ONLINE PRIVACY

1. Information about collecting personal data

The following provides information on the processing of personal data when using our websites www.elo.com/de-de, www.elo.com/en-de, www.elo.com/fr-fr/, www.elooffice.com, www.elooffice.com/blog, forum.elooffice.com, pages.elo.com and partner.elo.com (all referred in the following as "website") with this Privacy Policy. Personal data is all information referring to an identified or identifiable natural person (see Art. 4 No. 1 General Data Protection Regulation, "GDPR" in the following). This includes information such as your name, e-mail address, usage data, or address. Information that cannot be directly connected with your identity, for example, the number of users of a website, is not considered personal information.

2. Name and address of the processor

a) The processor as per Art. 4 Sec. 7 GDPR is:
ELO Digital Office GmbH
Tuebinger Str. 43
70178 Stuttgart
Tel.: +49 711 806089 - 0
dsb[at]elo.com
www.elo.com

b) Name and address of the data protection officer
You can reach our data protection officer at the e-mail address below or at our mailing address by specifying 'Data protection officer'.

3. General information on data processing

a) Scope of processing of personal data
We will only process your personal data provided necessary to provide a functional website and for our contents and services. Your personal data is only processed regularly if you have provided consent. An exception shall apply if it is not possible to obtain your consent ahead of time due to practical reasons and legal provisions allow for data processing in this case.

b) Legal basis for processing of personal data
Provided we obtain your consent to process your personal data, Art. 6 Sec. 1 a GDPR shall serve as the legal basis. When processing personal data required to fulfil a contract of which you are a contractual party, Art. 6 Sec. 1 b GDPR shall serve as the legal basis. This also applies to processing required to carry out pre-contractual duties. Should processing of personal data be required to fulfil a legal obligation of our company, Art. 6 Sec. 1 c GDPR shall apply as the legal basis. If processing is necessary to protect an entitled business interest of our company or a third-party, and your interests, basic rights, and basic freedoms do not outweigh the former interest, Art. 6 Sec. 1 f GDPR shall apply as the legal basis for processing.

c) Data deletion and storage periods
Your personal data is deleted or locked once there is no longer reason to save and collect it, or if you request us to delete or lock it. For more information, refer to the section on the rights of data subjects. Data may also be stored if provided by European or national legislation in harmonized regulations, laws, or other provisions ELO is governed by. Data is also locked or deleted when a retention period set by the named standards expires, unless it should become necessary to retain the data to conclude or fulfil a contract.

4. Proper processing of personal data

a) Processing personal data when visiting our website
When using the website for informational purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the personal data your browser transmits to our server. The log files contain IP addresses or other data that enable association with a user. For example, this could be the case if the link with which the user accesses the website or the link to the website to which the user switches contains personal data. If you would like to view our website, we collect the following data with the help of the server log file:

  • User IP address
  • Date and time of access/request
  • Time zone difference to Greenwich Mean Time (GMT)
  • Content of the request (concrete page)
  • Access status/HTTP status code
  • Transmitted data
  • Website from which the request originates
  • Browser type and version used
  • Operating system and interface
  • Language and version of the browser software.

b) Legal basis for data processing
The legal basis for temporary storage of data and log files is Art. 6 Sec. 1 f GDPR.

c) Purpose of data processing
Temporary storage of the IP address by the system is necessary in order to provide the website to your computer. The IP address has to remain stored over the duration of the session. It is stored in log files in order to ensure the functionality of the website. In addition, the data helps us optimize the website and ensure the security of our IT systems. In this context, the data is not analyzed for marketing purposes.

d) Retention period
The data is deleted once it is no longer necessary to achieve the purpose for which it was collected. If data is collected to provide the website, this is the case when the session is ended. If data is stored in log files, this is the case within seven days. Extended storage is possible. In this case, user IP addresses are deleted or disguised so that it is no longer possible to associate them with the respective client.

e) The right to object and rectification
It is necessary to collect data for the website and store this data in log files to operate the website. The user does not have the right to object. Regardless and provided your personal data is processed, you are considered the data subject as per GDPR and are entitled to the the rights listed below with regard to the processor (ELO).

5. Use of cookies

a) Description and scope of data processing
Our website uses cookies. Cookies are designed to improve our website's usability and to enable certain functions. Cookies are small text files that are assigned to the browser you use and stored on your hard disk. They are used to provide the party setting the cookie (in this case, us), with specific information. Cookies are either stored on your hard drive or device memory and cannot cause damage to your computer system. The cookies we use do not give us access to any personal information about you. Cookies cannot run any programs or transmit any viruses to your computer. Cookies help us to make the website more user-friendly and effective in general, and enabling cookies means that you do not have to enter the same data twice when you visit the website again. Additionally, cookies allow us to serve you specific content and respond to your individual preferences as well as trace the most popular site elements.

b) Use of cookies
We use the following types of cookies whose scope and functionality are explained below:
- Transient cookies
- Persistent cookies

Transient cookies are automatically deleted when you close the browser. This includes session cookies in particular, which save a so-called session ID that enables association of various requests from your browser to the joint session. As a result, your computer can be recognized when you return to our website. The session cookies are deleted when you log out or close the browser.

Persistent cookies are automatically deleted after a defined period, which can vary depending on the cookie. You can delete the cookies at any time in your browser's security settings.

