General Data Protection Information

CONTRIMA is committed to protecting your privacy. The following information provides details on the processing of personal data by CONTRIMA. This privacy notice specifically relates to the website-specific data processing procedures when you visit our website at www.contrima.com. Even beyond the website-specific data processing procedures, CONTRIMA attaches great importance to the protection of personal data. Please therefore also take note – where applicable to you – of our further privacy notice for photographers, the current version of which you can access at any time via the following link:

Privacy Notice for Photographers

Our privacy notices are updated regularly and adapted to new legal requirements or case law. We therefore recommend that you revisit and read through these privacy notices on a regular basis.

I. Data Controller

The data controller is Contrima GmbH, represented by its managing director, Mr Mark Reinhardt, Enzianweg 29, 71384 Weinstadt (hereinafter “CONTRIMA”).

Contact address: info@contrima.com

II. Processing of personal data, legal bases

This privacy notice informs you, in accordance with Article 12 et seq. of the GDPR, about the handling of your personal data when you use our website. It explains, in particular, which data we collect and what we use it for. It also informs you about how and for what purpose this takes place.

We process your personal data in accordance with Article 6(1) of the GDPR, i.e. for the processing of your personal data, we either have your consent or there is another legal basis for doing so. . We also work with service providers who process your personal data on our behalf (e.g. hosting the CONTRIMA website). Personal data is any information relating to an identified or identifiable natural person (hereinafter referred to as the ‘data subject’).

Personal data is any information relating to an identified or identifiable natural person (hereinafter referred to as the ‘data subject’) ; a natural person is regarded as identifiable if they can be identified, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier or one or more specific characteristics that reflect the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person (see Article 4(1) of the GDPR). Personal data therefore also includes data that can be linked to a specific individual, such as an IP address. Other examples include: title, first name, surname, job title, email address, company, street, postcode and town.

Processing means any operation or set of operations, whether or not by automated means, carried out on personal data data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, the alignment or linking, restriction, erasure or destruction (see Article 4(2) of the GDPR).

III. Purposes and legal bases for data processing

1. Automatic data processing when accessing and visiting the website of CONTRIMA

When you visit our website, we collect and process the information that you automatically transmit to us by technical means, and/or personal data that you voluntarily provide to us.

Every time you access our website, we process the following information automatically:

• IP address of the requesting device (computer, tablet or smartphone)
• Date and time of access
• Content of the request (specific page or file)
• Access status/HTTP status code
• Amount of data transferred in each instance
• Browser used, including version and language

This technically necessary information is collected and processed to enable users to use the service, to ensure system security, and to detect and investigate any malfunctions or attacks. This information is stored in log files in order to ensure the functionality of the service, guarantee the security of our IT systems and optimise our service.

The data mentioned above is also temporarily stored in our servers’ log files; this data is not stored together with any other personal data relating to you.

The information that is strictly necessary is collected and processed in accordance with Section 25(2)(2) of the Telecommunications and Digital Services Data Protection Act (TDDDG).

The subsequent processing in log files is carried out on the basis of Article 6(1)(f) of the GDPR. Our legitimate interest lies in providing a functional and technically secure website, as well as in preventing and investigating any unlawful uses. Where data processing is carried out on the basis of Article 6(1)(f) of the GDPR, you have the right to object; see Section IV below.

Insofar as you visit our website to find out about our range of products and services or to use them, the basis for the temporary storage and processing of access data is Article 6(1)(b) of the GDPR, which permits the processing of data for the performance of a contract or for the implementation of pre-contractual measures. processing of access data is Article 6(1), first sentence, point (b) of the GDPR, which permits the processing of data for the performance of a contract or the implementation of pre-contractual measures. 2. Processing of contact enquiries

2. Processing of contact enquiries

If you send enquiries to us by email to our contact address info@contrima.com, your messages, including the contact details you provide there (such as a personalised email address, name, contractual relationship with us, telephone number, etc.) will be stored by us for the purpose of processing and responding to your enquiry, as well as in the event of follow-up questions, and will be processed accordingly. Your personal data will be stored in our email or file management system and, where applicable, assigned to an existing case. We will not pass this data on to third parties unless this is necessary in the context of processing and responding to your enquiry, or you have given us your consent to do so.

