POOLgroup GmbH’s GDPR Privacy Policy

POOLGROUP GMBH’S GDPR PRIVACY POLICY

1. Data protection at a glance

General information

As the operator of this website, we have a legal requirement to inform you about the type of data we collect and use, as well as the amount of data we collect and why. Please feel free to contact us at any time should you have any further questions. Personal data is any information which can be used to identify you personally.

Who is responsible for the data collected by this website?

The operator of this website processes the data on this website. It is the data controller as per art. 4 para.7 of the EU General Data Protection Regulation (GDPR). Their contact details can be found in the legal notices for this website. The relevant link can be found at: https://www.pool.de/impressum/

How do we collect your personal data?

First of all, your personal data is collected when you provide it to us. This might be, for instance, data you enter into a contact form or send to us by email or other communication (such as first and last name, address, telephone number, mobile number, fax number and email address). Other data is automatically collected by our IT systems when visiting the website, for information purposes only. This is mainly technical data (such as internet browser, operating system or time the page was visited). This data is collected automatically once you enter our website.

How do we use your information?

If you contact us, your user details will be saved to process the request and in the event that any follow-up questions arise. Some data is collected to ensure that the website can be provided without any faults. Other data may be used to analyse your user behaviour. We process the personal data mentioned above in line with the provisions of the GDPR and the German Federal Data Protection Act (BDSG).

What rights do you have with regard to your data?

Under the GDPR, you have the following rights with regard to the processing of your personal data:

  • Right to information (article 15 GDPR),
  • Right to rectification (article 16 GDPR) or erasure (article 17 GDPR),
  • Right to restrict processing (article 18 GDPR),
  • Right to object to processing (article 21 GDPR),
  • Right to data portability (article 20 GDPR)

Please note that there are restrictions on the right to information and the right to erasure under §§ 34, 35 BDSG. You can contact us at any time at the address given in the legal notices should you have any further questions regarding data protection. You also have the right to make a complaint with the competent regulatory authority (see section 4.3 below).

2. General information about data protection 

The operator of this website takes the protection of your personal data very seriously. Please note that transferring data over the internet (such as when communicating by email) may not be fully secure. Data cannot be fully protected from third-party access. We will treat your personal data as confidential and in accordance with statutory data protection regulations and this data protection policy. When you visit our website, your browsing behaviour may be analysed for statistical purposes. This mainly involves the use of cookies and what are known as analysis programs. Your browsing behaviour is normally analysed anonymously; browsing behaviour cannot be traced back to you. You may object to this analysis or prevent it by not using certain tools. Details, including how to object, can be found under point 7 of this privacy policy.

3. Information as defined in article 13 para. 1 GDPR

Transparency is a key element in protecting personal data. This transparency applies to routine data processing as well as in the event of a potential data breach. Data subjects, and in certain cases such as a data protection breach, the competent regulatory authority for data protection, must be informed or may request information.

3.1 Note about the data controller 

The data controller responsible for processing data on this website is:

POOLgroup GmbH
Südring 26
48282 Emsdetten

Tel.: +49 (0) 2572-920 0
Fax: +49 (0) 2572-920 100
Email: info@pool.de

Directors with authority to represent the company: Carl Cordier & Jürgen Schürmann

Commercial court: Steinfurt district court, registered number HRB 4513. The data controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data (such as names, email addresses, etc.).

3.2 Note about the data protection officer for POOLgroup GmbH

The data protection officer appointed for this company is:

Udo Wolters
POOLgroup GmbH
Südring 26
D-48282 Emsdetten

Tel.: +49 (0) 2572-920 0
Email: datenschutz@pool.de

Types of data processed:

  • User data (such as names, addresses).
  • Contact details (such as email, phone numbers).
  • Content data (such as text input, photographs, videos, sound and image recordings).
  • Usage data (such as websites visited, interest in content, access times).
  • Metadata and communications data (such as device information, IP addresses).

Categories of data subjects
People who visit and use our website, as well as other interested parties, customers, suppliers and employees

Definitions used

“Personal data” means any information relating to an identified or identifiable natural person (“data subject” hereinafter); an identifiable natural person is one who may be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (such as a cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data with or without the aid of automated procedures. The term is very broad and covers practically any data handling.

