Privacy Policy / Datenschutzhinweise

It is, on principle, not necessary that you provide personal data for only using our Internet presence for informational purposes. Rather, in this case, we only collect and use those of your data that your Internet browser transmits to us automatically, such as:

• date and time of the retrieval of one of our web pages
• your browser type
• the browser settings
• the operating system used
• the page you last visited
• the volume of data transmitted and the access status (file transferred, file not found, etc.)
• Your IP address.

Purpose: In case of an informational visit, we collect and use these data exclusively in a form not related to a person. This is done to enable the use of the web pages you retrieved at all, for statistical purposes, as well as to improve our Internet offerings. The temporary storage of the IP address by the system is necessary to make possible a delivery of the web page to the user’s computer. To effect this, the user’s IP address must remain stored for the duration of the session.

Legal basis for the temporary collection of the data and the log files is Art. 6 Par. 1 Lit. f GDPR.

For our Internet presence, we use cookie technology. Cookies are small text files that are sent to your browser by our web server in the context of your visit to our websites and which are stored on your computer by your browser for a later retrieval. 

Once the browser session has ended, most of the cookies used by us are deleted from your computer once again (so-called session cookies, also referred to as temporary cookies). The purpose of these cookies is to able to continue to identify your computer during a visit to our Internet presence when switching from one of our web pages to another one of our web pages, and to be able to determine the end of your visit. Other cookies may, instead, remain on your computer and enable us or our partner companies to “remember” your browser upon your next visit (so-called persistent cookies).  

You can specify yourself, through the settings in your browser, whether cookies can be set and retrieved. In your browser, you can, for example, deactivate the storing of cookies altogether, restrict it to certain websites, or configure your browser such that you are automatically notified as soon as a cookie is to be set and you are prompted for a response regarding this. However, for the full scope of functionality of our Internet presence, it necessary, for technical reason, to allow the above. 
A collection or storage of personal data in cookies is note being performed by us in this context. Furthermore, we are not utilising any technologies that link the information generated by cookies with user data.

Legal basis for the processing of personal data under utilisation of cookies is Art. 6 Par. 1 Lit. f GDPR.

Legal basis for the processing of personal data under utilisation of cookies for analysis purposes is, in case of an existing corresponding declaration of consent of the user, Art. 6 Par. 1 Lit. a GDPR.
Purpose of the collection of technically necessary cookies is to simplify the utilisation of the websites for the users. Some functions of our website cannot be offered without the utilisation of cookies. For these, is necessary that the browser can be “remembered” even after switching pages.
The user data collected by technically necessary cookies are not being utilised to create user profiles.

The utilisation of analysis cookies is being carried out for the purpose of improving the quality of our website and of its contents. Through analysis cookies, we find out how the website is being utilised and how we can thusly continuously optimise our offer.

These purposes also constitute our legitimate interest in the processing of the personal da-ta in accordance with Art. 6 Par. 1 Lit. f GDPR.

Cookies are stored on the user’s computer and transmitted from the latter to our website. Therefore, you, as the user, also have full control over the utilisation of cookies. By modifying the settings in your web browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If you deactivate cookies for our website, it is possible that not all functions of the website can be utilised to their full extent any more.

Our website uses the cookie-consent technology of OneTrust, LLC, represented in two main offices in the USA and England: Atlanta, GA, USA (Co-Headquarters), 1200 Abernathy Rd NE, Building 600, Atlanta, GA 30328 United States and London, England (Co-Headquarters), Dixon House, 1 Lloyd’s Avenue, London, EC3N 3DQ (hereinafter referred to as “OneTrust”) to obtain your consent for the storage of specific cookies on your end device and to document this in a manner complying with data protection regulations.

When you enter our website, a OneTrust cookie is stored in your browser in order to assign the consents provided by you or their revocation. The data collected in this way is stored until you request us to delete it, until you delete the consent manager provider cookie itself or if the purpose for data storage no longer applies. Mandatory statutory storage obligations remain unaffected.

OneTrust is used to obtain the legally required consents for the use of cookies. The legal basis for this is Art. 6 Para.1 S. 1 lit. c GDPR.

We have concluded a contract for order processing with OneTrust. This is a contract required by data protection law which guarantees that OneTrust processes the personal data of visitors to our website only in accordance with our instructions and in compliance with the GDPR.

This website utilises Google Analytics, a web analysis service of Google Inc. ("Google"), 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States ("Google").  
Google Analytics uses so-called "Cookies", which are text files that are stored on your computer, and which allow for an analysis of your utilisation of the website. The information that the cookie generates about your utilisation of this website is generally transferred to and stored on a server operated by Google in the USA. In case of an active IP anonymization, your IP address will be shortened first by Google within member states of the European Union or in other contracting states of the Treaty on the European Economic Area. Only in exceptional circumstances will the complete IP address be transferred by Google to the USA and then shortened there. On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activities and for providing other services relating to website utilisation and internet usage to the operator of the website. The IP address transmitted by your browser – as part of "Google Analytics" – is not combined with other data of Google. You can prevent the storage of cookies through a corresponding setting of your browser software; however, we would like to point out that in this case you will not be able to use all features of this web-site to their fullest extent possible. You can, furthermore, prevent the recording of the data generated by the cookie and related to your use of the website (incl. your IP address) to Google as well as the processing of this data by Google by downloading and installing the browser plug-in available at the following link: tools.google.com/dlpage/gaoptout;

We would like to point out that, in order to prevent a direct correlation with individual persons, IP addresses are further processed on this website only in shortened form, since we are using Google Analytics with the “_anonymizeIp()” extension.

We have concluded a contract with Google for order processing and fully implement the strict requirements of the German data protection authorities with use of Google Analytics.

Utilisation of the advertising functions of Google Analytics

In addition to the standard configuration of Google Analytics, functions of Google Analytics are being utilised on this website that support interest-related advertising and advertising based on the surfing behaviour of users. For this, Google Analytics utilises a third party cookie from DoubleClick in order to analyse data regarding the surfing behaviour of users on different websites. With the help of this data, statistical statements regarding demographic data and areas of interest of website users can be made.

We would like to expressly point out to you that we cannot look at any data regarding indi-vidual users and that the statistical data that we utilise cannot be traced back to any specific users.
Some of our website visitors will – after their visit – get our web advertisements displayed at other websites. This form of ad placement is referred to as remarketing or retargeting. If you would like to object to the placement of these ads, we recommend you utilise one of the options listed above for the disabling of website tracking by website users. Additionally, Google provides you with the option to control cookies for advertisement preferences your-self: http://www.google.de/intl/de/policies/technologies/ads/.

