Privacy Notices acc. to Artt.
13, 14 General Data Protection Regulation (GDPR) for the Volume Graphics
Virtual Event Platform
This Privacy Notice is addressed
to users of the 3D online platform of Volume Graphics GmbH, Speyerer Str. 4-6, 69115 Heidelberg,
Germany (hereinafter "Volume Graphics", "we", "us"). In this Privacy
Notice, we provide information about the processing of personal data in
connection with the use of the Volume Graphics Virtual Event Platform. Please
refer to our general data protection information, which is available on our
website at: https://www.volumegraphics.com/de/f/r/datenschutz.html, for
information on the processing of personal data by us in general. For special
cases of data processing, special data protection notices apply, to which
reference is made separately in each case.
1.
Name
and Contact Details of the Controller
Controller acc. to Art. 4 (7) GDPR is
Volume Graphics GmbH. You can contact us at:
Volume
Graphics GmbH
Speyerer Str. 4 –
6
69115 Heidelberg
Germany
Phone: +49 6221 73920 60
Fax: +49 6221 73920 88
E-mail: info@volumegraphics.com
Managing directors
having power of representation:
Christof Reinhart, Christoph
Poliwoda, Thomas Günther
2. Contact Details
of the Data Protection Officer
You can contact our Data Protection Officer
at:
Volume
Graphics GmbH
Data Protection Officer
Speyerer Str. 4 – 6
69115 Heidelberg
Germany
E-mail: privacyofficer@volumegraphics.com
3.
Processing
Purpose, Legal Basis and Retention Period
We process the data of users of the 3D Online
Platform. Users are participants in Virtual Events of Volume Graphics, actors
of the Virtual Events such as exhibitors, speakers and sponsors, as well as
visitors of our Virtual Showroom outside the event periods.
We collect personal data during online
registration on our online platform, during registration for
admission-restricted events, when users create their profiles within their user
accounts, and in some cases automatically using various technologies.
After registration, the user receives access to
a virtual online platform via a personalized user account ("User
Account").
From time to time, Volume Graphics organizes virtual
events on the platform at which products and services of Volume Graphics and,
if applicable, various exhibitors are demonstrated and advertised and contact
can be established with employees of Volume Graphics - in particular the sales
staff - and, as the case may be, exhibitors, sponsors and speakers (individually
referred to as "Actor" and collectively as "Actors")
and other participants.
During the events, presentations and lectures
can be followed live or their recording can be viewed afterwards ("Participation").
Furthermore, users can create their own profile to represent themselves and
their company appropriately ("User Profile"). Some events
offer the possibility to get in touch with other participants and/or the actors
of the event ("Networking and Communication").
a) User Account
Use of the online platform requires registration
under a personalized user account. For the creation and maintenance of the user
account, Volume Graphics collects the title, full name and e-mail address of
the user. The user account enables the user to access the events and the
showroom of Volume Graphics and to use the platform services.
The legal basis for the processing is Art. 6 (1) 1 lit.b GDPR.
b) User Profile
Upon registration, each user receives a simple
user profile using salutation and full name. The data is processed for the
purpose of providing the platform services. Salutation and name are visible to other users.
The legal basis for the processing is insofar Art. 6 (1) 1 lit.b GDPR.
In addition, the user can create a detailed user
profile on a purely voluntary basis and upload a profile photo, i.e. create a
so-called virtual business card.
When creating the detailed user profile, Volume
Graphics collects, in addition to salutation and name, as the case may be, in
particular title, position and name of the company/organization, contact
details, address, status (exhibitor, visitor, trade visitor, media
representative), profile photo, professional interests and preferences, contact
details of the user via social media accounts such as Xing and LinkedIn, and
calendar ID.
If a user has filled in the business card with further information, this
data is processed and used within the framework of the services offered. Thus,
in the context of communication with participants and actors, further
information is displayed in addition to the name in order to make the user's
online presence more appealing, e.g. company affiliation and communication
data.
In addition, the user may, for example
>
pass the business card
to other participants, the actors or their delegated employees and/or Volume
Graphics and its employees and ask them to contact him; and/or
>
if desired, release the business card for networking by checking the
box.
