DATA PROTECTION NOTICE (PRIVACY POLICY)

INTRODUCTION

Privacy is very important to leon Fulfillment. We also understand that privacy is very important to you. This Privacy Policy tells you how we protect and use information that we gather through leon websites.

This policy describes the types of information leon may collect from you or that you may provide when you visit https://heart-recovery.leon.de (the “Website”) or when you fill out a form and explains how we collect, use, maintain, protect, and, in some circumstances, disclose that information.

Certain information we collect is necessary to complete our contractual or legal obligations, others are required for us to operate the Website or to fulfil Leon´s legitimate interests as a Company. In some instances, the information we collect may be done only with your consent. Please read this policy carefully to understand Leon’s policies and practices regarding your information and how we will treat it.

The information we receive, and how we use it, depends on what you do when visiting our Website, how your browser is configured, and what information you provide to us. We collect and use your personal information differently than your non-personal information (information that is not identifiable to you personally).

1. Responsible person and data protection contact person

The Controller for this website is leon Fulfillment GmbH Bockholtstr. 96-98 41460 Neuss Germany Tel.: +49 2131 59532-0 Fax: +49 2131 53532-10 E-Mail: leon(at)leon.de

You can contact the contact person for data protection by e-mail at leon(at)leon.de

2. Joint Controllership

If we carry out processing operations under joint responsibility (Art. 26 GDPR), we will inform you at the appropriate points of this notice.

3. Data processed for the provision of the website and the creation of the log files

a. Which data are processed for which purpose?

Whenever the content of our website is accessed, our system (i.e. the web server) automatically records information from the system of the calling computer or terminal device of the user, which may allow identification. The following data is collected and temporarily stored:

• Date and time of access
• IP address of the user
• Host name (Internet server provider) of the accessing computer
• Website from which the website was accessed (so-called referrer URL)
• Websites accessed via the website
• Visited page on our website
• Message whether the retrieval was successful
• Amount of data transmitted
• Information about the browser type and version used
• Operating system of the user's terminal device

Temporary storage of data is necessary for the course of a website visit to enable delivery of the website. For this purpose, the user's IP address must necessarily remain stored for the duration of the session. Further storage in log files is carried out to ensure the functionality of the website and the security of the information technology systems (e.g. for attack detection). These purposes also constitute our legitimate interest in data processing.
An evaluation of the data for marketing purposes does not take place in this context.

b. What is the legal basis on which these data are processed?

The data is processed based on Art. 6 Para. 1 lit. f GDPR to safeguard our legitimate interests as the responsible website operator.

c. Are there other recipients of the personal data besides the person responsible?

Leon utilizes the services of Kai Erne Internet-Dienstleistungen, Buchenkampsweg 18a, 51427 Bergisch Gladbach, +49 162 – 1851930, info@erne.de to support us regarding Webshop management. We have subscribed a data processing agreement (DPA) in accordance with Art. 28 GDPR. The service provider receives the above data as a processor on behalf of Leon.

d. How long is the data stored?

The data will be deleted as soon as they are no longer necessary for the purpose for which they were collected. In the case of the provision of the website, this is the case when the respective session has ended.

The log files are stored up to a maximum of 7 (seven) days directly and exclusively accessible to administrators. After that, they are only available indirectly through the reconstruction of backup tapes and are deleted permanently after up to a maximum of 30 (thirty) days. A storage beyond that is possible, but in this case the IP address of the user will be deleted or alienated by us, so that an allocation of the calling client is no longer possible and the contained data no longer show any personal reference.

4. Contacting leon via e-mail

a. Which data are processed for which purpose?

You can contact us via the e-mail address we have provided. In this case, your personal data transmitted with the inquiry (data of the sender/user) will be stored. This data is used exclusively for processing your contact. The purpose of processing is thus to enable communication or to answer your enquiry.

b. What is the legal basis on which these data are processed?

The legal basis for the processing of this personal data, which you send us during your inquiry, is based on Art. 6 Para. 1 lit. b or f GDPR. Our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR is to communicate with you regarding your inquiry.
If your inquiry is aimed at the conclusion of a contract, Art. 6 Paragraph 1 lit. b GDPR is an additional legal basis for our data processing (fulfilment of a contract or measures to initiate a contract)

c. How long is the data stored?

