Imprint

Privacy Policy

This privacy policy explains the nature, scope and purpose of the processing of personal data (referred to below as “data”) within our online offering and its associated websites, functions and content, as well as external online presences such as our social media profiles (collectively referred to below as the “online offering”). For definitions of terms such as “processing” or “controller”, please refer to Article 4 of the General Data Protection Regulation (GDPR). ControllerJuliane EichendorfVia Luigi Porro Lambertenghi 1920159 MilanoItalyOwner: Juliane EichendorfEmail address: info@julijane-maltawedding.comhttps://julijane-maltawedding.com/Link to the legal notice: https://julijane-maltawedding.com/imprint-privacy-policy/ Types of Data Processed- Basic customer data, such as names and addresses.- Contact data, such as email addresses and telephone numbers.- Content data, such as text entries, photographs and videos.- Usage data, such as websites visited, interest in content and access times.- Metadata and communication data, such as device information and IP addresses. Categories of Data SubjectsVisitors to and users of the online offering. Below, we also refer to these data subjects collectively as “users”. Purposes of Processing- Providing the online offering, its functions and content.- Responding to contact enquiries and communicating with users.- Security measures.- Audience measurement and marketing. Definitions“Personal data” means any information relating to an identified or identifiable natural person (the “data subject”). A natural person is identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier (such as a cookie), or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity. “Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers practically any handling of data. “Pseudonymisation” means processing personal data so that it can no longer be attributed to a specific data subject without using additional information, provided that this additional information is kept separately and is subject to technical and organisational measures ensuring that the personal data is not attributed to an identified or identifiable natural person. “Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning their performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data. “Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller. Applicable Legal BasesIn accordance with Article 13 GDPR, we inform you of the legal bases for our data processing. Unless a legal basis is specified elsewhere in this privacy policy, the following applies: the legal basis for obtaining consent is Article 6(1)(a) and Article 7 GDPR; the legal basis for processing to provide our services, perform contractual measures and respond to enquiries is Article 6(1)(b) GDPR; the legal basis for processing to fulfil our legal obligations is Article 6(1)(c) GDPR; and the legal basis for processing to safeguard our legitimate interests is Article 6(1)(f) GDPR. Where processing is necessary to protect the vital interests of the data subject or another natural person, Article 6(1)(d) GDPR serves as the legal basis. Security MeasuresIn accordance with Article 32 GDPR, taking into account the state of the art, implementation costs and the nature, scope, circumstances and purposes of processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical access to data and access to, input, disclosure, availability and separation of data. We have also established procedures to ensure the exercise of data subjects’ rights, the erasure of data and responses to threats to data. We take the protection of personal data into account when developing or selecting hardware, software and procedures, in accordance with the principles of data protection by design and by default (Article 25 GDPR). Cooperation with Processors and Third PartiesIf, in the course of processing, we disclose data to other persons or companies (processors or third parties), transmit it to them or otherwise grant them access, we do so only on the basis of legal permission. This includes, for example, transfers to third parties such as payment service providers necessary to perform a contract under Article 6(1)(b) GDPR, your consent, a legal obligation, or our legitimate interests, such as when using agents or web hosts. Where we commission third parties to process data under a data processing agreement, this is based on Article 28 GDPR. Transfers to Third CountriesIf we process data in a third country, meaning outside the European Union (EU) or the European Economic Area (EEA), or if this occurs when using third-party services or disclosing or transmitting data to third parties, this takes place only where necessary to fulfil our contractual or pre-contractual obligations, on the basis of your consent, because of a legal obligation, or on the basis of our legitimate interests. Subject to statutory or contractual permissions, we process or have data processed in a third country only if the special requirements of Articles 44 et seq. GDPR are met. This means, for example, processing on the basis of special safeguards, such as an officially recognised finding of a level of data protection equivalent to that in the EU (for example, for the USA through the “Privacy Shield”), or compliance with officially recognised special contractual obligations (“standard contractual clauses”). Rights of Data SubjectsYou have the right to request confirmation of whether data concerning you is being processed and to obtain information about that data, further information and a copy of the data in accordance with Article 15 GDPR. Under Article 16 GDPR, you have the right to request completion of data concerning you or correction of inaccurate data concerning you. Under Article 17 GDPR, you have the right to request that data concerning you be erased without undue delay or, alternatively, under Article 18 GDPR, to request restriction of processing. You have the