Data protection policy

Introduction

Many thanks for visiting our website. We take data protection seriously, and as part of our online offer strive to protect your personal data.
Under personal data, we understand all data about a natural person's individual and factual relationships. Personal data collected on our website is only used for in-house purposes.

Legal bases for data processing

Consent: Where your consent has been obtained for processing personal data, Article 6 (1, a) of the EU General Data Protection Regulation (GDPR) forms the legal basis for processing data.
Contract: When processing personal data, Article 6 (1, b) GDPR forms the legal basis for performing a contract to which you are a party. This also applies to processing required for performing contractual measures.
Statutory duty: Article 6 (1, c) GDRP forms the legal basis when personal data needs to be processed for meeting a legal duty to which our company is subject to.
In the event of vital interests of you or another natural person requiring personal data to be processed, Article 6 (1, d) GDPR forms the legal basis.
Legitimate interest: Where the processing is necessary for safeguarding a justified interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh the first-stated interest, Article 6 (1, f) GDPR serves as the legal basis for processing. The justified interests of our enterprise lie in performing our business.

Affected rights

When processing data, your personal data is processed. You are entitled to the rights under the Third Chapter of GDPR vis a vis our company. 
We observe the rights to information, rectification, restriction of processing, erasure or data transferability of your personal data. You can assert these rights as follows:

Right to information

You have the right to demand confirmation from us whether we processes personal data affecting you. Where this is the case, you have the right to information about this personal data and the following details: 
a) the purpose of processing; 
b) the categories of personal data processed; 
c) the recipients or categories of recipients to whom personal data is disclosed or not disclosed, in particular with recipients in third countries or with international organisations; 
d) if possible, the planned duration for storing the data or, where this is not possible, the criteria for setting this duration; 
e) the existence of a right to rectification or erasure of personal data concerning you, or to restriction of processing by the Controller, or a right to object to processing; 
f) the right to lodge a complaint with a supervisory authority; 
g) if the personal data has not been collected from the data subject, all available information about the origin of the data; 
h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. 
Where personal data is transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer. 
We will provide you with a copy of the personal data being processed. We are able to demand reasonable payment for all further copies requested by you to cover administration costs. Where you make an application for information electronically, then we must make the information available in a suitable electronic format unless you state otherwise.
The right to receive a copy may not adversely affect the rights and freedoms of other people. 

Right to rectification 

You also have the right to demand without delay the rectification of incorrect personal data about you. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. 

Right to erasure ('right to be forgotten') 

You have the right to demand from us the erasure of personal data concerning you without undue delay, and we shall erase personal data without undue delay where one of the following grounds applies: 
a) The personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
b) You withdraw your consent on which the processing is based according to point (a) of Article 6(1) GDPR, or point (a) of Article 9(2), and where there is no other legal ground for the processing. 
c) You object to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2). 
d) The personal data has been unlawfully processed. 
e) The personal data has to be erased for compliance with a legal obligation in a Union or Member State law to which we are subject. 
f) The personal data has been collected in relation to the offer of information society services referred to in Article 8(1). 
(2) Where we have made the personal data public and are obliged pursuant to paragraph 1 to erase the personal data, we, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you have requested the erasure by such controllers of any links to, or copy or replication of, this personal data. This does not apply where processing is necessary a) for exercising the right of freedom of expression and information; b) for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us; c) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3); (d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or (e) for the establishment, exercise or defence of legal claims. 

Right to restriction of processing 

(1) The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:
a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
c) the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims, or
d) the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject. 
(2) Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. 4.5.2016 L 119/44 Official Journal of the European Union DE 
(3) A data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction of processing is lifted. 
Article 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it. 

Article 20 Right to data portability 

(1) The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit this data to another controller without hindrance from the controller to which the personal data have been provided, where
a) the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and
b) the processing is carried out by automated means. (2) In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible. 
(3) The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. 
(4) The right referred to in paragraph 2 shall not adversely affect the rights and freedoms of others.
You also have the right to consult our Data Protection Officer with regard to the aforementioned rights as well as all matters in connection with processing your personal data. 
Our clients can also assert your right to complain to the relevant supervisory bodies.

Right to object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
2) Where personal data is processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
3) Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
4) In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.
5) Where personal data is processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), you, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning you, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you are of the view that processing personal data about you breaches GDPR.