The data will be deleted as soon as they are no longer necessary for the purpose for which they were collected. For personal data transmitted to us in the above-mentioned manner, this is the case when the respective conversation with the user has ended. The conversation ends when it is clear from the circumstances that the matter in question has been finally clarified. In the case contractual obligations or legal storage obligations, a deletion only comes into consideration after expiry of the respective storage obligation.

5. Registration area and login

We offer users of our Website the opportunity to place advertising material orders. To get a login into the Web shop, users have to register first. After legalizing, users get login data, which are necessary to enter the Shop.

a. Which data are processed for which purpose?

To register for the shop login, the user enters his personal data into an input mask, which is transmitted to and stored by our service provider Kai Erne Internetdienstleistungen (processor) to transmit the order to us. We have subscribed a data processing agreement (DPA) in accordance with Art. 28 GDPR. This data will not be passed on to third parties for other purposes. The following data is collected during the order process:

• personal data
  (first and last name, organisation, customer group, e-mail and delivery address )
• IP address

b. What is the legal basis on which these data are processed?

The legal basis for data processing in the context of ordering is Art. 6 Para. 1 letter b) GDPR, since this ordering is necessary for the shipment of the ordered items.

c. Are there other recipients of the personal data besides the person responsible?

Leon utilizes the services of Kai Erne Internet-Dienstleistungen, Buchenkampsweg 18a, 51427 Bergisch Gladbach, +49 162 – 1851930, info@erne.de to support us regarding Webshop management. We have subscribed a data processing agreement (DPA) in accordance with Art. 28 GDPR. The service provider receives the above data as a processor on behalf of Leon.

d. How long is the data stored?

The aforementioned data will be deleted as soon as they are no longer necessary for the purpose for which they were collected. This is the case for the data collected during the registration and login process for the fulfilment of leon.

6. Order process for advertising materials

We offer the users of our Website the opportunity to place advertising material orders.

a. Which data are processed for which purpose?

To place an order for advertising materials, the user enters his personal data into an input mask, which is transmitted to and stored by our service provider Kai Erne Internetdienstleistungen (processor) to transmit the order to us. We have subscribed a data processing agreement (DPA) in accordance with Art. 28 GDPR. This data will not be passed on to third parties for other purposes. The following data is collected during the order process:

1. personal data (invoice-, shipping and e-mail address)
2. IP address

b. What is the legal basis on which these data are processed?

The legal basis for data processing in the context of ordering is Art. 6 Para. 1 letter b) GDPR, since this ordering is necessary for the shipment of the ordered items.

c. Are there other recipients of the personal data besides the person responsible?

Leon utilizes the services of Kai Erne Internet-Dienstleistungen, Buchenkampsweg 18a, 51427 Bergisch Gladbach, +49 162 – 1851930, info@erne.de to support us regarding Webshop management. We have subscribed a data processing agreement (DPA) in accordance with Art. 28 GDPR. The service provider receives the above data as a processor on behalf of Leon.

d. How long is the data stored?

The aforementioned data will be deleted as soon as they are no longer necessary for the purpose for which they were collected. This is the case for the data collected during the ordering and shipping process for the fulfilment of leon.

7. Order process for business cards

We offer the users of our Website the opportunity to place orders for business cards.

a. Which data are processed for which purpose?

To place an order for business cards, the user enters his personal data into an input mask, which is transmitted to and stored by our service provider Kai Erne Internetdienstleistungen (processor) to transmit the order to us. We have subscribed a data processing agreement (DPA) in accordance with Art. 28 GDPR. This data will be passed on to third parties for the purpose of delivering produced business cards. This third parties will be: Desingkomplex, Ravelsberger Str. 10, 52146 Würseln, +49 2405 4258244, ralf.peters@designkomplex.de.

The following data is collected during the order process:

1. personal data (first name, name, address, phone and fax number, e-mail address, shipping address)
2. IP address

b. What is the legal basis on which these data are processed?