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data.

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

3.3 Purposes for which personal data is processed:

3.3.1 Contracts (article 6 para.1 lit. b GDPR)

We collect, process and use personal data only to the extent necessary to establish, define the contents of or modify the legal relationship (user data). This takes place on the basis of article 6 para. 1 lit. b GDPR, which allows data to be processed for the performance of a contract or to take steps prior to entering into a contract.

We collect, process and use personal data about the use of our website (usage data) only to the extent necessary to enable the user to use the service or to invoice them.

The customer data collected will be deleted once the contract is complete or the business relationship has ended. Statutory retention periods notwithstanding.

We only transfer personal data to third parties where this is necessary for the performance of a contract. The data will not be passed on, or only if you have specifically consented to it being passed on. Your data will not be shared with third parties, such as for advertising purposes, without your specific consent.

3.3.2 Legitimate interests (article 6 para. 1 lit. f GDPR)

Where necessary, we process your personal data beyond the actual performance of the contract for the purpose of safeguarding our own legitimate interests or those of third parties (such as making legal claims; market and opinion research – unless you have objected to your data being used; risk control in business; safeguarding IT security and IT operations).

3.3.3 Legal obligations, public interest (article 6 para.1 lit. c and e GDPR)

Additional processing purposes include meeting tax inspection and reporting requirements as well as the assessment and management of operational risks. This is because we are subject to legal requirements (such as tax laws).

3.4 Recipients of the personal data

The recipients are employees, senior management and contractual partners of POOLgroup GmbH. Other recipients include public and non-public bodies to which the data must be made available due to a legal or contractual requirement.

Personal data is only transferred to countries outside the EU or the EEA (what are known as third countries) to the extent necessary to meet contractual and legal obligations or in the course of order data processing. If service providers in third countries are used, in addition to written instructions they are required to match the data protection level in Europe by agreeing to the EU standard contractual clauses.

3.5 Legal basis for collecting, storing and processing data

Where we obtain the consent of the data subject for the processing of personal data, article 6 paragraph 1 lit.a of the GDPR serves as the legal basis.

In other cases, refer to the information in section 3.3.

4. Information as defined in article 13 para. 2 GDPR)

4.1 Retention times

Where no explicit storage period is specified when collecting personal data (e.g. based on consent), we process and store personal data relating to the data subject only for as long as is necessary to achieve the storage purpose. Data is only stored beyond this time scale where statutory retention periods apply, i.e. where this is required by the European or national legislature in Union regulations, legislation or other requirements with which the data controller must comply.

4.2 Rights of the data subjects

Under the applicable statutory provisions, you have the rights mentioned in section 1.5 above at all times. For details about these rights, please refer in particular to articles 15 to 18 and articles 20 to 21 of the GDPR. The full text of the regulation can be found at the following link: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN

4.3 Right to complain

In the event of breaches of data protection legislation, the data subject has the right to lodge a complaint with the competent data protection regulatory authority, whose details are as follows:

Federal Office for Data Protection and Freedom of Information North Rhine-Westphalia
PO Box 20 04 44
40102 Düsseldorf

or:

Kavalleriestraße 2-4
40213 Düsseldorf
Tel.: 02 11/384 24-0
Fax: 02 11/384 24-10
Email: poststelle@ldi.nrw.de
Homepage: https://www.ldi.nrw.de

4.4 Objecting to or withdrawing consent for the processing of your data

4.4.1 Withdrawing consent

Many data processing procedures are only possible with your explicit consent. You may withdraw consent you have given previously at any time. Sending a brief message by email to: datenschutz@pool.de is sufficient for this purpose. The legality of data processing that has taken place before this withdrawal is not affected by the withdrawal.

4.4.2 Balancing of interest

Where processing your personal data is based on a weighted balancing of interests, you may object to the processing. This would apply, in particular, if the processing is not necessary for performing a contract with you, which we describe in the following description of the functions. When exercising your right to object, please explain the reasons why we should not process your personal data as we have been doing. Once you explain the reasons for your objection, we will review the situation and either cease or modify processing, or else reply to you giving our legitimate overriding reasons on the basis of which we will continue processing. Your objection should be directed to our data protection officer (see section 3.3 above).

