Nanoq Records Online Shop

Privacy Policy

The Nanoq Records Online Store shop.nanoq-records.com is powered by finestvinyl.de. 

 

INTRODUCTION AND DEFINITIONS

1. INTRODUCTION

When operating this website shop.nanoq-records.de com (hereinafter referred to as the „Website“), we process personal data. We treat such data confidentially and process it in accordance with the applicable laws – in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, „BDSG-neu“). With this Privacy Policy, we wish to inform you whether and, if so, which personal data we collect from you, for which purposes and on which legal basis we use such data and, where applicable, to whom we disclose it. In addition, we will explain which rights you have to protect and enforce your data protection.

2. DEFINITIONS

This Privacy Policy contains technical terms used in the GDPR and the BDSG-neu. For your better understanding, we would like to explain these terms in plain language in advance:

2.1. Personal Data

„Personal data“ means any information relating to an identified or identifiable person (Art. 4(1) GDPR). Information relating to an identified person may, for example, be the name or the e-mail address. However, personal data also includes data where the identity is not immediately apparent but can be determined by combining one’s own or third-party information and thereby establishing who the person is. A person becomes identifiable, for example, by reference to their address or bank details, their date of birth or user name, their IP addresses and/or location data. What matters here is any information that in any way allows conclusions to be drawn about a person.

2.2. Processing

Art. 4(2) GDPR defines „processing“ as any operation performed on personal data. This includes, in particular, the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.

CONTROLLER AND DATA PROTECTION OFFICER

3. CONTROLLER

The controller responsible for the data processing is:

Company:                           finestvinyl GmbH („we“)

Legal representative:          Joachim Hiller (Managing Director)

Address:                             Hochstr. 15, 42697 Solingen

Telephone:                         0212/ 64520581

Fax:                                    0212/ 3831830

E-mail:                                mail@finestvinyl.de

4. DATA PROTECTION OFFICER

We have appointed an external data protection officer for our company. You can contact the data protection officer at:

Name:                                 Arne Platzbecker 

Address:                             HABEWI GmbH & Co. KG, Palmaille 96, 22767 Hamburg

Telephone:                         040/ 18189800

Fax:                                    040/ 181898099

E-mail:                                datenschutz@habewi.de

SCOPE OF PROCESSING

5. SCOPE OF PROCESSING: WEBSITE

In connection with the Website at the URL www.finestvinyl.de, we process the personal data set out in detail in Sections 6-15 below. We only process data that you actively provide on our Website (e.g. by completing forms) or that you automatically make available when using our services.

Your data is processed exclusively by us and, as a matter of principle, is not sold, lent or disclosed to third parties. Where we use the assistance of external service providers in processing your personal data, this takes place within the framework of so-called processing on behalf of the controller, under which we, as the controller, are entitled to issue instructions to our processors. We engage external service providers for the hosting as well as for the maintenance, support and further development of our Website. Should further external service providers be involved in individual processing operations listed in Sections 6-…, they will be named there.

As a matter of principle, no transfer of data to third countries takes place, nor is any such transfer planned. We will provide information on exceptions to this principle in the processing operations described below.

THE PROCESSING OPERATIONS IN DETAIL

6. PROVISION OF THE WEBSITE AND SERVER LOG FILES

6.1. Description of the Processing

Each time the Website is accessed, we automatically collect information that your browser transmits to our server. This information is also stored in the so-called log files of our system. This comprises the following data:

  • your IP address
  • the date and time of your access to our Website
  • the browser software you use, as well as its version and language
  • the operating system you use
  • the website from which you accessed our Website (so-called referrer)
  • the sub-pages of our Website accessed by you
  • the HTML status code of a requested page (e.g. error message 404: „Not Found“)
  • the volume of data transferred

The temporary storage of your IP address by the system is necessary in order to deliver our Website to a user’s device. For this purpose, the user’s IP address must remain stored for the duration of the session. Your IP address is recorded in the log files for security reasons, in order to defend against attacks on our Website (in particular so-called DDoS attacks), and for fraud prevention.

6.2. Purpose

The processing is carried out in order to enable access to the Website and to ensure its stability and security. In addition, the processing serves the statistical evaluation and improvement of our online services.

6.3. Legal Basis

The processing is necessary for the purposes of the overriding legitimate interests pursued by the controller (Art. 6(1)(f) GDPR). Our legitimate interest lies in the purpose stated in Section 6.2.

