DATA PRIVACY STATEMENT

1 Responsibility

Responsible for the ascertainment, processing and use of your personal data according to Art. 4 Nr. 7 GDPR  is:

CMM GMBH
Lange Laube 22
30159 Hannover

E-mail: info@cmm-marketing.com
Tel.: +49(0)5111699890

If you want to veto the ascertainment, processing or use of your data according to the requirements of this data protection regulations completely or for particular activities you can always address your veto to the above-named company in charge. You can also save and print this data protection regulation anytime.

2 General purpose of data processing

We use personal data to operate our website

3 What data we use and why

3.1 Hosting

The hosting services we make use of serve to provide the following services:  infrastructure and online platform, storage space, computing capacity, security services as well as technical maintenance services that we make use of for the purpose of operating  our website. We, respectively our hosting provider, process stock data, contact data, content data, service data, meta and communication data, in case this data is submitted voluntarily in our “PressLounge”.  This happens based on our legitimate interest in an efficient and save allocation of our website according to Art. 6 Abs. 1 S. 1 f) GDPR i.V.m. Art. 28 GDPR.

3.2 Access data

We collect information about you while you are using this website. We automatically gather information about your usage pattern and your interaction with us and register data about your computer or mobile device. We ascertain, store and use data about every single access to our website (so-called “Serverlogfiles”). The following is part of this access data:

 

• name and URL of the accessed data
• date and time of access
• amount of transmitted data
• note about successful access (HTTP response code)
• websites that are accessed by the user’s system via our website

We use these server log files without any assignment to your person or other profiling for statistical analysis for the purpose of operational, security and optimization of our website. Hierin does also lie our legitimate interest according to Art 6 Abs. 1 S. 1 f) GDPR. Tracking, statistical analysis or marketing for promotional purposes (e.g. Google Analytics) are explicitly not part of our offer – that perceives itself as a mere B2B service. We reserve the right to retrospectively recheck protocol data if concrete clues lead to a justified suspicion of unlawful usage. We never save IP addresses.  

3.3 Cookies

3.3.1 1st party cookies

We use a so-called session cookie to optimize our website. A session cookie is a small text data that the respective server sends over when a website is visited and that is then buffered on your hard disk. This data itself contains the so-called session ID that makes it possible to assign various requests of your browser to the corporate session. This way, your computer can be recognized whenever you return to our website. These cookies are deleted after you close your browser. Our session cookie can be identified by means of its name: “kohanasession”. A further cookie used on our website whenever it comes to bilingual content (German, English) is called “cmm_site_lang”. This cookie helps us to present our services in a more user friendly way by making it possible to show visitors information from our website that is especially adjusted to their respective tongue. “cmm_site_lang” contains only the input “en” for “English” once this language is chosen and frequently expires after a week. Our legitimate interest in the use of cookies according to Art 6 Abs. 1 S. 1 f) GDPR lies in making our website more user friendly, effective and secure.

Cookies are used to collect the following data and information:

• login information
• language settings

On the basis of cookie technology, we only get pseudonymised information, for example about the language you choose or whether you are currently logged in (for users that use our PressLounge as media partners – for more information on this see paragraph “PressLounge”). You can decide in your browser settings to be informed about cookies beforehand so that you can decide on the acceptance of cookies on an individual basis or in general or even completely prohibit cookies. This may restrict the functionality of respective websites.

3.3.2 3rd party cookies

Our site embeds videos using the services of YouTube LLC , 901 Cherry Avenue, San Bruno, CA 94066, USA, represented by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Usually, when opening up a website with embedded videos, your IP address would be sent to YouTube and cookies would be installed on your machine. However, at cmm-marketing.com we embed our YouTube videos using the extended data protection mode (in this case, YouTube still connects to the Google Service Double Klick, according to Google’s data privacy statement there will not be any processing of personal data though). Thus YouTube will not raise any information about visitors if they do not watch the video. If you click on the video, your IP address is conveyed to YouTube and YouTube learns that you watched the video. If you are logged in to YouTube, this information will be allocated to your user account (you can avoid this by logging out of your YouTube account before watching the video). We have neither knowledge of nor influence on the data raised by youtube in that instance. You can learn more in YouTubes data privacy statement at https://policies.google.com/privacy?hl=en&gl=en

3.3.3 Suppression of third-party cookies

Even after you have agreed to processing, you can still revoke your consent by clicking the corresponding task field at the lower rim of the browser window and revoke that consent there, albeit in that case you won’t be able to watch any embedded YouTube videos. To revoke, simply click on the dark cog icon in the bottom right corner and then click “deny” on the appearing cookie bar. 