The legal basis for the creation of the business card is in this respect
Art. 6 (1) 1 lit.a GDPR.
The user can retract the consent at any time with
effect for the future by updating the details of the business cards and
removing those voluntarily provided data with whose processing it no longer
agrees. The lawfulness of the processing activity carried out until the retraction
remains unaffected.
If an exhibitor creates an exhibitor profile,
Volume Graphics regularly collects and processes the following data: Exhibitor
name and category, address, stored URL, exhibitor description, business area,
products, as well as business cards of the delegated employees and contact
persons.
The legal basis for the processing is insofar Art. 6 (1) 1 lit.b GDPR. The
data will be processed for the purpose of fulfilling the exhibitor agreement
concluded with the exhibitor.
Volume Graphics processes the collected data
within the scope of the event-related services (see below: Networking and
Communication).
c) Networking und Kommunikation
When using the event-related services such as
networking and communication, for example via the avatars, via chats or via
1-to-1 video calls, Volume Graphics collects and processes the following data:
Full
name, content, timestamp and history of the chat as well as date and time of
agreed appointments, name of the conversation partner, type of appointment,
notes on appointment entries, availability and the calendar ID.
If the user has
entered additional information in his user profile, the status/role and name of
the company/organization of the participants in the conversation or chat.
Networking und Matchmaking
While registration on the platform and the
creation of the business card initially enables active contact to be made with
other users, in particular with Volume Graphics staff and the exhibitors' stand
personnel, networking offers users the opportunity to enter their contact data
in the networking area and to release the data for contact to be made by other user—in particular also by the players and Volume
Graphics.
Networking also includes so-called matchmaking.
If the user has specified certain preferences in its user profile, other users
can search for contacts of interest to them on the basis of these preferences
and filter the business cards released for networking.
The online events are intended for the exchange,
contacting and networking of people in the field of measurement services and
non-destructive technology as well as for the discourse of the possible
applications of Volume Graphics software products and the promotion of Volume
Graphics' and the approved exhibitors' products and services.
By releasing the business card for networking by
checking the appropriate box, the user therefore agrees to be contacted for the
aforementioned purposes by participants, actors and Volume Graphics.
The legal basis for the processing in this
respect is Art. 6 (1) 1 lit.a GDPR. The user can retract the consent at any
time with effect for the future by removing the checkmark regarding
participation in networking in its user profile. The
lawfulness of the processing activity carried out until the retraction remains
unaffected.
Important note: If the user has activated networking once, this
setting also remains active for future online events until deactivated. If a
user does not participate in a later event, other users can still contact it.
However, Volume Graphics is not obliged to store the contact requests. These
are regularly deleted from the history after the end of an event.
Passing the Virtual Business Card
If a user wishes to be contacted by others, it
can pass its virtual business card to them. In this respect, a short note
stating the purpose for which contact is requested is advantageous for the
addressee.
The addressee is not obliged to respond to the
contact. We therefore ask for your understanding if a contact request remains
unconsidered.
Contacting the Sales Personnel
The User may establish contact with Volume
Graphics sales personnel during Online Event in several ways.
It can:
>
contact avatars at
Volume Graphics booths directly through their respective available channels;
>
pass its business card
to Volume Graphics personnel and request to be contacted by Volume Graphics;
and/or
>
share its business
card for networking purposes.
The legal basis for processing the data varies
depending on the case. In constellations one and two, the legal basis for the
data processing is regularly Art. 6 (1) 1 lit.b GDPR, since the contact is
primarily due to the interest in the products and services of Volume Graphics
and can therefore be assigned to the pre-contractual area. In constellation
three, the legal basis is Art. 6 (1) 1 lit.a GDPR (see in detail: Networking
and Matchmaking).
d) Statistics and Cookies
Participation
Statistics
During and after a visit to the online platform,
statistical data is transmitted to Volume Graphics. If the user participates in
an event, Volume Graphics receives information about the user's interactions on
the platform. The information is collected via so-called cookies (see below in
detail Cookies).
