Login
Menu Icon Menu Icon
Logo MSR Family Office

– Data Protection –

Privacy Policy

Data Protection

I. Data protection

Name and contact details of the data controller


Münster Stegmaier Rombach
Family Office GmbH
Biberacher Straße 116
88339 Bad Waldsee
Germany


Phone: +49 (0)7524 9785 - 0
Fax: +49 (0)7524 9785 - 200
E-mail: info@remove-this.msr-familyoffice.de


Managing Partners:

Wolfgang Rombach

Werner Gasser

Stephan Jäggle

 

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the data protection regulations, as well as this privacy policy.

As a rule, our website can be used without having to provide personal data. Wherever possible, any personal data (e.g. name, address or e-mail addresses) that is collected on our website shall always be collected on a voluntary basis. This data shall not be passed on to third parties without your express consent. Wherever data may be collected and potentially stored when you access the website, e.g. in log files or cookies, in addition to us the company that maintains our website as an administrator also has access to this data.

The legal basis for this access is Art. 6 (1)(f) of the GDPR.

We draw your attention to the fact that transmitting data via the Internet (e.g. when communicating by e-mail) may pose a security risk. It is not possible to protect such data completely against access by third parties.


SSL encryption

This website uses SSL encryption for reasons of security and to prevent the transfer of confidential content, such as any enquiries you submit to us as the operator of the website. An encrypted link can be identified by the fact that the browser address line switches from “http://” to “https://” and the padlock symbol appears in your browser line.

When SSL encryption is activated, the data you transfer to us cannot be read by third parties.


Questions regarding data protection

If you have any questions regarding data protection, please contact: datenschutz@remove-this.msr-familyoffice.de

II. General information regarding data processing

1. Scope of processing of personal data

In principle, we only process the personal data of our users to the extent that it is necessary to provide a properly functioning website, as well as for our content and services. The personal data of our users is as a rule processed with the consent of the user. An exception is made in those instances when it is impossible to obtain the prior consent of the user for practical reasons and the processing of the data is permitted by law. Personal data includes names, addresses, e-mail addresses and user behaviour, for example. Legal basis for the processing of personal data

To the extent that we obtain consent from the data subject for the processing of personal data, Art. 6 (1)(a) of the General Data Protection Regulation (GDPR) serves as the legal basis.

For the processing of personal data that is necessary for the performance of a contract to which the data subject is party, Art. 6 (1)(b) of the GDPR serves as the legal basis. This also applies to processing that is required for any actions that must be taken prior to entering into a contract.

To the extent that processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6 (1)(c) of the GDPR serves as the legal basis.

In the event that processing of personal data is necessary in order to protect the vital interests of the data subject or of another natural person, Art. 6 (1)(d) of the GDPR serves as the legal basis.

If the processing is necessary for the purposes of the legitimate interests pursued by our company or a third party and does not override the interests or fundamental rights and freedoms of the data subject, then Art. 6 (1)(f) of the GDPR serves as the legal basis for processing.

2. Data deletion and retention period

The personal data of the data subject shall be deleted or blocked as soon as the purpose for retaining the data no longer applies. Data may be retained for longer periods of time if this is required by the European or national legislative body in EU regulations, laws or other provisions that apply to the data controller.

 

III. Provision of the website and creation of log files

1. Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the system of the computer that is gaining access.

The following data is collected in the process:

(1) Information regarding the type of browser and the version used

(2) The user’s operating system

(3) The user’s Internet service provider

(4) The user’s IP address

(5) Date and time of access

(6) Websites from which the user’s system accesses our website

(7) Websites that are accessed by the user’s system via our website

This data cannot be attributed to specific individuals and will not be merged with any other data sources. We reserve the right to check this data retrospectively, if we become aware of clear evidence of any unlawful use.

2. Legal basis for data processing

The legal basis for the temporary retention of data and log files is Art. 6 (1)(f) of the GDPR.

3. Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user’s computer. To do so, the user’s IP address must remain stored for the duration of the session.

The data is stored in log files to ensure the functionality of the website. In addition, the data helps us to optimise the website and to ensure the security of our information technology systems. Data is not evaluated for marketing purposes in this context.

These purposes also give rise to our legitimate interest in data processing pursuant to Art. 6 (1)(f) of the GDPR.

4. Possibility of objection and removal

The collection of data for the provision of the website and the storage of data in log files is absolutely essential for the operation of the website. Consequently, the user has no possibility of objection.


IV. Use of cookies

1. Description and scope of data processing

Our website uses cookies. Cookies are text files that are stored in or by the web browser on the user’s computer system. When a user accesses a website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic string of characters that allows the browser to be identified unambiguously when the website is accessed again.

Cookies do not damage your computer and do not contain viruses. Cookies enable us to make our website more user-friendly, more effective and more secure. Cookies are small text files that are placed on your computer and saved by your browser.

