Data protection

Privacy policy for the website at www.igbce-bonusagentur.de operated by

IGBCE Bonusagentur GmbH,
Fischerstr. 5,
30167 Hanover – hereinafter referred to as IGBCE Bonusagentur.

IGBCE Bonusagentur attaches the utmost importance to the careful handling of the personal data of users and its members. Data privacy, as well as all laws and regulations enacted to protect it, form the basis of all our data processing operations.

Access data is stored by default whenever a file is requested from the website.

Each data record consists of:

1. the page from which the file was requested
2. the name of the file
3. the date and time of the request
4. the amount of data transferred
5. the access status (file transferred, file not found, etc.)
6. a description of the type of web browser used
7. the anonymised IP address of the requesting computer

The stored data is evaluated exclusively for internal statistical purposes and for the technical administration of the websites; it is not passed on to third parties, even in part.

Furthermore, personal data is only stored if you provide it to us voluntarily, for example, to enable us to provide a service.

As a rule, you can visit the IGBCE Bonus Agency website at www.igbce-bonusagentur.de without providing any personal data. However, if you wish to actively use the services at www.igbce-bonusagentur.de, the following data must be collected from you:

1. when registering for the members’ area: registration is carried out exclusively using your membership number and date of birth
2. when subscribing to the “Bonusagentur aktuell” newsletter: surname, first name, email address
3. when using the contact form: surname, first name, email address, optional membership number, enquiry

IGBCE membership is verified using the membership number in combination with the date of birth.

Once entered, this data is never stored in our system, but is forwarded to the IGBCE solely for the purpose of verifying membership.

All data that you voluntarily provide to us when using our services (contact form) is stored in our system.

IGBCE Bonusagentur requires personal data when you register for the members’ area of the website or when we provide a service.

When subscribing to the newsletter “Bonusagentur aktuell”, the provision of your name and email address is used solely for the purpose of sending the newsletter.

The provision of your personal data in connection with the use of the contact form or other services is used solely to provide the service you have requested, such as sending information by email or post.

We only disclose data to third parties where this is necessary for the provision of our services. These third-party providers are obliged to treat the data received from us as confidential and to use it exclusively for the purposes of providing the service and conducting business on our behalf.

We assure you that, apart from the purposes set out above, we will not sell, pass on or make the data entrusted to us available to third parties.

In specific cases, IGBCE Bonusagentur is legally obliged to disclose users’ personal data to third parties, in particular to government authorities in the context of criminal investigations.

In the event that misuse is reported by other users, the disclosure of user data is subject to the condition that there are clearly substantiated and documented grounds for doing so.

By registering, you expressly consent to the collection, processing and use of your personal data.

You may request information about the status of your stored data at any time, free of charge.

You may request the deletion of your data at any time.

Our newsletter keeps you informed about us and our offers. If you would like to receive the newsletter, we need a valid email address from you; your first name and surname are optional and are used solely to address you personally in the newsletter. Data processing in connection with the sending of our newsletter is therefore carried out exclusively on the basis of the consent you have given us (Art. 6(1)(a) GDPR). This data is used solely for the purpose of sending the newsletter and is not passed on to third parties.

When you subscribe to the newsletter, we store your IP address and the date of subscription. This storage serves solely as evidence in the event that a third party misuses an email address and subscribes to the newsletter without the authorised person’s knowledge. After subscribing to the newsletter, you will receive an email containing an activation link. By clicking on the link, you confirm that you wish to subscribe to the newsletter and that you have read and understood the privacy policy.

You may withdraw your consent to the storage of your data and email address, as well as their use for sending the newsletter, at any time. You can do this via a link in the newsletters themselves or via the website www.igbce-bonusagentur.de/newsletter.

We send our newsletter using the newsletter service CleverReach (CleverReach GmbH & Co. KG, Mühlenstr. 43, 26180 Rastede, Germany). CleverReach is a member of the Certified Senders Alliance. We only transfer your name and email address to CleverReach for the sole purpose of sending the newsletter on our behalf. Your data is stored by CleverReach in such a way that other CleverReach customers or third parties have no access to this data. Further information can be found in CleverReach’s privacy policy.

Data protection compliance for our CleverReach account is enabled. This ensures that the use of data is 100% compliant with data protection regulations. In the reports, data relating to recipients who open and click on emails is displayed anonymously. Enabling this feature also prevents the collection and processing of full IP addresses.

The content of our website has been compiled with the utmost care. However, we cannot guarantee that the content is accurate, complete or up to date. As a service provider, we are responsible for our own content on this website in accordance with Section 7(1) of the German Telemedia Act (TMG) and general legislation. However, pursuant to Sections 8 to 10 of the German Telemedia Act (TMG), we, as a service provider, are not obliged to monitor transmitted or stored third-party information or to investigate circumstances that indicate illegal activity. Obligations to remove or block the use of information in accordance with general laws remain unaffected by this. However, liability in this regard is only possible from the time we become aware of a specific legal infringement. Should we become aware of any such infringements, we will remove the content immediately.

The content and works on these pages created by the site operators are subject to German copyright law. The reproduction, adaptation, distribution and any form of use beyond the limits of copyright law require the written consent of the respective author or creator. Downloads and copies of this site are permitted only for private, non-commercial use. Where the content on this site has not been created by the operator, the copyrights of third parties are respected. In particular, third-party content is identified as such. Should you nevertheless become aware of a copyright infringement, please notify us accordingly. Upon becoming aware of any infringements, we will remove such content immediately.

This website uses Matomo, a self-hosted open-source software, to collect anonymous usage data for this website.