We use the open source software tool Matomo on our website. Matomo uses technologies that allow the recognition of the user across pages for the analysis of user behaviour. The software sets a cookie on the user's computer (for cookies see: "Use of cookies"). If individual pages of our website are called up, the following data is stored:

• Anonymised IP address of the calling system of the user
• Web page accessed and time and duration of access
• Website from which the user has reached the accessed website (referrer)
• Frequency of access of the web page
• User's system information (operating system, browser, browser language set, device type, screen resolution)

The software runs exclusively on the servers of our website. A storage of the personal data of the users only takes place there. The data will not be passed on to third parties. Legal basis for the processing of the users' personal data is Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the anonymised analysis of user behaviour in order to optimise both its website and its user-friendliness.

By anonymising the IP address, the interest of users in their personal data protection is sufficiently taken into account. If a corresponding consent has been requested (e.g. consent to store cookies), the processing is based exclusively on Art. 6 para. 1 lit. a GDPR; the consent can be revoked at any time.  

Duration of storage: The data will be de-leted as soon as they are no longer required for the above-mentioned purposes. This is the case after 90 days. Subsequently, only the reports created from them are processed.    

Possibility of objection and removal: Cookies are stored on the user's computer and transmitted from it to our site. Therefore, as a user, you also have full control over the use of cookies. You can disable or restrict the transfer of cookies by changing the settings in your internet browser. Cookies that have already been saved can be deleted at any time. This can also be automated. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website to their full extent.

You can enable the "Do not track" setting in your browser. Our Matomo system is configured to respect this setting. We offer our users the possibility of opting out of the analy-sis process on our website. To do this, you need to follow the link below. In this way, another cookie is set on your system, which signals our system not to store the user's data.

The opt-out cookie has a validity of two years. If the user deletes the corresponding cookie from his own system in the meantime, he must set the opt-out cookie again.

Opt-out: Disable Matomo For more information on the privacy settings of the Matomo software please see the following link:https://matomo.org/docs/privacy-how-to/. 

We are utilising the Pardot Marketing Automation System (“Pardot MAS”) of Pardot LLC, 950 E. Paces Ferry Rd. Suite 3300 Atlanta, GA 30326, USA (“Pardot”) on our websites. Pardot is a specialised software for capturing and analysing the utilisation of a website by website visitors. To the extent that Pardot LLC is processing personally identifiable information, the processing is performed exclusively on our orders and based on our directions. We have ensured compliance with the GDPR in accordance with Art. 46 GDPR by Pardot LLC via an individual agreement with Pardot LLC.

Purpose: Upon visiting our website, Pardot MAS captures your click path and creates therefrom an individual utilisation profile using a pseudonym. Cookies that allow for a re-identification of your browser are being utilised for this purpose. By confirming the so-called cookie acceptance banner upon your initial utilisation of the website or by consenting to the utilisation of cookies via your continued use of our website, you also agree to the utilisation of cookies of Pardot.
Duration of storage: The data will be deleted as soon as they are no longer needed for re-cording purposes.

Option to object and remove: Cookies are stored on the user’s computer and transmitted from the latter to our website. Therefore, you, as the user, also have full control over the utilisation of cookies. By modifying the settings in your web browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically.  Furthermore, you can, at any time, deactivate the creation of pseudonymised usage profiles by configuring your web browser such that cookies by the “pardot.com” domain are not accepted. If you deactivate cookies for our website, it is possible that not all functions of the website can be utilised to their full extent any more.

Legal basis for the processing of personal data under utilisation of cookies is Art. 6 Par. 1 Lit. f GDPR.

This website uses the visitor action pixel from Facebook for conversion measurement. The provider of this service is Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. However, according to Facebook, the collected data is also transferred to the USA and other third countries. This makes it possible to track the behaviour of page visitors after they have been redirected to the provider's website by clicking on a Facebook ad. This allows the effectiveness of Facebook ads to be evaluated for statistical and market research purposes and future advertising measures to be optimised.

The collected data is anonymous for us as the operator of this website, and we cannot draw any conclusions about the identity of the users. However, the data is stored and processed by Facebook, so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes, in ac-cordance with the Facebook Data Use Policy.

This enables Facebook to serve ads on Facebook pages as well as outside of Facebook. This use of data cannot be influenced by us as the site op-erator. The use of Facebook Pixel is based on Art. 6 para. 1 lit. f GDPR.

The website operator has a legitimate interest in effective advertising measures including social media. If a corresponding consent has been requested (e.g. consent to store cookies), the processing is based exclusively on Art. 6 para. 1 lit. a GDPR; the consent can be revoked at any time. Data transfer to the USA is based on the standard contractual clauses of the EU Commission.

Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

Insofar as personal data is collected on our website with the help of the tool described here and forwarded to Facebook, we and Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this data processing (Art. 26 GDPR). The joint responsibility is limited exclusively to the collec-tion of the data and its transfer to Facebook.

The processing by Facebook that takes place after the forwarding is not part of the joint responsibility. The obligations incumbent on us jointly have been set out in a joint processing agreement. The text of the agreement can be found at: https://www.facebook.com/legal/controller_addendum. 

According to this agreement, we are responsible for providing the privacy information when using the Facebook tool and for implementing the tool on our website in a privacy-safe manner. Facebook is responsible for the data security of Facebook products. You can assert data subject rights (e.g. requests for information) regarding the data processed by Facebook directly with Facebook. If you assert the data subject rights with us, we are obliged to forward them to Face-book.

You can find more information about protecting your privacy in the Facebook privacy poli-cy: de-de.facebook.com/about/privacy/. You can also disable the "Custom Audiences" remarketing feature in the Ad Settings section at www.facebook.com/ads/preferences/.

To do this, you must be logged in to Facebook. If you do not have a Facebook account, you can opt out of usage-based advertising from Facebook on the European Interactive Digital Advertising Alliance web-site: www.youronlinechoices.com/de/praferenzmanagement/. 

This website uses functions of the network LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. Each time a page of this website containing functions of LinkedIn is accessed, a connection to servers of LinkedIn is established. LinkedIn is informed that you have visited this website with your IP address.

If you click the "Recommend Button" of LinkedIn and are logged into your account at LinkedIn, it is possible for LinkedIn to assign your visit to this website to you and your user account. We point out that we, as the provider of the pages, have no knowledge of the content of the transmitted data or its use by LinkedIn. The use of the LinkedIn plugin is based on Art. 6 para. 1 lit. f GDPR.

The website operator has a legitimate interest in ensuring the greatest possible visibility in so-cial media. If a corresponding consent has been requested (e.g. consent to store cookies), the processing is based exclusively on Art. 6 para. 1 lit. a GDPR; the consent can be revoked at any time. Data transfer to the USA is based on the standard contractual clauses of the EU Commis-sion.

Details can be found here: https://www.linkedin.com/help/linkedin/answer/62538/datenubertragung-aus-der-eu-dem-ewr-und-der-schweiz?lang=de  

For more information, please see LinkedIn's privacy policy at: https://www.linkedin.com/legal/privacy-policy.  

In case of shipping a catalogue, a brochure, or a customer magazine, your postal address.
Purpose: The collection or utilisation of your data is carried out for the purpose of handling the ordering of catalogues, brochures, and customer magazines.

