Data protection and privacy statement according to Article 13 GDPR

1. General
We take the protection of your personal data very seriously. We process data in accordance with the applicable data protection laws and regulations, in particular the European General Data Protection Regulation (hereinafter: GDPR) and the country-specific data protection regulations.
” Personal data ” means any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
” Processing ” means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission or transfer, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.
In the following, we will inform you about the processing of your data, in particular about the type, scope and purposes of the collection and use of your personal data when you visit our website and use our offers and services as well as the corresponding legal basis for the individual processing operations. In addition, we will explain to you in the context of our data protection declaration which rights you have in regard to data processing.

2. Responsible body for data processing
As the provider of our Internet services, we are the body responsible for data processing. You can reach us using the contact details below:
Awaris GmbH
Genter Strasse 8
50672 Cologne / Germany
phone +49 (0) 221 98655248
fax +49 (0)221 98655248-9
email: info@awaris.com

3. Processing of your data
The processing of your data differs in type, scope and purpose depending on whether you only visit our website, use the services we offer and / or services, send us an inquiry using our contact form or an application or order our newsletter:
a) Visiting our website (server log files)
When you visit our website, the server stores data in so-called server log files, which your internet browser automatically transmits to the server, in particular:
• Visited website
• Time of access
• Amount of data sent in bytes
• Source / reference from which you came to the page
• Browser used
• Operating system used
• IP address used
The data collected is only used for statistical evaluations and to improve the website. However, the website operator reserves the right to check the server log files retrospectively if there are specific indications of illegal use.
This data is processed in order to enable the use of the websites you have accessed, for statistical purposes, to improve our website and to protect against illegal cyberattacks, as well as to exercise, assert or defend against legal claims. Your IP address is only stored for as long as necessary to protect against possible cyberattacks and to provide law enforcement authorities with the information necessary for prosecution.
The data specified above is processed separately from all personal data that you provide to us when you visit our website and / or make use of a service, are in no way combined.
The above described data processing has its legal basis in Article 6 paragraph 1 letter b) GDPR to carry out the necessary pre-contractual measures that are carried out at your request to enable you to use the websites you have accessed. Insofar as the above data for security against illegal cyberattacks, or for exercising, asserting or warding off legal claims, is processed, this is done on the legal basis of Article 6 paragraph 1 letter f) of the GDPR. Our legitimate interest in this data processing lies in the evaluation of the data to improve our website, in order to exercise, assert or defend against legal claims, and in protecting our systems against illegal cyberattacks.
b) Processing of personal data when using the services and / or services we offer
Personal data will only be processed by us if this is permitted by law or if you consent to the processing of your personal data.
If you want to make use of the services offered by us on our website, it is necessary that you transmit or provide us with further personal data. We will provide you with the mandatory data we need to close a contract upon your request.
We process your personal data for the above purposes on the legal basis of Article 6 paragraph 1 letter b) GDPR in order to fulfil a contract with you or to carry out necessary pre-contractual measures, which are carried out at your request. The purpose of processing your personal data is therefore, for example, to process inquiries or to provide the desired service. Without providing the personal data, we cannot process your request and / or close the contract with you and cannot provide the services offered.
In addition, we process your data for the purpose of exercising, asserting or averting legal claims arising from the contractual relationship and, if necessary, enabling law enforcement authorities to prosecute those who misuse our services. The above data processing takes place on the legal basis of Art. 6 Paragraph 1 Letter f) GDPR. Our legitimate interest for data processing on the legal basis of Art. 6 Paragraph 1 Letter f) GDPR is to be able to exercise, assert or ward off legal claims from the contractual relationship and, if necessary, to enable the law enforcement authorities to prosecute.
We also process your personal data for the purpose of complying with our statutory retention requirements. The legal basis for the fulfilment of our legal storage obligations is standardized in Article 6 paragraph 1 letter c) GDPR.