6.4. Storage Period

The data will be erased as soon as it is no longer necessary for achieving the purpose for which it was collected. Where data is collected for the provision of the Website, this is the case when the respective session has ended. Log files are erased after 30 days.

7. REGISTRATION AND PROFILE

7.1. Description of the Processing

Certain functions and services of our Website are only available to you as a registered user. By registering, you conclude a free-of-charge user agreement with us. Upon registration, you receive your own user account on our Website. You register by completing the registration form at https://www.finestvinyl.de/kundenkonto?Subscribe and submitting it to us electronically. To register, you must provide your e-mail address, first name, surname, address and a password of your choice. By clicking the „Register“ button, you submit the form to us. You will then receive an automatic welcome e-mail. This e-mail contains a link for confirming your e-mail address. Your account on our Website will only be activated once your e-mail address has been successfully verified by clicking the confirmation link. As a registered user, you can shop on our Website more quickly and conveniently by storing your billing and delivery addresses, your preferred payment method for future orders, a parcel locker (Packstation) and a wish list in your user profile. As a result, you do not need to re-enter your personal data for subsequent (further) purchases. Furthermore, you obtain access to voucher codes. You can view your order history and track current orders (tracking).

7.2. Purpose

The processing is carried out in order to provide you with the functions of our Website available to registered users.

7.3. Legal Basis

The processing is necessary for the conclusion and performance of the user agreement (Art. 6(1)(b) GDPR). Without the provision of your personal data in the course of registration, we are unable to render the services owed under the contract.

7.4. Storage Period

We will automatically erase the data upon termination of your user agreement. You may terminate the user agreement by informing us by e-mail to datenschutz@finestvinyl.de, by post to finestvinyl GmbH, Hochstraße 15, 42697 Solingen, Germany, or by fax to +49 212 3831830 that you no longer wish to be a registered user of our Website. We will then erase your user account without undue delay. In addition, as a logged-in user, you can edit your own details and information at any time.

8. PURCHASES

8.1. Description of the Processing

You can make purchases on our Website as a guest or as a registered user. In the course of your ordering process, we process your personal data. You must complete the mandatory fields marked with an asterisk „*“ in our online shop. Otherwise, we are unable to conclude a purchase contract with you and to send you the goods ordered. All further information is voluntary. When making a purchase on our Website, you may also select one of the payment methods offered (credit card, PayPal, Giropay) to settle the purchase price. Upon completion of your order, the data required for payment is disclosed to the respective payment service provider. If you make purchases on our Website as a registered user, you can store your billing and delivery addresses as well as your preferred payment method in your user profile for faster and more convenient ordering. There, you can also view your order history and track current orders (tracking).

8.2. Purpose

The processing is carried out for the conclusion and performance of purchase contracts.

8.3. Legal Basis

The processing is necessary for the conclusion and performance of the purchase contracts (Art. 6(1)(b) GDPR).

8.4. Storage Period

Due to commercial and tax law requirements, we are obliged to store your address, payment and order data for a period of ten years.

8.5. Recipients

For the processing of your orders, returns management and customer service, we use the assistance of our service provider Cargo Records GmbH, Kaiserstr. 52, 42329 Wuppertal, Germany. Cargo Records GmbH acts as our processor.

For the processing of your payment, personal data is disclosed to one of the external payment service providers listed below and selected by you in the course of your purchase:

  • Credit card and Giropay: TeleCash GmbH & Co. KG, Marienbader Platz 1, 61348 Bad Homburg, Germany
  • PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Further information on data protection at PayPal is available at https://www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE.

9. CONTACT FORM AND CONTACT BY E-MAIL

9.1. Description of the Processing

We provide a contact form on our Website for you to get in touch with us. In this form, you are asked to enter your e-mail address, your name and a message to us. When you click the „Send“ button, the data is transmitted to us. The contact form can only be submitted if you accept our Privacy Policy by ticking the corresponding checkbox. You may also contact us via the e-mail addresses provided on the Website. In this case, we process the user’s personal data transmitted with the e-mail.

9.2. Purpose

By providing a contact form on our Website, we wish to offer you a convenient way of getting in touch with us. The data transmitted with and in the contact form or your e-mail is used exclusively for the purpose of handling and responding to your enquiry.

9.3. Legal Basis

The processing is necessary for the purposes of the overriding legitimate interests pursued by the controller (Art. 6(1)(f) GDPR). Our legitimate interest lies in the purpose stated in Section 9.2. Where the contact by e-mail is aimed at the conclusion or performance of a contract, the data is processed for the performance of a contract (Art. 6(1)(b) GDPR).