Most of the cookies we use are session cookies. They are automatically deleted when you end your visit. Other cookies remain stored on your device until you delete them. These cookies enable us to recognise your browser the next time you visit our website.

You can set your browser to inform you when cookies are placed on your computer and only allow cookies on an individual basis, refuse to accept cookies in specific situations or refuse them in general, and activate automatic deletion of cookies when you close your browser. Deactivating cookies may restrict the functionality of this website.

2. Cookies used (Cookie name/Expiry date/Purpose)

_ga /2 years/Used to distinguish between website users
_gat /1 minute/Used to throttle the request rate to Google Analytics
_gid/24 hours/Used to distinguish between website users
resolution/End of session/Saves the width of the device in pixels
displayCookieConsent/1 year/ Saves the result of the cookie request.

3. For the use of cookies as part of using Google Analytics, Google Maps and Google Remarketing, see below VI ff.

4. Legal basis

The legal basis for processing personal data using essential cookies is Art. 6 (1)(f) of the GDPR.

The legal basis for processing personal data using cookies that are not essential, provided the user has given their consent to this, is Art. 6 (1)(a) of the GDPR.

V. Establishment of contact, especially e-mail

1. As a rule, our website can be used without having to provide personal data. Wherever possible, any personal data (e.g. name, address or e-mail addresses) that is collected on our website shall always be collected on a voluntary basis. This data shall not be passed on to third parties without your express consent.

When you contact us by e-mail, the data you provide (your e-mail address and, where applicable, your name and telephone number) will be stored by us, to enable us to respond to your queries. We will delete any data provided to us in this way as soon as it is no longer necessary for us to store it, or will restrict its processing in cases where we are legally obliged to store it.

2. Legal basis for data processing

The legal basis for processing the data that is submitted to us as a result of sending an e-mail or contacting us in any other way is Art. 6 (1)(f) of the GDPR. If the purpose of contacting us is to conclude a contract, then the additional legal basis for processing the data is Art. 6 (1)(b) of the GDPR.

The legal basis for processing the data is the consent given by the user as a result of contacting our company: Art. 6 (1)(a) of the GDPR.

3. We draw your attention to the fact that transmitting data via the Internet (e.g. when communicating by e-mail) may pose a security risk. It is not possible to protect such data completely against access by third parties.

VI. Web analysis using Google Analytics

1. Service provider
This website uses features provided by the web analysis service Google Analytics. This service is provided by Google Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA.
Google Analytics uses cookies. These are text files that are saved on your computer and enable analysis of your use of the website. The information generated by the cookie on your use of this website is normally transferred to a Google server in the USA and stored there.
For more information about how Google Analytics handles user data, refer to Google’s privacy policy: https://support.google.com/analytics/answer/6004245?hl=en


2. Deactivation using a browser plugin
You can prevent cookies being saved by altering the respective settings in your browser software. However, please note that if you do this you may not be able to fully use all of the website functions. Furthermore, you can prevent collection of the data generated by the cookie relating to your use of the website (including your IP address) by Google, as well as its processing by Google, by downloading and installing the browser plugin via the following link: https://tools.google.com/dlpage/gaoptout?hl=en

 


3. Objection to data collection
You can prevent Google Analytics from collecting your data by clicking on the following link. An opt-out cookie is placed on your computer that prevents your data from being collected during any future visits to this website: Disable Google Analytics.

Clicking on the link above will download an opt-out cookie onto your computer. To do this, your browser must allow cookies to be stored. If you delete your cookies regularly, you will need to click on the link each time you visit this website.


4. Outsourcing of data processing

We have entered into an agreement with Google for the outsourcing of our data processing and fully implement the strict requirements of the German data protection authorities when using Google Analytics.


5. IP anonymization
We use the “Enable IP anonymization” feature on this website. However, within Member States of the European Union and in other contracting states of the Treaty on the European Economic Area, Google will truncate your IP address first. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. On behalf of the website operator, Google uses this information to evaluate your use of the website, compile reports on website activity and provide the website operator other services associated with the use of the website and the Internet. Google will not combine the IP address sent by your browser as part of Google Analytics with any other data.


6. Demographic data collection by Google Analytics
This website uses Google Analytics’ demographic features. This allows reports to be generated containing statements about the age, gender and interests of the visitors to our website. This data comes from interest-based advertising from Google and third-party visitor data. This data cannot be attributed to any specific individual person. You can disable this feature at any time by adjusting the ads settings in your Google account or by prohibiting the collection of your data by Google Analytics as outlined in the section “Objection to data collection”.

