Privacy notice

Privacy Policy

Information about how RIVED processes Personal Data and which rights Data Subjects have under applicable data protection laws.

Introduction

We are pleased that you are interested in our organization. The protection of your Personal Data is particularly important to our management. As a rule, you can use our websites without disclosing any Personal Data to us. However, if you wish to use more specific services via our websites, including our other websites, applications and social media pages, we may have to process your Personal Data. If we wish to process data about you and we cannot rely on any other legal basis, we will always ask you for your Consent first (e.g., via a cookie banner).

We always comply with applicable data protection laws when handling your Personal Data (such as name, address, email or telephone number). With this Privacy Policy, we inform you about which data we process. This Privacy Policy also explains to you what rights you have as a Data Subject.

We have taken various technical and organizational measures to protect your data on our websites in the best possible way. Nevertheless, there are always risks on the internet and complete protection is not possible. For this reason, you can also transmit your Personal Data to us by other means, for example by telephone, if you prefer.

This Privacy Policy is not only intended to fulfill the obligations under GDPR and to comply with the law of the Member States of the European Union (EU) and the European Economic Area (EEA). This Privacy Policy is also intended to comply with legislation such as UK data protection laws (UK-GDPR), Swiss Federal Data Protection Act and Swiss Data Protection Ordinance (DSG, DSV), California Consumer Privacy Act (CCPA/CPRA), China's Personal Information Protection Law (PIPL), Delaware Personal Data Privacy Act (DPDPA), Tennessee Information Protection Act (TIPA), Minnesota Consumer Data Privacy Act (MCDPA), Iowa Act Relating to Consumer Data Protection (ICDPA), Maryland Online Data Privacy Act (MODPA), Nebraska Data Privacy Act (NDPA), New Hampshire Consumer Data Privacy Law (SB255), New Jersey Data Privacy Law (SB332), South Carolina Consumer Privacy Bill (House Bill 4696) and other global data protection regulations and shall be interpreted accordingly. The following Privacy Policy shall be interpreted for each country, state or federal state in such a way that the terms and legal bases used correspond to the terms and legal bases used in the respective state or federal state.

For reasons of better readability, the simultaneous use of the language forms male, female, diverse and other gender identities (m/f/d/other) is avoided on our websites, in publications, in communication and in our Privacy Policy. All formulations used apply equally to all genders.

1. Definitions

In our Privacy Policy, we use special terms from various data protection laws. We want our statement to be easy to understand and therefore explain these terms in advance.

The following definitions shall be interpreted or expanded, as appropriate, based on the case law of the General Court of the European Union (EGC), the European Court of Justice (ECJ), the Swiss Federal Supreme Court (SFSC), the Supreme Court of the United Kingdom (UKSC) or on national data protection laws or national case law of a state or federal state, including but not limited to California, including case law, also under common law, if this is necessary for the application of the law in individual cases.

a) Personal Data

Personal Data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person, or who must be regarded as such under national data protection legislation or national jurisdiction of a state or federal state, including under common law.

b) Data Subject

Data Subject is any identified or identifiable natural person whose Personal Data is processed by the Controller, a Processor, an international organization or another data recipient, and persons who must be regarded as such under national data protection laws or national jurisdiction of a state or federal state, including case law, also under common law.

c) Processing

Processing is any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

d) Restriction of Processing

Restriction of Processing is the marking of stored Personal Data with the aim of limiting their Processing in the future.

e) Profiling

Profiling is any form of automated Processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

f) Pseudonymization

Pseudonymization is the Processing of Personal Data in such a manner that the Personal Data can no longer be attributed to a specific Data Subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the Personal Data are not attributed to an identified or identifiable natural person.

g) Controller

The Controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data. Where the purposes and means of such Processing are determined by Union or Member State law, the Controller or the specific criteria for its nomination may be provided for by Union or Member State law.

h) Processor

A Processor is a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller.

i) Recipient

A Recipient is a natural or legal person, public authority, agency or another body, to which the Personal Data are disclosed, whether a Third Party or not. However, public authorities which may receive Personal Data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.

j) Third Party

A Third Party is a natural or legal person, public authority, agency or body other than the Data Subject, Controller, Processor and persons who, under the direct authority of the Controller or Processor, are authorised to process Personal Data.

k) Consent

Consent is any freely given, specific, informed and unambiguous indication of the Data Subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the Processing of Personal Data relating to him or her.

