Data Protection Policy
We are delighted in your interest in our website and our company:
Thomas Sportwagen GmbH
Meissner Str. 34
contact (at) thomas-exklusiv.de
Tel. +49 351 40464 0
Fax +49 351 40464 10
Managing Director: Sibylle Thomas-Göbelbecker
Registered with Dresden District Court: HRB 20941
Place of jurisdiction: Meissen
VAT ID: DE227703011
Data protection is important to us. When you use our website, we process personal data wherever possible only to the extent required to provide functions or services.
Personal data, such as names, addresses, e-mail addresses or phone numbers, is processed at all times in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). In this policy, we set out the type, scope and purpose of the personal data collected, used and processed by us. We also inform data subjects of their rights in this policy.
Please note that there are inherent security risks in transmitting data via the Internet, which makes it impossible to completely safeguard the data. This being the case, all data subjects are free to transmit personal data to us through alternative channels, e.g. by phone.
- Controller and Data Protection Officer
We are the controller within the meaning of data protection legislation:
Thomas Sportwagen GmbH
Meissner Str. 34
datenschutz (at) thomas-exklusiv.de
Tel. +49 351 40464 0
Fax +49 351 40464 10
Managing Director: Sibylle Thomas-Göbelbecker
Our Data Protection Officer is:
Mr Johannes Bernhardt
Meissner Str. 34
Tel.: +49 351 40464 267
E-mail.: datenschutz (at) thomas-exklusiv.de
All data subjects can contact us or our Data Protection Officer at any time if they have any questions or suggestions relating to data protection.
- Collection of general data and information
Each time our website is accessed, certain general data is collected by us and stored in so-called log files on the server. This data includes, among other things: the IP address, the provider of the accessing system, the operating system used, the browser used, the website from which the accessing system was referred to our website, and other similar data.
We do not use the data processed in this way to identify particular individuals. It is used solely in order to display our Internet presence optimally and to improve it. This data serves to display the content of our website correctly, to protect our technical IT systems against attacks and, in exceptional cases, to provide law enforcement authorities with the required information. Where applicable, a statistical evaluation may be conducted to strengthen the level of data protection and IT security within our company. The anonymously collected data recorded in the log files is stored separately from all other personal data that users share with us.
- Legal basis for processing
We process personal data only within the framework of the applicable legislation and only if one of the legal grounds under Art. 6 (1) GDPR applies or the data subject has given his/her consent.
A data subject can provide a legally effective consent to the data processing in accordance with Art. 6 (1) a) GDPR if we have previously provided adequate information on how the data is processed and the purpose of this processing.
Under Art. 6 (1) b) GDPR, personal data can be processed to perform a contract. This can be the case, for example, if goods are delivered or data is required to perform a service. Pre-contractual services are included within this, for example, customer enquiries about our products.
Under Art. 6 (1) c) GDPR, processing is possible if there is another legal obligation to do so, as is the case, for example, with the storage of personal data for tax reasons.
Art. 6 (1) d) GDPR permits the processing of personal data to protect the vital interests of the data subjects or another natural person.
Finally, Art. 6 (1) f) GDPR permits processing where this is necessary for the purposes of the legitimate interests of our company or a third party, provided that the interests, fundamental rights and freedoms of the data subject do not outweigh these. Such an interest can consist of an existing customer relationship, for example. Our interest in the processing in such cases lies in wanting to conduct our business activities for the benefit of our company, employees and shareholders.
It emerges from the aforementioned provisions that the storage of personal data can be, for example, stipulated by law or necessary because otherwise a contract cannot be fulfilled. Data subjects can contact us in individual cases and we will advise them of the grounds on which we hold the personal data in question and how it is processed.
- Storage period
Personal data is stored in accordance with the applicable statutory retention periods. As soon as this period has expired, the data in question is routinely deleted where no other legal ground permits further retention.
- Routine erasure and blocking of personal data
We process and store data subjects’ personal data in accordance with the statutory regulations only for the length of time required to achieve the purpose of the storage or where other legal provisions permit it. As soon as the storage purpose no longer applies and no other legal ground exists, personal data is routinely blocked or deleted in accordance with the applicable statutory regulations.
- Rights of data subjects
6.1 Right to confirmation
Data subjects have the right to obtain confirmation from us as to whether or not personal data on them is processed. If a data subject wishes to exercise this right to confirmation, he/she can contact our Data Protection Officer or the company management at any time.
