Privacy Policy

Introduction

With the following privacy policy, we would like to inform you about the types of personal data we process (hereinafter also referred to as "data"), for what purposes, and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and, in particular, on our websites, in mobile applications, and within external online platforms, such as our social media profiles (hereinafter collectively referred to as the "online offering").

    As of: September 15, 2019

    Table of Contents

    Data Controller

    Stephan Buchmann
    Emanuelstr. 19
    80796 Munich

    Email address: info@citysim.de

    Phone: +49 (0) 160 95917290

    Imprint: www.citysim.de

      Overview of Processing Activities

      The overview below summarizes the types of data we process, why we use it, and who it affects.

      Types of data we collect

      • Basic details (like names and addresses).

      • Content data (like text messages, photos, and videos).

      • Contact info (like email addresses and phone numbers).

      • Technical info (like device details and IP addresses).

      • Usage data (like pages visited, interest in content, and access times).

      • Location data (information showing where your device is located).

      • Contract details (like what the contract is about, how long it lasts, and customer type).

      • Payment info (like bank details, invoices, and payment history).

      Groups of people affected

      • Business partners and contractors.

      • People interested in our offers.

      • Customers.

      • Visitors and users of our website and online services.

      Why we process your data

      • Making our website easy to use and providing our online services.

      • Analyzing website visits.

      • Office and administrative tasks.

      • Cross-device tracking (using your data across different devices for marketing).

      • Feedback (like collecting your thoughts through online forms).

      • Interest-based and behavior-based marketing.

      • Contact requests and communication.

      • Conversion tracking (measuring how well marketing efforts work).

      • Profiling (creating user profiles).

      • Remarketing.

      • Audience measurement (e.g., access statistics, recognizing returning visitors).

      • Security measures.

      • Tracking (e.g., interest- or behavior-based profiling, using cookies).

      • Contractual services and support.

      • Managing and responding to inquiries.

      • Target group creation (identifying relevant groups for marketing or other content delivery).

      Relevant Legal Bases

      Below, we share the legal bases of the General Data Protection Regulation (GDPR) that we rely on to process your personal data. Please note that national data protection laws in your or our country of residence may also apply alongside the GDPR.

      • Consent (Art. 6 para. 1 sentence 1 lit. a GDPR) - The user has given consent to the processing of their personal data for one or more specific purposes.

      • Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR) - Processing is necessary for the performance of a contract to which the user is a party, or in order to take steps at the request of the user prior to entering into a contract.

      • Legal obligation (Art. 6 para. 1 sentence 1 lit. c GDPR) - Processing is necessary for compliance with a legal obligation to which we are subject.

      • Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR) - Processing is necessary for the purposes of our legitimate interests or those of a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the user which require protection of personal data.

      National data protection laws in Germany: In addition to the GDPR, national data protection laws apply in Germany. This includes in particular the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). The BDSG contains specific rules on the right to information, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and data transmission and automated decision-making in individual cases, including profiling. Furthermore, it regulates data processing for employment purposes (§ 26 BDSG), particularly regarding the establishment, implementation, or termination of employment relationships as well as employee consent. State data protection laws of individual federal states may also apply.

        Security Measures

        Taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of processing, as well as the risks to the rights and freedoms of individuals, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

        These measures include ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access input, transmission, availability, and separation. We have also set up procedures to ensure that users can exercise their rights, data is deleted, and we can respond to data threats. Furthermore, we factor the protection of personal data into the development or selection of hardware, software, and procedures, following the principles of privacy by design and privacy by default.

        SSL encryption (https): To protect the data you send us via our website, we use SSL encryption. You can recognize encrypted connections by the "https://" prefix in your browser's address bar.

        Transmission and Disclosure of Personal Data

        During our processing of personal data, it may happen that data is transferred to or disclosed to other entities, companies, legally independent organizational units, or persons. Recipients of this data may include payment institutions for payment transactions, IT service providers, or providers of services and content integrated into a website. In such cases, we comply with legal requirements and, in particular, conclude appropriate contracts or agreements with the recipients to protect your data.

