Privacy Policy
Welcome to our website. We take the protection of your data very seriously. For this reason, we would like to let you know which data from your visit we will use and for which purposes. Should you have any questions on how we handle your personal data, please do not hesitate to contact our Data Protection Officer (contact details are provided at the end of this privacy policy).
I. Party responsible for data processing
The party responsible, as specified by the General Data Protection Regulation (GDPR), for using your data collected by this website is:
HIW Hamburg Invest Wirtschaftsförderungsgesellschaft mbH
Wexstraße 7
20355 Hamburg
II. General information on data processing
1. What are personal data?
The term ‘personal data’ is defined in the General Data Protection Regulation (hereinafter referred to as the “GDPR”). According to this definition, ‘personal data’ means any information relating to an identified or identifiable natural person. This includes details like your name, address, telephone number and date of birth. Information on how you use this website may also be categorised as personal data if it can be used to derive your identity.
2. Scope of processing of personal data
As a general rule, we process our users’ personal data only if this is required in order to be able to provide a functional website as well as our content and services. Our users’ personal data are regularly processed only after the users have expressed their consent or if processing is permitted by legal provisions.
3. Legal basis for processing personal data
Provided we acquire the consent of the data subject for processing their personal data, the legal basis is defined by Art. 6, para. 1, sent. 1, lit. a of the GDPR.
Art. 6, para. 1, sent. 1, lit. b of the GDPR forms the legal basis for the processing of personal data that is necessary for the performance of a contract to which the data subject is party. This also applies to processing operations that are necessary prior to entering into a contract.
Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, the legal basis is defined by Art. 6, para. 1, sent. 1, lit. c of the GDPR.
Art. 6, para. 1, sent. 1, lit. d of the GDPR forms the legal basis in the event that the processing of personal data is necessary in order to protect the vital interests of the data subject or of another natural person.
If processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, the legal basis is defined by Art. 6, para. 1, sent. 1, lit. f of the GDPR.
4. Data erasure and data storage
The data subject’s personal data shall be erased or blocked if the purpose for which they were stored no longer applies. The data may be stored beyond this time if this was stipulated by European or national legislators in Union regulations, laws or other provisions to which the controller is subject. The data shall also be blocked or erased if a retention period stipulated by the stated standards expires, unless it is necessary to continue storing the data for a contract conclusion or contract performance.
III. Provision of website and creation of log files
1. Description and scope of data processing
The following information is documented when accessing our website:
- Browser type/browser version
- Operating system
- Referrer URL (previously visited website), as well as the pages accessed on our website
- IP address
- Date and time of the server request
- Internet service provider
The data are also stored in our system’s log files. However, these data are not stored together with other personal data from the user.
2. Legal basis for data processing
The legal basis for storing the data and the log files is Art. 6, para. 1, sent. 1, lit. f of the GDPR.
3. Purpose of data processing
The system’s temporary storage of the IP address is necessary to enable the website to be delivered to the user’s computer. For this purpose, the user’s IP address must be stored for the duration of the session. The data are stored in log files to ensure that the website functions properly. In addition, the data help us to optimise the website and ensure the security of our information technology systems. The data are not evaluated in this context for marketing purposes. Our legitimate interest in data processing also lies in these purposes, in accordance with Art. 6, para. 1, sent. 1, lit. f of the GDPR.
4. Retention period
The data we store shall be erased as soon as they are no longer required for achieving the purpose of their collection. This is the case after no more than seven days. The data may also be stored beyond this period. In this case, the user’s IP address shall be erased or distorted so that the calling client can no longer be classified.
5. Possibility to object and opt out
Collecting the stated data is essential to be able to operate the website. For this reason, the user shall have no possibility to object.
IV. Registration
1. Description and scope of data processing
You can register on our website using the form provided. Compulsory personal data are marked as mandatory fields in the respective registration form. Any additional information provided by you is on a voluntary basis.