2. Name and address of the Controller

The Controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the Member States of the European Union and the European Economic Area, British data protection laws, Swiss data protection laws (DSG, DSV), Californian data protection law (CCPA/CPRA), Chinese data protection law (PIPL), as well as international laws and provisions with a data protection nature is:

RIVED
Berlin
eMail: info@rived.community
Website: https://www.rived.community/

3. Collection of general data and information

Our websites collect a range of general data and information each time the websites are accessed by a Data Subject or an automated system. This general data and information are stored in the log files of the respective server. Among other things, the browser types and versions used, the operating system used by the accessing system, the website from which an accessing system accesses our websites, sub-websites accessed, the date and time of access, IP address, internet service provider and other similar data and information used for security purposes can be recorded.

When using this general data and information, we generally do not draw any conclusions about the Data Subject. Rather, this information is required to correctly deliver website content, optimize website content and advertising, ensure long-term functionality and provide law enforcement authorities with information necessary for criminal prosecution in the event of a cyber-attack.

The purpose of processing is to avert danger and ensure IT security, as well as the aforementioned purposes. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is the protection of our information technology systems. The log files are deleted after the stated purposes have been achieved.

4. Contact possibility via the website and other data transfers and your Consent

Our website contains information that enables quick electronic contact with our organisation as well as direct communication with us, which also includes a general email address and possibly a telephone number. If a Data Subject contacts us by email, via a contact form, via an input form or in any other way, the Personal Data transmitted by the Data Subject will be stored automatically. This Personal Data transmitted to us on a voluntary basis is processed for the purposes of usage or contacting the Data Subject.

We obtain your Consent for the transmission, storage and Processing of your contact data and inquiries and for contacting you in accordance with Art. 6 (1) (a) GDPR and Art. 49 (1) (1) (a) GDPR as follows:

By transmitting your Personal Data, you voluntarily consent to the Processing of the Personal Data you have entered or transmitted for the purposes of processing the inquiry and contacting you. By transmitting your data to us, you also voluntarily give your explicit Consent in accordance with Art. 49 (1) (1) (a) GDPR to data transfers to third countries to and by the companies named in this Privacy Policy and for the purposes stated, in particular for such transfers to third countries for which there is or is not an adequacy decision by the EU/EEA and to companies or other bodies that are not subject to an existing adequacy decision on the basis of self-certification or other accession criteria and in which or for which there are significant risks and no suitable guarantees for the protection of your Personal Data. You can withdraw your Consent under data protection law at any time with effect for the future.

5. Routine deletion and restriction of Personal Data

We process and store Personal Data for the period required to achieve the purpose of processing or if this has been provided for by the European legislator or another legislator in laws or regulations to which we are subject, or if a legal basis for the Processing exists.

If the purpose of processing no longer applies or if a storage period prescribed by the European legislator or another competent legislator expires, or if the legal basis for the Processing no longer applies, the Personal Data will be routinely restricted or deleted in accordance with the statutory provisions.

6. Rights of the Data Subject according to GDPR

a) Right to confirmation

Each Data Subject has the right to obtain from the Controller confirmation as to whether or not Personal Data concerning him or her is being processed. If a Data Subject wishes to exercise this right, he or she may contact us at any time.

b) Right to information

Each Data Subject has the right to obtain from the Controller free information about the Personal Data stored about him/her and a copy of this data at any time. The Data Subject may also obtain information about:

  • the purposes of processing
  • the categories of Personal Data that are processed
  • the recipients or categories of recipients to whom the Personal Data have been or will be disclosed
  • the envisaged storage period or criteria used to determine that period
  • the right to rectification, erasure, restriction or objection
  • the right to lodge a complaint with a supervisory authority
  • available information about the origin of data not collected from the Data Subject
  • the existence of automated decision-making, including Profiling

Furthermore, the Data Subject has a right to information as to whether Personal Data has been transferred to a third country or to an international organization. If this is the case, the Data Subject also has the right to obtain information about the appropriate safeguards in connection with the transfer.

c) Right to rectification

Each Data Subject has the right to demand the immediate correction of incorrect Personal Data concerning them. Furthermore, the Data Subject has the right to request the completion of incomplete Personal Data, including by means of a supplementary declaration, taking into account the purposes of the Processing.

d) Right to erasure (right to be forgotten)

Each Data Subject has the right to obtain from the Controller the erasure of Personal Data concerning him or her without undue delay where one of the following grounds applies, as long as the Processing is not necessary:

  • Personal Data was collected or otherwise processed for purposes for which it is no longer necessary.
  • The Data Subject withdraws Consent and there is no other legal ground for the Processing.
  • The Data Subject objects to the Processing and there are no overriding legitimate grounds.
  • Personal Data was processed unlawfully.
  • Deletion is necessary to fulfill a legal obligation.
  • The Personal Data was collected in relation to information society services offered in accordance with Art. 8 (1) GDPR.