You can configure your browser settings as needed and reject cookies from third parties or all cookies. Please note that you may not be able to use all functions of this website.

c) What type of cookies do we use and for what purposes?
Strictly necessary cookies:
These are essential to navigate around a website and use its features. Without them, you would not be able to use services like logging in to your personal account and managing your login status during the Internet session.

Non-essential cookies:
On our website, we also use cookies that enable an analysis of the user's browsing habits. In this way, we can determine the entered search terms, frequency of page access, and use of website functions, for example.

Technical measures are taken to pseudonomyze data collected in this way. After, it is no longer possible to associate this data with you. The data is not saved together with other personal data of yours. When you access our website, you are notified that we use cookies for analysis purposes and asked to provide us your consent to process the personal data used in this context. You will then be referred to the Privacy Policy. You can block the storage of cookies in your browser settings.

Third-party cookies:
Third-party cookies (also non-essential cookies) are cookies set by other organizations and that embed third-party content into our website. These cookies do not contain any personal data. This data is anonymized and is not linked in any way to your personal information. It serves to enable external companies to target advertising to you.

d) Legal basis for data processing
The legal basis for the processing of personal data using technically necessary and non-essential cookies is Art. 6 Sec. 1 f GDPR. The legal basis for processing personal data using cookies for analysis purposes with the consent of the user is Art. 6 Sec. 1 a GDPR.

e) Purpose of data processing
The purpose of technically necessary cookies is to simplify website use for users. Some functions on our website cannot be offered without the use of cookies. These require the browser to be recognized even after changing sites.

We require cookies for the following applications:
Transient cookies:
- Partner login when registering for events on the website: www.elo.com/de-de/events/online-anmeldung.html
- Backend logon for editors to maintain website content
- Logging on and using the "My ELOoffice" at www.elooffice.com/
- Extended use for ELOoffice users who have registered their product in the "My ELOoffice" area at www.elooffice.com
- Carrying out the selection, ordering, purchase, and payment process in the https://shop.elooffice.com online shop

Persistent cookies:
- Displaying the cookie notice on our websites
- Displaying an additional notice regarding the actual content of www.elooffice.com

Usage data collected via technically necessary cookies is not used to create user profiles.

Non-essential cookies, especially analysis cookies, are used in order to improve the quality of our website and its contents. Analysis cookies inform us how the website is used, allowing us to continually optimize our offering.

This also forms our interest in processing personal data as per Art. 6 Sec. 1 f GDPR.

We use the following third-party cookies

Google Analytics
(1) This website uses Google Analytics, a web analytics service provided by Google, Inc. ("Google"). Google Analytics uses "cookies," which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of this website will be transmitted to and stored by Google on servers in the United States. If IP anonymization is activated on this website, Google will first shorten the IP address of the users within the member states of the European Union or in other states which are party to the Agreement on the European Economic Area (Section 4). Only in exceptional cases will the full IP address be sent to a Google server in the USA and shortened there. Google will use this information to analyze the use of the website by the users, to compile reports on the website activities, and to provide the operator of the website with other services related to the use of the website and the use of the Internet.

(2) The IP address transmitted by your browser to Google Analytics is not pooled with other Google data.

(3) You can block the storage of cookies by changing the settings in your browser software; please note that in this case you may not be able to use all functions of this website in full. Additionally, if you do not want the information generated by the cookie about your use of the website (including your IP address) to be transmitted to and stored by Google, you can download and install the browser add-on at the following link: tools.google.com/dlpage/gaoptout.

Deactivate Google Analytics

(4) This website uses Google Analytics with the add-on "_anonymizeIp()". The IP addresses are processed in their shortened form, and therefore cannot be linked directly to you. Provided the data collected on you contains a personal identifier, it is immediately excluded and the personal data can be deleted right away.

(5) We use Google Analytics to analyze and regularly improve the use of our website. The statistics we gain allow us to improve our offering and make our website more interesting to you as a user. For exceptions when personal data is transmitted to the United States, Google is subject to the EU-US Privacy Shield, www.privacyshield.gov/EU-US-Framework. The legal basis for the use of Google Analytics is Art. 6 Sec. 1 S. 1 f GDPR.

(6) This website also uses Google Analytics to analyze streams of visitors across devices via user IDs. You can disable cross-device usage analysis in your customer account under "My data" -> "Personal data".

(7) Information on the third-party provider: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Terms of service: www.google.com/analytics/terms/us.html, data privacy and security overview: support.google.com/analytics/answer/6004245 and privacy policy: policies.google.com/privacy.

Visual Website Optimizer
(1) This website analyzes usage data via A/B testing. As a result, we can display our websites with slightly varying content. This allows us to analyze and regularly improve our offering, and make our website more interesting to you as a user. We do not collect any personal data. The legal basis for A/B testing is Art. 6 Sec. 1 S. 1 f GDPR.

(2) Cookies are stored on your computer for this purpose.

(3) You can prohibit testing by deleting existing cookies and blocking the storage of cookies. If you block the storage of cookies, please note that you may not be able to use all functions of our website in full. You can block cookies by adjusting the settings in your browser. If you do not want Visual Website Optimizer to collect and store anonymous and non-personally identifiable data, you can opt out at this link (http://visualwebsiteoptimizer.com/opt-out.php). By copying the URL you want to visit to the field provided, the website generates a new link, which enables you to use the website without your usage data being tracked. Please note that this is not a setting that is saved, meaning that you need to generate the link when you visit the website again or when you visit another website.

