we have received from third parties within the scope of existing contracts or with your permission.

In particular, the following personal data and categories of data are processed for the purposes mentioned in section 3:

• Personal data (first name, last name, address, telephone number, e-mail address).
• Content of the specific contract (article, price, etc.)
• Payment information such as bank details or data for internet-based payment services
• Concluded contracts
• Information on payment behavior

3. What is the purpose of processing your data? What is the legal basis?

In the following we inform you on the purpose and legal basis of processing your data.

3.1 For the fulfillment of contractual obligations (Art. 6 para. 1 lit. b GDPR)

We process your personal data for preparation and implementation of the business relationship. The purposes depend on the specific contract and include, for example:

• Communication with contact persons of our business partners
• Preparation, conclusion and execution of contracts
• Preparation of offers, order confirmations and invoices

Data processing is effected on the basis of Art. 6(1)(b) GDPR provided that a business relationship exists or is to be entered into with you personally. Provided that, on the other hand, you are acting on behalf of a third party, in particular your employer, data processing will be carried out on the basis of Art. 6(1)(f) GDPR, provided your fundamental rights are complied with. See further explanations under section 3.2.

We delete the data when they are no longer required for the purposes we pursue in preparing and carrying out the business relationship and no other legal reasons, in particular statutory or contractual retention periods, intervene.

3.2 In the context of balancing of interests (Art. 6 para. 1 lit. f GDPR)

We may also use your data on the basis of a balance of interests to protect our legitimate interests and those of third parties. In particular, this may come into effect for the following purposes:

• General business management
• Assertion of legal claims and defense in legal disputes
• Prevention and investigation of criminal offences
• Ensuring IT security and IT operations

For your personal safety and for the prevention of criminal offenses against the company, video surveillance takes place on the company premises [in publicly accessible areas]. The video data will be stored for a period of 10 working days; if required, the storage period is extended until the specified purpose no longer applies.

Our interest in processing the data results from the respective purposes and is of economic nature (efficient task fulfillment, sales, avoidance of legal risks).

Furthermore, data processing is carried out on this basis provided that you are acting for a third party, in particular your employer, within the scope of the purposes stated in section 3.1. Our legitimate interests lie in transacting business with this third party. Data processing is thereby carried out on the basis of Art. 6 para. 1 lit. f) GDPR. We will delete the data when they are no longer required for the purposes we pursue and no other legal basis applies.

3.3 Based on your consent (Art. 6 para. 1 lit. a GDPR)

Under certain conditions, we also process your personal data on the basis of a declaration of consent given by you. A consent can be revoked at any time. This also applies to the revocation of declarations of consent given prior to the application of the GDPR, i.e. prior to May 25, 2018. The revocation only takes effect for the future. Processing that took place before the revocation is not affected.

We delete the data if they are no longer required for the purposes we pursue, if the storage period specified in the consent has expired or if you have revoked the consent and no other legal basis applies. If the latter applies, we delete the data when the other legal basis has ceased to exist.

4. Who will receive my data?

Your data will be passed on only if permitted on a legal basis.

The data mentioned under point 2 will be transferred to government agencies if there is a legal obligation or if you have consented to this transfer. Such government agencies may be, in particular, tax authorities, customs administration or trade supervisory authorities.

Within our company, your data will be disclosed only to those bodies fulfilling their respective tasks based on our contractual and legal obligations. Furthermore, personal data may be passed on to tax consultants, IT service providers or similar for the purpose of order processing. This is necessary for the fulfillment of contractual obligations (see section 3).

In addition, order processors used by us (Art. 28 GDPR), in particular in the field of IT services, may process your data for us in accordance with instructions.

In order to assess the risk of concluding a contract, we reserve the right to send your personal data to a credit agency or request information about you. This transfer is permitted pursuant to Art. 6 (1f) GDPR, for we pursue legitimate interests by limiting the economic risk. The credit bureaus evaluate the information collected by us and others and provide us with an assessment of the risk of default in individual cases.

Potential partners of this data exchange are:

SCHUFA Holding AG
Postfach 10 34 41
50474 Köln
Germany

Contact: https://www.schufa.de/de/datenschutz/

Infoscore Forderungsmanagement GmbH
Gütersloher Straße 123
33415 Verl
Germany

Contact: https://www.inkassoportal.de/rechtliches/datenschutz

Verband der Vereine Creditreform e.V.
Hellersbergstraße 12
41460 Neuss
Germany

5. HOW LONG WILL my DATA be stored?

As far as necessary, we process your personal data for the duration of the contract. The data will be deleted two years after termination of the contract. We are subject to various storage and documentation obligations, which result, among others, from the German Commercial Code (HGB) and the German Fiscal Code (AO). The retention and documentation periods specified are two to ten years. Finally, the storage period is also assessed according to the statutory limitation periods, which are generally three years, for example, according to §§ 195 ff. of the German Civil Code (BGB).

6. Will data be transferred to a country, which is not part of the European economic area?

We do not transfer your data to countries outside the European Economic Area - EEA (third countries).

7. What other data protection rights Do i have?

You have the following rights regarding the processing of your personal data:

a. Right of access

You may demand a confirmation from us as to whether or not we are processing personal data about you. In such a case, you have the right to obtain information about your personal data and further information regarding the processing of the same.

b. Right to rectification

You have the right to request the rectification of your inaccurate personal data and to have incomplete personal data completed.

c. Right to erasure („Right to be forgotten“)

Under certain circumstances, you have the right to demand deletion of your personal data. This right applies, for example, if the personal data are no longer necessary for the purposes for which they were collected or otherwise processed, or if unlawful use of the data can be proven.

d. Right to restriction of processing

Under certain circumstances, you have the right to demand restriction of the processing of your personal data. In this case, we will only store personal data for which you have given consent or for which the GDPR permits processing. For example, you may have a right to restrict processing if you have disputed the accuracy of your personal data.

e. Right to data portability

If you have provided us with personal data on the basis of a contract or consent, you may, if legal requirements are met, demand that we hand out to you the personal data you have provided in a structured, common and machine-readable format or that we transfer it to another data controller.

f. Withdrawal of consent

If you have consented to processing your personal data, you may withdraw this consent at any time with effect for the future. The lawfulness of processing your personal data until the revocation remains unaffected.

g. Right to lodge a complaint with a supervisory authority

In addition, you have the right to lodge a complaint with the competent supervisory authority if you believe that the processing of your personal data violates applicable law. For this purpose, you may contact the data protection authority responsible for your place of residence, workplace or the place of an alleged violation or the data protection authority responsible for us. The competent supervisory authority is the supervisory authority of the federal state you have residence or work in or in which an infringement is alleged to have taken place which is subject of the complaint.

8. To what extent is my data used for profiling?

We do not process your data with the aim of evaluating certain personal aspects (so-called "profiling").

9. Am i obliged to provide the data?

You are not obliged by law to provide us with personal data. If, however, you do not provide us with the data necessary for conclusion and processing of the contract, as well as the data we are obliged to collect and process for legal reasons upon and after conclusion of the contract, the conclusion of a contract will generally not be possible.

10. Information concerning your right of objection according to art. 21 GDPR

11. Your contact to us and the execution of your rights

If you have any questions regarding the processing of your personal data or the execution of your data subject rights as set out in Section 7, you may contact us free of charge. Please use our contact details under Section 1. In addition, you may always use the same contact method for revoking consent that you used for submitting the declaration of consent.