Legal basis: for the processing of personal data is Art. 6 Par. 1 Lit. b and/or f GDPR.

On our website, there is the option to order a newsletter free of charge. In the process, the data from the data entry mask is transmitted to us upon registration for the newsletter. In order to be able to register for our e-mail newsletter service, we need – in addition to your declaration of consent under data protection law – at a minimum your e-mail address to when the newsletter is to be sent. Additionally, the date and time of registration are being collected.

Your consent to the processing of the data is being collected in the course of the registration process and this data protection policy is being referred to.

For the sending of the newsletter, we utilise the so-called double opt-in method, i.e., we will only send you the newsletter if you previously confirmed your registration via a link contained in a confirmation e-mail sent to you for this purpose. With this, we want to ensure that only you yourself, as owner of the e-mail address specified, can register yourself for the newsletter. Your respective confirmation must be received within 5 working days from receipt of the confirmation e-mail, since your newsletter registration will otherwise be deleted from our database automatically.

To the extent that we transfer data to third countries, we have arranged for suitable guarantees in accordance with Art. 46 GDPR in connection with the transfer.

Purpose: Any additional information will be voluntary and will be utilised to personally address you and to design the content of the newsletter to you in a personalised fashion as well as to be able to obtain clarification in case of questions regarding the e-mail address. The collection of other personal data in the context of the registration process serves to prevent an abuse of the services or of the e-mail address utilised.

Legal basis for the data processing in case of newsletter marketing is Art. 6 Par. 1 S-Par. 1 Lit. a GDPR.

Duration of the processing and right to object: The data will be erased as soon as they are no longer necessary for achieving the purpose for which they were collected. As such, the user’s e-mail address will be stored as long as the newsletter subscription is active. The other personal data collected in the context of the registration process will typically be deleted after a period of seven days.

You may cancel a newsletter you subscribed to from us at any time. To do so, you can either send an informal e-mail to privacy@trilux.com or effect a cancellation via the link at the end of the newsletter. The cancellation does not affect the lawfulness of the data processing that took place based on the declaration of consent up until the objection. This also makes possible a withdrawal of consent to storage of the personal data collected during the registration process.

On our website, we provide you with the option to register for a warranty extension and to file a complaint and/or report a warranty claim, providing personal data. In the process, the data are entered into a data entry mask and transferred to us and stored. A passing-on of data to third parties does not take place. The following data are collected in the context of the registration process:

(1)    Your name and your e-mail address
(2)    The IP address of the user
(3)    Date and time of the registration

Purpose: The utilisation of your data is performed for the purpose of registering your TRILUX product and extending the product warranty or processing your reclamation. A registration of the user is necessary for the fulfilment of a contract with the user or for performing pre-contractual measures
Legal basis is the fulfilment of a contract to which the user is a contractual party or the carrying out of pre-contractual measures in accordance with Art. 6 Par. 1 Lit. b GDPR.

Duration of storage, Option to object/remove: The data will be erased as soon as they are no longer necessary for achieving the purpose for which they were collected. This is the case during the registration process for the fulfilment of a contract of for carrying out pre-contractual measures, if the data are no longer necessary for the execution of the contract. Even after the contract has been concluded, a need may exist to store personal data of the contractual partner in order to comply with contractual or statutory obligations.

If the data are necessary for the fulfilment of a contract or to carry out pre-contractual measures, an advance deletion of the data is possible only if no contractual or statutory ob-ligations prevent a deletion.

On our website, we provide the option to register for an event of the TRILUX Academy of TRILUX Vertrieb GmbH, providing personal data. In the process, the data are entered into a data entry mask and transferred to us and stored. A passing-on of data to third parties does not take place. The following data are collected in the context of the registration process:

(1)    Your name and your e-mail address
(2)    The IP address of the user
(3)    Date and time of the registration

Purpose: The utilisation of your data is performed for the purpose of registering for/with and carrying out the event of the TRILUX Academy.

Legal basis is the fulfilment of a contract to which the user is a contractual party or the car-rying out of pre-contractual measures in accordance with Art. 6 Par. 1 Lit. b GDPR.

Duration of storage, Option to object/remove: The data will be erased as soon as they are no longer necessary for achieving the purpose for which they were collected. This is the case during the registration process for the fulfilment of a contract of for carrying out pre-contractual measures, if the data are no longer necessary for the execution of the contract. Even after the contract has been concluded, a need may exist to store personal data of the contractual partner in order to comply with contractual or statutory obligations.

Data processing by Online-based Audio and Video Conferences (Conference tools) 
We use online conference tools, among other things, for communication with our customers. The tools we use are listed in detail below. If you communicate with us by video or audio conference using the Internet, your personal data will be collected and processed by the provider of the respective conference tool and by us. The conferencing tools collect all information that you provide/access to use the tools (email address and/or your phone num-ber). Furthermore, the conference tools process the duration of the conference, start and end (time) of participation in the conference, number of participants and other “context information” related to the communication process (metadata).

Furthermore, the provider of the tool processes all the technical data required for the processing of the online communication. This includes, in particular, IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or loudspeaker and the type of connection.

Should content be exchanged, uploaded or otherwise made available within the tool, it is also stored on the servers of the tool provider. Such content includes, but is not limited to, cloud recordings, chat/ instant messages, voicemail uploaded photos and videos, files, whiteboards and other information shared while using the service.

Please note that we do not have complete influence on the data processing procedures of the tools used. Our possibilities are largely determined by the corporate policy of the respective provider. Further information on data processing by the conference tools can be found in the data protection declarations of the tools used, and which we have listed below this text. 

Purpose and legal bases
The conference tools are used to communicate with prospective or existing contractual partners or to offer certain services to our customers (Art. 6 para. 1 sentence 1 lit. b GDPR). Furthermore, the use of the tools serves to generally simplify and accelerate communication with us or our company (legitimate interest in the meaning of Art. 6 para. 1 lit. f GDPR). Insofar as consent has been requested, the tools in question will be used on the basis of this consent; the consent may be revoked at any time with effect from that date. 

Duration of storage
Data collected directly by us via the video and conference tools will be deleted from our systems immediately after you request us to delete it, revoke your consent to storage, or the reason for storing the data no longer applies. Stored cookies remain on your end device until you delete them. Mandatory legal retention periods remain unaffected.
We have no influence on the duration of storage of your data that is stored by the operators of the conference tools for their own purposes. For details, please contact directly the operators of the conference tools. 

Conference tools used
We employ the following conference tools: 

GoToWebinar
We use GoToWebinar. The provider is LogMeIn, Inc., 320 Summer Street Boston, MA 02210, USA. For details on data processing, please see GoToWebinar's Privacy Policy: https://www.logmeininc.com/legal/privacy. 

Execution of a contract data processing agreement

We have entered into a contract data processing agreement with the provider of Go-ToWebinar and implement the strict provisions of the German data protection agencies to the fullest when using GoToWebinar. 