(4) Before analysis, the IP addresses are processed in shortened form. These analyses therefore cannot be linked directly to you. The IP address transmitted by your browser is not pooled with other data we have collected.

(5) The analysis service provider is Visual Website Optimizer (an offering of Wingify Software Private Limited, 404, Gopal Heights, Netaji Subhash Place, Pitam Pura, Delhi 110034, India). For more information on data privacy policy of the third-party provider, refer to vwo.com/privacy-policy/.

eTracker Analytics
(1) This website uses technologies of etracker GmbH (http://www.etracker.com) to gather and store data for marketing and optimization purposes. The data collected may be used to create user profiles under a pseudonym. Cookies can be used to this end. For more information, refer to Point 5a. The data collected with eTracker technologies is not used to personally identify the visitors to this website or pooled with personal data via the anonymous profile without the express consent of the data subject. You can opt out of data collection and storage at any time with future effect. Visit the following link for this purpose: www.etracker.de/privacy

(2) We use eTracker to analyze and regularly improve the use of our website. The statistics we gain allow us to improve our offering and make our website more interesting to you as a user. Collected data is stored permanently and analyzed anonymously. The legal basis for the use of eTracker is Art. 6 Sec. 1 S. 1 f GDPR

(3) Information from the third-party provider: etracker GmbH, Erste Brunnenstraße 1, 20459 Hamburg; www.etracker.com/en/data-privacy/. The legal basis for the use of eTracker is Art. 6 Sec. 1 S. 1 f GDPR.

f) Retention period, right to object and rectification
Cookies are stored on your computer, which sends them to us. As a user, you have full control over cookie usage. You can block or restrict the transmission of cookies by adjusting the settings in your web browser. You can also delete existing cookies at any time. This can be done automatically. If you block cookies for our website, you may not be able to use all functions of the website in full.

In addition and provided your personal data is processed, you are considered the data subject as per GDPR and are entitled to the the rights listed below with regard to the processor (ELO).

6. Newsletter

a) Description and scope of data processing
On our website or as part of prize draws or surveys, you have the option to subscribe to a free newsletter. When subscribing to the newsletter, the data from the input form is sent to us. The only information you have to provide to receive the newsletter is your e-mail address. In addition, we save your IP addresses (in shortened, anonymized form) as well as the time of subscription and confirmation. In order to process the data, we obtain your consent during the subscription process and refer to the Privacy Policy. With your consent, you can subscribe to our newsletter, which informs you of our products, solutions, and events in the area of enterprise content management.

b) Legal basis for data processing
For the newsletter subscription process, we use a double opt-in method. This means that after you subscribe, we will send an e-mail to the address you have provided asking you to confirm you would like to receive the newsletter. If you do not confirm subscribing within 24 hours, your information is locked and automatically deleted in one month. Within the context of newsletter subscription, the legal basis for processing data is your agreement as per Art. 6 Sec. 1 a GDPR.

c) Purpose of data processing
We require your e-mail address to deliver the newsletter. Collection of other personal data as part of the registration process serves to prevent misuse of the services or e-mail address used, as well as to create a personalized user profile in order to better gear marketing and online offerings to your personal interests. We use a third-party tool (Rapidmail), which processes and saves this data in the EU, to send our newsletter. Using this tool, we can create analyses on opening frequency, bounces, and clicks at the personal level. For more information on Rapidmail, refer to www.rapidmail.de/datensicherheit.

d) Retention period
The data is deleted once it is no longer necessary to achieve the purpose for which it was collected. Your e-mail address is saved as long as your subscription to the newsletter is active (exception below). All other personal data collected as part of the registration/subscription process is generally deleted after a period of seven days.
Exception: If you expressly object (see Point 6 e) to these advertising purposes, we can add your personal data (e.g. name, address, telephone number, e-mail address) to a blacklist. This allows us to ensure we do not send any undesired advertisements (legal basis: your legitimate interest as per Art. 6 Sec. 1 f GDPR). Our legitimate interest lies in being able to meet our obligation resulting from your objection to advertisements. The data is saved for this purpose until you expressly revoke your objection to advertisements in writing.

e) The right to object and rectification
You can withdraw your consent to receiving the newsletter (unsubscribe) at any time. You can withdraw your consent by clicking the link provided in every newsletter e-mail, e-mailing info[at]elo.com, or sending a message to the contact data provided in the company information. In addition and provided your personal data is processed, you are considered the data subject as per GDPR and are entitled to the the rights listed below with regard to the processor.

7. Event registration

a) Description and scope of data processing
On our website, we offer you the option to register for different events (webinars, trade fairs, conferences, etc.) by specifying your personal data. The data is entered to a form and the form is sent to us. The data will not be passed on to any third party. (exception: Point 7 f)).
The following data is collected for registration/subscription:
Mandatory information: company name, postal code, city, first and last name, e-mail address, event for which the individual registered, invited by
Voluntary information: street, country, phone number, position
The following data is also saved when you subscribe/register: user IP address, date and time of registration, website from which the request originates
As part of the registration and subscription process, we request your consent to process this data.

b) Legal basis for data processing
Registration/subscription serves to fulfil a contract to which the user (you) is a contractual party or to carry out pre-contractual duties. The legal basis for processing data is Art. 6 Sec. 1 b GDPR. The legal basis for processing further (voluntary) data as part of the registration process is user agreement as per Art. 6 Sec. 1 a GDPR.