4.4.3 Automated procedures (profiling)

Where personal data relating to you is processed for the purposes of direct marketing, you have the right to object at any time to personal data relating to you being processed for the purpose of such marketing; this similarly applies to profiling where it is associated with such direct marketing. If you object to processing for direct marketing purposes, personal data relating to you will no longer be processed for those purposes. In relation to the use of information society services, you have the option to exercise your right to object by means of automated procedures that use technical specifications. Your objection should be directed to our data protection officer (see section 3.3 above).

5. Encryption

This site uses SSL encryption on security grounds, and to ensure the secure transfer of confidential content, such as orders or enquiries which you send to us as the site operator. You can recognise an encrypted connection by the fact that the address bar in the browser changes from “http://” to “https://” and a padlock symbol appears in the browser bar. If SSL encryption is activated, the data you transfer to us cannot also be read by third parties.

Security measures

We put suitable technical and organisational measures in place to ensure a level of protection appropriate to the risk, in accordance with art. 32 GDPR, taking into account the state of the art, the cost of implementation and the type, scope, circumstances and purposes of processing, as well as the varying probabilities of occurrence and severity of risk to the rights and freedoms of natural persons.

Measures include, in particular, securing the confidentiality, integrity and availability of data by controlling physical access to the data, as well as controlling posting, input, transfer, making available and segregation, as appropriate. We have also set up procedures to ensure the exercise of data subject rights, deletion of data and response to data vulnerability. We do also in fact consider the protection of personal data during the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design and by default (art. 25 GDPR).

6. Objection by the operator of this website to marketing emails

We hereby object to the contact details published as part of the legal notices being used for sending unsolicited marketing and information material. The operators of this website specifically reserve the right to take legal action should unsolicited marketing information, such as spam emails, be received.

7. Data collection on our website

7.1 Cookies

This website uses cookies. We use cookies to personalize content and ads, to provide social media features and to analyze traffic to our website. We also share information about your use of our website with our social media, advertising and analytics partners. Our partners may combine this information with other data that you have provided to them or that they have collected as part of your use of the services.

Cookies are small text files used by websites to make the user experience more efficient.

By law, we can store cookies on your device if they are strictly necessary for the operation of this site. For all other types of cookies, we need your permission.

This site uses different types of cookies. Some cookies are placed by third parties that appear on our pages.

You can change or withdraw your consent at any time from the cookie statement on our website.

Find out more about who we are, how you can contact us and how we process personal data in our privacy policy.

Your consent applies to the following domains: www.pool.de

Your current state: Allow all.

Your consent ID: CwBprLsQLJiGoMv7FxuUeFcwlU/lqNsdCoUkLqNlAl57oydV3KJclA==Consent date: Friday, November 24, 2023 at 10:49:43 CET

The cookie statement was last updated on 14.05.24 by Cookiebot

7.2 Server log files

The website provider automatically collects and stores information in what are known as server log files, which your browser sends to us automatically. These are:

  • Browser type and version
  • Operating system being used
  • Referrer URL
  • Host name of the accessing computer
  • Time of server request
  • IP address

This data will not be merged with other data sources.

The legal basis for data processing is art. 6 para. 1 lit. b GDPR, which allows data to be processed for the performance of a contract or to take steps prior to entering into a contract.

7.3 Contact form

POOLgroup GmbH uses a contact form on our website to give users of this website the opportunity to contact the operator of this website, POOLgroup GmbH, directly. The mandatory information marked in the form is required and is collected in order to be able to use the contact form. Fields that are not marked can be filled in.

If you contact us as the website operator using the contact options provided, your details will be stored so that they can be used to process and respond to your request.

The use of our contact form is voluntary, but we cannot provide the service without the provision of your personal data. We process the data provided exclusively for the purpose of responding to your request.

The use of our contact form is voluntary, but we cannot provide the service without the provision of your personal data. We process the data provided exclusively for the purpose of responding to your inquiry.

The use of the contact form and the input of your data are based on the legal basis of Art. Art. 6 para. 1 lit. a of the GDPR. The consent you have given can be revoked at any time, for this we require a corresponding written message to datenschutz@pool.de

Your personal data will not be passed on to third parties or transferred to a third country or an international organization, unless a legal or contractual obligation requires the transfer of your data or you give us your consent to do so.