right to receive data concerning you that you have provided to us in accordance with Article 20 GDPR and to request its transmission to other controllers. Under Article 77 GDPR, you also have the right to lodge a complaint with the competent supervisory authority. Right to Withdraw ConsentYou have the right to withdraw consent given under Article 7(3) GDPR with effect for the future. Right to ObjectYou may object at any time to future processing of data concerning you in accordance with Article 21 GDPR. In particular, you may object to processing for direct marketing purposes. Cookies and the Right to Object to Direct Marketing“Cookies” are small files stored on users’ computers. Various information can be stored in cookies. A cookie primarily stores information about a user, or the device on which it is stored, during or after a visit to an online offering. Temporary cookies, also called session or transient cookies, are deleted when a user leaves an online offering and closes their browser. Such a cookie may store, for example, the contents of a shopping basket in an online shop or a login status. Permanent or persistent cookies remain stored after the browser is closed. For example, a login status may remain stored when users return after several days. Such a cookie may also store users’ interests for audience measurement or marketing purposes. Third-party cookies are offered by providers other than the controller operating the online offering; cookies offered only by that controller are called first-party cookies. We may use temporary and permanent cookies and explain this in our privacy policy. Users who do not wish cookies to be stored on their computers are asked to disable the relevant option in their browser settings. Stored cookies can be deleted in the browser settings. Excluding cookies may restrict the functionality of this online offering. A general objection to the use of cookies for online marketing purposes can be made for many services, particularly tracking services, through the US website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/. Cookies can also be prevented from being stored by disabling them in the browser settings. Please note that not all functions of this online offering may then be available.

Erasure of DataThe data we process is erased or its processing is restricted in accordance with Articles 17 and 18 GDPR. Unless expressly stated otherwise in this privacy policy, data stored by us is erased as soon as it is no longer required for its intended purpose and no statutory retention obligations prevent erasure. Where data is not erased because it is required for other legally permissible purposes, its processing is restricted. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax-law reasons. Under German statutory requirements, records are retained in particular for ten years under Sections 147(1) AO and 257(1), nos. 1 and 4, and (4) HGB, including books, records, management reports, accounting documents, commercial books and documents relevant to taxation, and for six years under Section 257(1), nos. 2 and 3, and (4) HGB for commercial correspondence. Under Austrian statutory requirements, records are retained in particular for seven years under Section 132(1) BAO, including accounting records, receipts, invoices, accounts, vouchers, business papers and statements of income and expenditure; for 22 years in connection with real estate; and for ten years for documents relating to electronically supplied services, telecommunications, broadcasting and television services supplied to non-business customers in EU Member States for which the Mini One Stop Shop (MOSS) is used. Business-Related ProcessingWe also process:- Contract data, such as the subject matter and term of a contract and customer category.- Payment data, such as bank details and payment history.This data relates to our customers, prospective customers and business partners and is processed to provide contractual services, service and customer care, marketing, advertising and market research. Contractual ServicesWe process data relating to our contractual partners and prospective customers, as well as other principals, customers, clients or contractual partners (collectively “contractual partners”), in accordance with Article 6(1)(b) GDPR to provide contractual or pre-contractual services. The data processed and the nature, scope, purpose and necessity of processing depend on the underlying contractual relationship. The data processed includes our contractual partners’ basic data, such as names and addresses; contact data, such as email addresses and telephone numbers; contract data, such as services used, contractual content, contractual communications and names of contact persons; and payment data, such as bank details and payment history. As a rule, we do not process special categories of personal data unless they form part of processing commissioned or agreed under a contract. We process data necessary to establish and perform contractual services and indicate when its provision is necessary unless this is already apparent to contractual partners. Data is disclosed to external persons or companies only where necessary in connection with a contract. When processing data entrusted to us under an assignment, we act in accordance with the client’s instructions and statutory requirements. When users use our online services, we may store their IP addresses and the time of the relevant action. Storage is based on our legitimate interests and users’ interests in protection against misuse and other unauthorised use. As a rule, this data is not disclosed to third parties unless necessary to pursue our claims under Article 6(1)(f) GDPR or required by law under Article 6(1)(c) GDPR. Data is erased when it is no longer required to fulfil contractual or statutory duties of care or to deal with warranty and comparable obligations. The necessity of retaining the data is reviewed every three