If one of the aforementioned reasons applies, and a Data Subject wishes to request the erasure of Personal Data stored by us, he or she may contact us at any time.

e) Right to Restriction of Processing

Each Data Subject has the right to obtain from the Controller Restriction of Processing where one of the following applies:

  • The accuracy of the Personal Data is contested by the Data Subject.
  • The Processing is unlawful and the Data Subject opposes erasure.
  • The Controller no longer needs the Personal Data, but they are required by the Data Subject for legal claims.
  • The Data Subject has objected to Processing pending verification of overriding legitimate grounds.

f) Right to data portability

Each Data Subject has the right to receive Personal Data concerning him or her in a structured, commonly used and machine-readable format and to transmit those data to another Controller, where Processing is based on Consent or contract and carried out by automated means.

g) Right to object

Each Data Subject has the right to object, on grounds relating to his or her particular situation, at any time, to Processing of Personal Data based on point (e) or (f) of Article 6(1) GDPR. This also applies to Profiling based on these provisions.

If we process Personal Data for direct marketing purposes, the Data Subject has the right to object at any time to such Processing.

h) Automated decisions in individual cases including Profiling

Each Data Subject has the right not to be subject to a decision based solely on automated Processing, including Profiling, which produces legal effects concerning him or her, or similarly significantly affects him or her, unless legally permitted and accompanied by suitable safeguards.

i) Right to withdraw Consent under data protection law

Each Data Subject has the right to withdraw Consent to the Processing of Personal Data at any time.

7. General purpose of Processing, categories of processed data and categories of recipients

The general purpose of processing Personal Data is the handling of all activities relating to the Controller, customers, interested parties, business partners or other contractual or pre-contractual relationships between the aforementioned groups or legal obligations of the Controller. This general purpose applies if no more specific purposes for specific Processing are specified.

The categories of Personal Data that we process are customer data, prospective customer data, employee data (including applicant data) and supplier data. The categories of recipients of Personal Data are public bodies, external bodies, internal processing, intragroup processing and other bodies.

A list of our Processors and data recipients in third countries and, if applicable, international organizations is either published on our website or can be requested from us free of charge.

8. Legal basis for the Processing

Art. 6 (1) (a) GDPR serves as the legal basis for Processing operations for which we obtain Consent for a specific Processing purpose. If Processing is necessary for the performance of a contract, Processing is based on Art. 6 (1) (b) GDPR. If we are subject to a legal obligation requiring Processing, Processing is based on Art. 6 (1) (c) GDPR.

In rare cases, Processing may be necessary to protect vital interests of the Data Subject or another natural person and is then based on Art. 6 (1) (d) GDPR. If Processing is necessary for a task carried out in the public interest or in the exercise of official authority, the legal basis is Art. 6 (1) (e) GDPR.

Ultimately, Processing operations could be based on Art. 6 (1) (f) GDPR where Processing is necessary for legitimate interests pursued by our organisation or a Third Party, except where overridden by the interests or fundamental rights and freedoms of the Data Subject.

9. Legitimate interests in Processing pursued by the Controller or a Third Party and direct marketing

If the Processing of Personal Data is based on Art. 6 (1) (f) GDPR and no more specific legitimate interests are stated, our legitimate interest is the performance of our business activities for the benefit of the well-being of our staff and our shareholders.

We may send you direct advertising about our own goods or services that are similar to the goods or services you have requested, commissioned or purchased. You may object to direct advertising at any time. Processing for direct marketing purposes is based on Art. 6 (1) (f) GDPR. The legitimate interest is direct marketing.

Our messages and newsletters may also constitute direct marketing communications within the meaning of Article 13(2) of EU Directive 2002/58 and national law resulting from the Directive, provided that legal requirements are met.

10. Duration for which the Personal Data is stored

The criterion for the duration of the storage of Personal Data is the respective statutory retention period. If there is no statutory retention period, the criterion is the contractual or internal retention period. After this period has expired, the corresponding data is routinely deleted if it is no longer required to fulfill or initiate a contract.

11. Legal or contractual provisions for the provision of Personal Data

We would like to inform you that the provision of Personal Data is partly required by law or may result from contractual obligations. Sometimes it may be necessary for a contract to be concluded for a Data Subject to provide us with Personal Data that must subsequently be processed by us. Failure to provide Personal Data could mean that the contract with the Data Subject could not be concluded.

12. Existence of automated decision-making

As a responsible company, we do not normally use automated decision-making or Profiling. If, in exceptional cases, we carry out automated decision-making or Profiling, we will inform the Data Subject either separately or via a sub-item in our Privacy Policy.

Automated decision-making, including Profiling, may take place if necessary for contract conclusion or performance, permissible on the basis of Union or Member State legislation, or based on explicit Consent.