9.4. Storage Period

We will erase the data as soon as it is no longer necessary for achieving the purpose for which it was collected. This is usually the case when the respective communication with you has ended. The communication has ended when it can be inferred from the circumstances that your enquiry has been conclusively resolved. Where statutory retention periods preclude erasure, the data will be erased without undue delay upon expiry of the statutory retention period.

10. COOKIES

10.1. Description of the Processing

Our Website uses cookies. Cookies are small text files that are stored on the user’s device when visiting a website. Cookies contain information that enables the recognition of a device and, where applicable, certain functions of a website. In most cases, we only use so-called „session cookies“. These are automatically deleted when you end your internet session and close your browser. Other cookies remain stored on your device for a longer period. We use the following cookies on our Website:

Cookie name

Purpose/function

Storage period

MIO

Stores the language last selected by the user

This cookie expires 30 days after it has been set

AFFILIATECOOKIE

Management of the finestvinyl affiliate system

 

cfid

Session cookie of the web-based scripting language and database application ColdFusion

This cookie expires at the end of the browser session

cftoken

ColdFusion token

This cookie expires at the end of the browser session

_pk_id

Matomo cookie for storing the visitor ID

This cookie expires 1 year after it has been set

_pk_ses

Matomo session cookie

This cookie expires 30 minutes after it has been set

 

10.2. Purpose

We use cookies to make our Website more user-friendly and to offer the functions described in Section 10.1.

10.3. Legal Basis

The processing is necessary for the purposes of the overriding legitimate interests pursued by the controller (Art. 6(1)(f) GDPR). Our legitimate interest lies in the purpose stated in Section 10.2.

10.4. Storage Period

Cookies are automatically deleted at the end of a session or upon expiry of the stated storage period. Since cookies are stored on your device, you as the user also have full control over the use of cookies. By changing the settings of your internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our Website, certain functions of our Website may not be usable, or only to a limited extent.

11. NEWSLETTER

11.1. Description of the Processing

We send out a newsletter at irregular intervals. With the newsletter, we inform you about offers and new releases available for purchase in our online shop. You will only receive our newsletter if you actively subscribe to our mailing list or if you have purchased goods and services on our Website (see below). You can subscribe by completing and submitting a newsletter subscription form on our Website or in the course of placing an order in our online shop. Only your e-mail address is required to subscribe to the newsletter. All further information (such as your first name and surname) is voluntary and serves solely to personalise the e-mails. We use the so-called double opt-in procedure to carry out and verify newsletter subscriptions. Subscription takes place in several steps. First, you register for the newsletter on our Website. You will then receive an e-mail from us at the e-mail address you provided. In this e-mail, we ask you to confirm that you have in fact subscribed to the newsletter and wish to receive it. Confirmation is given by clicking a confirmation link contained in the e-mail. Only after successful confirmation will we add you to our newsletter mailing list and send you e-mails in the future. As part of the double opt-in procedure, we store the date, time and your IP addresses both at the time of subscription and at the time of confirmation.

If you purchase goods or services on our website and provide your e-mail address in doing so, we may subsequently use it to send a so-called existing customer newsletter. In such a case, the newsletter will exclusively contain direct marketing for our own similar goods or services.

11.2. Purpose

The processing is carried out in order to offer the newsletter function and to send the requested e-mails to subscribers and existing customers. The collection and storage of the date, time and IP addresses at the time of newsletter subscription serve to document your consent and to protect against the misuse of e-mail addresses.

11.3. Legal Basis

The processing is based on your consent to receive the newsletter pursuant to Art. 6(1)(a) GDPR. You can access the declaration of consent on our Website at any time at … (LINK). Your consent is voluntary. The collection and storage of the date, time and IP addresses at the time of newsletter subscription is necessary for the purposes of the overriding legitimate interests pursued by the controller (Art. 6(1)(f) GDPR). Our legitimate interest lies in the purpose stated in Section 11.2. In the case of our existing customer newsletter, the processing is based on Art. 6(1)(f) GDPR for the purposes of the overriding interests pursued by the controller. Our legitimate interest lies in direct marketing to existing customers. Such direct marketing is permissible within the limits of Section 7(3) of the German Act against Unfair Competition (UWG), which we observe.