Once your data has been collected by POOLgroup GmbH, it will be stored for as long as is necessary to fulfill the purpose for which it was collected. As a rule, this means that we delete or anonymize your personal data until the request has been completed. Existing statutory or contractual retention obligations and periods are observed.

8. Google Analytics

This website uses functions of the web analysis service Google Analytics. The provider is Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics uses so-called “cookies”. These are text files that are stored on your computer and enable your use of the website to be analyzed. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. Google Analytics cookies are stored on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in the analysis of user behavior in order to optimize both its website and its advertising. Google transmits the data to third parties only within the framework of legal regulations or within the framework of commissioned data processing. Google will not combine the data collected with other data collected by Google.

We use Google Analytics with the extension “anonymizeIp()”. This means that your IP address is shortened by Google within EU member states or in other EEA contracting states before being transmitted to the USA. Only in exceptional cases will the complete IP address be transmitted to Google servers in the USA and shortened there. Google Inc. will use this information on our behalf for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage.

You can prevent the collection of your data by Google Analytics at any time by clicking on the opt-out link provided. This sets an opt-out cookie that prevents the collection of your data on future visits to this website.

“Prohibit Google Analytics from tracking me”

In addition, you can prevent Google from collecting the data generated by the cookie and relating to your use of the website and the processing of this data by Google Inc by downloading and installing the browser plugin available at the following link:

http://tools.google.com/dlpage/gaoptout?hl=de

You can find more information on how Google Analytics handles user data in Google’s privacy policy:

https://support.google.com/analytics/answer/6004245?hl=de

 9. Notes on social networks

Our website uses direct links to social networks.

facebook.com             Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA

LinkedIn.com              LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Irland

Instagram.com           Instagram LLC Vertreten durch Kevin Systrom und Mike Krieger,
1601 Willow Rd Menlo Park CA 94025 USA

xing.com                      XING AG, Gänsemarkt 43, 20354 Hamburg, Deutschland, “Xing”

The direct links are marked with the respective logo of the social network. Usually, these direct links immediately establish a direct connection to the servers of the social networks as soon as you activate the respective logo. When visitors to our website activate the direct links, the social networks receive the information that you have accessed the corresponding page of our website. If you are logged in to the relevant social network, the social network can assign the visit to your profile account. If you interact with the direct links, the corresponding information is transmitted directly from your browser to the social network and stored there.

For the purpose and scope of the data collection and the further processing and use of the data by the social network, as well as your rights in this regard and settings to protect your privacy, please refer to the data protection information of the social networks:

Data protection information Facebook

https://de-de.facebook.com/privacy/explanation

Data protection information LinkedIn

https://www.linkedin.com/legal/privacy-policy?trk=hb_ft_priv

Data protection information Instagram:

https://help.instagram.com/519522125107875?helpref=page_content

Data protection information Xing

https://privacy.xing.com/de/datenschutzerklaerung

Youtube

On our website we use plugins from the online video service YouTube from the operator YouTube,LLC, 901 Cherry Ave, San Bruno, CA 94066, USA. If a website on which this plugin is installed is accessed and loaded in the browser, a data connection is automatically established with the servers of Youtube.com. An identifier in the website code tells YouTube which website you have just loaded, which video you have watched, how long you have watched the video and stores your comments, likes and dislikes. If you are already registered and logged in with your YouTube account when you load our website with YouTube code in the background, this information will be assigned to your YouTube profile and can then be viewed in your YouTube history. The data is also used for analysis, statistics and to create video recommendations, among other things. If you do not want this, please log out of your YouTube profile before loading a website with YouTube code. You can find more information here: https://www.google.de/intl/de/policies/privacy

Vimeo

On our website we use plugins from the online video service Vimeo, operated by Vimeo, Inc, 555 West 18th Street, New York, New York 10011, USA. If a website on which this plugin is installed is accessed and loaded in the browser, a data connection is automatically established with the Vimeo.com servers. An identifier in the website code tells Vimeo which website you have just loaded, which video you have watched, how long you have watched the video and saves your comments, likes and dislikes. If you are logged in with your Vimeo login when you load our website, this information is assigned to your Vimeo profile and can then be viewed in the Vimeo history. The data is also used for analysis, statistics and to create video recommendations. If you do not want this, please log out of your YouTube profile before loading a website with YouTube code. You can find more information here:  https://vimeo.com/privacy

