Privacy policy

This data protection notice informs you about the nature, scope and purpose of the processing of personal data (hereinafter referred to as "data") within our online offer and the websites, functions and content associated with it, as well as external online presences, such as our social media profiles and partner sites (hereinafter collectively referred to as "online offer"). With regard to the terms used, such as "processing" or "controller", we refer to the definitions in Art. 4 of the General Data Protection Regulation-DSGVO/EU-DSGVO/TTDSG and the Trans-Atlantic Data Privacy Framework.

Responsible
Cebra Media Solutions S.L.U.
Carrer Arxiduc Lluis Salvador 7b, 07004 Palma de Mallorca, Spain
Branch office Germany: Hollerallee 26, 28209 Bremen, phone: 0421-40885746
E-mail: data.privacy@on-sup.com
You can find all contact details in our imprint

Types of data processed:
- Inventory data (e.g., names, addresses).
- Contact details (e.g., email, phone numbers).
- Content data (e.g., text input, photographs, videos).
- Usage data (e.g., websites visited, interest in content, access times).
- Meta/communication data (e.g., device information, IP addresses).

Categories of persons concerned
Visitors and users of the online offer (hereinafter we also refer to the data subjects collectively as "users").
Purpose of the processing - provision of the online offer, its functions and contents.
- Responding to contact requests and communicating with users.
- Safety measures.
- Reach measurement/marketing

Terminology used
"Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

"Processing" means any operation or set of operations which is performed upon personal data, whether or not by automatic means. The term is broad and covers virtually any handling of data.

"pseudonymisation" means the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures which ensure that the personal data are not attributed to an identified or identifiable natural person.

"profiling" means any automated processing of personal data which consists in using such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects relating to that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or change of location.

Controller" means the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data.
"processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Relevant legal bases
In accordance with Art. 13 DSGVO or EU-DSGVO and the Trans-Atlantic Data Privacy Framework, we inform you about the legal basis of our data processing. If the legal basis is not mentioned in the data protection information, the following applies: The legal basis for obtaining consent is Art. 6 para. 1 lit. a and Art. 7 DSGVO or EU-DSGVO, the legal basis for processing for the fulfilment of our services and implementation of contractual measures as well as answering enquiries is Art. 6 para. 1 lit. b DSGVO or EU-DSGVO, the legal basis for processing for the fulfilment of our legal obligations is Art. 6 para. 1 lit. c DSGVO or EU-DSGVO, and the legal basis for processing for the protection of our legitimate interests is Art. 6 para. 1 lit. f DSGVO or EU-DSGVO. In the event that vital interests of the data subject or another natural person make it necessary to process personal data, Art. 6 (1) lit. of the DSGVO or EU-DSGVO serves as the legal basis.

Security measures
We take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk in accordance with Article 32 of the GDPR or EU GDPR, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons.

The measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical access to the data, as well as the access, input, transfer, assurance of availability and separation of the data. We also have procedures in place to ensure the exercise of data subjects' rights, deletion of data and response to data compromise. Furthermore, we already take the protection of personal data into account during the development and selection of hardware, software and procedures, in accordance with the principle of data protection through technology design and through data protection-friendly default settings (Art. 25 DSGVO and EU-DSGVO).

Cooperation with processors and third parties
If, in the course of our processing, we disclose data to other persons and companies (processors or third parties), transmit it to them or otherwise grant them access to the data, this will only be done on the basis of legal permission (e.g. if a transfer of the data to third parties, such as to payment service providers, is necessary for the performance of the contract pursuant to Art. 6 para. 1 lit. b DSGVO or EU-DSGVO), you have consented, a legal obligation provides for this or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).

If we commission third parties with the processing of data on the basis of a so-called "order processing agreement", this is done on the basis of Art. 28 DSGVO or EU-DSGVO. Transfers to third countriesIf we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or do so in the context of using third-party services or disclosing or transferring data to third parties, this only takes place if it is done to fulfil our (pre-)contractual obligations, on the basis of your consent, due to a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we only process or allow the data to be processed in a third country if the special requirements of Art. 44 ff. DSGVO or EU-DSGVO. This means that the processing is carried out, for example, on the basis of special guarantees, such as the officially recognised determination of a level of data protection corresponding to the EU, such as the Trans-Atlantic Data Privacy Framework, or in compliance with officially recognised special contractual obligations (so-called "standard contractual clauses").

Rights of the data subjects
You have the right to request confirmation as to whether data in question is being processed and to information about this data as well as further information and a copy of the data in accordance with Art. 15 DSGVO or EU-DSGVO. You have according to. You have the right to request that the data concerning you be completed or that the incorrect data concerning you be corrected in accordance with Art. 16 of the GDPR and the EU Data Protection Regulation.
In accordance with Art. 17 DSGVO or EU-DSGVO, you have the right to demand that the data in question be deleted without delay, or alternatively, in accordance with Art. 18 DSGVO or EU-DSGVO, to demand restriction of the processing of the data.
You have the right to request that the data relating to you that you have provided to us be received in accordance with Art. 20 DSGVO or EU-DSGVO and to request that it be transferred to other data controllers.
You also have the right to lodge a complaint with the competent supervisory authority pursuant to Art. 77 DSGVO or EU-DSGVO.

