General notices
We are pleased that you are visiting our online shop and thank you for your interest. In the following, we inform you about the handling of your personal data when using our online shop.
1. Who is responsible for processing your personal data?
State Ministry of Baden-Württemberg Richard-Wagner-Straße 15
70184 Stuttgart
Telephone: +49 711 / 2153-0
E-mail: poststelle@stm.bwl.de
2. Contact for data protection
You can reach our data protection officer at the State Ministry at:
State Ministry of Baden-Württemberg
Data Protection Officer
Richard-Wagner-Straße 15
70184 Stuttgart
Datenschutz@stm.bwl.de
3. For what purposes and on what legal basis do we process personal data and how long is it stored?
We collect, process and use personal data for the purposes described below on the legal basis described below, in particular for the provision of the online shop and the processing of orders.
(1) Registration | user account
You can either place orders via our website as a guest without registering or register in our shop as a customer for future orders. Registration has the advantage for you that you can log in directly to our shop with your e-mail address and password should you wish to make an order in future without having to enter your contact details again.Your personal data is entered in an input mask and transmitted to us and stored. The data you provide during registration will be processed by us on the basis of a user agreement pursuant to Article 6(1) sentence 1 b) GDPR in order to assign the orders you placed with us to your user account. When you register and log in to your user account, the date and time of registration are also stored. The legal basis is Art. 6(1) 1 f) GDPR. Legitimate purposes are the evaluation of access to the protected areas of our website, ensuring the integrity of our online shop and the prevention of misuse by individual users. You have the option of deleting your customer account at any time in the customer area. Your data stored for the customer account will then be deleted subject to statutory retention periods.
(2) Order
When you place an order via our website, we first collect the following data, both in the case of a guest order and in the case of registration in the shop:
-
Salutation, first name, last name
-
A valid e-mail address
-
Invoice and, if applicable, delivery address
-
Telephone number, if applicable (landline and/or mobile)
-
Contents of the order
-
Invoice and payment details
-
Company name and VAT ID no., if applicable
This data is collected
-
in order to be able to process, fulfil and handle your order;
-
for correspondence with you;
-
for invoicing;
- to manage our customer data for registered customers.
The data processing is carried out in response to your order and is required pursuant to Article 6(1) sentence 1 b) GDPR for the stated purposes for appropriately processing your order and for the performance of our obligations arising from the purchase agreement. In addition, we process your e-mail address in accordance with Article 6(1) sentence 1 c) GDPR, as we are legally obliged to send you an electronic order confirmation. We store the personal data collected by us for the processing of your order until the expiry of the statutory or possible contractual warranty and guarantee rights (usually two years statutorily). After expiry of this period, we shall delete your data unless we are obliged to store it for a longer period of time pursuant to Article 6(1) sentence 1 c) GDPR due to tax and commercial law retention and documentation obligations (under the German Value Added Tax Act (UStG), German Commercial Code (HGB), German Criminal Code (StGB) or German Fiscal Code (AO)) or you have consented to storage beyond this pursuant to Article 6(1) sentence 1 a) GDPR.
(3) Enforcement of rights
Insofar as this is necessary for the assertion, exercise or defence of legal rights/claims (e.g. in the event of payment defaults), we may also process your personal data on the basis of our legitimate interests in the enforcement of rights pursuant to Article 6(1) sentence 1 lit. f GDPR.
d) Contact form | contact via e-mail
If you would like to send any enquiries to us via the contact form on our website or via e-mail, the information you enter in the form (including any contact data you provide) will be stored by us for the purpose of processing your enquiry and any follow-up questions which may arise. The processing of the data entered in the contact form is based on Article 6(1) sentence 1 b) GDPR, insofar as it is necessary for the performance of the contract or the implementation of pre-contractual measures, and otherwise based on our legitimate interests pursuant to Article 6(1) sentence 1 f) GDPR. Our legitimate interests lie in responding to user enquiries. The data will be deleted after final processing of your enquiry, but at the latest after the expiry of the calendar year since the last contact with you, insofar as we are not legally obliged to store the data beyond this point. Please note that data is generally not always transmitted securely on the Internet. Especially in e-mail traffic, protection cannot be guaranteed when exchanging data.
4. Disclosure of data to third parties and other recipients
We only transmit personal data to third parties if this is necessary for the purpose of performing the contract, such as to companies shipping our goods or banks handling our payment transactions. No further transmission of data to third parties will take place unless you have expressly consented to this; in particular, we will not pass on your data to recipients based outside the European Union or the European Economic Area. In order to process your order, we pass on the data to the third parties named below. In addition, we use the service providers listed under “Other recipients” who process the data on our behalf.
a) Shipping service provider
We use the external logistics service providers DHL/Deutsche Post (DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany) and DPD (DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg, Germany) to execute the contract. We will pass on your name and delivery address to them insofar as this is necessary for the delivery of the goods you ordered. The legal basis is Art. 6(1) 1 b) GDPR. We also pass on further contact information (in the case of DHL the e-mail address and in the case of DPD the e-mail address and telephone number) to the respective shipping service provider for the purpose of coordinating a delivery date or receiving a delivery notification by the shipping service provider, provided you have given your express consent for this in the ordering process (Article 6(1) sentence 1 a) GDPR). Consent may be revoked at any time with effect for the future vis-à-vis the controller named above or vis-à-vis the transport service provider.
b) Payment service providers
General provisions
In addition, your payment data will be passed on to the payment service provider commissioned by us or selected by you in the ordering process as well as to the credit institution instructed to effect payment, insofar as this is necessary for processing the payment. The legal basis for this is Article 6(1) sentence 1 b) GDPR.