Where you contact us in the context of an existing contractual relationship or contact us in advance to enquire about our range of services or other services , the data and information you provide will be processed for the purpose of processing and responding to your enquiry in accordance with Article 6(1), first sentence, point (b) of the GDPR. Furthermore, to safeguard our legitimate interests in accordance with Article 6(1), first sentence, (f) of the GDPR, in order to respond appropriately to customer/enquiry requests.

The data you have entered will remain with us until the purpose for which it was collected and processed no longer applies (e.g. once your enquiry has been fully processed). If you so wish, we will delete your personal data, provided that we have no legal claim or legitimate interest in retaining it any longer. If you so wish, we will delete your personal data, provided that we have no legal obligation or interest in retaining it further. A legitimate interest on our part in retaining the data exists in relation to the possible assertion of legal claims against us. Data will then be retained for at least a further three years from the end of the year following the completion of the processing of your enquiry. Any other mandatory legal provisions – in particular retention periods – remain unaffected.

3. Use of cookies, audience measurement and advertising

Our website uses cookies. Cookies are small text files that are stored on your device (e.g. computer, tablet or smartphone) and enable us to recognise your browser when you visit the site again. We distinguish between technically necessary cookies (hereinafter ‘a.’) and cookies or services that we only use with your consent (hereinafter ‘b.’ to ‘d.’).

a. Technically necessary cookies

Technically necessary cookies are required for the website to function properly; these include:

• session cookies for login and session management; these are automatically deleted at the end of your visit or browser session,
• cookies to store your language and country settings,
• the ‘ctm_consent’ cookie, in which we store your selection from the cookie banner; (retention period 182 days, see b.). It does not contain any identifier that could be used to recognise you.

These cookies constitute ‘strictly necessary’ information within the meaning of Section 25 (2) No. 2 of the Telecommunications and Digital Services Data Protection Act (TDDDG). The associated data processing is carried out on the basis of Article 6(1), first sentence, point (f) of the GDPR to safeguard our legitimate interests in a technically functional, user-friendly and secure website, or on the basis of Article 6(1), first sentence, point (b) of the GDPR, in so far as the cookies are necessary for the provision of contractually required functions (e.g. login).

You can configure your browser so that you are notified when cookies are set and only allow cookies on a case-by-case basis, exclude the acceptance of cookies in specific cases or in general, and enable the automatic deletion of cookies when you close your browser . You can usually find out how to disable cookies via the ‘Help’ function of your web browser. If you disable cookies, the functionality and/or full availability of this website may be limited. b. Consent via the cookie banner, withdrawal of consent and proof of consent.

b. Consent via the cookie banner, withdrawal of consent and proof

We only use cookies and services for audience measurement (‘Statistics’), for measuring the performance of our advertisements (‘Advertising Performance Measurement’) and for displaying personalised advertising (‘Personalised Advertising’) if you have given your prior consent. The first time you visit our public information pages (e.g. homepage, features, prices, FAQs, contact) and the registration page, we will display a banner with the buttons: ‘Accept all’, ‘Essential only’ and ‘Settings’. ‘Only necessary’ rejects all purposes that require consent. Under ‘Settings’, you can decide individually for each purpose; no category is preselected. The purposes available for you to choose from in the banner depends on which of the services described under c. and d. we are currently using. As long as you have not given your consent, no data will be transferred to Google and none of the cookies mentioned under c. and d. will be set. We host the banner ourselves on our servers.