VII. Privacy policy for the use of Google Maps

1. We use the Google Maps service on this website. This means that we are able to directly show you interactive maps within the website and make it easy for you to use the maps feature.
When visiting the website, Google will be informed that you have visited the corresponding sub-page on our website. This takes place regardless of whether Google provides a user account with which you are logged in, or whether no user account exists. If you are logged into Google, your data is directly allocated to your account. If you do not want this allocation to your Google profile to take place, then you must log out before activating the button. Google stores your data as a user profile and uses it for the purposes of advertising, market research and/or to personalise the design of its website. In particular, this type of analysis is undertaken (even for users who are not logged in) in order to provide personalised advertising and to inform other users of the social network about your activities on our website. You are entitled to object to the creation of this user profile, whereby you are required to contact Google in order to exercise this right.
Further information about the purpose and scope of data collection and the processing of data by the plug-in provider can be found in the provider’s privacy policies. You can also obtain additional information about your rights in respect of this, as well as the configuration options to protect your privacy in these policies: www.google.com/intl/en/policies/privacy. Google also processes your personal data in the USA and has subscribed to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.


2. Legal basis for the processing of personal data
The legal basis for processing the personal data of users is Art. 6 (1)(f) of the GDPR.


3. Purpose of data processing
Processing the personal data of users enables us to analyse the web surfing behaviour of our users. By analysing the data we obtain, we are able to compile information about the use of the individual components of our website. This helps us to constantly improve our website and its user-friendliness. These purposes also give rise to our legitimate interest in data processing pursuant to Art. 6 (1)(f) of the GDPR. The anonymization of the IP address sufficiently takes into account the interest of users in the protection of their personal data.

VIII. Privacy policy for the use of Google Analytics Remarketing

1. Our webpages use Google retargeting technologies. This service is provided by Google Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA.

This enables visitors to our webpages to be targeted with personalised, interest-based advertising. Advertising is displayed using a cookie-based analysis of past usage and web surfing behaviour. To the best of our knowledge, no personal data will be stored. For this purpose, a cookie is stored on the computer in order to collect anonymous data about the interests of the user and thus individually tailor the advertising to this information. These cookies are small text files that are saved on your computer or mobile device.


2. Legal basis for the processing of personal data
The legal basis for processing the personal data of users is Art. 6 (1)(f) of the GDPR.
You can permanently object to the use of cookies for retargeting by disabling Google ad personalisation here: www.google.com/settings/ads/onweb/

For more information and the data protection provisions of Google, refer to Google’s privacy policy at http://www.google.com/policies/technologies/ads/

IX. Processing of data (customer and contract data)

We collect, process and use personal data only to the extent that is necessary for the establishment, development or modification of the legal relationship (inventory data). We collect, process and use personal data relating to the use of our website (usage data) only to the extent that is necessary to enable the user to access the service or for us to issue invoices.


The legal basis for processing the personal inventory data of users is Art. 6 (1)(b) of the GDPR.

The legal basis for processing personal usage data is Art. 6 (1)(f) of the GDPR.

X. Rights of the data subject

If your personal data is processed, then you are the data subject within the meaning of the GDPR and have the following rights in respect of the data controller:

1. Withdrawal of consent

Where personal data is processed on the basis of consent having been granted previously, you have the right to withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of the processing that was carried out with consent prior to its withdrawal.


You may contact us at any time to exercise your right of withdrawal.

2. Right to receive confirmation

You have the right to obtain from the data controller confirmation as to whether or not we are processing personal data concerning you. You may request this confirmation at any time using the contact details provided here.

3. Right of access

If your personal data is being processed, you have the right to access this personal data and request the following information at any time:

  • the purposes of the processing;
  • the categories of personal data being processed;
  • the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations;
  • where possible, the envisaged period for which the personal data will be stored, or, if this is not possible, the criteria used to determine this period of time;
  • the existence of the right to request from the data controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
  • the existence of the right to lodge a complaint with a supervisory authority;
  • where the personal data is not collected from the data subject, any available information as to the source of the data;
  • the existence of automated decision-making, including profiling, referred to in Article 22 (1) and (4) of the GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Where personal data is transferred to a third country or to an international organisation, you have the right to be informed of the appropriate safeguards pursuant to Article 46 of the GDPR relating to the transfer. We shall provide a copy of the personal data subject to processing. For any further copies that you request we may charge a reasonable fee based on administrative costs. Where you make the request by electronic means, the information shall be provided in a commonly used electronic form. The right to obtain a copy must not adversely affect the rights and freedoms of others.

4. Right to rectification

You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

5. Right to erasure (“Right to be forgotten”)

You have the right to demand from the data controller the erasure of personal data concerning you without undue delay, and we are obliged to erase personal data without undue delay where one of the following grounds applies:

  • The personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
  • The data subject withdraws their consent on which the processing is based according to Article 6 (1)(a) or Article 9 (2)(a) of the GDPR, and there is no other legal ground for the processing.
  • The data subject objects to the processing pursuant to Article 21 (1) of the GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21 (2) of the GDPR.
  • The personal data has been unlawfully processed.
  • The personal data must be erased to comply with a legal obligation in EU or Member State law to which the data controller is subject.
  • The personal data has been collected in relation to the offer of information society services referred to in Article 8 (1) of the GDPR.