c) Purpose of data processing
Your registration/subscription is mandatory to fulfil a contract to which the you are a contractual party or to carry out pre-contractual duties. The data collected for these contracts is required for planning, carrying out, and following up on the respective event as well as for optimizing our event offering.

d) Retention period
The data is deleted once it is no longer necessary to achieve the purpose for which it was collected. This is the case to fulfil a contract or carry out pre-contractual duties during the registration process if the data is no longer required to execute the contract. After the contract is concluded, it may still be necessary to store and maintain personal data of the contractual partner in order to meet contractual or legal obligations.

e) The right to object and rectification
If data is required to fulfill a contract or carry out pre-contractual duties, it is only possible to delete data prematurely provided no contractual or legal obligations exclude deletion. In addition and provided your personal data is processed, you are considered the data subject as per GDPR and are entitled to the the rights listed below with regard to the processor (ELO).

f) Possible transfer to third parties
When registering for events, you may be able to specify which ELO Business Partner has invited you to the specific event. In this context, you can also provide us with your consent to transmit the data you have entered in the form to this ELO Business Partner. By checking the corresponding box, you consent to ELO forwarding the data you have specified, in particular personal data, to this ELO Business Partner.
The data collected for this purpose and to be transmitted serves to help the ELO Business Partner plan, carry out, and follow up on the respective event.
The legal basis for processing data is user agreement as per Art. 6 Sec. 1 a GDPR.
The data is deleted once it is no longer necessary to achieve the purpose for which it was collected at the latest. This is the case to fulfil a contract or carry out pre-contractual duties if the data is no longer required to execute the contract (event). After the contract is concluded, it may still be necessary to store and maintain personal data of the contractual partner in order to meet contractual or legal obligations.
Regardless, you can withdraw your consent to transmission of your personal data at any time. Contact your ELO Business Partner at the information provided above to withdraw your consent.

8. Contact via e-mail/the contact form

a) Description and scope of data processing
Our website contains a contact form that can be used to contact us electronically. If you use this function, the data you enter in the form is sent only to us (ELO Digital Office GmbH, headquarters) and processed. Requests from our website (see section 1 above) from Switzerland and Austria are sent to our ELO Switzerland/ELO Austria subsidiaries and processed there accordingly. Refer to Points 12 a and b for more information)). Generally, the following data is collected:
Mandatory information: company, first and last name, country, e-mail address
Voluntary information: street, town/city, telephone, request, your message including the information specified
The following data is also saved when you send your message: your IP address, date and time of registration, website from which the request originates

In order to process the data, we obtain your consent during the delivery process and refer to the Privacy Policy. Alternatively, contact via the provided e-mail address is also possible. In this case, the personal data transferred with your e-mail address is saved. Your data will not be passed on to any third party in this context. The data is only used to process the conversation.

b) Legal basis for data processing
The legal basis for processing data is your agreement as per Art. 6 Sec. 1 a GDPR. The legal basis for processing data collected in the context of e-mail delivery is Art. 6 Sec. 1 f GDPR. If e-mail contact is made with the objective of concluding a contract, the legal basis for processing is Art. 6 Sec. 1 b GDPR.

c) Purpose of data processing
We process personal data from the form solely to process your contact with us. In case of e-mail contact, this represents the legitimate interest for processing data. Other data processed during delivery serve to prevent misuse of the contact form and ensure the security of our IT systems.

d) Retention period
The data is deleted once it is no longer necessary to achieve the purpose for which it was collected. For personal data from the contact form and the data sent by e-mail, this is the case when the conversation with the user has ended. The conversation is considered ended when it can be assumed from the circumstances that the relevant matter has been resolved fully. The additional personal data collected as part of the delivery process is deleted within seven days.

e) The right to object and rectification
The user can withdraw consent to processing of personal data at any time. If the user contacts us directly via e-mail, the user can withdraw consent to storage of personal data at any time. In such a case, the conversation cannot be continued. To exercise such right, the user may write to info[at]elo.com. All personal data saved in contact is deleted in this case. You are also entitled to the the rights listed below with regard to the processor.

9. White paper

a) Description and scope of data processing
On our website, we offer you the option to download different white papers by entering personal data. The data is entered to a form and the form is sent to us. The data will not be passed on to any third party. The following data is collected for registration/subscription:
Mandatory information: first and last name, e-mail address, country
Voluntary information: company, title
The following data is also saved when you subscribe/register: user IP address, date and time of registration, website from which the request originates, white paper downloaded

As part of the registration and subscription process, we request your consent to process this data.

b) Legal basis for data processing
Registration/subscription serves to fulfil a contract to which you are a contractual party or to carry out pre-contractual duties. The legal basis for processing data is Art. 6 Sec. 1 b GDPR. The legal basis for processing further data as part of the registration process is your agreement as per Art. 6 Sec. 1 a GDPR.

c) Purpose of data processing
Your registration/subscription is mandatory to fulfil a contract to which the you are a contractual party or to carry out pre-contractual duties. The data collected for these contracts is mandatory to optimize the white paper offering.

d) Retention period
The data is deleted once it is no longer necessary to achieve the purpose for which it was collected. This is the case to fulfil a contract or carry out pre-contractual duties if the data is no longer required to execute the contract. After the contract is concluded, it may still be necessary to store and maintain personal data of the contractual partner in order to meet contractual or legal obligations.

e) The right to object and rectification
If it is necessary to process personal data to fulfill a contract or carry out pre-contractual duties, it is only possible to delete data prematurely provided no contractual or legal obligations exclude deletion. In addition and provided your personal data is processed, you are considered the data subject as per GDPR and are entitled to the the rights listed below with regard to the processor (ELO).