The legal basis for data processing in the context of ordering is Art. 6 Para. 1 letter b) GDPR, since this ordering is necessary for producing and shipping of the ordered business cards.

c. Are there other recipients of the personal data besides the person responsible?

Leon utilizes the services of Kai Erne Internet-Dienstleistungen, Buchenkampsweg 18a, 51427 Bergisch Gladbach, +49 162 – 1851930, info@erne.de to support us regarding Web shop management. We have subscribed a data processing agreement (DPA) in accordance with Art. 28 GDPR. The service provider receives the above data as a processor on behalf of Leon.

d. How long is the data stored?

The aforementioned data will be deleted as soon as they are no longer necessary for the purpose for which they were collected. This is the case for the data collected during the ordering and shipping process for the business cards.

8. Cookies for the provision of our website

a. General information on the use of cookies

In order to make visiting our website attractive and to enable the use of certain functions, to display suitable products or for market research, we use so-called cookies on various pages. Cookies are small text files that are automatically stored on your end device. Some of the cookies we use are deleted again after the end of the browser session, i.e. after closing your browser (so-called session cookies). Other cookies remain on your end device and enable us to recognize your browser the next time you visit us (persistent cookies). You can see the duration of storage in the cookie settings of your web browser. You can set your browser so that you are informed about the setting of cookies and decide individually whether to accept them or to exclude the acceptance of cookies for certain cases or in general. Each browser differs in the way it manages the cookie settings. This is described in the help menu of each browser, which explains how you can change your cookie settings. You can find these for each browser under the following links: (these are examples for the “German” browser setting links)

Internet Explorer™: http://windows.microsoft.com/de-DE/windows-vista/Block-or-allow-cookiesMicrosoft
Edge™: https://support.microsoft.com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies
Safari™: https://support.apple.com/de-de/guide/safari/sfri11471/mac
Chrome™: http://support.google.com/chrome/bin/answer.py?hl=de&hlrm=en&answer=95647
Firefox™ https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen Opera™ : https://blogs.opera.com/germany/2016/03/cookies-aktivieren-opera/

b. Which data are processed for which purpose?

Which data is processed by a cookie and for what purpose depends on the cookie in question. Details of this can be found under the respective IT services or tools in the further course of our data protection notice which use the respective cookie. You will also find detailed information in the data protection notices or cookie guidelines of the respective providers. As a rule, the following personal data may be affected:

1. IP address (usually anonymous)
2. the website accessed

c. On which legal basis do we use cookies?

The use of technically mandatory cookies, i.e. those without which our website would not function properly, is based on Art. 6 Para. 1 letter f) GDPR and serves to safeguard our legitimate interests, which predominate in the context of a balancing of interests, in a functional and optimized presentation of our offer as well as the security and stability of our website in accordance with Art. 6 Para. 1 sentence 1 letter f) GDPR.

Insofar as we wish to use cookies that are not absolutely necessary for the operation of this website and insofar as they are not justified by our legitimate interests in an optimized presentation of our offer and the security and stability of our website in accordance with Art. 6 Para. 1 S. 1 lit. f) GDPR, we require your prior consent, Art. 6 Para. 1 S. 1 lit. a GDPR.

We inform you about the existence of so called “technical necessary” cookies via a so-called cookie banner when you visit our site for the first time.

A list of the cookies used can be found below under the cookie reference table of this privacy policy. Example for Cookie Reference Table: What kind of cookies do we use? What are the cookies called? How long are the cookies active? What exactly do the cookies do? Where do we use the cookies? Session Cookies "PHPSESSID" "JSESSIONID" Browser Session End of session (60 min.) We use "session cookies" to improve our services for our visitors and to make surfing on our pages easier. Deleting or blocking these cookies does not affect the use of our site and its functions. Session cookies are used on all leon web sites. (First-Party-cookie) Session Cookies "CAKEPHP" Browser session (6 hours) The visit or session is stored as a session in a cookie.
Personal data is made anonymous. CakePHP is a framework for sub-applications based on PHP. (First-Party-cookie) Web Analysis utma utmb utmc utmz 2 years 30 Minutes Session 6 month These cookies are used by Google Analytics to analyze our website traffic and to measure the interaction of users with our website Google (Third Party Cookies).

d. Are there other recipients of the personal data besides the person responsible?