We store your selection – including a refusal – for 182 days; during this time, we will not display the banner to you again. If you close the banner without making a selection, this is not considered consent, and we will ask you again the next time you visit. If we change the purposes, the services or the text of the banner, we will display the banner again. If you close the banner without making a selection, this is not considered consent, and we will ask you again the next time you visit. If we change the purposes, the services or the text of the banner, we will also ask you again.

On the pages featuring photographed individuals, in the galleries, in the photographers’ account section and on our legal notices pages, we do not use cookies for audience measurement or for advertising purposes.

The legal basis for storing and accessing information on your device is your consent in accordance with Section 25(1) of the TDDDG – for visitors outside Germany, the corresponding provision in their country. The legal basis for the subsequent processing of your personal data is your consent in accordance with Article 6(1), first sentence, point (a) of the GDPR.

Withdrawal: You may withdraw your consent at any time with effect for the future or change your selection via the ‘Cookie settings’ menu item in the footer of each page. Upon withdrawal, we will delete the Google cookies on our domain; you can delete cookies set by Google on its own domain (see d.) in your browser. Data already transmitted to Google prior to the withdrawal is not affected by the withdrawal.

Evidence: We store your selection in the ‘ctm_consent’ cookie (182 days). In addition, we log the following information anonymously – without an IP address, browser identifier, account identifier or reference to an account – the time of the decision, the version of the banner, the page language, the page accessed and the selection made for each purpose. The log serves as evidence that and how we obtain consent (Art. 7(1) GDPR).

c. Google Analytics – Audience measurement (“Statistics”)

With your consent for the purpose of “statistics”, we use Google Analytics (version 4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Ireland Limited engages Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, to carry out the processing.

The purpose is to measure the reach and analyse the usage of our public information pages (such as page views, sessions, source of the visit, device used and browser). In addition, we record two events: the registration of an account and the completion of a subscription. When a subscription is taken out, the plan price, currency and subscription number are transmitted – an identifier that only we can link to your account and which allows Google detect duplicate counts. Names, email addresses or other account details are not transmitted. The ‘Subscription completed’ event is triggered once after you return from the payment process, and only if you have given your prior consent. The analytics data help us to improve our website and our services.

Google Analytics sets cookies that assign a random identifier to your browser: ‘_ga’ (to distinguish between users) and ‘_ga_’ followed by our website’s identifier (session status), each with a retention period of up to two years (shorter depending on the browser). Google uses your IP address only to determine the approximate region from which the request originated; for users from the the EU, Switzerland and the United Kingdom, it is not, according to Google, stored. Event data is retained by Google for 14 months; after that, only aggregated reports with no reference to individual users remain.

Google processes this data on our behalf on the basis of the Google Data Processing Terms in accordance with Article 28 of the GDPR. Where data is transferred to the USA, the transfer is based on the EU-US Data Privacy Framework , including its UK extension, and the Swiss–US Data Privacy Framework, under which Google LLC is certified. In this respect, the European Commission has certified, through an adequacy decision, that data protection is comparable to the EEA standard.

The legal basis is your consent (Article 6(1), first sentence, point (a) of the GDPR, Section 25(1) of the TDDDG); for information on withdrawal, see b. In addition, you can prevent data collection by Google Analytics using the Google browser add-on: https://tools.google.com/dlpage/gaoptout. Further information on data protection in Google Analytics: https://policies.google.com/privacy and https://support.google.com/analytics/answer/6004245.

d. Google Ads – Performance measurement and personalised advertising

Google Ads is an online advertising service provided by Google Ireland Limited (see c. for address). Where we use Google Ads, this is done exclusively on the basis of your consent, and for two purposes, to each of which you may give your consent individually:

• Advertising performance measurement: If you have reached our website via a Google advert, we can track whether this subsequently led to a registration or the taking out of a subscription. When a subscription is taken out, the plan price and currency are transmitted; no names, email addresses or other account details are provided. This enables us to measure the success of our adverts. To do this, Google sets cookies with the prefix ‘_gcl_’ are transmitted, but not names, email addresses or other account details. This enables us to measure the success of our adverts. To do this, Google sets cookies with the prefix ‘_gcl_’ (e.g. ‘_gcl_au’, “_gcl_aw”, “_gcl_gs”) with a retention period of 90 days, which match the click on a advertisement with a subsequent registration or subscription.
• Personalised advertising: Google records that your browser has visited our website, and may link this information with data from other websites that use Google services in order to show you CONTRIMA adverts on websites and within services provided by Google and its advertising partners (remarketing). To do this, Google sets sets the ‘IDE’ and ‘id’ cookies on its own domain, doubleclick.net, with a retention period of up to 13 months – depending on whether your browser allows cookies from third parties.

We ourselves only receive aggregated statistics from Google, not any information relating to individual persons. We are responsible for the collection of this data on our website and its transmission to Google; Google is solely responsible for its further processing (Google Ads Controller-Controller Data Protection Terms). Information on the processing carried out by Google can be found in Google’s Privacy Policy: https://policies.google.com/privacy. Where data is transferred to the USA, the transfer is based on the EU-US Data Privacy Framework (see c.).

The legal basis is your consent (Art. 6(1), first sentence, (a) of the GDPR, § 25(1) of the TDDDG); for information on withdrawal, see b. You can also disable personalised advertising by Google in your Google Account: https://myadcenter.google.com.

4. Links to social media platforms/websites

Our website contains links to websites, including social media platforms, for which other companies are responsible. If you follow these links, you will be taken directly to the websites of these providers, who are responsible for the data processing carried out there. We ourselves have no influence over the data processing carried out there. We ourselves have no influence over the data processing carried out there; we have no influence over the data processing carried out there.

Please note that these websites very often use various cookies and that data processing is frequently carried out by companies based in a third country, and data may be transferred to servers in a third country and thus processed outside the territory of the European Union.

5. Further purposes of processing

a. Compliance with legal requirements

We also process your personal data in order to fulfil other legal obligations that may apply to us in connection with our business activities. These include, in particular, retention periods under commercial, trade or tax law. In doing so, we process your personal data in accordance with Article 6(1), first sentence, point (c) of the GDPR (legal basis) to fulfil a legal obligation to which we are subject.

b. Law enforcement

We also process your personal data in order to assert our rights and to be able to enforce our legal claims. We also process your personal data in order to be able to defend ourselves against legal claims. Finally, we process your personal data to the extent that this is necessary to prevent or prosecute criminal offences. We process your personal data in this context to protect our legitimate interests in accordance with Article 6(1), first sentence, point (f) of the GDPR, insofar as we assert legal claims or defend ourselves in legal disputes, or we prevent or investigate criminal offences (legitimate interest).

6. Recipients of personal data

Within CONTRIMA, those departments that require your data to fulfil our contractual and statutory obligations will have access to it. Service providers and vicarious agents (e.g. technical service providers) engaged by us may also receive data for these purposes. We limit the disclosure of your personal data to what is strictly necessary, whilst complying with data protection regulations. In some cases, recipients receive your personal data as sub-processors and are then strictly bound by our instructions when handling your personal data.

• Our website is hosted on servers belonging to Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (‘AWS’). We also use the email service provided by AWS (Amazon Simple Email Service). Processing takes place on the basis of a data processing agreement in accordance with Article 28 of the GDPR. Insofar as, in individual cases, a transfer to the USA takes place, the data transfer is based on the EU-US Data Privacy Framework. In this regard, the European Commission has issued an adequacy decision certifying that data protection is comparable to the EEA standard. You can view the privacy policy of Amazon Web Services, Inc. at: https://aws.amazon.com/de/privacy/.
• To process payments (such as for a subscription), we use the payment service provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). When you take out a subscription, you will be redirected to Stripe’s payment process: (www.stripe.com). Stripe may transfer data to the USA and is certified under the EU-US Data Privacy Framework. Further information: https://stripe.com/de/privacy.
• Only with your consent (see Section III.3): For audience measurement and for advertising purposes, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, receives the data described there; it engages Google LLC, USA. For Google Analytics, Google is our data processor in accordance with Article 28 of the GDPR; for further processing within the scope of Google Ads, it acts as the independent data controller. The transfer to the USA is based on the EU–US Data Privacy Framework, including its UK extension, as well as the Swiss-US Data Privacy Framework, under which Google LLC is certified. Google’s privacy policy: https://policies.google.com/privacy.