Your data will be passed on to us, if necessary, supporting service providers in order to fulfil the contract or to carry out the necessary pre-contractual measures, which we have carefully selected. This can be technical service providers or service providers supporting us in shipping or payment processing or accounting or other employees who are obliged to maintain confidentiality.
We also reserve the right to integrate third-party content (e.g. YouTube videos, external map services, external graphics, etc.) on our website. If we use third-party tools, we will inform you about their use, functionality, legal basis and further details of the respective tools under point 15 of this data protection declaration.
Your personal data will only be passed on to other third parties if we are legally obliged to do so on the legal basis of Article 6 paragraph 1 letter c) GDPR and, if applicable, to lawyers and tax advisors on the legal basis of Article 6 paragraph 1 letter f) GDPR. Our legitimate interest in passing on your data to tax advisors and lawyers is to meet our tax obligations or to exercise, assert or avert legal claims.
In addition, we will not pass on your personal data to third parties without your explicit consent.
c) Contact form
If you send us inquiries using the contact form, your details from the inquiry form, including the contact details you provided there, will be stored by us for the purpose of processing the inquiry and in the event of follow-up questions. We will not pass on this data without your consent or legal permission.
This data processing described above has its legal basis in Article 6 paragraph 1 letter b) GDPR for the implementation of necessary pre-contractual measures, which are carried out at your request.
d) Newsletter
In the following we will inform you about the order and shipping process of our newsletter, the cancellation of the newsletter as well as the respective data processing processes:
aa) Ordering and sending our newsletter
If you order our newsletter when registering or later via your customer account, we will send you the desired newsletter regularly until you unsubscribe or we will inform you about changes to the newsletter service.
When subscribing to and unsubscribing from our newsletter, the IP address of the subscriber and the date and time of registration are also saved. We process this data for the purpose of being able to prove your registration and deregistration if necessary and if necessary to be able to exercise, assert or defend against legal claims and to enable the law enforcement authorities to prosecute the abuse of our newsletter service or a cyberattack.
Otherwise, your personal data will only be passed on to other third parties if we are legally obliged to do so (e.g. to authorities to investigate cyberattacks and possibly committed crimes), to courts and lawyers to exercise, assert or defend against legal claims, or if you expressly state that have consented to the transfer of your personal data.
We process your personal data for the above purposes from May 25th, 2018 based on your consent on the legal basis of Article 6 paragraph 1 letter a) GDPR.
bb) Cancellation of the newsletter
You can cancel the newsletter at any time by sending us a message or using the unsubscribe function, which we will inform you about in every newsletter. By cancelling the newsletter service, the consent given to us for sending the newsletter will be revoked with effect for the future. The legality of the data processing based on the consent up to the revocation is not affected by the revocation.
After cancelling the newsletter service and revoking your consent, your data record will be entered on a unsubscribe list and you will no longer receive the newsletter associated with your email address.
e) Online job applications
We occasionally offer you the opportunity to apply to us via our website.
We will only use your applicant data for the purpose of processing the application process.

We usually process only the data that you voluntary provide to us or that is necessary to assess your job application and to enter into an employment contract. This includes in particular your name, contact data, your education and job experience in particular in the area of mindfulness and mindfulness trainings. Please do not provide us with any sensitive data.

The legal basis for this data processing is Art. 88 GDPR and Section 26 BDSG.
Your personal data will not be passed on to other third parties unless we are legally obliged to do so or you separately consent to the transfer of your data.
You are neither legally nor contractually obliged to send us your applicant data. However, we need your applicant data for a possible contract. If you do not send us applicant data, this means that we cannot consider you in the application process.
If the processing purpose for your personal data no longer applies, your personal data processed by us will be deleted in accordance with section 5 of this data protection declaration.

More specifically, in case your application is successful we will continue to process your personal data in accordance with the applicable laws. Otherwise, will delete your personal data after approx. six months after receipt of your application; we will do so in line with our regular review cycles. If you agree, we may keep your personal data on our files for later job opportunities.