Data on visitor behaviour is collected to identify any issues such as pages not found, search engine problems or unpopular pages. Once the data (number of visitors seeing error pages or only one page, etc.) has been processed, Matomo generates reports for the website operators so that they can respond accordingly (layout changes, new content, etc.).

Matomo processes the following data:

1. Cookies
2. Anonymised IP addresses by removing the last 2 bytes (i.e. 198.51.0.0 instead of 198.51.100.54)
3. Pseudo-anonymised location (based on the anonymised IP address)
4. Date and time
5. Title of the page visited
6. URL of the page visited
7. URL of the previous page (where permitted)
8. Screen resolution
9. Local time
10. Files that have been clicked on and downloaded
11. External links
12. Page load time
13. Country, region, city (with low accuracy based on IP address)
14. Browser’s primary language
15. Browser user agent
16. Interactions with forms (but not their content)

When you use this website, your visit is recorded by the website’s host (visionconnect.de). This server log contains your IP address, which indirectly identifies you via your internet service provider. The recording of this data is required by law and necessary for security purposes. There is no option to opt out, but the data will never be used for any other purpose.

Data processing is based on the principle of legitimate interest.

Processing the data helps us identify what works on our site and what doesn’t. For example, it enables us to determine whether the content is well received or how we can improve the website’s structure. Our team benefits from this and can act on it. As a result of data processing, you therefore benefit from a website that is constantly improving.

Without this data, we would not be able to provide the service. Your data is used exclusively to improve the user experience of the website.

Your personal data will be sent to:

1. us (the team at igbce-bonusagentur.de)
2. IGBCE Bonus Agency (visionconnect.de)

The data from this website and Matomo is hosted in Germany. The data never leaves the EU.

As Matomo collects data on the basis of legitimate interest, you may exercise the following rights:

1. Right of access and data portability: you may request all your data at any time.
2. Right to erasure and rectification: you may request at any time that we completely erase all your data.
3. Right to object and restrict processing: you may object to the collection of data at any time.
4. The right to lodge a complaint with the data protection authority

If you believe that the way we process your data using Matomo violates the law, you have the right to lodge a complaint with the data protection authority.

You may request that the controller erases your personal data without delay, and the controller is obliged to erase such data without delay if any of the following grounds apply:

1. The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
2. You withdraw your consent on which the processing was based pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing.
3. You object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR.
4. The personal data concerning you has been processed unlawfully.
5. The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union law or the law of the Member States to which the controller is subject.
6. The personal data concerning you was collected in relation to information society services offered pursuant to Article 8(1) of the GDPR.

If the controller has made the personal data concerning you public and is obliged to erase it pursuant to Article 17(1) of the GDPR, the controller shall, taking into account available technology and the cost of implementation, take reasonable steps, including technical measures, to inform controllers who process the personal data that you, as the data subject, have requested the erasure of all links to such personal data or of copies or replications of such personal data.

The right to erasure does not apply where the processing is necessary

1. for the exercise of the right to freedom of expression and information
2. to comply with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
3. for reasons of public interest in the area of public health pursuant to Article 9(2)(h) and (i) and Article 9(3) of the GDPR
4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the GDPR, insofar as the right referred to in point (a) is likely to render impossible or seriously impair the achievement of the objectives of such processing
5. or for the establishment, exercise or defence of legal claims.

In accordance with Article 15 of the GDPR and Section 34 of the BDSG, you have the right to request information as to whether, and if so to what extent, we process personal data relating to you.

If you have exercised your right to rectification, erasure or restriction of processing against the controller, the controller is obliged to notify all recipients to whom your personal data has been disclosed of such rectification, erasure or restriction of processing, unless this proves impossible or involves disproportionate effort.

You have the right to be informed by the controller of these recipients.

You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that

1. the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, or on a contract pursuant to Article 6(1)(b) of the GDPR, and
2. the processing is carried out by automated means.

In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, insofar as this is technically feasible. The freedoms and rights of other individuals must not be adversely affected by this.

The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you carried out on the basis of Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions.

The controller shall no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Where personal data concerning you is processed for the purposes of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing.

If you object to processing for the purposes of direct marketing, the personal data concerning you will no longer be processed for these purposes.

You have the option, in connection with the use of information society services – notwithstanding Directive 2002/58/EC – to exercise your right to object by means of automated procedures.

You have the right to withdraw your consent under data protection law at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to withdrawal.

You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

1. is necessary for the conclusion or performance of a contract between you and the controller,
2. is authorised by Union or Member State law to which the controller is subject, and that law provides for appropriate measures to safeguard your rights and freedoms and your legitimate interests, or
3. is based on your explicit consent.

However, such decisions must not be based on special categories of personal data as referred to in Article 9(1) of the GDPR, unless Article 9(2)(a) or (g) of the GDPR applies and appropriate measures have been taken to safeguard your rights and freedoms as well as your legitimate interests.

With regard to the cases referred to in (1) and (3), the controller shall take appropriate measures to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place where the alleged infringement occurred, if you consider that the processing of personal data relating to you infringes the GDPR. The competent authority for IGBCE Bonusagentur GmbH is the State Data Protection Commissioner of Lower Saxony.

Karl-Heinz Rohlfing, Chartered Engineer
Rohlfing Consultancy and Expert Services, Hangbaumstraße 11, 32257 Bünde
Tel.: +49 5223 49 239 90

Andreas Schwarz
Staufer Straße 13, 67133 Maxdorf
Tel.: +49 151 4180 6912

Data Protection Officer IGBCE Bonusagentur GmbH & IGBCE Bonusassekuranz GmbH

Email: datenschutz@igbce-bonusagentur.de