As part of the registration process, we use the ‘double opt-in’ procedure, i.e. your registration is not complete until you have confirmed your registration by clicking on the link included in a confirmation e-mail that is sent to you for this purpose. In the event that you do not confirm, your registration information will be automatically erased from our database. Once you have registered, you will receive your individual, password-protected log-in details, allowing you to view and manage the information you provided to us. Registration is voluntary but may be a prerequisite for using some of our services.
2. Legal basis for data processing
The legal basis for processing personal data is Art. 6, para. 1, sent. 1. lit. a, b of the GDPR. If you wish to delete any of the information provided by you on a voluntary basis, you can do so independently by accessing your user account.
3. Purpose of data processing
The collection, the subsequent processing and, where applicable, the sharing of your data is necessary for the performance of the contracts requested by you or in order to take steps prior to entering into a contract.
Furthermore, your registration may be required in order to be able to provide specific contents and services on our website.
4. Retention period
The data we store shall be erased as soon as they are no longer required for achieving the purpose of their collection.
This applies to any data collected during the registration process in the event that registration on our website is cancelled or modified.
This also applies to data collected during the registration process for the purpose of performing a contract or taking steps prior to entering into a contract if the data are no longer required for the performance of the contract. Following the conclusion of the contract, it may still be necessary to store personal data of the contractual partner in order to comply with contractual or legal obligations.
5. Possibility to object and opt out
You have the option to revoke registration at any time and/or to request a rectification of your data stored in our system.
You can find out how to delete your registration information from the party responsible as well as from our Data Protection Officer.
If the data are necessary for the performance of a contract or taking steps prior to entering into a contract, early erasure of data shall only be possible provided that there are no contractual or statutory obligations to retain such data.
V. Contact form and e-mail contact
1. Description and scope of data processing
Our website provides a contact form that can be used for contacting us electronically. If users make use of this option, the data they enter will be transferred to us and stored.
When you contact us by e-mail or via a contact form, the data you provide (your e-mail address, name and telephone number) will be stored by us in order to answer your questions and process your requests.
The moment the message is sent, the following data will also be stored:
a) The user’s IP address
b) The date and time of registration
Alternatively, contact is also possible via the e-mail address provided. In this case, the user’s personal data transmitted in the e-mail will be stored. If you provide us with details regarding your communication channels (such as your e-m address, telephone number), we will only use them to reply to your enquiries.
The data thus provided shall not be forwarded to third parties. The data will be solely used for the purpose of processing the conversation.
2. Legal basis for data processing
The legal basis for processing data that you transmit to us when making contact is Art. 6, para. 1, sent. 1 lit. f of the GDPR. Where our contact form requests information that is not necessary for making contact, we have always marked this as optional. This information serves to specify your enquiry and process your concern better. Providing such information is voluntary and requires your express consent, as per Art. 6, para. 1, sent. 1 lit. a of the GDPR.
If the aim of the e-mail contact is to conclude a contract, the additional legal basis for the processing is Art. 6, para. 1, sent. 1 lit. b of the GDPR.
3. Purpose of data processing
Processing the personal data entered into the input mask serves the sole purpose of handling the request. If contact is made by e-mail, the required legitimate interest shall also lie in processing the data.
Other personal data processed during the sending procedure serve to prevent a misuse of the contact form and ensure the security of our information technology systems.
4. Retention period
The data shall be erased as soon as they are no longer required for achieving the purpose of their collection. This is the case for personal data entered into the contact form’s input mask and data sent by e-mail when the respective conversation with the user has ended. The conversation is deemed to have ended when the circumstances show that the situation in question has been conclusively clarified.
The personal data additionally collected during the sending procedure shall be erased no later than after a period of seven days.
5. Possibility to object and opt out
Users can withdraw their consent to having their personal data processed at any time. If users contact us by e-mail, they can object to their personal data being stored at any time. In this case, the conversation cannot be continued.
All personal data stored during the contact process shall be erased in this case.