6.2 Right to access
Each data subject has the right, granted under European legislation, to obtain from the controller at any time information about the personal data stored concerning himself/herself, free of charge, and to obtain a copy of this information. In addition, European legislation grants the data subject the right to the following information:
- The categories of personal data processed
- The purposes of the processing
- The recipients or categories of recipient to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations
- Where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
- The existence of the right to rectification or erasure of the personal data relating to him/her, or the right to restrict the processing by the controller, or the right to object to such processing
- The right to lodge a complaint with a supervisory authority
- Where the personal data is not collected from the data subject: any available information as to its source
- The existence of automated decision-making, including profiling, under Art. 22 (1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject
The data subject also has the right to be informed if his/her personal data has been transferred to a third country or to an international organisation. Where that is the case, the data subject also has the right to be informed of the appropriate safeguards relating to this data transfer.
Where a data subject wishes to exercise this right of access, he/she can contact our Data Protection Officer or the company management at any time.
6.3 Right to rectification
Data subjects have the right to obtain the rectification of inaccurate personal data relating to them without undue delay. Taking into account the purposes of the processing, they also have the right to have incomplete personal data completed.
Where a data subject wishes to exercise this right to rectification, he/she can contact our Data Protection Officer or the company management at any time.
6.4 Right to erasure
Data subjects have the right to request from us as the controller the erasure of personal data relating to them without undue delay where one of the following grounds applies and insofar as the processing is not required:
- The personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
- The data subject withdraws the consent on which the processing was based according to Art. 6 (1) a) or Art. 9 (2) a) GDPR, and where there is no other legal ground for the processing.
- The data subject objects to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21 (2) GDPR.
- The personal data has been unlawfully processed.
- The erasure of the personal data is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
- The personal data was collected in relation to the offer of information society services referred to in Art. 8 (1) GDPR.
Where one of the aforementioned grounds applies and a data subject wishes to exercise his/her right to have the personal data stored by us erased, he/she can contact our Data Protection Officer or the company management at any time.
Where we have publicly disclosed the personal data and our company as the controller is obliged pursuant to Art. 17 (1) GDPR to erase the personal data, we shall, taking account of the available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other controllers that are processing the publicly disclosed personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, this personal data, insofar as the processing is not necessary. We will take the necessary steps in the individual case.
6.5 Right to restrict the processing
Data subjects have the right to obtain from us the restriction of the processing where one of the following conditions applies:
- The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
- The processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of its use instead.
- The controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims.
- The data subject has objected to the processing pursuant to Art. 21 (1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.
Where one of the aforementioned grounds applies and a data subject wishes to exercise his/her right to have the processing of the personal data stored by us restricted, he/she can contact our Data Protection Officer or the company management at any time. We will ensure that the processing is restricted.
6.6 Right to data portability
Data subjects have the right to receive the personal data concerning them that they have provided to us in a structured, commonly used and machine-readable format. They also have the right to transmit this data to another controller without hindrance from the controller to which the personal data has been provided where the processing is based on consent pursuant to Art. 6 (1) a) GDPR or Art. 9 (2) a) GDPR or on a contract pursuant to Art. 6 (1) b) GDPR, and the processing is carried out by automated means, insofar as the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Data subjects can also have the personal data transmitted directly from one controller to another where this is technically feasible and does not adversely affect the rights and freedoms of others, see Art. 20 (1) GDPR.
To exercise the right to data portability, the data subject can contact our Data Protection Officer or the company management at any time.
6.7 Right to object
Each data subject has the right, granted under European legislation, to object at any time, on grounds relating to his/her particular situation, to the processing of personal data concerning him/her that is based on Art. 6 (1) e) or f) GDPR. This also applies to any profiling based on these provisions.
In the event of an objection, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or where processing is necessary for the establishment, exercise or defence of legal claims.
Where we process personal data for direct marketing purposes, the data subject has the right to object at any time to the processing of his/her personal data for such marketing. This includes profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, we will no longer process the personal data for these purposes.
In addition, the data subject has the right, on grounds relating to his/her particular situation, to object to the processing by us of personal data concerning him/her for scientific or historical research purposes or statistical purposes pursuant to Art. 89 (1) GDPR, unless such processing is necessary for the performance of a task carried out for reasons of public interest.
To exercise the right to object, the data subject can contact our Data Protection Officer or the company management directly at any time. In the context of the use of information society services, notwithstanding Directive 2002/58/EC, the data subject may also exercise his/her right to object by automated means using technical specifications.
6.8 Right to complain to a supervisory body
Without prejudice to any other administrative or judicial remedy, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him/her infringes the GDPR. The data protection authority with which the complaint is lodged will inform complainant on the progress and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
- Right to withdraw consent under data protection legislation
Every consent granted to us in the context of data protection can be withdrawn at any time.
Where a data subject wishes to exercise this right to withdraw consent, he/she can contact our Data Protection Officer or the company management at any time.