Right of withdrawal
You have the right to revoke consent granted in accordance with Art. 7 (3) DSGVO or EU-DSGVO with effect for the future.

Right of objection
You may object to the future processing of data relating to you in accordance with Art. 21 DSGVO or EU-DSGVO at any time. The objection can be made in particular against processing for direct marketing purposes.

Data deletion
In accordance with legal requirements in Germany and the laws applicable in the EU, storage takes place in particular for 10 years in accordance with §§ 147 Para. 1 AO, 257 Para. 1 No. 1 and 4, Para. 4 HGB (books, records, management reports, accounting vouchers, commercial books, documents relevant for taxation, etc.) and 6 years in accordance with § 257 Para. 1 No. 2 and 3, Para. 4 HGB (commercial letters).

Business related processing
Additionally we process:
- Contract data (e.g., subject matter of the contract, term, customer category).
- Payment data (e.g., bank details, payment history)
of our customers, prospective customers and business partners, for the purpose of providing contractual services, service and customer care, marketing, advertising and market research. Administration, financial accounting, office organisation, contact management.

We process data in the context of administrative tasks as well as organisation of our operations, financial accounting and compliance with legal obligations, such as archiving. In doing so, we process the same data that we process in the context of providing our contractual services. The processing bases are Art. 6 para. 1 lit. c. DSGVO or EU-DSGVO, Art. 6 para. 1 lit. f. DSGVO or EU-DSGVO. Customers, interested parties, business partners and website visitors are affected by the processing.

The purpose and our interest in the processing lies in the administration, financial accounting, office organisation, archiving of data, i.e. tasks that serve the maintenance of our business activities, performance of our tasks and provision of our services. The deletion of data with regard to contractual services and contractual communication corresponds to the information specified in these processing activities.

In this context, we disclose or transmit data to the tax authorities, consultants such as tax advisors or auditors as well as other fee offices and payment service providers. Furthermore, we store information on suppliers, organisers and other business partners on the basis of our business interests, e.g. for the purpose of contacting them at a later date. This data, most of which is company-related, is stored permanently.

Contact
When contacting us (e.g. by contact form, email, telephone or via social media), the user's details are processed for the purpose of handling the contact request and its processing pursuant to Art. 6 (1) lit. b) DSGVO or EU-DSGVO. The user's details may be stored in a customer relationship management system ("CRM system") or comparable enquiry organisation.
We delete the requests if they are no longer necessary. We review the necessity every two years; furthermore, the legal archiving obligations apply.

Hosting and e-mail dispatch
The hosting services used by us serve to provide the following services: Infrastructure and platform services, computing capacity, storage space and database services, e-mail dispatch, security services and technical maintenance services, which we use for the purpose of operating this online offer.

In doing so, we or our hosting provider process inventory data, contact data, content data, contract data, usage data, meta data and communication data of customers, interested parties and visitors of this online offer on the basis of our legitimate interests in an efficient and secure provision of this online offer pursuant to Art. 6 (1) lit. f DSGVO or EU-DSGVO in conjunction with Art. 28 DSGVO or EU-DSGVO. Art. 28 DSGVO or EU-DSGVO (conclusion of a contract processing agreement).

Collection of access data and log files
We, or our hosting provider Profihost, Expo Plaza 1, 30539 Hannover, Germany, collect data on every access to the server on which this service is located (so-called server log files) on the basis of our legitimate interests within the meaning of Art. 6 Para. 1 lit. f. DSGVO or EU-DSGVO, respectively, we collect data about every access to the server on which this service is located (so-called server log files). The access data includes the name of the website accessed, file, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page), IP address and the requesting provider.

Log file information is stored for security reasons (e.g. to clarify acts of abuse or fraud) for a maximum of 7 days and then deleted. Data whose further storage is required for evidentiary purposes is exempt from deletion until the respective incident has been finally clarified.

Newsletter dispatch
Our free newsletter informs you regularly by e-mail about new products and special offers. The data you enter here will only be used to personalise the newsletter and will not be passed on to third parties. You can unsubscribe from the newsletter or revoke your consent at any time by sending an e-mail to data.privacy@on-sup.com. Your data will be deleted within 2 weeks after you have stopped receiving the newsletter, provided that there are no legal obligations to retain the data. By sending the data you have entered, you consent to the data processing and confirm our data protection information.
We send our newsletters via the DSGVO-compliant provider CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany.

Cookie technology
We use the "Real Cookie Banner" consent tool to manage the cookies and similar technologies used (tracking pixels, web beacons, etc.) and related consents. Details on how "Real Cookie Banner" works can be found at devowl can be viewed.

The legal basis for the processing of personal data in this context is Art. 6 para. 1 lit. c DS-GVO and Art. 6 para. 1 lit. f DS-GVO. Our legitimate interest is the management of the cookies and similar technologies used and the related consents.

The provision of personal data is neither contractually required nor necessary for the conclusion of a contract. You are not obliged to provide the personal data. If you do not provide the personal data, we will not be able to manage your consents.

The website operator reserves the right to adapt the data protection information if necessary. The current version of our privacy policy is always available at https://on-sup.com/datenschutz.