years; statutory retention obligations otherwise apply. Administration, Financial Accounting, Office Organisation and Contact ManagementWe process data for administrative tasks, the organisation of our business, financial accounting and compliance with legal obligations, such as archiving. We process the same data that we process when providing our contractual services. The legal bases are Article 6(1)(c) and Article 6(1)(f) GDPR. Processing concerns customers, prospective customers, business partners and website visitors. The purpose of and our interest in processing lie in administration, financial accounting, office organisation and data archiving: tasks that maintain our business operations, fulfil our responsibilities and enable us to provide our services. Erasure of data relating to contractual services and contractual communications follows the information provided for those processing activities. In this context, we disclose or transmit data to tax authorities, advisers such as tax advisers or auditors, and other fee-collection bodies and payment service providers. On the basis of our business interests, we also store information about suppliers, event organisers and other business partners, for example for future contact. As a rule, this mainly business-related data is stored permanently. Comments and ContributionsWhen users leave comments or other contributions, their IP addresses may be stored for seven days on the basis of our legitimate interests under Article 6(1)(f) GDPR. This serves our security in case someone leaves unlawful content, such as insults or prohibited political propaganda, in comments or contributions. In such cases, we may ourselves be held liable for the comment or contribution and therefore have an interest in identifying its author. We also reserve the right to process users’ information for spam detection on the basis of our legitimate interests under Article 6(1)(f) GDPR. On the same legal basis, we reserve the right, in the case of surveys, to store users’ IP addresses for the duration of the survey and to use cookies to prevent multiple votes. Data provided in comments and contributions is stored permanently until the user objects. Contacting UsWhen users contact us, for example through a contact form, email, telephone or social media, their information is processed to handle and respond to the enquiry under Article 6(1)(b) GDPR. Users’ information may be stored in a customer relationship management system (“CRM system”) or a comparable enquiry-management system. We erase enquiries when they are no longer required. We review their necessity every two years; statutory archiving obligations also apply. Hosting and Email TransmissionThe hosting services we use provide infrastructure and platform services, computing capacity, storage space and database services, email transmission, security services and technical maintenance services used to operate this online offering. For these purposes, we or our hosting provider process basic customer data, contact data, content data, contract data, usage data, metadata and communication data relating to customers, prospective customers and visitors to this online offering. This is based on our legitimate interests in providing the online offering efficiently and securely under Article 6(1)(f) GDPR in conjunction with Article 28 GDPR (conclusion of a data processing agreement). Collection of Access Data and Log FilesWe or our hosting provider collect data about each access to the server hosting this service (“server log files”) on the basis of our legitimate interests under Article 6(1)(f) GDPR. Access data includes the name of the website or file requested, date and time of access, transferred data volume, notification of successful retrieval, browser type and version, the user’s operating system, referrer URL (the previously visited page), IP address and requesting provider. Log-file information is stored for security purposes, for example to investigate misuse or fraud, for a maximum of seven days and is then erased. Data that must be retained as evidence is exempt from erasure until the relevant incident has been finally resolved. Google AnalyticsOn the basis of our legitimate interests, meaning our interest in the analysis, optimisation and economic operation of our online offering under Article 6(1)(f) GDPR, we use Google Analytics, a web analytics service provided by Google LLC (“Google”). Google uses cookies. Information generated by the cookie about users’ use of the online offering is generally transmitted to and stored on a Google server in the USA. Google is certified under the Privacy Shield agreement and thereby provides a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active). Google uses this information on our behalf to evaluate users’ use of our online offering, compile reports about activities within the online offering and provide us with further services relating to use of the online offering and the internet. Pseudonymous user profiles may be created from the processed data. We use Google Analytics only with IP anonymisation enabled. This means that Google truncates users’ IP addresses within Member States of the European Union or other states party to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. The IP address transmitted by the user’s browser is not combined with other Google data. Users may prevent cookies from being stored by selecting the appropriate browser settings. Users may also prevent Google from collecting data generated by the cookie relating to their use of the online offering, and prevent Google from processing that data, by downloading and installing the browser plugin available at http://tools.google.com/dlpage/gaoptout?hl=de. Further information about Google’s use of data, settings and options to object is available in Google’s privacy information (https://policies.google.com/technologies/ads) and its advertising settings (https://adssettings.google.com/authenticated). Users’ personal data is erased or anonymised after 14 months. Google AdWords and Conversion MeasurementOn the basis of our legitimate interests, meaning our interest in the analysis, optimisation and economic operation of our online offering under Article 6(1)(f) GDPR, we use services provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google is certified under the Privacy Shield agreement and thereby provides a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active). We use the Google “AdWords” online marketing service to place advertisements in the Google advertising network, for example in search results, videos and websites, so that they are displayed to users presumed to have an interest in them. This allows us to display advertisements for and within our online offering in a more targeted way and to present users only with advertisements potentially relevant to their interests. For example, showing users advertisements for products in which they have shown an interest on other online offerings is called “remarketing”. For these purposes, when our website or other websites using the Google advertising network are accessed, Google directly executes Google code and integrates so-called (re)marketing tags, meaning invisible graphics or code also called “web beacons”, into the website. These store an individual cookie, a small file, on users’ devices; comparable technologies may be used instead of cookies. This file records the websites users visited, the content in which they showed interest and the offers they clicked, as well as technical information about the browser and operating system, referring websites, time of visit and further information about use of the online offering. We also receive an individual “conversion cookie”. Information collected through this cookie enables Google to produce conversion statistics for us. However, we learn only the anonymous total number of users who clicked our advertisement and were redirected to a page containing a conversion-tracking tag. We do not receive information that would allow us to identify users personally. Users’ data is processed pseudonymously within the Google advertising network. This means that Google does not, for example, store or process users’ names or email addresses, but processes relevant cookie-related data within pseudonymous user profiles. From Google’s perspective, advertisements are not managed and displayed for a specifically identified person but for the cookie holder, regardless of who that holder is. This does not apply if a user has expressly authorised Google to process the data without this pseudonymisation. Information collected about users is transmitted to Google and stored on Google’s servers in the USA. Further information about Google’s use of data, settings and options to object is available in Google’s privacy information (https://policies.google.com/technologies/ads) and its advertising settings (https://adssettings.google.com/authenticated). Online Presences on Social MediaWe maintain online presences on social networks and platforms to communicate with customers, prospective customers and users active there and to inform them about our services. When accessing these networks and platforms, the terms and data processing policies of their respective operators apply. Unless otherwise stated in our privacy policy, we process users’ data when they communicate with us within social networks and platforms, for example by posting contributions on our online presences or sending us messages. Integration of Third-Party Services and ContentOn the basis of our legitimate interests, meaning our interest in the analysis, optimisation and economic operation of our online offering under Article 6(1)(f) GDPR, we use third-party content or services to integrate their content and services, such as videos or fonts (collectively referred to below as “content”). This always requires the third-party providers to receive users’ IP addresses, because without the IP address they cannot send the content to users’ browsers. The IP address is therefore necessary to display this content. We endeavour to use only content whose providers use IP addresses solely to deliver the content. Third-party providers may also use pixel tags, meaning invisible graphics also called web beacons, for statistical or marketing purposes. Pixel tags may be used to analyse information such as visitor traffic on this website. Pseudonymous information may also be stored in cookies on users’ devices and may include technical information about the browser and operating system, referring websites, time of visit and further information about use of our online offering. It may also be combined with information from other sources. VimeoWe may integrate videos from the “Vimeo” platform provided by Vimeo Inc., Attention: Legal Department, 555 West 18th Street, New York, New York 10011, USA. Privacy policy: https://vimeo.com/privacy. Please note that Vimeo may use Google Analytics; please refer to Google’s privacy policy (https://www.google.com/policies/privacy), the Google Analytics opt-out options (http://tools.google.com/dlpage/gaoptout?hl=de), or Google’s settings for the use of data for marketing purposes (https://adssettings.google.com/.). YouTubeWe integrate videos from the “YouTube” platform provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy: https://www.google.com/policies/privacy/; opt-out: https://adssettings.google.com/authenticated. Google reCAPTCHAWe integrate the bot-detection function “ReCaptcha”, for example for entries in online forms, provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy: https://www.google.com/policies/privacy/; opt-out: https://adssettings.google.com/authenticated. Google MapsWe integrate maps from the “Google Maps” service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Data processed may include, in particular, users’ IP addresses and location data. Location data is not collected without