11.4. Storage Period, Withdrawal of Consent

If you do not confirm your subscription to our newsletter within 24 hours of receiving the corresponding subscription e-mail, your data will be erased automatically. Otherwise, we process your personal data for the duration of your newsletter subscription. You can stop receiving our newsletter at any time by withdrawing your consent. A simple notification is sufficient for this purpose (by e-mail to datenschutz@finestvinyl.de, by post to finestvinyl GmbH, Hochstraße 15, 42697 Solingen, Germany, or by fax to +49 212 3831830). You can also unsubscribe from the newsletter by clicking the unsubscribe link in every newsletter e-mail or here (LINK). Upon withdrawal of your consent, you will no longer receive newsletters and your personal data will be removed from our active mailing list.

11.5. Recipients, Transfers to Third Countries

We use the services of the newsletter provider Mailchimp to manage our newsletter mailing list and to send the e-mails. This takes place within the framework of processing on behalf of the controller. Mailchimp is a service of The Rocket Science Group, LLC, 512 Means Street, Suite 404 Atlanta, GA 30318, USA (hereinafter referred to as „Mailchimp“). When you subscribe to the newsletter, the data provided during the registration process is transmitted to Mailchimp and processed on Mailchimp servers in the USA. Mailchimp has submitted to the EU-US Privacy Shield. Further information on the EU-US Privacy Shield is available at https://www.privacyshield.gov/EU-US-Framework. Further information on data protection at Mailchimp can be found in the service provider’s privacy policy at http://mailchimp.com/legal/privacy/.

12. SOCIAL NETWORKS

Our Website does not use so-called social media plugins. The logos of the social networks Facebook, Twitter and Instagram displayed on our Website are merely linked to our company’s respective profiles. If you click on one of the logos, you will be redirected to the external website of the respective social network.

13. YOUTUBE VIDEOS

13.1. Description of the Processing

Our Website uses services of „YouTube“, a video platform operated by YouTube LLC, 901 Cherry Avenue, San Bruno, CA 94066, USA. YouTube is represented by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. We use YouTube by embedding individual videos from the platform on our Website as a so-called iFrame (embedding), so that they can be played directly on our Website. The videos are embedded in the „privacy-enhanced mode“ offered by YouTube, i.e. no personal data of yours is transmitted to Google as long as you do not play the videos. Data is only transmitted to Google once you play a video; we have no influence on such transmission. If you play a video embedded on a sub-page of our Website, Google is informed which sub-page you have visited and which video you have watched. Your IP address may also be transmitted to Google. If you are logged in as a YouTube or Google user, Google assigns this information to your user account. Google stores your data as usage profiles and uses it for advertising purposes, market research and/or the demand-oriented design of Google websites. You have the right to object to the creation of such user profiles; to exercise this right, you must contact Google directly. Further information on data protection at Google is available at http://www.google.com/intl/de-DE/policies/privacy/.

13.2. Purpose

The processing is carried out in order to display videos to you on our Website.

13.3. Legal Basis

The processing is necessary for the purposes of the overriding legitimate interests pursued by the controller (Art. 6(1)(f) GDPR). Our legitimate interest lies in the purpose stated in Section 13.2.

13.4. Recipients, Transfers to Third Countries

By embedding YouTube, personal data may be transmitted to YouTube LLC or Google. Google also processes your personal data in the USA and has submitted to the EU-US Privacy Shield. Further information on the EU-US Privacy Shield is available at https://www.privacyshield.gov/EU-US-Framework.

14. VIMEO VIDEOS

14.1. Description of the Processing

Our Website uses services of „Vimeo“, a video platform operated by Vimeo LCC, 555 West 18th Street, New York, New York 10011, USA. We use Vimeo by embedding individual videos from the platform on our Website as a so-called iFrame (embedding), so that they can be played directly on our Website. If you visit a sub-page of our Website on which a video is embedded, a connection to the Vimeo servers is established and the video is displayed within our Website. In the process, Vimeo is informed which web page you have visited. Your IP address may also be transmitted to Vimeo. If you play an embedded video, this information is also passed on to Vimeo. If you are logged in as a Vimeo user, Vimeo assigns this data to your user account. Further information on data protection at Vimeo is available at http://vimeo.com/privacy.

14.2. Purpose

The processing is carried out in order to display videos to you on our Website.

14.3. Legal Basis

The processing is necessary for the purposes of the overriding legitimate interests pursued by the controller (Art. 6(1)(f) GDPR). Our legitimate interest lies in the purpose stated in Section 14.2.