        Data Processing in Third Countries

        If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or if this happens as part of using third-party services or disclosing/transmitting data to other persons, bodies, or companies, this is only done in accordance with legal requirements.

        Unless you have given explicit consent or a contract or law requires the transfer, we only process data in third countries with a recognized level of data protection—such as US processors certified under the Privacy Shield—or on the basis of special guarantees, like standard contractual clauses from the EU Commission, certifications, or binding internal data protection rules (Arts. 44 to 49 GDPR, EU Commission information page: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).

        Use of Cookies

        "Cookies" are small files stored on users' devices. Cookies can store various types of information, such as language settings on a website, login status, a shopping cart, or where a video was watched.

        Cookies are generally also used when a user's interests or behavior (e.g., viewing specific content, using features) are saved in a user profile across different websites. These profiles are used to show users content that matches their potential interests, for example. This process is known as "tracking" users' potential interests. We also use the term "cookies" for other technologies that perform the same functions (e.g., when user data is stored using pseudonymous online IDs, also known as "user IDs").

        If we use cookies or "tracking" technologies, we will inform you separately in our privacy policy.

        Information on legal bases: The legal basis on which we process your personal data using cookies depends on whether we ask for your consent. If this applies and you consent to the use of cookies, the legal basis for processing your data is your declared consent. Otherwise, data processed using cookies is handled based on our legitimate interests (such as running our online services efficiently and improving them) or, if cookies are required, to fulfill our contractual obligations.

        Withdrawal and Objection (Opt-Out): Regardless of whether processing is based on consent or legal permission, you can withdraw any consent you have given or object to the processing of your data by cookie technologies at any time (collectively referred to as "Opt-Out").

        You can initially object to cookies through your browser settings, for example, by disabling cookies (though this may limit how well our website works).

        You can object to the use of cookies for online marketing purposes through various services, especially for tracking, via the US site http://www.aboutads.info/choices/, the EU site http://www.youronlinechoices.com/, or generally at http://optout.aboutads.info.

        • Types of data processed: Usage data (e.g., web pages visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).

        • Data subjects: Users (e.g., website visitors, users of online services).

        • Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

        Commercial and Business Services

        We process data from our contractual and business partners, such as customers and prospective clients (collectively referred to as "contractual partners"), within the scope of contractual and comparable legal relationships, related measures, and communication with them (or prior to a contract), for example, to answer inquiries.

        We process this data to fulfill our contractual obligations, protect our rights, handle administrative tasks related to this information, and manage our business organization. Within the framework of applicable law, we only share contractual partners' data with third parties if necessary for the aforementioned purposes, to fulfill legal obligations, or with the partners' consent (e.g., to telecommunications, transport, and other auxiliary services or subcontractors, banks, tax and legal advisors, payment service providers, or tax authorities). Contractual partners will be informed about any additional forms of processing, such as for marketing purposes, in this privacy policy.

        We will let contractual partners know which data is required for the above purposes before or during data collection, such as in online forms, through special markings (e.g., colors) or symbols (e.g., asterisks), or in person.

        We delete data after statutory warranty and comparable obligations expire, generally after 4 years, unless the data is stored in a customer account, for example, because it must be kept for legal archiving reasons (typically 10 years for tax purposes). Data provided to us by a contractual partner as part of an assignment will be deleted according to the terms of the assignment, generally after the assignment ends.

        If we use third-party providers or platforms to deliver our services, the terms and conditions and privacy policies of the respective third-party providers or platforms apply between the users and the providers.

        Economic analysis and market research: For business reasons and to identify market trends and the wishes of contractual partners and users, we analyze the data we have on business transactions, contracts, inquiries, etc. The group of affected individuals may include contractual partners, prospective clients, customers, visitors, and users of our online services.