Leadinfo
We use the lead generation service of Leadinfo B.V., Rotterdam, Netherlands. This recognizes visits from companies to our website based on IP addresses and shows us publicly available information, such as company names or addresses. In addition, Leadinfo sets two first-party cookies to evaluate user behavior on our website and processes domains from form entries (e.g. “leadinfo.com”) in order to correlate IP addresses with companies and improve the services. Further information can be found at www.leadinfo.com. On this page: www.leadinfo.com/en/opt-out you have an opt-out option. If you opt out, your data will no longer be collected by Leadinfo.

10. Google AdWords und Google Conversion-Tracking

This website uses Google AdWords. AdWords is an online advertising program of Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States (“Google”). As part of Google AdWords, we use what is known as conversion tracking. When you click on an ad placed by Google, a cookie is set for conversion tracking. Cookies are small text files that the Internet browser stores on the user’s computer. These cookies lose their validity after 30 days and are not used to personally identify the user. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognize that the user clicked on the ad and was redirected to this page. Each Google AdWords customer receives a different cookie. The cookies cannot be tracked via the websites of Ad Words customers. The information collected using the conversion cookie is used to generate conversion statistics for AdWords customers who have opted for conversion tracking.

Customers learn the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, they do not receive any information with which users can be personally identified. If you do not wish to participate in tracking, you can object to this use by easily deactivating the Google Conversion Tracking cookie via your Internet browser under user settings. You will then not be included in the conversion tracking statistics.

“Conversion cookies” are stored on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in the analysis of user behavior in order to optimize both its website and its advertising.

You can find more information about Google AdWords and Google Conversion Tracking in Google’s privacy policy:

https://www.google.de/policies/privacy

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be restricted.

Deactivate: Block cookies from the domain “googleadservices.com”

11. Electronic mail (e-mail)

If you send us an e-mail, it will be stored by us until your request has been dealt with or until any statutory retention obligations have expired. We ensure that the data is stored securely to prevent unauthorized access by third parties. Please note, however, that unencrypted e-mails sent via the Internet are not adequately protected against unauthorized access by third parties.

Information that you send to us unencrypted by electronic mail (e-mail) may be read by third parties during transmission. As a rule, we are also unable to verify your identity and do not know who is behind an e-mail address. Legally secure communication by simple e-mail is therefore not guaranteed. Like many e-mail providers, we use filters against unwanted advertising (“SPAM filters”), which in rare cases automatically classify normal e-mails as unwanted advertising and delete them. E-mails containing harmful programs (“viruses”) are automatically deleted by us in all cases.

If you wish to send us messages worthy of protection, we recommend that you encrypt and sign them to prevent unauthorized access and falsification during transmission or send the message to us by conventional post.

You can send PGP-encrypted e-mails to us to the following e-mail address: pgp@pool.de
You can import the required PGP communication key (public key) with the appropriate software and then use it. Information on the free downloadable encryption software “GpG4Win”, which was developed on behalf of the Federal Office for Information Security, can be found on their website at
https://www.bsi.bund.de/DE/Themen/Cyber-Sicherheit/Tools/Gpg4Win/gpg4win_node.html

Please also let us know whether and how we can send you encrypted e-mails to reply to your correspondence and, if this is not possible, whether you agree to an unencrypted e-mail reply to your letter. If you do not have the option of receiving encrypted e-mails, please provide us with your postal address so that we can reply to your more sensitive messages.

11.1. Hosting 

The hosting services we use serve to provide the following services: Infrastructure and platform services, computing capacity, storage space and database services, e-mail dispatch, security services and technical maintenance services that we use for the purpose of operating this online offering. In doing so, we or our hosting provider process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers, interested parties and visitors to this online offer on the basis of our legitimate interests in an efficient and secure provision of this online offer in accordance with Art. 6 para. 1 lit. f GDPR in conjunction with Art. 28 GDPR. Art. 28 GDPR.