14.4. Recipients, Transfers to Third Countries

Vimeo also processes data in the USA.

15. MATOMO (FORMERLY „PIWIK“)

15.1. Description of the Processing

Our Website uses „Matomo“, a web analytics service of Innocraft Ltd., 150 Willis St, 6011 Wellington, New Zealand. Matomo is open-source software which we have installed on our server. Matomo uses cookies (see Section 10) which enable an analysis of your use of our Website. The statistics generated by Matomo record, in particular, how many users visit our Website, from which country or location access takes place, which sub-pages are accessed and via which links or search terms visitors reach our Website. The information generated by the cookie is transmitted to and stored on our server. It is not disclosed to third parties. Your IP address is not combined with any other data relating to you. IP addresses are recorded exclusively in anonymised form, so that attribution is not possible (so-called IP masking).

15.2. Purpose

The processing is carried out in order to evaluate the use of our Website. The information thus obtained serves to improve our online presence and to design it in line with users’ needs.

15.3. Legal Basis

The processing is necessary for the purposes of the overriding legitimate interests pursued by the controller (Art. 6(1)(f) GDPR). Our legitimate interest lies in the purpose stated in Section 15.2.

15.4. Storage Period

We have explained the storage period as well as your control and setting options regarding cookies in Section 10. You can also prevent data collection by Matomo by unticking the following box and thereby activating the opt-out plug-in: Matomo iFrame. Otherwise, the analytics data processed and stored with Matomo is automatically erased by us after 6 months.

SECURITY MEASURES

16. SECURITY MEASURES

In order to protect your personal data against unauthorised access, we have equipped our Website with an SSL or TLS certificate. SSL stands for „Secure Sockets Layer“ and TLS for „Transport Layer Security“; they encrypt the communication of data between a website and the user’s device. You can recognise active SSL or TLS encryption by a small padlock logo displayed on the far left of the browser’s address bar.

YOUR RIGHTS

17. RIGHTS OF THE DATA SUBJECT

With regard to the data processing by our company described above, you have the following rights as a data subject:

17.1. Right of Access (Art. 15 GDPR)

You have the right to obtain from us confirmation as to whether or not we are processing personal data concerning you. Where that is the case, you have, under the conditions set out in Art. 15 GDPR, the right of access to such personal data and to the information listed in detail in Art. 15 GDPR.

17.2. Right to Rectification (Art. 16 GDPR)

You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you and, where applicable, to have incomplete personal data completed.

17.3. Right to Erasure (Art. 17 GDPR)

You have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the grounds listed in detail in Art. 17 GDPR applies, e.g. where your data is no longer needed for the purposes pursued by us.

17.4. Right to Restriction of Processing (Art. 18 GDPR)

You have the right to obtain from us restriction of processing where one of the conditions set out in Art. 18 GDPR applies; e.g. if you contest the accuracy of your personal data, the processing will be restricted for a period enabling us to verify the accuracy of your data.

17.5. Right to Data Portability (Art. 20 GDPR)

You have the right, under the conditions set out in Art. 20 GDPR, to request that the data concerning you be provided in a structured, commonly used and machine-readable format.

17.6. Withdrawal of Consent (Art. 7(3) GDPR)

Where processing is based on consent, you have the right to withdraw your consent at any time. The withdrawal takes effect from the time it is declared. In other words, it has effect for the future. The withdrawal of consent therefore does not render the processing unlawful retroactively.

17.7. Right to Lodge a Complaint (Art. 77 GDPR)

If you consider that the processing of personal data relating to you infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. You may exercise this right with a supervisory authority in the EU Member State of your residence, your place of work or the place of the alleged infringement.

17.8. Prohibition of Automated Decisions/Profiling (Art. 22 GDPR)

Decisions which produce legal effects concerning you or significantly affect you may not be based solely on automated processing of personal data, including profiling. We hereby inform you that we do not use automated decision-making, including profiling, with regard to your personal data.

17.9. Right to Object (Art. 21 GDPR)

Where we process personal data concerning you on the basis of Art. 6(1)(f) GDPR (for the purposes of overriding legitimate interests), you have the right to object to such processing under the conditions set out in Art. 21 GDPR. However, this only applies insofar as there are grounds relating to your particular situation. Following an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms. We are also not required to cease processing where it serves the establishment, exercise or defence of legal claims. In any event – even irrespective of any particular situation – you have the right to object at any time to the processing of your personal data for direct marketing purposes.

Status: May 2018