5.1 Processing of your personal data

In principle, the legal basis for the processing of your personal data on our social media sites is Art. 6 Para. 1 lit. f GDPR. The data processing is necessary to provide you with the functions and information you requested in the interest of our public relations work and communication with you.

By actively interacting with us via our social media sites (news, comments, downloads etc.), we are informed about your actions where applicable. The functions of the social media sites enable us to view your public profile data. You yourself determine which data is visible in the settings of your social media account.

The use of our lead forms is voluntary, the legal basis of which is the Art. 6 Para. 1 lit. a GDPR; you can object to the data processing in whole or in part at any time without specifying reasons. If you send us an inquiry via our social media channels we may respond to you via other, secure communication channels to ensure confidentiality at all times.

5.2 Social Media sites

5.2.1 LinkedIn

By interaction with our LinkedIn site (e.g. via a campaign), your data provided will be transmitted by LinkedIn to companies of the TRILUX Group as operators of the LinkedIn site.

The legal basis for these data transmissions is Art. 6 Para. 1 lit. f GDPR. You yourself can decide in the settings of your LinkedIn account which personal data is publicly accessible. To do this, go to the settings of your LinkedIn account under the “Privacy” section. You can control and change these settings at https://www.linkedin.com/psettings/privacy.

If you use LinkedIn forms to generate leads (the legal basis is consent pursuant to Art. 6 Para. 1 lit. a GDPR), personal data (e.g. your name, specified company, your e-mail address or telephone number) will be stored by LinkedIn and made available to TRILUX. The data can then be viewed by the companies of the TRILUX Group in their company-wide CRM software.

TRILUX uses this contact data to provide you with further information about our services and products. Use of the lead forms within the framework of our LinkedIn presence is pursuant to Art. 6 Para. 1 lit. f GDPR. TRILUX has legitimate interests in the processing, which can be followed in 5.3. You can object to the use of your data from the lead form at any time.

The lead data is stored on LinkedIn for 90 days and then deleted. For more detailed information about how LinkedIn uses your information, see the LinkedIn Privacy Policy at: https://www.linkedin.com/legal/privacy-policy.

TRILUX retains your personal data provided to us by LinkedIn for as long as knowledge of the data is necessary for the purposes of the business relationship or the purposes for which it was collected, or for as long as legal or contractual retention requirements exist. In addition, you can object to storage of the data at any time (right of objection).

LinkedIn offers the operators of the LinkedIn site analysis functions. With this function, operators of the LinkedIn site can analyse a summary of data in the form of page statistics within a tool.

TRILUX uses this data to generate anonymised statistics (page views, regional distribution etc.) and to analyse the effectiveness of the campaigns. Inferences about individual users are not possible. The LinkedIn analysis function is used pursuant to Art. 6 Para. 1 lit. f GDPR. See also 5.3.

Further information on the processing of user data by LinkedIn as the responsible party can be viewed at https://www.linkedin.com/legal/privacy-policy.

5.2.2 Facebook

We would like to point out that under current law, Facebook (Facebook Ireland Ltd. | 4 Grand Canal Square | Grand Canal Harbour | Dublin 2 Ireland) and the operator of the Facebook fan page have a joint responsibility (“Joint Controller”). For more detailed information see: https://www.facebook.com/legal/terms/information_about_page_insights_data. If you have any questions about data processing by Facebook you can contact the data protection representative of Facebook (https://www.facebook.com/help/contact/540977946302970).

Through interaction with our Facebook fan page (e.g. in the form of news, comments or “Like” information), the data you provide is forwarded from Facebook to companies of the TRILUX Group as the operator of the fan page.

The legal basis for these data transmissions is Art. 6 Para. 1 lit. f GDPR. You yourself can define which personal data is publicly accessible in the settings of your Facebook account. To do this, go to the settings of your Facebook account under the “Privacy” section. You can control and change these settings at https://www.facebook.com/settings?tab=privacy. The behaviour of the "Like" information can also be controlled there (visibility for other users).

If you use Facebook forms to generate leads (the legal basis is consent pursuant to Art. 6 Para. 1 lit. a GDPR), personal data (e.g. your name, specified company, your e-mail address or telephone number) will be stored by Facebook and made available to TRILUX. The data can then be viewed by the companies of the TRILUX Group in their company-wide CRM software.

TRILUX uses this contact data to provide you with further information about our services and products. Use of the lead forms within the framework of our Facebook fan page is pursuant to Art. 6 Para. 1 lit. f GDPR. TRILUX has legitimate interests in the processing, which can be comprehended in 5.3. You can object to the use of your data from the lead form at any time. The lead data is stored on Facebook for 90 days and then deleted. For more information on how Facebook uses your data see the more detailed information on Facebook at: https://www.facebook.com/business/help/1526849577619206?id=735435806665862.

TRILUX retains your personal data provided to us by Facebook for as long as knowledge of the data is necessary for the purposes of the business relationship or the purposes for which it was collected, or for as long as legal or contractual retention requirements exist. In addition, you can object to storage of the data at any time (right of objection).

Facebook offers the operators of the fan page analysis functions (“Facebook Insights”). With these functions, page operators of a fan page can analyse a summary of data in the form of page statistics within a tool.

TRILUX uses this data to generate anonymised statistics (“Like” information, page views, regional distribution of the users, contribution range etc.) and to analyse the effectiveness of the fan page contributions. Use of the Facebook Insights function is pursuant to Art. 6 Para. 1 lit. f GDPR. See also 5.3.

Facebook is responsible for all processing related to Facebook Insights and further processing of user data. Further information on this can be found at: https://www.facebook.com/legal/terms/page_controller_addendum and here: https://www.facebook.com/privacy/explanation.

5.2.3 Instagram

Through interaction with our Instagram site (e.g. in the form of news, comments or “Like” information), the data you provide is forwarded from Instagram to companies of the TRILUX Group as the operator of the Instagram account.

The legal basis for these data transmissions is, among others, Art. 6 Para. 1 lit. f GDPR. You yourself can decide which personal data is publicly available in the settings of your Instagram account under the “Privacy and Security” section. You can control and change these settings under https://www.instagram.com/accounts/privacy_and_security/.

If you use Instagram forms to generate leads (the legal basis is consent pursuant to Art. 6 Para. 1 lit. a GDPR), personal data (e.g. your name, specified company, your e-mail address or telephone number) will be stored by Instagram or Facebook and made available to TRILUX. The data can then be viewed by the companies of the TRILUX Group in their company-wide CRM software.

TRILUX uses this contact data to provide you with further information about our services and products. Use of the lead forms within the framework of our Instagram presence is pursuant to Art. 6 Para. 1 lit. f GDPR. TRILUX has legitimate interests in the processing, which can be comprehended in 5.3. You can object to the use of your data from the lead form at any time. The lead data is stored on Instagram/Facebook for 90 days and then deleted. For more information on how Facebook as the operator of Instagram uses your data see the detailed information on Facebook at: https://www.facebook.com/business/help/563690893827148?id=735435806665862.