- Data protection with regard to job applications and application processes
We collect and process the personal data of applicants. This processing is solely for the purpose of administering the application process. The data is processed in written or electronic form, for example, if application documents are sent to us by e-mail. If the application results in an employment contract, the data transmitted will be stored in order to administer the employment relationship. Otherwise the data will be automatically deleted two months after our rejection, insofar as there are no other legitimate interests on the part of the controller that would oppose this deletion. A legitimate interest in this sense would be, for example, a burden of proof in a lawsuit under the German General Equal Treatment Act (AGG).
- E-mail contact and contact form
Due to statutory regulations, our website contains information that enables rapid electronic contact with our company and direct communication with us, which also comprises a general so-called electronic mail address (e-mail address). Where a data subject contacts us by e-mail or using a contact form, the personal data transmitted by the data subject is stored automatically. Such personal data provided by the data subject to the controller on a voluntary basis will be stored for the purposes of processing the enquiry or to contact the data subject. This personal data will not be disclosed to third parties.
By using cookies, information and features on our website can be optimised for the benefit of users. Cookies enable us to recognise users of our website. Recognising users serves to make it easier for them to navigate our website.
Data subjects can prevent our website from setting a cookie at any time by configuring the settings in their browser accordingly. Almost all browsers, including Google Chrome, Firefox, Safari, Internet Explorer as well as mobile browsers, provide this function. In addition, cookies that have already been placed can be subsequently deleted from data subjects’ systems. If a user deactivates cookies in his/her browser, it may not be possible in some circumstances to use all features of our website to their full extent.
- Subscribing to our newsletter
We provide a newsletter, which users can subscribe to via our website. The personal data transmitted to us when subscribing to the newsletter is indicated in the form used to subscribe.
We inform our customers and business partners of offers at regular intervals in our e-mail newsletter. Data subjects can subscribe to it and thereby register to receive the newsletter. Upon initial subscription, we send a confirmation e-mail in order to comply with the so-called double opt-in process. This means that only persons who have access to the confirmation e-mail can subscribe. In this way, we ensure that the owner of the e-mail address has authorised receipt of our newsletter.
During the subscription process, we store the IP address assigned by the provider that is used by the data subject when subscribing. In addition, we store the date and time of subscription. This data is stored in order to be able to demonstrate that sending the newsletter is lawful.
None of the data that we collect when a data subject subscribes to the newsletter is shared with third parties. This data is used exclusively to send the e-mails. In exceptional cases, newsletter subscribers will be informed by e-mail where this is required for continued receipt of the newsletter. The reasons for contacting them could be a change to the service or other technical reasons. The data subject can cancel his/her subscription at any time. Consent to the storage of the personal data provided by the data subject for the purposes of sending the newsletter can be withdrawn at any time. A link is provided at the end of each newsletter for this purpose. There is also an option to subscribe directly on our website, but other means of contacting us can also be used to subscribe.
- Google Analytics
We use Google Analytics. The operator of the Google Analytics component is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043-1351, USA. Google Analytics is a web analysis service. Web analysis is the collection, compilation and evaluation of data relating to user behaviour on websites. The information collected includes information about the website from which a data subject was forwarded to another website (so-called referrer), which sub-pages of a website were accessed, or how often and for how long a sub-page was viewed. A web analysis is primarily used to optimise a website and to perform a cost-benefit analysis of online advertising.
We use the extension “_gat._anonymizeIp” for web analysis. With this extension, the IP address of the data subject’s Internet connection is truncated and anonymised by Google where our website is accessed within a Member State of the European Union or in other countries that are party to the Agreement on the European Economic Area.
The Google Analytics component is used to analyse the stream of visitors to our website. Google uses the data and information obtained, among other things, to evaluate the use of our website, to compile reports for us about activity on our websites and to provide other services relating to the use of our website.
Google Analytics places a cookie on the user’s computer. This is the only way Google is able to analyse how our website is used. Each time a page of this website, which is operated by us, is accessed, the Internet browser on the data subject’s computer is automatically prompted by the respective Google Analytics components to transmit data to Google for the purpose of online analysis. During the course of this technical process, Google gains knowledge of personal data, such as the IP address of the data subject, which Google uses, among other things, to track the origins of visitors and clicks and to subsequently allow commission to be calculated. This personal data is stored by Google in the US. Google may disclose the personal data collected by way of this technical process to third parties.
Data subjects can object to and prevent the collection of data and its processing by Google. To do so, they must download and install the programme available on the following link: https://tools.google.com/dlpage/gaoptout. This browser add-on sends a message to Google Analytics that no data and information regarding website visits may be transmitted to Google Analytics. The browser add-on is viewed by Google as an objection.
Further information can be accessed at www.google.com/policies/privacy/ and at https://www.google.com/analytics/terms/gb.html. Google Analytics is described in more detail at this link: https://www.google.com/analytics/.
- Automated decision-making
We do not carry out any profiling and do not use any other forms of automated decision-making.