10. "My ELOoffice": ELOoffice free, creating an account and product registration

a) Description and scope of data processing
On our website, we offer you the option to set up a "My ELOoffice" account and register your purchased ELOoffice license by entering personal data. The data is entered to a form and the form is sent to us. The data will not be passed on to any third party. The following data is collected for registration/subscription:
Mandatory information: company name, title, first and last name, e-mail address, country, postal code (only for product registration), serial number (only for product registration)
Voluntary information: academic title, street address, telephone, town/city
The following data is also saved when you subscribe/register: your IP address, date and time of registration, website from which the request originates

As part of the registration and subscription process, we request your consent to process this data.

During product registration: In order to process the data, we obtain your consent during the delivery process and refer to the Privacy Policy.

b) Legal basis for data processing
Registration/subscription serves to fulfil a contract to which you are a contractual party or to carry out pre-contractual duties. The legal basis for processing data is Art. 6 Sec. 1 b GDPR. The legal basis for processing further voluntary data as part of the registration process is your agreement as per Art. 6 Sec. 1 a GDPR.

c) Purpose of data processing
Your registration/subscription is mandatory to fulfil a contract to which the you are a contractual party or to carry out pre-contractual duties. The data collected for these contracts is required to set up a "My ELOoffice" account and use the information available there, for example to download the free version of ELOoffice. During product registration, the collected data is required to enable access to the protected download area and to the ELOoffice forum, as well as to grant you two free support tickets.

d) Retention period
The data is deleted once it is no longer necessary to achieve the purpose for which it was collected.

  • This is the case for data collected during the registration process if you cancel or change your registration on our website.
  • This is the case to fulfil a contract or carry out pre-contractual duties during the registration process if the data is no longer required to execute the contract. After the contract is concluded, it may still be necessary to store and maintain personal data of the contractual partner in order to meet contractual or legal obligations.

e) The right to object and rectification
As a user you have the option to cancel your registration at any time. You can request changes to the data stored on your person at any time.

  • When creating an account on "My ELOoffice", the data you enter is stored and can be revoked. You can delete all data, including that of your user account, in the "My ELOoffice" customer area yourself.
  • If data is required to fulfill a contract or carry out pre-contractual duties, it is only possible to delete data prematurely provided no contractual or legal obligations exclude deletion.

You are also entitled to the the rights listed below (point 17) with regard to the processor (ELO).

11. ELOoffice support request

a) Description and scope of data processing
On our website/in the protected "My ELOoffice" area, we offer you the option to submit support requests related to the ELOoffice product by entering personal data. The data is entered to a form and the form is sent to us. The data will not be passed on to any third party.
The following data is collected for registration/subscription:
Mandatory information: customer number, company name, first and last name, e-mail address , country, serial number
Voluntary information: street, postal code, town/city, telephone
The following data is also saved when you subscribe/register: your IP address, date and time of the support request, website from which the request originates

In order to process the data, we obtain your consent during the delivery process and refer to the Privacy Policy.

b) Legal basis for data processing
ELOoffice support requests serve to fulfil a contract to which you are a contractual party or to carry out pre-contractual duties. The legal basis for processing data is Art. 6 Sec. 1 b GDPR. The legal basis for processing further voluntary data as part of the registration process is your agreement as per Art. 6 Sec. 1 a GDPR.

c) Purpose of data processing
Your ELOoffice support request is mandatory to fulfil a contract to which the you are a contractual party or to carry out pre-contractual duties. We process personal data from the form solely to process your support request.

d) Retention period
The data is deleted once it is no longer necessary to achieve the purpose for which it was collected. For personal data from the support request form, this is the case when the conversation with you has ended. The conversation is considered ended when it can be assumed from the circumstances that the relevant matter has been resolved fully. If data is required to fulfill a contract or carry out pre-contractual duties, it is only possible to delete data prematurely provided no contractual or legal obligations exclude deletion.

e) The right to object and rectification
If data is required to fulfill a contract or carry out pre-contractual duties, it is only possible to delete data prematurely provided no contractual or legal obligations exclude deletion. In addition and provided your personal data is processed, you are considered the data subject as per GDPR and are entitled to the the rights listed below with regard to the processor (ELO).

12. Processor/data transmission

a) Processor within the EU/EEA
In some cases, we employ external service providers from the EU to process your data. We carefully select and commission these providers (including order processing agreement), which are subject to our instruction and regular checks. In particular, this includes:
- 3shop GmbH, Unterer Talweg 40, 86179 Augsburg, Germany, 3shop.de
- development.IT, Fürstenstr. 43, 09130 Chemnitz, Germany, www.veljus.de
- easyfeedback, Ernst-Abbe-Str. 4 D, 56070 Koblenz, Germany, www.easy-feedback.de
- ELO Digital Office AT GmbH, Leonfelder Str. 2-4, 4040 Linz, Austria, www.elo.com/de-at
- eTracker, Erste Brunnenstraße 1, 20459 Hamburg, Germany, www.etracker.com
- Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland
- LogMeIn Ireland Limited, Bloodstone Building, 1st Floor, Bloodstoney Road, Sir John Rogerson’s Quay, Dublin 2, Ireland, www.logmeininc.com
- nelo digitalagentur GmbH & Co KG, Magirus-Deutz-Straße 14, 89077 Ulm, Germany, www.nelo.de
- rapidmail GmbH, Augustinerplatz 2, 79098 Freiburg, Germany, www.rapidmail.de
- RobHost GmbH, Glashütter Str. 53 , 01309 Dresden, Germany, www.robhost.de

b) Data transmission outside of the EU/EEA
Data is only transferred as described in point 8 of this Privacy Policy to a "third country" if the contact form is submitted from within Switzerland. The provided data is saved at ELO Digital Office GmbH, but is transmitted to ELO Digital Office CH AG and processed there accordingly based on the fact that the EU Commission has made an "adequacy decision" in this case. Data is only transferred provided that:

  • You have selected the country of Switzerland as a mandatory field,
  • Transmission is generally permissible, and
  • The specific requirements set out by GDPR for transmission to a third country have been meet, in particular that the data importer ensures an appropriate level of data protection. This is ensured by an order processing agreement between ELO Digital Office GmbH and ELO Digital Office CH AG.

The complete address of our Swiss subsidiary is: ELO Digital Office CH AG, Industriestr. 50b, 8304 Wallisellen, Switzerland, www.elo.com/de-ch

13. Use of our portal

(1) Provided you would like to use our (Partner) Portal (reserved for ELO sales partners and customers of the ELOprofessional and ELOenterprise products), you must register by specifying your e-mail address, a custom password, and a user name of your choice. Use of a real name is mandatory; anonymous accounts are not permitted. The data named above is mandatory; you can provide all other information on a voluntary basis while using our portal.

(2) If you use our portal, we save your data required to fulfill the contract until you delete your account permanently. We will continue to save the data you have provided voluntarily for the period during which you use the portal, should you not delete said data first. You can manage and change all information in the protected customer area. The legal basis is Art. 6 Sec. 1 S. 1 f GDPR.

(3) Your entire profile (exception: user name, position, company) is not visible to members of the portal. If you make content available to your personal contacts without sending it in a private message, this content can also be seen by other parties. If you upload posts to public groups, these can be viewed by all portal members who are logged on.

(4) To prevent third parties from gaining unauthorized access to your personal data, the connection is encrypted by means of TLS technology.

14. Use of the ELOoffice online shop

(1) If you would like to place orders in the ELOoffice online shop, it is mandatory to specify personal data required to process your order for the purpose of concluding the contract. The mandatory information required to process contracts is marked; all other information is voluntary. The data you have provided is processed to process your order. Your payment data may be passed on to a payment service provider. The legal basis for this is Art. 6 Sec. 1 S. 1 b GDPR.

(2) The ELOoffice shop is operated by ELO Digital Office GmbH. Contractual execution (delivery, invoicing, etc) is carried out by 3 Shop GmbH acting in its own name in invoicing third parties (see point 9).

(3) You can optionally create a customer account, which saves your data for subsequent purchases. When creating an account on "My ELOoffice", the data you enter is stored and can be revoked. You can delete all other data, including that of your user account, in the "My ELOoffice" area at any time.

(4) Provided you have given express consent (in particular based on Art. 6 Sec. 1 S. 1 a GDPR), the data you have provided can also be processed in order to notify you of other relevant products from the ELO Digital Office portfolio or to send you e-mails with technical information (point 6 of this Privacy Policy shall apply).

(5) Based on the specifications of commercial and tax law, your address, payment, and order data is saved for a period of ten years. However, after two years we restrict processing of this data, i.e. your data is only used to meet legal obligations.

(6) To prevent third parties from gaining unauthorized access to your personal data, in particular financial data, the ordering process is encrypted by means of TLS technology.

15. Additional functions/offers on our website

(1) In addition to the purely informational use of our website as described above, for example, we offer various other services that you can use if interested. Generally, you have to provide additional personal data for this purpose, which we use to provide the respective service and to which the principles of data processing named in this Privacy Policy (legal considerations/rights of data subjects, etc.) shall apply.

(2) In addition, we can pass on/forward your personal data to third parties when offering campaigns, prize draws, contract conclusions, or similar services in conjunction with partners. Refer to the description of the respective offer for more information.

These offers include:

  • The partner contact form: On our website, you will find a contact form that you can use to contact an ELO Partner directly. If you use this function, the data you enter in the form, including your request, is transmitted to the ELO Partner via e-mail and saved. The selected ELO Partner is contacted via this form, meaning your data is sent to this partner. ELO receives a copy of this data, which is temporarily saved in our database. The legal basis for temporary storage of data is Art. 6 Sec. 1 f GDPR. This data is processed for technical purposes, which serves to send a relevant e-mail to the partner. The data is deleted once it is no longer necessary to achieve the purpose for which it was collected, within seven days at the latest. Extended storage is not possible. Provided your personal data is processed, you are considered the data subject as per GDPR and are entitled to the the rights listed below with regard to the processor (ELO).
  • Events or webinars that are carried out by external organizers: You are simply forwarded to the page of the relevant organizer. You register right on the website of the respective organizer.

(3) Provided our service provider or partner is headquartered in a country outside of the European Economic Area (EEA), we will inform you of the consequences of this in regard to the processing of your personal data in the description of the offer.