PayPal
Among other services, our website offers payment via PayPal. The provider of this payment service is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg (hereinafter “PayPal”). PayPal reserves the right to conduct a credit check for the payment methods credit card via PayPal, direct debit via PayPal or “purchase on account” via PayPal. PayPal uses the result of the creditworthiness assessment with regard to the statistical probability of non-payment for the purpose of deciding on the provision of the respective payment method. Further information on data protection can be found in the PayPal Privacy
Statement: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
c) Other recipients
Fulfilment partner
Verlagsgesellschaft W.E. Weinmann e.K.
The publishing company Verlagsgesellschaft W.E. Weinmann e.K., Karl-Benz-Str. 19, 70794 Filderstadt, Germany, has been commissioned by us to support the online shop in the areas of communication, logistics and the dispatch of goods and processes your personal data for these purposes on our behalf and on our instructions (Article 28 GDPR).
Design and conception
Jung von Matt NECKAR GmbH
The agency Jung von Matt NECKAR GmbH has been commissioned by us to support the online shop in the areas of design, conception and configuration of the online shop and processes your personal data for these purposes on our behalf and on our instructions (Article 28 GDPR).
Online shop hosting
For hosting our online shop, we use the service provider Gambio GmbH, Parallelweg 30, 28219 Bremen, Germany, who performs the associated data processing on our behalf and on our instructions (Article 28 GDPR).
5. What rights do you have?
a) Right of cancellation
Insofar as we process your data on the basis of your consent pursuant to Article 6(1) sentence 1 a) GDPR, you may revoke your consent at any time with future effect. Withdrawal of consent does not affect the lawfulness of any processing based on consent before its withdrawal. For the revocation, an informal message to us using the contact data mentioned under section 1 or 2 suffices.
b) Right of objection
You may object to the processing of your personal data insofar as it is based on Article 6(1) sentence 1 f) GDPR (“legitimate interests”) (Article 21 GDPR). Your personal data will no longer be processed unless there are compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or if the processing is for the purposes of asserting, exercising or defending legal rights/claims. To exercise the right of objection, it is sufficient to send a short message to the contact details provided under section 1 or 2.
c) Rights of data subjects
In addition, you may – if the applicable legal requirements are met and subject to any restrictions pursuant to sections 9, 10 of the Data Protection Act of the State of Baden- Württemberg (LDSG BW) – make use of the following rights, which you can exercise by contacting us at any time using the data specified in sections 1 and 2:
Right of access pursuant to Article 15 GDPR: You have the right to obtain information about your personal data processed by us (the processing purposes, the categories of personal data processed, the recipients or categories of recipients to whom your data has been or will be disclosed, the planned storage period or criteria for determining the storage period, the existence of a right to rectification, erasure, restriction of processing, objection to processing, complaint to a supervisory authority, the origin of your data if it has not been collected from you by us, the existence of automated decision-making including profiling and, if applicable, meaningful information about the logic involved and the scope and the intended effects of such processing concerning you, as well as your right to be informed about the guarantees existing pursuant to Article 46 of the GDPR if your data is transferred to third countries) and to a copy of the data;
-
Right of rectification pursuant to Article 16 GDPR: You have the right to have any incorrect data relating to you corrected without delay and/or to have any incomplete data stored by us completed;
-
Right to erasure pursuant to Article 17 GDPR: You have the right to demand the erasure of your personal data if the requirements of Article 17(1) GDPR are met. However, this right shall particularly not exist if processing is necessary for exercising the right to freedom of expression and information, for fulfilling a legal obligation, for reasons of public interest or for asserting, exercising or defending legal rights/claims;
-
Right to restriction of processing pursuant to Article 18 GDPR: You have the right to request the restriction of the processing of your personal data as long as the accuracy of your data that you dispute is being verified, if you refuse the erasure of your data due to unlawful data processing and instead request the restriction of the processing of your data, if you require your data for the assertion, exercise or defence of legal rights/claims after we no longer need this data after the purpose has been achieved or if you have lodged an objection on the grounds of your particular situation as long as it has not yet been determined whether our legitimate grounds outweigh your interests;
-
Right to be informed pursuant to Article 19 GDPR: If you have exercised your right of any rectification or erasure of personal data or restriction of processing vis-à-vis the controller, the controller is required to communicate any rectification, erasure or restriction of processing of personal data to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to obtain information about those recipients.
- Right to data transferability pursuant to Article 20 GDPR: You have the right to receive the personal data, which you have provided to us, in a structured, commonly used and machine-readable format or to require its transmission to another controller as long as this is technically feasible;
d) Right to lodge a complaint
If you believe that the processing of personal data concerning you infringes the GDPR, you have the right to appeal to a supervisory authority, in particular in the Member State of your residence, workplace or the place of the alleged infringement, in accordance with Article 77 of the GDPR, without prejudice to any other administrative or judicial remedy. The supervisory authority with jurisdiction over us is the State Commissioner for Data Protection and Freedom of Information in Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.
6. Data security
This website uses SSL encryption for security purposes and to protect the transmission of confidential content, such as inquiries which you have sent to us. You can recognise an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in your browser line.