Where the data controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the data controller, taking account of the technology available and the cost of implementation, shall take reasonable steps, including technical measures, to inform data controllers who are processing the personal data that the data subject has requested the erasure by such data controllers of any links to, or copy or replication of, this personal data, unless this turns out to be impossible or would entail unreasonable expense or effort.

You have the right to be informed of these recipients by the data controller.

The right to erasure (“right to be forgotten”) shall not apply provided that processing is necessary:

  • for exercising the right to freedom of expression and information;
  • for compliance with a legal obligation that requires processing in accordance with EU or Member State law to which the data controller is subject or for the performance of a task that is carried out in the public interest or in the exercise of official authority vested in the data controller;
  • for reasons of public interest in the area of public health in accordance with Article 9 (2)(h) and (i) as well as Article 9 (3) of the GDPR;
  • for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89 (1) of the GDPR in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
  • for the establishment, exercise or defence of legal claims.

 

6. Right to restriction of processing

You have the right to have the processing of your personal data restricted by us where one of the following applies:

  • the accuracy of the personal data is contested by the data subject, for a period enabling the data controller to verify the accuracy of the personal data;
  • the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead;
  • the data controller no longer needs the personal data for the purposes of processing, but it is required by the data subject for the establishment, exercise or defence of legal claims; or
  • the data subject has objected to processing pursuant to Article 21 (1) of the GDPR pending verification of whether the legitimate grounds of the data controller override those of the data subject.

Where processing has been restricted in accordance with the aforementioned preconditions, such personal data will, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the EU or of a Member State.

The data subject can contact us at any time using the contact details provided above to assert his/her right to have processing restricted.

7. Right to data portability

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit this data to another data controller without hindrance from the data controller to which the personal data has been provided, where:

  • the processing is based on consent pursuant to Article 6 (1)(a) or Article 9 (2)(a) or on a contract pursuant to Article 6 (1)(b) of the GDPR; and
  • the processing is carried out by automated means.

In exercising the right to data portability pursuant to paragraph 1, you have the right to have the personal data transmitted directly from one data controller to another, where this is technically feasible. Exercising the right to data portability shall be without prejudice to the right of erasure (“right to be forgotten”). This right shall not apply to any processing necessary for the performance of a task that is carried out in the public interest or in the exercise of official authority vested in the data controller.

8. Right to object

You have the right to object, on grounds relating to your particular situation, at any time, to the processing of personal data concerning you that is based on Article 6 (1)(e) or (f) of the GDPR; this also applies to profiling that is based on these provisions. The data controller shall no longer process the personal data, unless the data controller can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing. Where you object to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

Where personal data is processed for scientific or historical research purposes or statistical purposes pursuant to Article 89 (1) of the GDPR, you have the right to object, on grounds relating to your particular situation, to processing of personal data concerning you, unless the processing is necessary for the performance of a task that is in the public interest.

You may exercise your right to object at any time by contacting the relevant data controller.

9. Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which results in legal consequences for you or significantly affects you in a similar way. This does not apply if the decision:

  • is necessary for entering into, or for the performance of, a contract between the data subject and the data controller;
  • is authorised by EU or Member State law to which the data controller is subject and which also lays down suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests; or
  • is based on the data subject’s explicit consent.

The data controller shall implement suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests, which includes at the very least the right to obtain human intervention on the part of the data controller, to express his or her point of view and to contest the decision.

The data subject may exercise this right at any time by contacting the relevant data controller.


10.
Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if the data subject considers that the processing of personal data relating to them infringes this regulation.


11.
Right to an effective judicial remedy

Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR, you have the right to an effective judicial remedy where you consider that your rights under this regulation have been infringed as a result of the processing of your personal data in non-compliance with this regulation.

 

XI. Children

As a basic principle, our website is aimed at adults. Persons below the age of 18 should not send us any personal data without the consent of their parents or legal guardians.

XII. Changes to our data privacy terms

We reserve the right to occasionally amend this privacy policy so that it remains constantly in line with the latest legal requirements or so that we can incorporate changes to our services, such as the introduction of new services. If you come back to our website, any new privacy policy will apply.

XIII. Objection to advertising e-mails

We hereby object to the use of the contact data published within the scope of our statutory legal notice obligations for the transmission of advertising and information material that has not been expressly requested. The operators of this website expressly reserve the right to take legal action in the event that unsolicited advertising material is sent, such as in spam e-mails.