TRILUX retains your personal data provided to us by Instagram/Facebook for as long as knowledge of the data is necessary for the purposes of the business relationship or the purposes for which it was collected, or for as long as legal or contractual retention requirements exist. In addition, you can object to storage of the data at any time (right of objection).

Instagram offers the operators of the fan page analysis functions (“Instagram Insights”). With these functions, account holders can analyse a summary of data in the form of page statistics within a tool.

TRILUX uses this data to generate anonymised statistics (“Like” information, page views, regional distribution of the users, contribution range etc.) and to analyse the effectiveness of the Instagram presence. Use of the Instagram Insights function is pursuant to Art. 6 Para. 1 lit. f GDPR. See also 5.3.

The responsibility for all processing related to Instagram Insights and further processing of the user data lies with Instagram or Facebook (Instagram as a product of Facebook). Further information on this can be found at: https://www.facebook.com/help/instagram/155833707900388.

5.2.4 YouTube

Through interaction with our YouTube channel (e.g. in the form of news, comments or “Like” information), the data you provide is forwarded from YouTube to companies of the TRILUX Group as the operator of the YouTube channel.

The legal basis for these data transmissions is, among others, Art. 6 Para. 1 lit. f GDPR. You yourself can define which personal data is publicly accessible in the settings of your YouTube account under “Privacy”. You can control and change these settings at https://www.youtube.com/account_privacy.

If you use YouTube forms to generate leads (the legal basis is consent pursuant to Art. 6 Para. 1 lit. a GDPR), personal data (e.g. your name, specified company, your e-mail address or telephone number) will be stored by YouTube or Google and made available to TRILUX. The data can then be viewed by the companies of the TRILUX Group in their company-wide CRM software.

TRILUX uses this contact data to provide you with further information about our services and products. Use of the lead forms within the framework of our YouTube channel is pursuant to Art. 6 Para. 1 lit. f GDPR. TRILUX has legitimate interests in the processing, which can be followed in 5.3. You can object to the use of your data from the lead form at any time. The lead data is stored on YouTube/Google for 90 days and then deleted. For more information on how Google as the operator of YouTube uses your data, see the detailed information on Google at: https://support.google.com/google-ads/answer/9423235?hl=en

TRILUX retains your personal data provided to us by YouTube/Google for as long as knowledge of the data is necessary for the purposes of the business relationship or the purposes for which it was collected, or for as long as legal or contractual retention requirements exist. In addition, you can object to storage of the data at any time (right of objection).

YouTube offers the operators of the channel analysis functions (“YouTube Analytics”). With these functions, account holders can analyse a summary of data in the form of page statistics within a tool.

TRILUX uses this data to generate anonymised statistics (“Like” information, page views, regional distribution of the users etc.) and to analyse the effectiveness of the YouTube channel. Use of the YouTube Analytics function is pursuant to Art. 6 Para. 1 lit. f GDPR. See also 5.3.

The responsibility for all processing related to YouTube Analytics and further processing of the user data lies with YouTube or Google Inc. (YouTube as a product of Google). Further information on this can be found at: https://policies.google.com/privacy.

5.2.5 Pinterest

Through interaction with our Pinterest site (e.g. in the form of “remember” or “follow”), the data you provide is forwarded from Pinterest to companies of the TRILUX Group as the operator of the Pinterest site.

The legal basis for these data transmissions is, among others, Art. 6 Para. 1 lit. f GDPR. You yourself can decide in the settings of your Pinterest account under “Settings” which personal data is publicly accessible. You can control and change these settings under www.pinterest.de/settings/edit/.

Pinterest offers the operators of the account analysis functions (“Pinterest Analytics”). With these functions, account holders can analyse a summary of data in the form of page statistics within a tool.

TRILUX uses this data to generate anonymised statistics (page impressions, traffic from other channels, comparisons of target groups etc.) and to investigate the effectiveness of the Pinterest presence. Use of the Pinterest Analytics function is pursuant to Art. 6 Para. 1 lit. f GDPR. See also 5.3.

Pinterest is responsible for all processing related to Pinterest Analytics and further processing of user data. Further information on this can be found at: https://policy.pinterest.com/privacy-policy.

5.3 Legitimate interest

The use of our social media sites is partly based on Art. 6 Para. 1 lit. f GDPR (legitimate interests). Our interests are in the analysis of trends, interaction with our social media users and improvement of our campaigns and services. If you require further information on the weighing of interests to be carried out in accordance with Art. 6 Para. 1 lit. f GDPR, please contact our data protection representative at the contact data provided in this data protection declaration. If necessary, we will obtain your consent for data processing (Art. 6 Para. 1 lit. a GDPR).

5.4 Rights of persons affected

Your rights as an affected person with regard to TRILUX are specified in the section: “IV. YOUR RIGHTS AS DATA SUBJECT".

Social Media sites:

LinkedIn – For more information on how to exercise your rights as an affected person directly against LinkedIn, see: https://www.linkedin.com/help/linkedin/answer/50191?trk=micrositesfrontend_legal_privacy-policy.

Facebook – For more information on how to exercise your rights as an affected person directly against Facebook, see: https://www.facebook.com/privacy/explanation.

Instagram – For more information on how to exercise your rights as an affected person directly against Facebook (as the operator of Instagram), see: https://www.facebook.com/help/instagram/155833707900388.

YouTube – For more information on how to exercise your rights as an affected person directly against Google (as the operator of YouTube), see: https://policies.google.com/privacy.

Pinterest – For more information on how to exercise your rights as an affected person directly against Pinterest Inc., see: https://policy.pinterest.com/privacy-policy

To conduct online surveys, we use the service GetFeedback (123 Mission St, San Francisco, CA 94105, USA). GetFeedback is a web service for creating and conducting surveys. GetFeedback provides technical infrastructures and software solutions for creating, conducting and evaluating online surveys. We use the service of GetFeedback to constantly improve and optimize our services. When you participate in a survey, the following data is processed:

• Server log files
• Timestamp (date- start and end time of the response)
• Web browser and operating system used
• Language in which the survey was answered
• IP address
• (optional) your entered answers
• (optional) name, e-mail and telephone number

A link between your person and your answers is only possible if optional information with a personal reference has also been stored.

The legal basis for the processing of the users' personal data is Art. 6 (1) lit. f DSGVO. If a corresponding consent has been requested (e.g. consent to the storage of cookies), the processing is carried out exclusively on the basis of Art. 6 Para. 1 lit. a DSGVO; the consent can be revoked at any time.

Duration of storage: The data is deleted as soon as it is no longer required for the above-mentioned purposes.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission.