        These analyses are conducted for business evaluations, marketing, and market research (e.g., to determine customer groups with different characteristics). Where available, we may include the profiles of registered users along with their details, such as services used. The analyses are for our own use only and are not disclosed externally unless they are anonymous analyses with combined, i.e., anonymized, values. Furthermore, we respect user privacy and process data for analysis purposes as pseudomonymously and, where feasible, anonymously as possible (e.g., as aggregated data).

        Shop and e-commerce: We process our customers' data to enable them to select, purchase, or order chosen products, goods, and related services, as well as to handle payment, delivery, or fulfillment.

        Required information is marked as such during the ordering or similar purchasing process and includes details needed for delivery, provision, and billing, as well as contact information for any necessary follow-up.

        • Types of data processed: Master data (e.g., names, addresses), payment data (e.g., bank details, invoices, payment history), contact data (e.g., email, phone numbers), contract data (e.g., subject matter, duration, customer category), usage data (e.g., web pages visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).

        • Data subjects: Prospective clients, business and contractual partners, customers.

        • Purposes of processing: Contractual services and support, contact requests and communication, office and organizational procedures, administration and response to inquiries, visitor action evaluation, interest-based and behavioral marketing, profiling (creating user profiles), security measures.

        • Legal bases: Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b. GDPR), Legal obligation (Art. 6 para. 1 sentence 1 lit. c. GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

        Payment Service Providers

        As part of contractual and other legal relationships, due to legal obligations, or otherwise based on our legitimate interests, we offer data subjects efficient and secure payment options and use other payment service providers (collectively "payment service providers") alongside banks and credit institutions.

        The data processed by payment service providers includes master data like name and address, bank details like account or credit card numbers, passwords, TANs, and checksums, as well as contract, amount, and recipient-related details. This information is needed to complete transactions. However, the data entered is only processed and stored by the payment service providers. This means we do not receive any account or credit card information, only confirmation or notification that the payment went through or failed. In some cases, payment service providers may transmit the data to credit reference agencies. This transmission is used to verify identity and creditworthiness. Please refer to the terms and conditions and privacy policies of the payment service providers for details.

        Payment transactions are subject to the terms and conditions and privacy policies of the respective payment service providers, which can be found on their websites or within their transaction apps. We also point to these for further information and to assert rights of withdrawal, access, and other data subject rights.

        • Types of data processed: Master data (e.g., names, addresses), payment data (e.g., bank details, invoices, payment history), contract data (e.g., subject matter, duration, customer category), usage data (e.g., web pages visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).

        • Data subjects: Customers, prospective clients.

        • Purposes of processing: Contractual services and support.

        • Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

        Services and service providers used:

        Provision of the Online Offering and Web Hosting

        To provide our online services securely and efficiently, we use the services of one or more web hosting providers whose servers (or servers managed by them) are used to host our website. For these purposes, we may use infrastructure and platform services, computing capacity, storage space and database services, as well as security and technical maintenance services.

        The data processed as part of providing the hosting services may include all details relating to the users of our online services that arise during use and communication. This regularly includes the IP address necessary to deliver the content of online services to browsers, as well as all entries made within our online services or from websites.

        Email dispatch and hosting: The web hosting services we use also include sending, receiving, and storing emails. For these purposes, the addresses of recipients and senders as well as further information regarding email delivery (e.g., the providers involved) and the content of the respective emails are processed. The aforementioned data may also be processed for the purpose of detecting spam. Please note that emails on the internet are generally not sent in encrypted form. While emails are usually encrypted during transport, they are not encrypted on the servers from which they are sent and received (unless an end-to-end encryption method is used). We therefore cannot assume any responsibility for the transmission path of emails between the sender and receipt on our server.

        Collection of access data and log files: We (or our web hosting provider) collect data on every access to the server (so-called server log files). Server log files may include the address and name of the accessed web pages and files, date and time of access, data volumes transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page), and usually IP addresses and the requesting provider.