11.2. Deletion of data

The data processed by us will be deleted or its processing restricted in accordance with Art. 17 and 18 GDPR. Unless expressly stated in this privacy policy, the data stored by us will be deleted as soon as it is no longer required for its intended purpose and the deletion does not conflict with any statutory retention obligations. If the data is not deleted because it is required for other and legally permissible purposes, its processing will be restricted. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.

According to legal requirements in Germany, data is stored in particular for 10 years in accordance with §§ 147 para. 1 AO, 257 para. 1 no. 1 and 4, para. 4 HGB (books, records, management reports, accounting vouchers, commercial books, documents relevant for taxation, etc.) and 6 years in accordance with § 257 para. 1 no. 2 and 3, para. 4 HGB (commercial letters).

11.3. Administration, financial accounting, office organization, contact management

We process data in the context of administrative tasks and the organization of our business, financial accounting and compliance with legal obligations, such as archiving. In doing so, we process the same data that we process as part of the provision of our contractual services. The processing bases are Art. 6 para. 1 lit. c. GDPR, Art. 6 para. 1 lit. f. GDPR. Customers, interested parties, business partners and website visitors are affected by the processing. The purpose and our interest in the processing lies in the administration, financial accounting, office organization, archiving of data, i.e. tasks that serve to maintain our business activities, perform our tasks and provide our services. The deletion of data with regard to contractual services and contractual communication corresponds to the information specified in these processing activities. We disclose or transmit data to the tax authorities, consultants such as tax advisors or auditors as well as other fee offices and payment service providers. We also store information on suppliers, event organizers and other business partners on the basis of our business interests, e.g. for the purpose of contacting them at a later date. We generally store this mainly company-related data permanently.

11.4. Anti spam check

Our online offer regarding e-mailing and contact form uses services:

Exchange Spamfilter (Microsoft)

Trend Micro Spamfilter (Trend Micro)

Firewall spam filter (Palo Alto)

The use is based on our legitimate interests within the meaning of Art. 6 para. 1 lit. f) GDPR. This service is used to distinguish access and messages from genuine people from spam. For this purpose, all information is analyzed by preset spam rules. If a post is classified as spam, it is stored in the spam folder and either deleted immediately or further analyzed and forwarded to the specified destination after verification. The data to be checked includes the name entered, the email address, the IP address, the comment content, the reference, details of the browser used and the computer system and the time of the entry. You can completely prevent the transfer of data by not using our system.

12. Data transmission

12.1. Transfer to third countries

The controller may transfer personal data to a third country. Personal data is only transferred to countries outside the EU or the EEA (so-called third countries) to the extent that this is necessary to fulfill contractual and legal obligations or is required as part of commissioned data processing.

In principle, the controller can use various suitable guarantees to ensure that an appropriate level of protection is established for the processing. It is possible to transfer data on the basis of an adequacy decision, internal data protection regulations, approved codes of conduct, standard data protection clauses or an approved certification mechanism pursuant to Art. 46 para. 2 lit. a) – f) GDPR.

If the controller carries out a transfer to a third country on the legal basis of Art. 49 para. 1 a) GDPR, you will be informed here about the possible risks of data transfer to a third country.

There is a risk that the third country receiving your personal data may not have an equivalent level of protection compared to the protection of personal data in the European Union. This may be the case, for example, if the EU Commission has not issued an adequacy decision for the respective third country or if certain agreements between the European Union and the respective third country are declared invalid. Specifically, there are risks in some third countries with regard to the effective protection of EU fundamental rights through the use of surveillance laws (e.g. USA). In such a case, it is the responsibility of the controller and the recipient to assess whether the rights of the data subjects in the third country enjoy an equivalent level of protection as in the Union and can also be effectively enforced.

12.2. Transmission to the USA

Due to the ECJ (judgment of 16.07.2020, ref.: C-311/18 (“Schrems II”)), there is no adequate level of data protection in the USA and the USA is not a safe third country within the meaning of EU data protection law. Government surveillance measures may be carried out in the USA and it cannot be ruled out that US authorities (e.g. secret services) may process your data stored on US servers for surveillance purposes. There is no adequate legal protection against these measures and we have no influence on these processing activities.

13. Final provision

In order to do justice to the constant development of the Internet, POOLgroup GmbH may adapt this data protection declaration at any time in compliance with the current data protection regulations.

POOLgroup GmbH in May 2024