If third-party IT services or tools are used, the cookies used are usually stored and processed by the respective third party, whereby these third parties may in turn use service providers who support them in providing their services and who may also receive the data collected by the cookie in this context.

e. How long is the data stored?

The data processed by us will be deleted in accordance with the legal requirements as soon as they are no longer required for the purpose of their collection.
In this case, the processing will be limited to this purpose (contrary to deletion) in the form that the data will be blocked and not processed for other purposes.
Further information on the deletion of personal data can be found in the individual explanations in this data protection notice.

9. Used services for functionality improvement, statistics and web analysis

a. General information on the use of Google services:

This information applies to all web services that we use on our website, which are offered by Google:
If you are habitually resident in the European Economic Area or Switzerland, the services of Google Ireland Ltd. ("Google"), a company incorporated and organised under the laws of Ireland (registration number: 368047) with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland.
You can find a current excerpt of the terms of use, as well as explanations about data protection at Google under:
https://policies.google.com/privacy? https://policies.google.com/terms

Data Processing outside the European Union:

Since Google operates servers around the world, it cannot be ruled out that personal data will continue to be transferred to Google LLC, based in the USA. Google is certified under the EU-US Privacy Shield. A current certificate can be viewed at https://www.privacyshield.gov/list. The EU- US Privacy Shield (also EU-US Privacy Shield) is an informal agreement in the field of data protection law that was negotiated between the European Union and the United States of America from 2015 to 2016. It consists of a series of assurances by the US Federal Government and a decision by the EU Commission. On July 12, 2016, the Commission decided that the specifications of the data protection shield were in line with the level of data protection in the European Union; the agreement can be applied since then.

10. Plugins and embedded functions and content

On our website, we integrate functional and content elements that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These can be, for example, social media buttons and contributions or graphics or videos (hereinafter referred to uniformly as "content"). This serves to provide and optimize our online presence and to make it more user-friendly, and enables us to align our website and our offers as a whole with user behavior in relation to interests and to provide the user with a diverse and wide-ranging online experience.
In order for the third party provider of this content to be able to show the user the content we have integrated, it is technically necessary that the third party provider processes the IP address of the user of the integrated content, as this content must be sent to the user's browser via the user's IP address. The IP address is therefore required to display this content or function. As a rule, we only use such content whose respective providers use the IP address only to deliver the content. Third party providers may also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. The "pixel tags" are used to evaluate information such as user behavior on the individual web pages of this website. The pseudonymous information may also be placed in cookies on the user's device and may contain, among other things, technical information on the browser and operating system, the websites to be referred to, the time of visit and other details on the use of our website, as well as being linked to such information from other sources.
As far as possible, we integrate third-party plug-ins in a privacy-friendly way, so that you as a user of our website are first informed that when you select a certain embedded content, a connection is established to the server of the third-party provider who provides this content. Only when the user clicks on the embedded content again after this information is given, does the aforementioned connection take place, so that data exchange between the user's device and the server of the third-party provider only takes place at this point in time (so called 2-Click- Solution “Sharrif”). In this case you as the user give the necessary consent to the resulting data transfer as well as data collection and processing by the third party provider by your active action in the form of clicking the content again after the information has been provided. In this case, the legal basis for our forwarding of data to the third-party provider is Art. 6 para. 1 lit. a GDPR.
Insofar as a service provider does not enable such a data protection-friendly integration of its content, but wishes to start collecting and processing data before actively selecting the relevant content, we will of course first obtain the user's consent to this in accordance with Art. 6 Para. 1 lit. a GDPR when the user enters our website. If the user gives this consent, the relevant plugin or script is loaded. If consent is refused, no data processing will take place to the extent described above. In this case, however, the corresponding content is unfortunately not available.