IV. Your rights as a data subject

1. Right to withdraw consent: You may withdraw your consent to the processing of personal data, given in accordance with Article 6(1)(a) of the GDPR, at any time by notifying us. Please note that the withdrawal of consent only takes effect for the future. Any processing carried out prior to the withdrawal is not affected by this. To withdraw your consent, a simple informal notification, e.g. by email to us, is sufficient: info@contrima.com. You may also withdraw or amend your consent to cookies and services for audience measurement and advertising (Section III.3) at any time directly via the menu item ‘Cookie settings’ in the footer of every page.

2. Right to object: You are entitled, subject to the conditions set out in Article 21 of the GDPR – that is, in the case of processing based on legitimate interests pursuant to Article 6(1)(f) of the GDPR – to object to the processing of your personal data, meaning that we must cease processing your personal data. The right to object applies only within the limits set out in Article 21 of the GDPR. Furthermore, our legitimate interests may override the processing, meaning that, despite your objection, we are entitled to process your personal data. We will take any objection to any direct marketing measures into account immediately and without further weighing up the existing interests.

Information regarding your right to object under Article 21 of the GDPR: You have the right to object at any time to the processing of your data carried out on the basis of Article 6(1), first sentence, (f) of the GDPR (data processing based on a balancing of interests) or Article 6(1) sentence 1 (e) of the GDPR (data processing in the public interest), to object if there are grounds for doing so arising from your particular situation. If you object, we will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims. The objection may be made in any form and should, where possible, be addressed to: info@contrima.com.

3. You have the right to request confirmation from us as to whether we are processing personal data relating to you. If this is the case, you have the right to access this personal data to the extent provided for by law (Article 15 of the GDPR in conjunction with Section 34 of the BDSG).

4. You also have the right to request the rectification of any incorrect personal data concerning you and, where applicable – taking into account the purposes of the processing – the completion of incomplete personal data, including by means of a supplementary statement, (Article 16 of the GDPR). (Article 16 of the GDPR).

5. In the cases set out in Article 17(1)(a) to (f) of the GDPR, you also have the right to erasure of your personal data, provided that no exception under Article 17(3) of the GDPR applies, as well as in the cases set out in Article 18(1) of the GDPR, a right to restriction of processing.

6. In the cases referred to in Article 20(1) of the GDPR, you also have a right to data portability.

7. You have the right to lodge a complaint with a supervisory authority, if you believe that the processing of your personal data infringes the GDPR. The competent lead supervisory authority for us is: The State Commissioner for Data Protection and Freedom of Information in Baden-Württemberg (LfDI BW), PO Box 10 29 32, 70025 Stuttgart, email: poststelle@lfdi.bwl.de, website: baden-wuerttemberg.datenschutz.de.

V. Data security

We take all necessary technical and organisational security measures to protect your personal data from loss, unauthorised access and misuse.

In particular, for security reasons and to protect the transmission of confidential content – such as the contact enquiries you send to us as the website operator – this website uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the browser’s address bar changes from ‘http://’ to ‘https://’, as well as by the padlock icon in your browser bar. If SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties; however, we would like to point out that data transmission over the internet (e.g. when communicating via email) may be subject to security vulnerabilities. It is therefore not possible to provide complete protection of data against access by third parties.

Our staff and the service providers we commission have been bound by us to maintain confidentiality and to comply with data protection regulations.