3.4 CMM PressLounge

For the registration for our “PressLounge”, we ascertain personal data that we need to fulfill our services, like name, media, postal address, e-mail address of the editor registering or of the media or publisher the editor is working for. Our PressLounge is a secure member area for professional users of our press mailing list and serves as an additional service for the collaboration with media partners that we provide our service for. All data ascertained hereby is submitted voluntarily and can, after registration and login, be reviewed, changed and deleted by the user under “My Account”. Additionally, information, changes or complete deletion of all data can always be done by request after an e-mail to info@cmm-marketing.com. We need the data to – after an examination of the affiliation of a editor to the respective media – send over samples of sound storage media, picture-sound storage media or books and make relevant graphical material the media partens need for publications available for them. Further activities that we need the data for include the coordination of interviews with the artists represented by us and the guest list coordination for journalists with concerts and festivals we supervise. The data is deleted after the end of all collaboration. Data that is linked to the user account (see below) are thus preserved for the time an account is maintained by a user. The legal basis for the processing of this data is Art. 6 Abs. 1 S. 1 a) GDPR, for we need this data to be able to comply with the obligations requested from us by them.

Furthermore, and all in terms of data economy and data avoidance, a completely passive usage of our website to access the journalistic information (such as press releases and pictures in web format) depicted here without a registration for the PressLounge is generally possible and welcome.

4 E-mail contact

If you contact us (e.g. using the contact form or via e-mail), we will use and process your data to  handle your request and in case of follow-up questions. We will only process further personal data in case you agree (Art. 6 Abs. 1 S. 1 a) GDPR) or if we have a legitimate interest in the processing of your data (Art. 6 Abs. 1 S. 1 f) DSGVO). A legitimate interest might e.g. be to answer your e-mail.

5 Storage duration

If specified, we only store personal data as long as needed to comply with and fulfill a request. In some cases, the legislative authority allows for the storage of personal data, for example when it comes to tax law and commercial law. In these cases, data will be stored for legal purposes only  but not processed in any other way and be deleted after the expiration of the lawful statutory storage obligations.

6 Your rights as person concerned with the data processing

According to the applicable law, you have various rights when it comes to your personal data. If you want to claim those rights, please address your request via e-mail or by post and with a possible clear identification of yourself, to the address mentioned in paragraph 1. Hereinafter, you will find an overview of your rights.

6.1 The right to get confirmation and information

You have the right to get clear information about the processing of your personal data. In detail, you have the right to get a confirmation about if personal data related to you is processed by us. In this case, you have the right to get a free information about the data stored by us about you along with a copy of this data. You furthermore have the right to get the following information: 

6.1.1. purposes for processing data;
6.1.2. categories for personal data that is processed;
6.1.3. addressees and categories of addressees that personal information is disclosed or will be disclosed to, especially addressees in third party countries or when it comes to international organisations;
6.1.4. if possible: the planned period for storing the personal data, or, if this is not possible, the criteria for determining this period;
6.1.5. that you have the right to correct or delete personal data related to you or to restrict the processing through the people in charge or completely veto the processing;
6.1.6. that you have the right to file a complaint to controlling institution;
6.1.7. if the personal data is not collected from you, all available information about the origin of the data;
6.1.8. that there is an automatic decision making including profiling according to Art. 22 Abs. 1 und 4 GDPR and – at least in these cases – significant informations about the logic involved as well as about the consequences of such a processing for you. If your personal data is transmitted to a third person country or international organization you have the right to be informed about appropriate guarantees according to Art. 46 GDPR  in connection with this transmission.

6.2 Right to correction

You have the right to demand the correction and if so also completion of personal data related to you from us. In detail: You have the right to demand the immediate correction of incorrect personal data relating to you from us. In consideration of the purposes of processing, you have the right to demand the completion of incomplete personal data –  also using an additional declaration.

6.3 The right to erasure ("right to be forgotten")

In some cases, we are obligated to delete personal data relating to you. In detail and according to Art. 17 Abs. 1 GDPR, you have the right to demand the immediate deletion of of all personal data relating to you, and we are obligated to immediately delete personal data if one of the following causes applies:

6.3.1. The personal data are no longer needed for the purposes for which they were originally ascertained.
6.3.2. You revoke your consent, on which the processing was based on Art. 6 Abs. 1 a) GDPR or Art. 9 Abs. 2) (a) GDPR, and there is no other legal basis for the processing.
6.3.3. You veto the processing according to Art. 21 Abs. 1 GDPR and there are no prior-ranking legitimate reasons for a processing, or you veto the processing according to Art. 21 Abs. 2 GDPR.
6.3.4. The personal data was processed unlawfully.
6.3.5. The erasure of the personal data is necessary to fulfill legal commitments according to the law of Europe or other member states that we are subject to.
6.3.6. The personal data was collected in matters of the services offered by the information society according to Art. 8 Abs. 1 GDP.