a. Video Plugins

We integrate YouTube Videos on our website. This service is provided by Google ("Provider"). Please also note our general information on the use of Google services. For videos from YouTube

that are embedded on our site, the advanced privacy setting is activated. This means that no information about website visitors is collected and stored on YouTube unless they play the video. The integration of the videos serves to safeguard our predominantly legitimate interests in the optimal marketing of our offer in accordance with Art. 6 Para. 1 S. 1 lit. f GDPR.
When you play a video embedded on our site, YouTube will collect and store your data. Therefore, before playing the video, please inform yourself about the purpose and scope of the data collection there and the further processing and use of the data by Google as provider of the YouTube service as well as your rights and setting options for the protection of your privacy, which you can find out about in the data protection information from Google http://www.google.com/intl/de/+/policy/+1button.html.
Starting the playback of an embedded YouTube video is done by active action of the website visitor and is considered by us as consent (Art. 6 para. 1 lit. a GDPR) to the transfer of data to YouTube (Google).
When a YouTube video is played, the IP address and other login data of the website visitor are transmitted to YouTube and thus, in particular, information is transmitted about which of our websites the visitor has visited.
However, this information cannot be associated with the respective website visitor unless the visitor has logged in to YouTube or another Google service (e.g. Google+) before viewing the page or is permanently logged in.
When starting the playback of an embedded video by clicking on it, YouTube only stores cookies on the website visitor's device through the advanced privacy mode, which do not contain any personally identifiable information, unless the website visitor is currently logged on to a Google service. These cookies can be prevented by appropriate browser settings and extensions.

11. Data Processing outside the European Union/European Economic Area

If personal data is processed outside the European Union, you can see this at the relevant points of this notice.

12. Links to other websites

Our site contains links to other websites. We are not responsible for the data protection and also the content of these other internet offers and in particular we have no influence on them. We select the sites to which we link to the best of our knowledge and belief, check them to the extent that it is reasonable and remove links from our website if dubious or even illegal content is reported to us or becomes known to us in any other way. Should you notice any such content, please inform us so that we can react accordingly. We recommend that Internet users who leave our website inform themselves about the respective data protection notices of the other Internet offerings they visit.

13. Rights of data subjects

a. Right to information

In accordance with Art. 15 GDPR, you can request information about the personal data we process.

b. Right of appeal

You have a right of appeal on special grounds (see point II).

c. Right of rectification

If the information concerning you is not (or is no longer) correct, you can request a correction under Art. 16 GDPR. If your data is incomplete, you may request that it be completed.

d. Right of deletion

Under Art. 17 GDPR, you can request the deletion of your personal data.

e. Right to limit processing

According to Art. 18 GDPR, you have the right to request a restriction on the processing of your personal data.

f. Right of appeal

If you are of the opinion that the processing of your personal data violates data protection law, you have the right to complain to a data protection supervisory authority of your choice in accordance with Article 77 paragraph 1 of the GDPR, e.g. to the data protection authority responsible for your place of residence, your workplace or the location of the data protection violation.

g. Right to data portability

In the event that the requirements of Art. 20 Para. 1 GDPR are met, you have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to third parties. The collection of data for the provision of the website and the storage of log files are absolutely necessary for the operation of the website. They are therefore not based on consent pursuant to Art. 6 Para. 1 letter a GDPR or on a contract pursuant to Art. 6 Para. 1 letter b GDPR, but are justified pursuant to Art. 6 Para. 1 letter f GDPR. The requirements of Art. 20 para. 1 GDPR are therefore not fulfilled in this respect.

13. Right of objection under Article 21(1) of the GDPR

You have the right to object at any time, for reasons arising from your particular situation, to the processing of your personal data carried out by Leon pursuant to Article 6 para. 1 lit. f GDPR. The controller will then no longer process the personal data unless he can demonstrate compelling reasons for processing which are justified on grounds of protection and which outweigh the interests, rights and freedoms of the data subject, or unless the processing is for the purpose of asserting, exercising or defending legal claims. The collection of the data for the provision of the website and the storage of the log files are absolutely necessary for the operation of the website.

14. Amendment and update of the privacy policy

We reserve the right to update our data protection notice from time to time if changes in the data processing carried out by us make this necessary or if the legal framework or its interpretation and application practice, which form the basis of our data processing, change. We therefore ask you to inform yourself independently at regular intervals about the content of our data protection notice (Privacy Policy).
Stand: December 2021