16. Use of social media plug-ins

(1) We currently use the following social media plug-ins: Twitter, Xing, LinkedIn, and YouTube. We use the two-click solution, meaning when you visit our site, initially no personal data is passed on to the plug-in provider. You will recognize the plug-in provider by the marking on the box above its initial letter, or the logo. We offer you the option to communicate with the plug-in provider directly using the button. If you click the marked field to activate it, the plug-in provider is notified that you have opened the corresponding website for our online offering. In addition, the data described under point 3 of this policy is also transmitted. By activating the plug-in, your personal data is transmitted to the respective plug-in provider and saved there (in case of American providers, in the United States). In the case of Xing, the provider indicates that the IP address is anonymized immediately after collection within Germany.

(2) We do not have any influence on the collected data or processing of such data, nor do we know the full extent of data collection, the purposes of processing, or the retention periods. We also do not have any information on deletion of the collected data by the plug-in provider.

(3) The plug-in provider stores the data collected on you as user profiles, and uses these for the purposes of advertising, market research, and/or to optimize the content of its website. Such an analysis is carried out in order to show individual advertisements and to notify other users of the social network of your activities on our website (including for users that are not logged on). You have the right to object to the creation of these user profiles, whereby you have to contact the respective plug-in provider in order to exercise this right. Via these plug-ins, we offer you the option to interact with social networks and other users, allowing us to improve our offering and make our website more interesting to you as a user. The legal basis for the use of plug-ins is Art. 6 Sec. 1 S. 1 f GDPR.

(4) Data is forwarded regardless of whether you have an account with the plug-in provider or are logged on. If you are logged on to the service provided by the plug-in provider, your data we collect can be associated directly with the account you have with the plug-in provider. If you click the activated button and link the page, for example, the plug-in provider saves this information in your user account and shares it publicly with your contacts. We recommend regularly logging out after using a social network, but especially before activating the button so that you can prevent associating your data with your profile with the plug-in provider.

(5) Refer to the privacy policies of the respective providers listed below for additional information on the purpose and scope of data collection and data processing by the plug-in provider. There, you will also find more information on your rights and options available to protect your privacy.

(6) Addresses of the respective plug-in providers and URLs to their privacy policies:
LinkedIn Corporation, 2029 Stierlin Court, Mountain View, California 94043, USA; www.linkedin.com/legal/privacy-policy. LinkedIn hat sich dem EU-US-Privacy-Shield unterworfen, www.privacyshield.gov/EU-US-Framework.

Twitter, Inc., 1355 Market St, Suite 900, San Francisco, California 94103, USA; www.twitter.com/privacy. Twitter hat sich dem EU-US-Privacy-Shield unterworfen, www.privacyshield.gov/EU-US-Framework.

Xing AG, Gänsemarkt 43, 20354 Hamburg, DE; www.xing.com/privacy.

YouTube: Google Inc., 1600 Amphitheater Parkway, Mountainview, California 94043, USA; www.google.com/policies/privacy/partners/?hl=de

17. Rights of data subjects

Provided your personal data is processed, you are considered the data subject as per GDPR and are entitled to the the rights listed below with regard to the processor (ELO).

1. Right to be informed
You can demand a confirmation of whether personal data related to you is processed. Should this be the case, you can demand the following information:
(1) The purposes for which the personal data is processed;
(2) The categories of the personal data processed;
(3) The recipients/categories of recipients receiving the personal data related to you;
(4) The planned storage period for the personal data related to you or, if no concrete information is possible, criteria for determining the storage period;
(5) Existence of a right to rectification or erasure of the personal data related to you, a right to restrict processing by the processor, or a right to object to this processing;
(6) The existence of a right to appeal to the authorities.
(7) All available information on the origin of the data if the personal data is not collected from the associated individual;
(8) The existence of an automated decision making solution including profiling, as per Art. 22 Sec. 1 and 4 GDPR and – at least in these cases – meaningful information on the involved logic as well as the reach and target effect of such processing for the concerned individual.

You have the right to be informed of whether the personal data related to you is transmitted to a third country or an international organization. In this context, you can request to be informed of appropriate safeguards as per Art. 46 GDPR in conjunction with the transmission of your data.

2. Right to rectification
You have the right to rectification and/or completion provided the processed personal data related to you is incorrect or incomplete. The data processor must promptly rectify the issue.

3. Right to restrict processing
You can exercise your right to restrict processing of the personal data related to you provided the following conditions are met:
(1) If you dispute the accuracy of the personal data related to you for a period that enables the processor to verify the accuracy of the data;
(2) Processing is wrongful and you reject the deletion of your personal data, instead exercising your right to restrict the use of your personal data;
(3) The processor no longer requires the personal data for processing, but you need it to assert, exercise, or defend legal claims.
(4) If you have exercised your right to object to processing as per Art. 21 Sec. 1 GDPR and it has not been determined whether the the legitimate interest of the processor outweigh your interest.

If processing of the personal data related to you has been restricted, this data may only be processed (besides storage) with your express consent or to assert, exercise, or defend legal claims, or to protect the rights of other natural or legal persons, or for reasons of an important public interest of the European Union or a member state.

If restriction of processing was lifted based on the requirements above, you will be notified by the processor before this restriction is lifted.