users’ consent, which is usually given through their mobile-device settings. Data may be processed in the USA. Privacy policy: https://www.google.com/policies/privacy/; opt-out: https://adssettings.google.com/authenticated. Adobe Typekit FontsOn the basis of our legitimate interests, meaning our interest in the analysis, optimisation and economic operation of our online offering under Article 6(1)(f) GDPR, we use external “Typekit” fonts provided by Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Republic of Ireland. Adobe is certified under the Privacy Shield agreement and thereby provides a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000TNo9AAG&status=Active). Use of Facebook Social PluginsOn the basis of our legitimate interests, meaning our interest in the analysis, optimisation and economic operation of our online offering under Article 6(1)(f) GDPR, we use social plugins (“plugins”) from the social network facebook.com, operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”). Plugins may display interactive elements or content, such as videos, graphics or text contributions. They can be recognised by a Facebook logo, such as a white “f” on a blue tile, the words “Like” or “Gefällt mir”, a thumbs-up symbol, or the designation “Facebook Social Plugin”. A list and illustrations of Facebook social plugins are available at https://developers.facebook.com/docs/plugins/. Facebook is certified under the Privacy Shield agreement and thereby provides a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active). When a user accesses a function of this online offering containing such a plugin, their device establishes a direct connection to Facebook’s servers. Facebook transmits the plugin content directly to the user’s device, which integrates it into the online offering. User profiles may be created from the processed data. We therefore have no influence over the scope of data collected by Facebook through these plugins and inform users according to our knowledge. Integration of the plugins informs Facebook that a user has accessed the relevant page of the online offering. If the user is logged into Facebook, Facebook can associate the visit with their Facebook account. If users interact with a plugin, for example by clicking the Like button or submitting a comment, the relevant information is transmitted directly from their device to Facebook and stored there. Even if a user is not a Facebook member, Facebook may still obtain and store their IP address. According to Facebook, only an anonymised IP address is stored in Germany. For the purpose and scope of data collection, Facebook’s further processing and use of data, and the corresponding rights and settings available to protect users’ privacy, please refer to Facebook’s privacy information at https://www.facebook.com/about/privacy/. If a user is a Facebook member and does not want Facebook to collect data about them through this online offering and associate it with their Facebook membership data, they must log out of Facebook and delete their cookies before using our online offering. Further settings and options to object to the use of data for advertising are available in Facebook profile settings at https://www.facebook.com/settings?tab=ads, through the US website http://www.aboutads.info/choices/, or through the EU website http://www.youronlinechoices.com/. These settings are platform-independent and therefore apply across devices, such as desktop computers and mobile devices. InstagramFunctions and content from Instagram, provided by Instagram Inc., 1601 Willow Road, Menlo Park, CA 94025, USA, may be integrated into our online offering. These may include images, videos, text and buttons allowing users to share content from this online offering on Instagram. If users are members of Instagram, Instagram may associate access to the above content and functions with their Instagram profiles. Instagram privacy policy: http://instagram.com/about/legal/privacy/. XingFunctions and content from Xing, provided by XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany, may be integrated into our online offering. These may include images, videos, text and buttons allowing users to share content from this online offering on Xing. If users are members of Xing, Xing may associate access to the above content and functions with their Xing profiles. Xing privacy policy: https://www.xing.com/app/share?op=data_protection.. LinkedInFunctions and content from LinkedIn, provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, may be integrated into our online offering. These may include images, videos, text and buttons allowing users to share content from this online offering on LinkedIn. If users are members of LinkedIn, LinkedIn may associate access to the above content and functions with their LinkedIn profiles. LinkedIn privacy policy: https://www.linkedin.com/legal/privacy-policy.. LinkedIn is certified under the Privacy Shield agreement and thereby provides a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000L0UZAA0&status=Active). Privacy policy: https://www.linkedin.com/legal/privacy-policy; opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out. Google+Functions and content from Google+, provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”), may be integrated into our online offering. These may include images, videos, text and buttons allowing users to share content from this online offering on Twitter. If users are members of Google+, Google may associate access to the above content and functions with their Google+ profiles. Google is certified under the Privacy Shield agreement and thereby provides a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active). Further information about Google’s use of data, settings and options to object is available in Google’s privacy information (https://policies.google.com/technologies/ads) and its advertising settings (https://adssettings.google.com/authenticated).