4. Use of cookies
We use so-called ” cookies ” on our website. Cookies are small text files that are sent to your browser by our web server when you visit our website and are stored by your browser for a limited time on your device (e.g. PC, smartphone, tablet) for various purposes. Below we inform you about the use of cookies on our website:
a) Session cookies
We only use session cookies on our website which are set when the website is opened and are only valid until your browser is closed again. The purpose of the session cookies used by our website is to enable you to use our website more user-friendly and more effectively.
The use of cookies described above is based on our legitimate interests and thus on the legal basis of Article 6 paragraph 1 letter f) GDPR. Our legitimate interests are to offer you a user-friendly and modern website that serves both our business interests and the expectations of the users.
b) Third-party cookies
Cookies are only used on our website by third-party providers of tools (programs) that we use on our website. We will inform you about the use, functionality and further details of the respective tools under point 15 of this data protection declaration.
c) Prevention of the use of cookies through browser settings
You can determine yourself whether cookies can be set and accessed using the settings in your browser. For example, you can deactivate the storage of cookies in your browser altogether, restrict it to certain websites or configure your browser so that it automatically notifies you as soon as a cookie is to be set and asks for your permission. You can also set your browser so that cookies are automatically deleted when the browser is closed. Finally, you can activate a do-not-track function (” DNT ”) in your browser so that you are not automatically recorded by any web analysis tool that may be used. Information on the configuration of your browser settings can be found in the help function of your respective internet browser.

5. Storage and deletion periods for personal data
If the processing purpose for your required personal data no longer applies, your personal data processed by us will be routinely deleted or blocked unless you have consented to the permanent storage of your personal data.
If individual data has to be kept due to legal retention periods after the processing purposes ceased to exist (e.g. tax and commercial law retention requirements), the data will be blocked instead of deleted. The to be stored data may be processed on the legal basis of Article 6 paragraph 1 letter c) GDPR exclusively for the above named purposes.

6. Your rights as a data subject
You always have the rights described below:
• Right of confirmation and information about the personal data processed by us in accordance with Article 15 GDPR
• Right to have your personal data corrected in accordance with Article 16 GDPR
• Right to have your personal data deleted (” right to be forgotten ”) in accordance with Article 17 GDPR
• Right to restrict the processing of your personal data in accordance with Article 18 GDPR
• Right to data portability of your personal data in accordance with Article 20 GDPR
• In accordance with Article 22 GDPR, you have the right not to be subject to a decision based solely on automated processing – including profiling – that has a legal effect on you or similarly significantly affects it.
Please send us your request to the contact details given in section 2 of this data protection declaration.

7. Right to object
You have the right to object, at any time, to the processing of your personal data based on Article 6 (1) (e) or (f) GDPR for reasons arising from your particular situation; this also applies to profiling based on these provisions.

In this case, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

If personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling insofar as it is connected to such direct advertising.

You also have the right to object, for reasons arising from your particular situation, to the processing of your personal data relating to you, which is carried out for scientific or historical research purposes or for statistical purposes in accordance with Article 89 (1) GDPR, if it is because processing is necessary to fulfil a task in the public interest. If you object to processing for direct marketing purposes, the personal data will no longer be processed for these purposes.

8. Right to withdraw your consent
You can revoke your explicit data protection consent at any time with future effect. The legality of the processing based on the consent up to the revocation is not affected by the revocation.

9. Lodging a complaint the supervisory authorities in the event of data protection infringements
If you believe that your privacy rights have been infringed, you can contact the supervisory authority in your federal state or the state in which our company has its headquarters. If a complaint concerns a company domiciled in another federal state, the supervisory authority will forward the complaint to the competent supervisory authority there.

10. Notification obligation regarding rectification or erasure of personal data or the restriction of processing
The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with article 16, Article 17 (1) or Article 18 to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate efforts.