Web server logs

When using our online product, connection information is stored in the log server files. 
This information includes:
• IP addresses of the accessing systems
• Browser information such as operating system used and screen resolution
• Website accessed
• Original website
• Time accessed
The web server logs are only processed for security purposes. 
We only use log data for statistical evaluations for the purpose of operating, safeguarding and optimising the product. Nevertheless, we reserve the right to retrospectively examine log data if specific indications point to a justified suspicion of unlawful use.

Contact form

Within the contact form, you have the option of sending us as much data as you want. The data is forwarded by email from our web server to our company's inbox. Please note that communication via the contact form is not encrypted. In your own interests, please use a secure communication channel for secure communication.

Login area

Where data is used for logging a user in, it is only used for providing the respective service. Evaluation only takes place to safeguard convenient and secure system operation. Please contact us by email to delete your customer account.

Google Analytics

This website uses Google Analytics, a web analysis service of Google Inc. ('Google'). Google Analytics uses Cookies, text files stored on your computer that allow analysis of how you use the website. The information generated by the cookie about your usage of this website (including your IP address) is generally passed to and stored on a Google server in the USA. In the event of IP anonymisation activated on this website, your IP address is abbreviated within Member States of the European Union or in other Signatory States to the Agreement on the European Economic Area beforehand. The full IP address is only forwarded to and abbreviated on a Google server in the USA in exceptional cases. Google will use this information on behalf of the website's operator to evaluate your use of the website, compile reports about website activity for the website operator, and to provide the website operator with services associated with use of the website and internet. The IP address provided from your browser by Google Analytics is not combined with other data from Google. You can prevent the storage of cookies by setting your browser software appropriately. However, we would like to point out that in this case, not all functions of this website may work to their full extent. You can also prevent the collection of data generated by the cookie and referring to the use on your website (including your IP address) by Google and also the processing of this data by downloading and installing the browser plugin available via the following link tools.google.com/dlpage/gaoptout.
We have entered into a contract with Google Germany GmbH - GOOGLE ANALYTICS DEUTSCHLAND ensuring that personal data is only generally processed within Europe in accordance with our instructions. IP anonymisation (IP mask method) is activated on our website, whereby the IP address is automatically anonymised. 
You will find further information about Google Analytics and data protection at the website https://www.google.com/intl/de/analytics/privacyoverview.html.

Cookies

This website uses cookies. Cookies are text files stored on your device. Cookies can be read, transferred and modified by the website when it accesses them. We only use cookies with random, pseudonymised identification numbers. These identification numbers are used for evaluating your behaviour on our website. At no time can the usage profile be associated with the name of a natural person. If you use special functions (such as the shopping cart or 'stay logged in') of our website, cookies are also used for these functions. 
It is always possible to object to the setting of cookies by appropriately changing the setting in the internet browser. Cookies set can be deleted. It is pointed out that when disabling cookies, not all functions of our website may be used in full.
You can find out the exact functions of cookies in the more detailed information in this data protection policy.

Google AdWords

Our website uses Google AdWords Conversion Tracking. This is an analysis service of Google Inc. (XXXXX ). The service places a cookie on your computer where you reach our site via a Google advert. We do not use the cookie to personally identify you. It is only used for identifying whether a user has reached our website via an advert purchased by us. It allows via which advert you visited our website to be identified and whether you then surfed our website again. We use the findings of this analysis to be able to target our advertising more. 
You will find further information as well as Google's data protection policy at: http://www.google.de/policies/privacy/

Google Maps

For a better illustration, we link to the subpages [listing] a letter provided by Google Inc. servers. Viewing the letter creates a link to the Google server, whereby the IP address is passed to Google among other things. Google also has the option of writing and reading cookies. These cookies may involve Google user cookies directly linked with your identity. You can find further information about Google Maps in the data protection conditions and conditions of use.

Data protection contact

The Controller for processing data in the sense of Article 4 (7) GDPR is 
Axxence Aromatic GmbH
Tackenweide 28
Tel: + 49 2822 685610
Email: service(at)axxence.com

Legal representative

Ivo Litjens
Ron Honing
Peter van der Schaft

Data Protection Officer

Sicoda GmbH
Oliver Gönner
Rochusstraße 198
53123 Bonn
Tel: 0228 28614060
Email: dataprivacy(at)axxence.com