In case the personal data gets published and becomes subject to an erasure according to  Art. 17 Abs. 1 GDPR, we will, considering all available technology and costs for implementation, take appropriate (including technical) actions, to inform the one responsible for processing this personal data about your demand to delete all links to these personal data as well as all possible copies and  replicants of the same.

6.4 Right to processing restriction

In certain cases you are entitled to restrict our processing of your personal data. These cases are as follows and you are entitled to restricting our processing of your data if one of the following conditions is met:

6.4.1. You contest the correctness of your personal data in a timespan which allows us to check for the correctness of your data.
6.4.2. Processing would be unlawful and you refused the deletion of your data but instead demanded to restrict the use of your personal data;
6.4.3. We do not need your personal data for processing purposes any longer but you need it to achieve, enact or defend against legal rights, or
6.4.4. You protest the processing according to Art. 21 Abs. 1 GDPR, as long as there has been no decision as to if our enterprises legitimate reasons outweigh yours.

6.5 Right to data portability

You are entitled to receive, transmit or have transmitted by us your personal data in a machine-readable format. In detail: 

You are entitled to receive the personal data you have provided us with sent to you in a structured, common and machine-readable format and also to forward this data to another empowered person without hindrance as long as

6.5.1. Processing is based on an agreement according to Art. 6 Abs. 1 S. 1 a) GDPR or Art. 9 Abs. 2 a) GDPR or a contract according to Art. 6 Abs. 1 S. 1 b) GDPR  and
6.5.2. processing is done using automatized methods.

When enacting your right to data portability according to Absatz 1 you are entitled to have us forward the personal data directly to another empowered person as long as this is technically possible.

6.6 Right to object

You are entitled to object to our rightful processing of your personal data if given reason by special circumstances and if our legitimate reasons do not outweigh yours.

In detail:
You have the right to object against the processing of your personal data which happens according to Art. 6 Abs. 1 S. 1 e) or f) GDPR at any time for reasons arising from your exceptional personal situation; this also applies to any profiling done based on these regulations.

We will refrain from processing your personal data except if we can substantiate reasons urgent and interests worthy of protection outweighing your interests, rights and liberties, or if processing serves achieving, enacting or defending against legal rights. If personal data is processed for direct marketing you have the right to object any time against processing personal data for advertising purposes; this also extends to profiling as long as it is connected to this direct method of advertising. You are entitled to object against processing your personal data for scientific or historical purposes according to Art. 89 Abs. 1 GDPR out of reasons arising from your exceptional situation if processing is not necessary for the fulfillment of a task which lies in the public interest.

6.7 Automated decisions including profiling

You have the right not to be subjected to any decision based on automatized processing -including profiling- which judicially impacts you or otherwise severely impairs you. Automatized decision-making based on your personal data does not happen.

6.8 Right to revoke a data privacy agreement

You have the right to revoke your consent to processing your personal data at any time.  

6.9 Right to file a complaint with a supervisory authority

You are entitled to file a complaint with any supervisory authority, especially in the state of your current location, your workplace or the place of the alleged violation, if you are convinced that processing your personal data is unlawful.

7 Data privacy

We care for the privacy of your personal data to the utmost extent regarding the data protection laws and technical possibilities.
Your personal data will only be transmitted when encrypted. We use the encryption system SSL (Secure Socket Layer) but feel obliged to point out that data transmission on the internet (i.e. when communicating via e-mail) can have security flaws. A flawless protection of your personal data from access by third parties is technically not possible. To keep your data safe, we employ technical and organizational safety measures compliant with Art. 32 GDPR which we always adapt to the current state of technology. We also can not warrant the availability of our services at any time; errors, technical interference and downtimes can not completely be ruled out. The servers we use are being backed up regularly.

8 Data transfer to third parties, no data transfer to non-EU countries

Basically, we only use your personal data inside our company. If and when we employ third parties in the fulfillment of our contracts, these only are provided with the minimum of data necessary for their fulfillment of their service. In case we outsource certain data processing tasks (“mandated data processing”), we contractually place the processor under obligation only to use the personal data in accord with the requirements of data protection and privacy laws and to ensure the affected person’s rights’ safety and security. A data transfer to institutions or persons outside of the EU except for the case mentioned in numeral 4 of this statement does not happen and is not planned for the future.