4. Right to erasure

a) Obligation of erasure
You can demand the processor to delete any personal data related to you right away and the processor is required to delete this data provided one of the following reasons applies:
(1) The personal data related to you is no longer needed for the purpose for which it was collected or processed in any other way.
(2) You withdraw your consent for processing based on Art. 6 Sec. 1 a or Art. 9 Sec. 2 a GDPR and there is no other legal basis for processing.
(3) As per Art. 21 Sec. 1 GDPR, you object to processing and there are no superior legitimate reasons for processing; or, you object to processing as per Art. 21 Sec. 2 GDPR.
(4) The personal data related to you was processed unlawfully.
(5) Deletion of the personal data related to you is required to fulfil a legal obligation in line with EU law or law of member states to which the processor is subject.
(6) The personal data related to you was collected as per Art. 8 Sec. 1 GDPR with regard to the services offered by the information society.

b) Information to third parties
If the processor has published your personal data and is obligated to delete this data as per Art. 17 Sec. 1 GDPR, the processor shall take suitable measures taking into account the available technology and implementation costs, including those of a technical nature, to inform the processor responsible for processing the personal data that you as data subject have requested the deletion of all links to this personal data or of copies or replications of this personal data.

c) Exceptions
The right to erasure does not apply if processing is required
(1) to exercise the right to free expression of opinion and information;
(2) to meet a legal obligation requiring processing in accordance with the law of the European Union or a member state to which the processor is subject, or to carry out a duty in the public interest or in exercising official authority assigned to the processor;
(3) for reasons of public interest in the area of public health as per Art. 9 Sec. 2 h as well as Art. 9 Sec. 3 GDPR;
(4) for archiving purposes in the public interest, economic or historical research purposes, or for statistical purposes as per Art. 89 Sec. 1 GDPR provided that the right named in a) is not expected to render attainment of the objectives of this agreement impossible or have a serious negative effect, or
(5) To assert, exercise, or defend legal claims.

5. Right to be informed
If you have exercised your right to rectification, erasure, or to restrict processing vis-à-vis the processor, the processor is obligated to notify all recipients to which your personal data was disclosed of rectification or deletion of the data, or restriction to its processing, unless this proves to be impossible or requires a disproportional amount of effort. You have the right to be informed of these recipients by the processor.

6. Right to data portability
You have the right to receive the personal data related to you that you have provided to the processor in a structured, commonly used, machine-readable format. In addition, you have the right to pass on this data to another processor without interference of the processor to which you have provided the personal data, provided
(1) Processing is based on consent as per Art. 6 Sec. 1 a GDPR or Art. 9 Sec. 2 a GDPR, or on a contract as per Art. 6 Sec. 1 b GDPR and
(2) Processing is carried out by automated processes.

In exercising this right, you also have the right to demand your personal data be transferred directly from one processor to another processor, provided this is technically feasible. This must not negatively affect the freedoms and rights of other individuals.

The right to data portability does not apply to processing of personal data required or to carry out a duty in the public interest or in exercising official authority assigned to the processor.

7. Right to object
You have the right to object to the processing of your personal data based on Art. 6 Sec. 1 e or f GDPR for reasons resulting from your particular situation at any time; this also applies to profiling based on these provisions.

The processor no longer processes your personal data unless the processor can provide compelling legitimate reasons that outweigh your interests, rights, and freedoms, or processing serves to assert, exercise, or defend legal claims.

If the personal data related to you is processed to carry out direct advertising, you have the right to object to the processing of your personal data for the purpose of such advertising at any time; this also applies to profiling provided directly related to such direct advertising.

If you object to processing for purposes of direct advertising, your personal data will no longer be processed for this purpose.

You have the option to exercise your right to object by means of an automated process which uses technical specifications in connection with the use of services provided by the information society, directive 2002/58/EC notwithstanding.

8. Right to withdraw consent to use of data
You have the right to withdraw your consent to the use of your data at any time. Withdrawing your consent does not affect the lawfulness of the processing taking place based on your consent up to withdrawal.

9. Automated decision including profiling in individual cases
You have the right to not be subjected to a decision based solely on automated processing, including profiling, that has a legal effect on you or affects you significantly in a similar manner. This does not apply if the decision
(1) Is required to conclude or fulfil a contract between you and the processor,
(2) Is permissible based on legal provisions of the European Union or a member state to which the processor is subject and these legal provisions contain suitable measures to protect your rights and freedoms as well as your legitimate interests, or
(3) Is carried out with your express permission.

However, these decisions shall not be based on special categories of personal data as per Art. 9 Sec. 1 GDPR provided Art. 9 Sec. 2 a GDPR applies and suitable measures have been taken to protect your rights and freedoms as well as your legitimate interests.

With regard to the cases named in (1) and (3), the processor shall take appropriate measures to ensure your rights and freedoms as well as your legitimate interests, including at least the right to request an individual on the side of the processor to intervene, to present your own position, and to contest the decision.

10. Right to appeal to the authorities
Notwithstanding any other administrative or judicial decision, you have the right to appeal to the authorities, especially in the member state where you are located, your workplace, or the location of the alleged violation if you believe that the processing of your personal data is in violation of GDPR.

The authority receiving the appeal shall inform the appealing party of the status and result of the appeal, including the option for a legal decision as per Art. 78 GDPR.

18. Our right to changing the guidelines with notice

We reserve the right to change the guidelines at any time while taking the data privacy provisions into account.

19. Contact

For questions, requests, or complaints related to data privacy, please contact our Data Protection Officer. Please contact:

ELO Digital Office GmbH
Data Protection Officer
Tuebinger Str. 43
70178 Stuttgart
Germany

Or send an e-mail to dsb[at]elo.com.

Further information