For more information, please see: https://www.getfeedback.com/ and https://www.surveymonkey.com/mp/legal/privacy/

We use Mopinion (Mopinion B.V, Pannekoekstraat 104, 3011 LL, Rotterdam, The Netherlands) to carry out customer satisfaction analyses. We use the service of Mopinion to continuously improve and optimize our services. When you participate in a survey, the following data is processed:

1. Technical data (server log files, time stamp (date - start and end time of the response), system information (browser, screen resolution, IP address)
2. Simple feedback, detailed feedback (optional)
3. (optional) name, e-mail and telephone number

The processed data is used exclusively for the collection of feedback. Any further use of the data, in particular for profiling or automated decision-making, will not be made.

The legal basis for the processing of the users' personal data is Art. 6 (1) lit. f DSGVO. Insofar as a corresponding consent has been requested (e.g. consent to store cookies), the processing is carried out exclusively on the basis of Art. 6 (1) lit. a DSGVO; the consent can be revoked at any time.

Duration of storage: The data is deleted as soon as it is no longer required for the above-mentioned purposes.

This is the case after the evaluation has been completed. We have concluded an order processing agreement with the service provider used in accordance with Art. 28 DSGVO; this service provider processes the personal data strictly in accordance with instructions and exclusively for the purposes specified by us.

You can find more information at: https://mopinion.com/ and https://mopinion.com/legal/terms-and-conditions/data-processing-addendum/.

You may demand from the Controller a confirmation regarding whether personal data con-cerning you are being processed by us.

If such a processing is the case, you shall have the right to demand access to the following information from the Controller:

(1)    the purpose for which the personal data is being processed;
(2)    the categories of personal data that are being processed;
(3)    the recipients and/or the categories of recipients to whom the personal data con-cerning you have been or still will be disclosed;
(4)    the planned duration of storage of the personal data concerning you or, if specific statements regarding this are not possible, criteria for the specification of the storage peri-od;
(5)    the existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the Controller, or a right to object to this processing;
(6)    the existence of a right to lodge a complaint with a supervisory authority;
(7)    any and all available information regarding the origin of the data if the personal data were not collected from the data subject;

(8)    the existence of an automated decision-making, including profiling, in accordance with Art. 22 Par. 1 and 4 GDPR, and – at least in these cases – meaningful information about the logic involved as well as the significance and the envisioned consequences of such processing for the data subject.

You shall have the right to demand information whether the personal data that related are transferred to a third country or to an international organisation. In connection with this, you may demand to be informed about the appropriate safeguards in accordance with Art. 46 GDPR in connection with the transfer.

You have a right to rectification and/or completion against the Controller insofar as the per-sonal data processed concerning you are incorrect or incomplete. The Controller must per-form the rectification without undue delay.

Subject to the following prerequisites, you may demand restriction of the processing of personal data concerning you:

(1)    if you contest the accuracy of the personal data concerning you, for a period ena-bling the Controller to verify the accuracy of the personal data;
(2)    the processing is unlawful and you oppose the erasure of the personal data and re-quest the restriction of their use instead;
(3)    the controller no longer needs the personal data for the purposes of processing but you still need them for the establishment, exercise or defence of legal claims, or
(4)    you have objected to processing pursuant to Art. 21 Par. 1 GDPR and it has not yet been determined whether the legitimate grounds of the Controller override your grounds.

Where the processing of the personal data concerning you has been restricted, such data shall, with the exception of their storage, only be processed with your consent or for the es-tablishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.

4.1 Obligation to erase

You shall have the right to demand from the controller to erase the personal data concern-ing you without undue delay, and the controller shall have the obligation to erase these da-ta without undue delay where one of the following grounds applies:

(1)    The personal data concerning you are no longer necessary in relation to the pur-poses for which they were collected or otherwise processed.
(2)    You withdraw your consent on which the processing is based in accordance with Art. 6 Par. 1 Lit. a or Art. 9 Par. 2 Lit. a GDPR, and there is no other legal ground for the processing.
(3)    You object to the processing pursuant to Art. 21 Par. 1 GDPR and there are no overriding legitimate grounds for the processing or you object to the processing pursuant to Art. 21 Par. 2 GDPR.
(4)    The personal data concerning you have been unlawfully processed.
(5)    The personal data concerning you have to be erased for compliance with a legal ob-ligation in Union or Member State law to which the Controller is subject.
(6)        The personal data concerning you have been collected in relation to the offer of information society services referred to in Art. 8 Par. 1 GDPR.

4.2 Information to third parties

Where the Controller has made the personal data concerning you public and is obliged, pursuant to Art. 17 Par. 1 GDPR, to erase the personal data, the Controller, taking account of available technology and the cost of implementation, shall take reasonable steps, includ-ing technical measures, to inform controllers which are processing the personal data that you, as the data subject, have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

4.3 Exceptions

The right to erasure shall not apply to the extent that processing is necessary

(1)    for exercising the right of freedom of expression and information;
(2)    for compliance with a legal obligation which requires processing by Union or Mem-ber State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(3)    for reasons of public interest in the area of public health in accordance with Art. 9 Par. 2 Lit. h and i as well as Art. 9 Par. 3 GDPR;
(4)    for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 Par. 1 GDPR in so far as the right re-ferred to section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
(5)    for the establishment, exercise or defence of legal claims.

If you have asserted the right to rectification, erasure or restriction of processing against the Controller, the Controller shall be obliged to communicate to each recipient to whom the respective personal data concerning you was disclosed any rectification or erasure of the data  or restriction of the processing, unless this proves impossible or involves dispro-portionate effort.
You shall have the right to be informed by the Controller about those recipients.

You shall have the right to receive the personal data concerning you, which you provided to the Controller, in a structured, commonly used and machine-readable format. In addition, you shall have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where

(1)    the processing is based on consent pursuant to Art. 6 Par. 1 Lit. a GDPR or Art. 9 Par. 2 Lit. a GDPR or on a contract pursuant to Art. 6 Par. 1 Lit. b GDPR; and
(2)    the processing is carried out by automated means.
In exercising your right to data portability you shall, furthermore, have the right to have the respective personal data transmitted directly from one controller to another, where technically feasible. This shall not adversely affect the rights and freedoms of others.
The right to data portability shall not apply to a processing of personal data that is needed for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller.

You shall have the right, at any time, to object, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 Par. 1 Lit. e or f GDPR; this shall also apply to a profiling based on those provisions.
The controller shall no longer process the personal data concerning you unless the controller can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or if the processing serves for the establishment, exercise or defence of legal claims.
Where personal data concerning you are processed for direct marketing purposes, you shall have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this shall also apply to profiling to the extent that it is related to such direct marketing.

Where you object to the processing for direct marketing purposes, the personal data concerning you shall no longer be processed for such purposes.
In the context of the use of information society services – and Directive 2002/58/EC notwithstanding – you may exercise your right to object by automated means using technical specifications.

You shall have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of the declaration of consent will not affect the legality of the processing performed based on the declaration of consent up until the withdrawal.