        The server log files can be used for security purposes, e.g., to prevent server overload (especially in the event of abusive attacks, so-called DDoS attacks) and to ensure server capacity utilization and stability.

        • Types of data processed: Content data (e.g., text entries, photographs, videos), Usage data (e.g., websites visited, interest in content, access times), Meta/communication data (e.g., device information, IP addresses).

        • Data subjects: Users (e.g., website visitors, users of online services).

        • Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

        Online Marketing

        We process personal data for online marketing purposes, which includes in particular the display of advertising and other content (collectively referred to as "content") based on the potential interests of users and the measurement of its effectiveness.

        For these purposes, user profiles are created and stored in a file (a so-called "cookie") or similar procedures are used, by means of which information relevant to the user for the display of the aforementioned content is stored. This information may include viewed content, visited websites, online networks used, but also communication partners and technical information such as the browser used, the computer system used, and information on usage times. If users have consented to the collection of their location data, this can also be processed.

        Users' IP addresses are also stored. However, we use IP masking procedures (i.e., pseudonymization by shortening the IP address) to protect users. Generally, no clear user data (such as email addresses or names) is stored in the context of online marketing procedures, but rather pseudonyms. This means that neither we nor the providers of the online marketing procedures know the actual identity of the users, but only the information stored in their profiles.

        The information in the profiles is usually stored in cookies or via similar methods. These cookies can generally also be read out later on other websites that use the same online marketing procedure, analyzed for the purpose of displaying content, supplemented with additional data, and stored on the online marketing provider's server.

        In exceptional cases, clear data can be assigned to profiles. This is the case, for example, if users are members of a social network whose online marketing procedure we use and the network connects the users' profiles with the aforementioned information. Please note that users can make additional agreements with providers, e.g., by giving consent during registration.

        As a rule, we only receive aggregated information about the success of our ads. However, as part of so-called conversion measurements, we can check which of our online marketing procedures have led to a so-called conversion, i.e., for example, the conclusion of a contract with us. Conversion measurement is used solely to analyze the success of our marketing measures.

        Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for processing data is consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e., interest in efficient, economical, and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

        Facebook Pixel: With the help of the Facebook Pixel, Facebook is able to determine visitors to our online service as a target group for the display of ads (so-called "Facebook Ads"). Accordingly, we use the Facebook Pixel to display the Facebook Ads placed by us only to those Facebook users who have also shown an interest in our online service or who have certain characteristics (e.g., interest in certain topics or products based on the websites visited) that we transmit to Facebook (so-called "Custom Audiences"). With the help of the Facebook Pixel, we also want to ensure that our Facebook Ads match the potential interest of users and are not annoying. With the help of the Facebook Pixel, we can also track the effectiveness of Facebook ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook ad (so-called "conversion measurement").

        • Types of data processed: Usage data (e.g., websites visited, interest in content, access times), Meta/communication data (e.g., device information, IP addresses), Location data (data indicating the location of an end user's device).

        • Data subjects: Users (e.g., website visitors, users of online services), prospective customers.

        • Purposes of processing: Tracking (e.g., interest-/behavior-based profiling, use of cookies), Remarketing, Visit action evaluation, Interest-based and behavioral marketing, Profiling (creation of user profiles), Conversion measurement (measuring the effectiveness of marketing measures), Reach measurement (e.g., access statistics, recognition of returning visitors), Target group building (determination of target groups relevant for marketing purposes or other output of content), Cross-device tracking (cross-device processing of user data for marketing purposes).

        • Security measures: IP masking (pseudonymization of the IP address).

        • Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

        • Right to Object (Opt-Out): We refer to the privacy policies of the respective providers and the opt-out options provided for them (so-called "opt-out"). If no explicit opt-out option has been provided, you have the option to disable cookies in your browser settings. However, this may limit the functions of our online services. We therefore additionally recommend the following opt-out options, which are grouped by region: a) Europe: https://www.youronlinechoices.eu. b) Canada: https://www.youradchoices.ca/choices. c) USA: https://www.aboutads.info/choices. d) Cross-regional: http://optout.aboutads.info.