13. Recipients in a third country and appropriate or adequate safeguards

According to Art. 46 (1) GDPR, the Controller or Processor may only transfer Personal Data to a third country if appropriate safeguards are provided and enforceable rights and effective legal remedies are available to Data Subjects. Appropriate safeguards can be provided by standard contractual clauses without special approval from a supervisory authority.

The EU standard contractual clauses or other appropriate safeguards are agreed with recipients from third countries prior to the first transfer of Personal Data, or transfers are based on adequacy decisions.

In all cases where the European Commission, or a government or competent authority of another country, has decided that a third country ensures an adequate level of protection and/or a valid framework exists, transfers may be based on such frameworks or adequacy decisions.

14. Right to lodge a complaint with a data protection supervisory authority

As the Controller, we are obliged to inform the Data Subject of the existence of the right to lodge a complaint with a supervisory authority. According to Art. 77 (1) GDPR, every Data Subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement.

15. Data protection provisions about the application and use of IONOS

IONOS is a web hosting and domain services company. As a provider in this area, IONOS provides the technical infrastructure for our online presence and related services such as email hosting, SSL certificates and data backup.

IONOS collects data about website traffic to ensure IT security and ward off attacks such as DDoS attacks. This information may include IP addresses, timestamps and pages accessed. The purpose is to provide and optimize hosting services, ensure network and information security and improve user-friendliness.

The company that operates the service and thus the recipient of personal data is: IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. The representative under national law in the United Kingdom is: IONOS Cloud Limited, 2 Cathedral Walk, The Forum, Gloucester, GL1 1AU, United Kingdom.

Processing is based on Art. 6 (1) (f) GDPR. Our legitimate interest lies in the reliable and secure provision of our website and related services.

Further information and the applicable data protection provisions of IONOS SE can be found at https://www.ionos.de.

16. Subscription to our newsletter and your Consent

We inform our customers and business partners about offers and news at regular intervals by means of a newsletter. You are therefore given the opportunity to subscribe to our newsletter on our website. You can only receive our newsletter if you have a valid email address and have registered to receive the newsletter.

For legal reasons, a confirmation email is sent to the email address entered by a Data Subject for the first time for the newsletter using the double opt-in procedure. The legal basis for sending this double opt-in confirmation email is Art. 6 (1) (c) GDPR.

When registering for the newsletter, we also store the IP address assigned by the internet service provider at the time of registration, as well as the date and time of registration. This storage is necessary to trace possible misuse and serves as legal protection for the Controller.

We obtain your Consent for the transmission and storage of your email address for the subscription to our newsletter in accordance with Art. 6 (1) (a) GDPR and Art. 49 (1) (1) (a) GDPR as follows:

By entering and transmitting your Personal Data, you voluntarily consent to the Processing of the Personal Data you have entered for the purpose of sending our newsletter. By entering and transmitting your data to us, you also voluntarily give your explicit Consent in accordance with Art. 49 (1) (1) (a) GDPR to data transfers to third countries to and by the companies named in this Privacy Policy and for the purposes mentioned. You can withdraw your Consent under data protection law at any time with effect for the future.

Your Consent to the Processing of Personal Data that you have given us for the storage of the email address for sending the newsletter can be revoked at any time. There is a corresponding link in every newsletter for revoking Consent. It is also possible to inform us of your wish to unsubscribe by other means.

The Personal Data collected when registering for the newsletter will be used exclusively to send our newsletter. By subscribing to our newsletter, you conclude a contract with us for the delivery of the newsletter, which is why Processing in connection with dispatch is based on Art. 6 (1) (b) GDPR. The contract can be terminated at any time.

17. Data protection provisions about the application and use of ChatGPT

ChatGPT is an advanced AI-driven platform that enables natural and informative conversations. This technology supports us in a wide range of applications, including customer service, education, content creation and much more.

When using ChatGPT, data such as text entered, questions and contextual information of the conversation are processed. This information enables the AI to generate relevant and personalized responses. The data collected is used to improve the model, increase response quality and create a better user experience.

The company that operates the service and thus the recipient of personal data is: OpenAI OpCo, LLC, 3180 18th Street, San Francisco, CA 94110, USA. For data subjects in the EU and EEA, OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: OpenAI UK Ltd., Suite 1, 3rd Floor, 11-12 St. James's Square, London, SW1Y 4LB, United Kingdom.

Processing is based on Art. 6 (1) (f) GDPR, whereby our legitimate interest lies in the development, improvement and provision of innovative services and in increasing economic efficiency.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR.

Further information and the applicable data protection provisions of OpenAI can be found at https://openai.com.