11. Statutory or contractual provision of personal data; requirement for the conclusion of the contract; obligation of the data subject to provide personal data; consequences of failure to provide personal data
As described above, we collect and process your personal data in particular for the fulfilment of a contract with you or for the implementation of pre-contractual measures that are carried out at your request. In some cases, the provision of personal data when concluding contracts (e.g. for invoices) is required by law due to tax and / or commercial law regulations, otherwise it is a contractual or pre-contractual obligation. If you do not provide us with any personal data, this means that we cannot conclude a contract with you and / or cannot answer your inquiries.
Insofar as we process your personal data on the basis of a legitimate interest in accordance with Article 6 paragraph 1 letter f) of the GDPR, the provision of your data described here is, therefore, neither contractually nor legally required. The details of data processing based on a legitimate interest can be found in the relevant information at the relevant points. If you do not provide us with personal data for these purposes, this may result in you not being able to use our website and services or not being able to use them to their full extent.

12. Automated decision-making, in individual cases including profiling
We do not use automated decision-making – including profiling as laid down in Article 22 paragraphs 1 and 4 of the GDPR.

13. Data security
We use technical and organisational security measures to protect your personal data, in particular against accidental or intentional manipulation, loss, destruction or against unauthorized third-party access. Our security measures are continuously improved in line with technological developments.

14. Questions / comments
Questions or comments about this data protection declaration or about data protection in general can be directed to our contact details, which you can find in section 2 of this data protection declaration.

15. Use of third party tools and content
We currently use the following third-party tools on our website:

Notes on Google Analytics

It is important to us to make our website as optimal as possible and thus make it attractive for our visitors. For this it is necessary that we know which parts of our website reach our visitors.
For this purpose, we use the web analytics service Google Analytics on our website, a web analytics service provided by Google Inc. (” Google ”). Google Analytics uses so-called “cookies ”, text files that are stored on your computer and that enable an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. We use Google Analytics on this website with activation of IP anonymization, i.e. Your IP address will be shortened beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. The full IP address is only transferred to a Google server in the USA and abbreviated there in exceptional cases. Google will do this on behalf of the operator of this website. Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with other services related to website activity and internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.
You can prevent the storage of cookies by setting your browser software accordingly. Information on the configuration of your browser settings can be found in the help function of your respective internet browser. However, please note that if you do this you may not be able to use the full functionality of this website.
You can also prevent the collection of data by a browser plug-in. This plugin sets an opt-out cookie and thus prevents the future collection and processing of your data by Google Analytics. You can download and install a browser plug-in under the link https://tools.google.com/dlpage/gaoptout?hl=de.
You can find more information about Google’s terms of use and data protection at:
https://www.google.com/analytics/terms/de.html or https://www.google.de/intl/de/policies/terms/regional.html.
The use of Google Analytics described above is used to analyse and improve our website. This represents a legitimate interest in the legal basis of Article 6 (1) (f) GDPR.

Notes on Google Ads with Conversion Tracking

We use the Google Ads tool with conversion tracking, from Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA, to measure the success of our advertising measures. After certain target achievements on our website (“conversions”) – such as sending a request via our contact form or registering for our newsletter – this goal achievement is recorded by Google. In addition, Google will use the cookies previously set to assign which advertisements have been clicked on and which were decisive for achieving the goal. Google can use this to measure the number of target achievements and provide us with corresponding statistics on the success of our advertising measures.
Google processes this data on servers in the USA. Through certification according to the EU-US Privacy Shield (” EU-US Privacy Shield ”)
https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active
Google guarantees that the EU data protection regulations will also be observed when processing data in the USA. The so-called conversion cookies lose their validity after 30 days, but according to Google, are not associated with personal data from your Google account and are not used for your personal identification.
Further information on Google Ads and Conversion Tracking and how you can prevent cookies from being placed can also be found in the explanations for Google Ads Conversion Tracking and in Google’s privacy policy under the following links
https://www.google.com/intl/de/policies/privacy/
https://services.google.com/sitestats/de.html
https://www.google.com/policies/technologies/ads/
The use of Google Ads with conversion tracking described above is for advertising purposes. This represents a legitimate interest in the legal basis of Article 6 (1) (f) GDPR.