You shall have the right not to be subject to a decision based solely on automated pro-cessing, including profiling, which produces legal effects concerning you or similarly signifi-cantly affects you. This shall not apply if the decision

(1)    is necessary for entering into, or performance of, a contract between you and the Controller,
(2)    is authorised by Union or Member State law to which the Controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legiti-mate interests; or
(3)    is based on your explicit consent.

However, these decisions shall not be based on special categories of personal data re-ferred to in Art. 9 Par. 1 GDPR unless Art. 9 Par. 2 Lit. a or g GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.

With respect to the cases referred to in (1) and (3), the Controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests which include, at least, the right to obtain human intervention on the part of the Controller, to express your point of view and to contest the decision.

Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider the processing of personal data relating to you to be infringing on the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the com-plainant on the progress and the outcome of the complaint including the possibility of a ju-dicial remedy pursuant to Art. 78 GDPR.

The use and configuration of our services can, among other ways, also be carried out via mobile applications (hereinafter referred to as »Apps«).

When you use the Apps, we will process personal data about you. Personal data means any and all information relating to an identified or identifiable natural person. Since the protection of your privacy when using the Apps is important to us, we would like to inform you with the following information about which personal data we process when you use the Apps and how we handle this data. In addition, we will inform you about the legal basis for the processing of your data and, to the extent that the processing is necessary to protect our legitimate interests, also about our legitimate interests.

You can access this privacy policy at any time within the respective App.

Certain information is already processed automatically as soon as you use our Apps. In the following, we have listed for you exactly which personal data is processed:

2.1 Information collected during download
When downloading the Apps, certain required information is transmitted to the App Store you selected (e.g. Google Play or Apple App Store), in particular the username, the e-mail address, the customer number of your account, the time of the download, payment information as well as the individual device identification number may be processed. The processing of this data is carried out exclusively by the respective App Store and is beyond our control.

2.2 Information collected automatically
Within the context of your use of our Apps, we automatically collect certain data that is required for the use of the Apps. This includes, among other things: internal device ID, version of your operating system, time of access. This data is automatically transmitted to us but is not stored,

(1) to provide you with the service and functions connected therewith;

(2) to improve the functions and features of our Apps; and

(3) to prevent and remedy misuse and malfunctions.

This data processing is justified by the fact that

(1) the processing is necessary for the performance of the contract between you as the data subject and us pursuant to Art. 6 Para. 1 lit. b GDPR for the use of the Apps, or

(2) we have a legitimate interest in ensuring the functionality and error-free operation of the apps and in being able to offer a service that is in line with the market and interests, which here outweighs your rights and interests in the protection of your personal data within the meaning of Art. 6 Para 1 lit. f GDPR.

2.3 Creating a user account (registration) and logging in
When you create a user account or log in, we use your access data (e-mail address and username) to grant you access to and manage your user account (»mandatory information«). Mandatory information within the context of registration is marked with an asterisk and is required for the conclusion of the contract of use. If you do not provide this information, you will not be able to create a user account.

We use the mandatory information to authenticate you when you log in. The data you enter as part of the registration or login process is processed and used by us,
(1) to verify your authorisation to manage the user account;

(2) to enforce the terms of use of the Apps as well as all rights and responsibilities associated therewith; and
(3) to contact you in order to be able to send to you technical or legal advice, updates, security messages or other messages concerning, for example, the administration of the user account.

This data processing is justified by the fact that

(1) the processing is necessary for the performance of the contract between you as the data subject and us pursuant to Art. 6 Para. 1 lit. b GDPR for the use of the Apps, or

(2) we have a legitimate interest in ensuring the functionality and error rights and interests in the protection of your personal data within the meaning of Art. 6 Para. 1 lit. f GDPR.

3.1 LiveLink ONE App

3.1.1 Description of the App
Scope of the mobile application: The scope of the LiveLink ONE app is the setup of lighting fixtures that contain Live-Link components. It covers the use cases of fixture-based control and room-based control and provides a mobile app for commissioning and configuration by an installer (»application scope«).

3.1.2 Utilisation of the App
Within the app, you can enter, manage and edit various informations, tasks and activities. This information includes, in particular, data about the project and the lighting installation.

In addition, the App requires the following permissions:

• Internet access: This is required to enable firmware updates of the LiveLink system as well as to save system configurations or importing lighting plans.
• WLAN access: This is needed so that you can control and manage our system.
• Access to location information: This is needed to display which WLAN network the mobile device is connected to.
• Access to the file system for possible storage of system configurations or configuration logs.

3.2 LiveLink Basic Wireless App

3.2.1 Description of the App
Area of application of the mobile App: The area of application of the LiveLink Basic Wireless Mobile App is the setup of lighting systems that contain LiveLink Basic Wireless components. It covers the use cases of fixture-based control and room-based control and offers a mobile App for commissioning and configuration by an installer (»area of application«).

3.2.2 Utilisation of the App
Within the App, you can enter, manage and edit various information, tasks and activities. This information includes, in particular, data regarding the project and the lighting system. In addition, the App requires the following permissions:

• Internet access: It is required for registration and to save your entries on our server.
• Camera access: It is required to be able to scan QR codes.
• Bluetooth access: It is needed in order for you to be able to control and manage our systems.

Access and registration: To access and use the mobile App, you must register as a user. When you apply for a user account, you must provide your valid, current and verifiable email address. Subsequent to verification of access authorisation, you will receive an automatic e-mail with an authentication code which you must enter into the mobile App to complete the registration. Once the code has been verified and found to be correct, you can choose your username that will be displayed in the mobile App. It is not possible to create multiple accounts under one and the same e-mail address.

You are responsible for sharing your user account with others in your organisation and for maintaining the confidentiality of your user account within your organisation. You and your organisation shall assume responsibility for any and all activities (including the activities of others in your organisation) that occur under your user account that are attributable to your conduct, inaction or negligence. TRILUX may, at its sole discretion, refuse registration in case of a particular e-mail service or Internet Service Provider (ISP).

Upgrades, updates: TRILUX may, at its sole discretion, make upgrades, updates or modifications to the mobile App, including remotely, without notifying you of this. Upgrades, updates or modifications shall be governed by these Terms & Conditions of Use unless such upgrade, update or change is accompanied by a separate licence, in which case the Terms & Conditions of that licence shall apply to such upgrades, updates and modifications. If you do not wish to receive such updates, upgrades or modifications, your sole legal remedy is to cease using the mobile App altogether. Your continued use of the mobile App implies that you accept these updates and upgrades.

Support: For questions and support regarding the mobile App, please contact your local TRILUX organisation.

Usage data: The mobile App enables you and others in your organisation with whom you share your user account to generate data from the use of the mobile App regarding the functionality of the mobile App (»Usage Data«).

The processing and use of usage data is carried out in order to provide the service. This data processing is justified by the fact that the processing is necessary for the performance of the contract between you as the data subject and us in accordance with Art. 6 Para. 1 lit. b GDPR for the use of the App.