We process this data based on our legitimate
interest in measuring and monitoring the success of the events, improving the
online presence and aligning the events and event-related offers with the
habits and preferences of the participants.
The legal basis for the preparation and
evaluation of the statistics is Art. 6 (1) 1 lit.f GDPR.
Usability
In
addition to the analysis cookies, we use other cookies to make the website
experience and the visit to the platform as pleasant as possible. Therefore,
based on our legitimate interests, we use mandatory cookies to maintain the
functionality of the platform, as well as functional cookies to improve the
user experience of the online platform, e.g. by storing the language settings
(for the more details see cookies and cookie-settings below).
The legal
basis for the collection and storage of this data is Art. 6 (1) 1 lit.f GDPR.
Cookies and Cookie-Settings
Via the cookies Volume Graphics collects and
processes in particular the following data:
Abbreviated IP address (i.e. anonymized IP
address), rooms visited, sessions and interactions carried out within the
virtual rooms as well as date, time and duration of participation.
Tabular overview of the cookies
In detail, we use the following cookies on the
virtual platform:
|
Name |
Own/ Third Party |
Stored Data |
Purpose |
Function |
Cookie Type |
Storage Period |
|
XSRF-Token |
Own |
csrf |
Security
- Verification of the transmission |
|
Essential or technically
required |
2h |
|
Expo_x_session |
Own |
Session
(language-, profile- und role setting) |
Security – Settings |
|
Functional |
2h |
|
_pk_id.6.4 964 |
Own (Matomo /Piwik—selfhosted) |
User ID |
Analysis—visitor statistics |
Enables recognition
of visitors returning to our platform page after their first visit. |
Statistics |
1 year |
|
_pk_ses.6.4 964 |
Own (Matomo /Piwik—selfhosted) |
Session |
Analysis—visitor statistics |
During
its validity period the cookie serves to identify a visitor, so that despite
their accessing the web page multiple times during this period their web page
visit can be evaluated as an individual visit. |
Statistics |
1 hour |
|
piwik_ignore |
|
|
|
Stores the
decision to no longer be tracked by Matomo in future. |
technically required |
1 year |
Cookie-Settings
The user can manage the setting of cookies in
the cookie settings. Because of the privacy-friendly default setting, we initially
only set permissible cookies for which we do not require consent. The user can
agree to advertising cookies and other cookies for which we require consent by
confirming the button "accept all cookies". Via the cookie settings,
the user can deactivate functional cookies and statistics cookies. Necessary
cookies are mandatory for the operation of the online platform and cannot be
deactivated.
Alternatively, the management of cookies is
possible via the browser settings.
The user can restrict or entirely prevent the
online platform placing cookies by means of its Internet browser deoending on
its needs. Via the browser security settings the user can specify whether it
wishes to
>
be informed of the placement of cookies so that it can decide individually
whether to accept them,
>
generally accept cookies,
>
exclude the placement of cookies in particular cases (e.g. acceptance of
third-party cookies), or
>
generally exclude the placement of cookies.
Every browser manages the cookie settings
differently. The browser’s help menu describes how the browser’s cookie setting
can be changed.
In addition, when cookies have already been
placed the user can delete these in its browser settings. Please note that if
all cookies are deleted completely, opt-out cookies that the user has already
activated will also be deleted. In this case any objections the user has
already declared will have to be declared again.
The deactivation and deletion of cookies also
only affects the particular browser the user is using at the time, so the user will
have to repeat this if it uses a different browser.
Please note that deactivating cookies might
restrict the functionality of our web page.
e) Direct Marketing
If you
register on our online platform, we reserve the right to use the e-mail address
of users who have created a user account for the online platform to regularly
provide updates and other information via e-mail on online events hosted by
Volume Graphics GmbH via the online platform.
This processing is in our legitimate interest to
maintain our customer relationship and to keep users who have shown an interest
in our virtual event informed about upcoming virtual events.
The legal basis for data processing are Artt. 6 (1)
1 lit.f, 5 (1) lit.a GDPR in conjunction with. § 7 (3) German Act Against
Unfair Competition (UWG).