Notes on Google Maps

We use the map material from Google on our website via the so-called ” Google Maps API ” from Google Inc., USA. We use Google’s interactive maps because we believe they will help our visitors find the best way to find us. When using Google Maps, Google uses cookies and, in addition, your IP address and other data about the use of the Google Maps functions of visitors to our websites is processed by Google. Google Maps is based on a JavaScript code, so you can prevent it from running altogether by deactivating JavaScript in the settings of your browser or installing a JavaScript blocker. Please note that the map service on our website may then not be displayed correctly.
Additional information and the terms of use for Google Maps can be found at the following link:
https://www.google.com/intl/de_de/help/terms_maps/
You can find Google’s privacy policy at the following link:
https://www.google.com/intl/de/policies/privacy/
The use of Google Maps described above serves the purpose of making it easy for you to find the places we have indicated on the website. This represents a legitimate interest in the legal basis of Article 6 (1) (f) GDPR.

Notes on Google fonts

We integrate fonts on our website via the ” Google Fonts ” service from Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA. We use ” Google Fonts ” only for the uniform representation of the fonts on our website. Google Fonts are not stored on our own server, but from the cloud of Google servers. If you open one of our websites, your browser loads the required fonts into your browser cache in order to display texts and fonts correctly. The unabridged IP address and the personal browser history are transmitted to Google Server.
If your browser does not support Google fonts, a standard font will be used by your computer.
You can find more information about Google Web Fonts at
https://developers.google.com/fonts/faq
and in Google’s privacy policy:
https://www.google.com/intl/de/policies/privacy/
The use of Google fonts described above is in the interest of a uniform and appealing presentation of our website. This represents a legitimate interest in the legal basis of Article 6 (1) (f) GDPR.

Notes on YouTube videos

We embed videos of the service ” YouTube ”, a service of YouTube LLC 901 Cherry Ave, San Bruno, CA 94066, USA in our extended data protection mode on our website.
YouTube videos are not stored on our own server, but on YouTube servers. According to YouTube, YouTube embeds no information about visitors on a website when embedding a YouTube video, unless a visitor looks at the embedded video. In this case, YouTube sets cookies to record video statistics, to avoid fraud and to improve user-friendliness and to save your IP address. Also, when watching a video, contact is made with Google’s “DoubleClick” advertising network. As soon as an embedded You-Tube video is started, we therefore no longer have any influence on this data processing by YouTube. Further information on data protection at YouTube can be found in their data protection declaration at:
https://www.youtube.com/t/privacy_at_youtube
The use of YouTube described above is used to present videos about our products and / or services to you and to enable you a modern user experience on our website as well as for advertising purposes. This represents a legitimate interest in the legal basis of Article 6 (1) (f) GDPR.

Notes on LinkedIn Insight Tag

We use the conversion tool LinkedIn Insight Tag from LinkedIn Ireland Unlimited Company. By using it, a cookie is created in your browser, which enables the collection of the following data, among others: IP address, device and browser properties, and page events (e.g. page views). The data is encrypted, anonymized within seven days, and the anonymized data is deleted within 90 days. LinkedIn does not share any personal data with us, but offers anonymized reports on website audience and ad performance. In addition, LinkedIn offers the possibility of retargeting via the Insight Tag. We can use this data to display targeted advertising outside our website without identifying you as a website visitor. You can find more information about data protection at LinkedIn in the LinkedIn privacy notices. As a user of this site, you can object to the setting of the cookie. In addition, LinkedIn members can control the use of their personal data for advertising purposes in their account settings.