        Services and service providers used:

        Social Media Presences

        We maintain online presences within social networks to communicate with active users there or to offer information about ourselves.

        Please note that user data may be processed outside the European Union. This can pose risks for users, for example, because enforcing user rights could be more difficult. Regarding US providers that are certified under the Privacy Shield or offer comparable guarantees of a secure level of data protection, we point out that they commit to complying with EU data protection standards.

        Furthermore, user data within social networks is generally processed for market research and advertising purposes. For example, user profiles can be created based on usage behavior and resulting user interests. These profiles can in turn be used, for example, to place ads inside and outside the networks that presumably match the interests of the users. For these purposes, cookies are generally stored on the users' computers, in which the usage behavior and user interests are saved. In addition, data can also be stored in the user profiles independently of the devices used by the users (especially if the users are members of the respective platforms and logged into them).

        For a detailed description of the respective processing methods and opt-out options, we refer to the privacy policies and information provided by the operators of the respective networks.

        Also in the case of information requests and the assertion of data subject rights, we point out that these can be asserted most effectively with the providers. Only the providers have access to the respective user data and can directly take appropriate measures and provide information. Should you still need help, you can contact us.

        • Types of data processed: Master data (e.g., names, addresses), contact data (e.g., email, phone numbers), content data (e.g., text inputs, photographs, videos), usage data (e.g., visited websites, interest in content, access times), meta/communication data (e.g., device information, IP addresses).

        • Data subjects: Users (e.g., website visitors, users of online services).

        • Purposes of processing: Contact requests and communication, tracking (e.g., interest/behavior-based profiling, use of cookies), remarketing, reach measurement (e.g., access statistics, recognition of returning visitors).

        • Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

        Services and service providers used:

        Plugins and Embedded Functions as well as Content

        We integrate functional and content elements into our online services that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These can be, for example, graphics, videos, or social media buttons as well as posts (hereinafter uniformly referred to as "content").

        The integration always requires that the third-party providers of this content process the users' IP address, since without the IP address they could not send the content to their browsers. The IP address is therefore required for the display of this content or functions. We make every effort to use only such content whose respective providers use the IP address solely for the delivery of the content. Third-party providers may also use pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. "Pixel tags" can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information can also be stored in cookies on the users' devices and may contain technical information about the browser and operating system, referring websites, visit time, and other details regarding the use of our online services, as well as being linked with such information from other sources.

        Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for processing data is consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e., interest in efficient, economical, and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

        • Types of data processed: Usage data (e.g., visited websites, interest in content, access times), meta/communication data (e.g., device information, IP addresses), contact data (e.g., email, phone numbers), content data (e.g., text inputs, photographs, videos), master data (e.g., names, addresses).

        • Data subjects: Users (e.g., website visitors, users of online services).

        • Purposes of processing: Provision of our online services and user-friendliness, contractual services and support, tracking (e.g., interest/behavior-based profiling, use of cookies), feedback (e.g., collecting feedback via online form), security measures, administration and answering of requests.

        • Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR), consent (Art. 6 para. 1 sentence 1 lit. a GDPR), fulfillment of contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR).

        Services and service providers used:

        Deletion of Data

        The data processed by us will be deleted in accordance with legal requirements as soon as the consents permitted for processing are revoked or other permissions cease to apply (e.g., if the purpose of processing this data no longer applies or it is not required for that purpose).

        If the data is not deleted because it is required for other legally permissible purposes, its processing will be restricted to those purposes. This means the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax reasons, or whose storage is necessary to assert, exercise, or defend legal claims, or to protect the rights of another natural or legal person.

        Further information on the deletion of personal data can also be found within the individual data protection notices of this privacy policy.

          Created with Datenschutz-Generator.de by Dr. jur. Thomas Schwenke