In order to keep you up to date on upcoming
virtual events, you will receive regular updates on online events of Volume
Graphics GmbH via e-mail.
You may opt out of receiving any updates to
future events at any time, e.g., by sending an e-mail to marketing@volumegraphics.com. Opting out will not incur any costs other than the transmission costs
according to the base rates.
f) Livestreaming, Retrieval of On-Demand Videos
We process personal data for the organization
and implementation of online events. As part of these events, we sometimes also
offer program sections via livestream as well as on-demand videos for
retrieval. On-demand videos are regularly provided via YouTube linking.
YouTube, Use of YouTube in Extended Data Protection
Mode
Our web page incorporates videos via the
provider YouTube. YouTube is operated by the US company YouTube, LLC, 901
Cherry Avenue, San Bruno, CA 94066, USA— a subsidiary of Google LLC, 1600
Amphitheatre Parkway, Mountain View, CA 94043, USA.
YouTube videos are incorporated into our web
page on the basis of our legitimate interest in making our online presence as
attractive and interesting as possible for our visitors. The legal basis for
the use of the YouTube videos is therefore Art. (1) 1 lit.f GDPR.
Like most web pages, YouTube also uses cookies
to collect information about the visitors to its web page and viewers of
YouTube videos. YouTube uses these among other things to collect video
statistics, prevent fraud and improve the user-friendliness. At the same time
as the cookies are deposited in your browser, a link is created to the Google
DoubleClick network.
To limit the data collection by YouTube, we
embed videos in the extended data protection mode. When you access a web page
with an embedded video, initially a link to the YouTube server is created via
your browser and the video is shown on the web page.
For this, YouTube needs your IP address.
Therefore. when you are visiting our web page, as soon as you reach a web page
on which a YouTube video is embedded your IP address is transmitted to YouTube.
However, according to YouTube your user behavior
will only be tracked once you watch the video. As long as you do not watch the
embedded video, YouTube will neither place cookies, nor create a link to the
DoubleClick server.
If you should not agree to your web page visit
being tracked by YouTube, then please do not watch the embedded video.
We would also like to point out that it is
possible for YouTube to allocate the collected information to your YouTube
membership account if you are logged in to YouTube during your visit to our web
page. You can prevent this by logging out of your membership account before you
visit our web page.
Unfortunately, we have no influence over the
collection and processing of data by YouTube. We do not know the exact extent
of this. The data collected by YouTube are also presumably processed outside
the EU, as YouTube, LLC is a US company.
Google, LLC and its subsidiaries (which also
include YouTube, LLC) are certified under the EU-US Privacy Shield, and are
thus obliged to uphold the EU data protection standard. The corresponding entry
in the Privacy Shield list can be found here: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active.
The Privacy Shield was declared invalid by the
ECJ in its ruling of July 16, 2020, Case C-3111/18 (the so-called Schrems II
ruling). As a result, the Privacy Shield is no longer suitable to legitimize
any data transfer to the USA. An adequate level of data protection is thus no
longer guaranteed without further ado.
If you decide to watch the video, you therefore
consent to the collection and processing of your data by YouTube, including the
transfer of your data to the USA (Artt. 6 (1) 1 lit.a, 7, 49 (1) 1 lit.a GDPR).
You will find details of the data protection by
YouTube and your rights in the Google data privacy policy, which can be viewed
at: https://policies.google.com/privacy?hl=en&gl=en.
Please address any requests for information
about how YouTube handles your personal data directly to YouTube. The same
applies to the assertion of further rights. Only YouTube has access to the data
that is collected and is able to take corresponding measures and provide
information.
However, we are happy to answer your queries at
any time. You can email us at privacy@volumegraphics.com.
4.
Data Recipients and Data Transfer to Third Countries
a) SaaS-Solution of
the rooom AG
For the provision and
operation of the 3D online platform, Volume Graphics utilizes the services of
rooom AG, Löbstedter Straße 47a, 07749 Jena, Germany. Your data will therefore
be transmitted to and processed by rooom AG. he processing of the data by rooom
AG is based on a commissioned data processing agreement pursuant to Art. 28 (3)
GDPR.
b) Processing of Data
within the Volume Graphics Group
Volume Graphics is a
company of the Volume Graphics Group. Certain services such as IT services are
performed centrally by Volume Graphics. This concerns in particular the
maintenance of a common group-wide customer relationship management system. In
this respect, there may be a transfer of data within the group of companies.