4.1
Upgrades, Updates: TRILUX may, in its sole discretion, make upgrades, updates or changes to the Mobile Applications, including remotely, without notice to you. Upgrades, updates or changes are subject to these Terms of Use unless such upgrade, update or change is accompanied by a separate license, in which case the terms of that license will apply to such upgrades, updates and changes. If you do not wish to receive such upgrades, updates or modifications, your sole remedy is to cease using the Mobile Application entirely. Your continued use of the Mobile Applications is conditioned upon your acceptance of such updates and upgrades.

4.2
Support: For questions and support related to our mobile applications, please contact your local TRILUX organization.

In addition to the cases explicitly mentioned in this privacy policy, your personal data will only be disclosed without your express prior consent if this is permitted or required by law. This may be the case, inter alia, if the processing is necessary to protect the vital interests of the user or of another natural person

5.1

To the extent necessary, the data that you provide during registration will be passed on within the TRILUX Group for internal administrative purposes, including joint customer care.

Any disclosure of personal data is justified by the fact that we have a legitimate interest in disclosing the data for administrative purposes within our group of companies and that your rights and interests in the protection of your personal data within the meaning of Art. 6 Para. 1 lit. f GDPR do not outweigh this.

5.2

If it is necessary to investigate an illegal or abusive use of the App or for legal prosecution, personal data will be forwarded to law enforcement agencies or other authorities and, if applicable, to injured third parties or legal advisors. This does, however, only happen if there are indications of an illegal or abusive behaviour. A disclosure may also take place if this serves the enforcement of Terms & Conditions of Use or other legal claims. We are, furthermore, required by law to provide information to certain public bodies upon request. These are law enforcement authorities, authorities that prosecute administrative offences subject to fines, and the tax authorities.

Any disclosure of personal data is justified by the fact that

(1) the processing is necessary for compliance with a legal obligation to which we are subject pursuant to Art. 6 Para. 1 lit. f GDPR in conjunction with national legal requirements to disclose data to law enforcement authorities, or

(2) we have a legitimate interest in disclosing the data to the aforementioned third parties if there are indications of abusive behaviour or in order to enforce our Terms & Conditions of Use, other terms & conditions or legal claims and your rights and interests in the protection of your personal data within the meaning of Art. 6 Para. 1 lit. f GDPR do not outweigh this interest.

When you access our Apps, your behaviour may be statistically analysed using certain analytics tools and may be analysed for advertising and market research purposes or to improve our offerings. When using such tools, we ensure compliance with the statutory data protection provisions. When using external service providers (processors), we ensure by means of appropriate contracts with the service providers that the data processing complies with German and European data protection standards.

5.3 Service providers used

5.3.1 Signify
We use tools provided by Signify Netherlands B.V., High Tech Campus 48, 5656AE Eindhoven, The Netherlands (hereinafter »Signify«).

Signify comprises various functions that enable us to operate and users to use the App. Authentication is made possible via Signify, and project data can also be stored in the cloud services of Signify.

5.3.2 Other service providers and open source
Services provided by third parties and open-source software: When you use the mobile App, you may (as a result of or due to your use of the mobile App) use a service or download software or purchase goods provided by another person or company. Your use of these other services, software or goods may be subject to separate terms & conditions between you and the respective company or person. If this is the case, these Terms & Conditions of Use shall have no influence on your legal relationship with these other companies or persons. If the mobile App contains a third-party software component or an open-source software component, the use of that software or component shall be subject to the terms & conditions of use of that third party software or component or that open-source software or component. Your licence rights under these Terms & Conditions of Use do not include any rights or licences to use, distribute or create derivative works of the mobile App in any way that would subject the mobile App to the Open-Source Terms & Conditions. »Open-Source Terms & Conditions« means the terms & conditions of a Licence that provide, as a condition of the use, modification and/or distribution of a work, for the provision of the source code or other materials preferred for modifications and/or for the granting of permission to create derivative works and/or for the reproduction of certain notices or licence terms & conditions in derivative works or the accompanying documentation and/or for the granting of a royalty-free intellectual property licence to any party.

5.4 Disclosure of personal data

Any disclosure of personal data is justified by the fact that

(1) we have a legitimate interest in sharing the data for administrative purposes within our group of companies and your rights and interests in the protection of your personal data within the meaning of Art. 6 Para. 1 lit. f GDPR do not outweigh this, and

(2) we have carefully selected our third-party companies and external service providers as processors within the context of Article 28 Para. 1 of the GDPR, checked them regularly, and contractually required them to process any and all personal data exclusively in accordance with our instructions.

5.5 Further development

In the context of the further development of our business, it may occur that the structure of our company changes by changing the legal form, founding, buying or selling subsidiaries, parts of companies or components. In such transactions, customer information may be passed on together with the part of the business to be transferred. Whenever we disclose personal data to third parties to the extent described above, we will ensure that this is done in accordance with this privacy policy and applicable data protection law.

Any disclosure of personal data is justified by the fact that we have a legitimate interest in adapting our corporate form to the economic and legal circumstances as required and that your rights and interests in the protection of your personal data within the meaning of Art. 6 Para. 1 lit. f GDPR do not outweigh this.

On this, please refer to the section »Notice regarding data transfer to the USA« in these privacy notices.

We erase or anonymise your personal data as soon as it is no longer needed for the purposes for which we collected or used it in accordance with the above clauses. Typically, we store your personal data for the duration of the usage and/or contractual relationship regarding the App plus a period of 1 month, during which we keep backup copies subsequent to erasure, unless this data is needed for a longer period for criminal prosecution or for the safeguarding, assertion or enforcement of legal claims.

For your rights as a data subject, see Section »IV. YOUR RIGHTS AS DATA SUBJECT«

All information you transmit to us will be stored on servers within the European Union. Un-fortunately, the transmission of information via the Internet is not fully secure, which is why we cannot guarantee the security of the data transmitted to our website via the Internet. However, we protect our website and other systems, through technical and organisational measures, against loss, destruction, access, modification, or distribution by unauthorised persons. In particular, your personal is being transmitted encrypted by us. For this, we uti-lise the SSL (Secure Socket Layer) [and/or TLS (Transport Layer Security)] coding system.

In addition, we are utilising technical and organisational security measures to protected personal data that is incurred or collected, against – in particular – accidental or intentional manipulation, loss, destruction or attack by unauthorised persons. Our security measures are continuously being improved corresponding to the technological development.

The website may contain hyperlinks to and from third party websites. If you follow a hyper-link to one of those websites, please note that we cannot assume responsibility or liability for third party contents or terms and conditions of privacy / data protection. Please deter-mine for yourself the respective applicable terms & conditions of privacy / data protection before transmitting personal data to those websites.

We reserve the right to change these data protection provisions at any time, effective for the future. The website will contain the respective current version. Please visit the website regularly and inform yourself about the applicable data protection provisions.

The privacy / data protection policy has been translated from the German language. In case of inconsistencies, the German version shall prevail.

End of privacy policy.

Version 1 July 2020