The legal basis is our
legitimate interest in designing our internal administrative processes
efficiently and economically, Art. 6 (1) 1 lit.f GDPR in conjunction with. Rec.gr 48 GDPR.
If, in exceptional
cases, a transfer of your data to affiliated companies in third countries
should become necessary, this will take place on the basis of an adequacy
decision by the European Commission and, if such a decision does not exist, on
the basis of EU standard contractual clauses of the European Commission.
5.
Data Subject Rights
You have the following rights pursuant to
the General Data Protection Regulation:
a)
Right
to Information, Art. 15 GDPR
Acc. to Art. 15 GDPR, you have
the right to obtain confirmation as to whether or not personal data concerning
you is being processed, the right to information about such data and to further
information, e.g. the categories of recipients of your data.
b)
Right
to Rectification, Art. 16 GDPR
Where personal data concerning you and
retained by us is incorrect, you can obtain its rectification acc. to the 1st sentence
of Art. 16 GDPR. Furthermore, you can obtain the completion of your
personal data retained by us, 2nd sentence of
Art. 16 GDPR.
c)
Right
to Erasure, Art. 17 GDPR
In
accordance with Art. 17 GDPR, you can obtain the erasure of personal
data concerning you without undue delay.
d)
Right
to Restriction of Processing, Art. 18 GDPR
Acc. to Art. 18 GDPR, you can
obtain the restriction of processing of your personal data in the cases
specified there.
e)
Right
to Data Portability, Art. 20 GDPR
Under the prerequisites of
Art. 20 GDPR, you have the right to receive the personal data
concerning you, which you have provided to us, and to have it transmitted to
other controllers.
f)
Right
to Object, Art. 21 GDPR
Acc. to
Art. 21 GDPR, you have the right to object at any time to the future
processing of personal data concerning you based on our legitimate interests within
the meaning of Art. 6 (1) 1 lit.f GDPR. In particular, you have the
right to object to the processing of your data for direct marketing purposes.
g) Right to Withdraw Consent, Art. 7 (3) GDPR
You have the right to withdraw granted
consents acc. to Art. 6 (1) 1 lit.a GDPR
with effect for the future, Art. 7 (3) GDPR. This does not affect the
lawfulness of the processing of your data based on the consent until such
withdrawal.
h)
Right
to Lodge a Complaint, Art. 77 GDPR
Furthermore, without prejudice to any other
administrative or judicial remedy, you have the right to lodge a complaint with
a supervisory authority acc. to Art. 77 GDPR. Acc. to
Art. 19 GDPR, responsibility lies with the supervisory authority of
the Land of Baden-Württemberg:
State Commissioner for Data Protection and
Freedom of Information
Street address:
Königstraße 10a, 70173 Stuttgart, Germany
Postal address:
P. O. Box 10 29 32,
70025 Stuttgart, Germany
Phone: +49
(0)711/615541-0,
Fax:
+49 (0)711/615541-15,
E-mail: poststelle@lfdi.bwl.de
To exercise your rights
and for general privacy issues, please send an e-mail to privacy@volumegraphics.com. If you prefer any other communication
channel, you can also contact us by mail, telephone or fax using the contact
details of the controller specified above.
6.
Status and
Changes in the Privacy Notes
These
privacy notes were last revised: June 2021.
We update our privacy notes from time to
time to adapt them to legal developments and to reflect changes in our
company's internal processes.
If we make fundamental changes regarding
the collection, use or dissemination of your personal data, we will notify you thereof
by e-mail sent to the last e-mail address specified by you, and—if need be—asking
for your consent again.
These changes do not
affect your legal rights to information, rectification, restriction, erasure,
objection, withdrawal and complaint.
In all other respects, the privacy policy of Volume Graphics GmbH shall
apply: