Privacy

Data Protection Declaration for the website https://efsm.online, the portal "Evidence for Self-Medication".

This English translation is provided as a service whereas the original German version  is legally binding.

The responsible handling of personal data is very important to us. With this Data Protection Declaration, we would like to inform you about the type, scope and purpose of the personal data we collect, use and process, as well as your rights pertaining to data protection. We process your personal data in accordance with the General Data Protection Regulation (GDPR) of the European Union and in accordance with the applicable data protection regulations in Germany (BDSG [German data protection act]). However, absolute data protection cannot be guaranteed since there may be security gaps whenever data is transferred on the internet. We reserve the right to adapt this Data Protection Declaration as necessary in order to remain in compliance with the current legal requirements or to implement changes to our services within the scope of the data protection declaration.

The Controller pursuant to the General Data Protection Regulation (GDPR) and other national data protection laws of the member states as well as other data protection law provisions is:

Wissenschaftliche Verlagsgesellschaft mbH Stuttgart
Maybachstraße 8
70469 Stuttgart
Telephone: +49-711-2582-234

Fax: +49-711-2582-283

E-mail: service@efsm.online
Website: https://efsm.online 
Managing Directors: Dr. Benjamin Wessinger, Leonie Haas-Rotta, Thomas Koch, Nils Wörner

We have appointed a Data Protection Officer whom every data subject can contact directly at any time with all questions and suggestions regarding data protection. You can reach them by post at the above-mentioned address of our company with the addition "personally c/o Data Protection Officer" or via e-mail to datenschutz@dav-medien.de.

a) Extent of processing of personal data

We only process the personal data of our users insofar as it is necessary to ensure the provision of the website or our content and services. We only process the personal data of our users after they have given their consent. Data may be collected in exceptional cases in which prior consent is not possible for practical reasons or the data processing is permitted by legal regulations.

b) Legal basis for the processing of personal data

Insofar as we receive a data subject’s consent for the processing of personal data, Article 6 (1) lit. a) EU General Data Protection Regulation (GDPR) serves as the legal basis. For the processing of personal data that is necessary for the performance of a contract concluded with the data subject, this is done as pursuant to Article 6 (1) lit. b) GDPR. This also applies to data processing operations that are necessary prior to entering into a contract. Insofar as the processing of personal data is required to fulfil a legal obligation to which our company is subject, this is done in accordance with Article 6 (1) lit. c) GDPR. In the event that the processing of personal data is necessary to protect the vital interests of the data subject or of another natural person, Article 6 (1) lit. d) GDPR serves as the legal basis. If the processing is required for the purposes of legitimate interests on the part of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh the former’s interests, this is carried out according to Article 6 (1) lit. f) GDPR.

c) Deletion of data and retention duration

The personal data of the data subject will be deleted or blocked as soon as the intended purpose of the processing is no longer valid. In addition, data may be stored if the processing of said data is provided for by European or German legislation or by regulations, laws or other directives to which the Controller is subject. Blocking or deletion of data is also carried out when a retention deadline prescribed by the aforementioned standards expires, unless the further storage of the data is required for the conclusion or the performance of a contract.

d) Transfer of data

If, within the scope of our processing, we transmit, disclose or grant access to data to other persons and companies (subcontractors or third parties), this is done only on the basis of a legal permission, legal obligation or our legitimate interests or your consent. In these cases, our data processing is performed by a service provider bound by instructions who is obliged by data protection requirements and may not use the data for another purpose. Insofar as we contract third parties to process data based on a so-called "order processing contract”, this is done as pursuant to Article 28 GDPR.

If data is processed in a third country, this is done so only in order to fulfil our (pre-)contractual obligations, if there is a legal obligation to do so or it is in our legitimate interests or with your consent. Subject to legal or contractual permissions, we process data or have data processed in a third country only if the special conditions laid out in Articles 44 et seq. GDPR have been ensured. This means the processing is done, for example, based on special guarantees or officially recognised special contractual obligations.

a) Description and extent of data processing

Every time you access our website, our system automatically captures data and information from the computer system of the accessing computer. The following data are collected in this process:

• Information on the browser type and the version used
• The user's operating system
• The user's Internet service provider
• The user's IP address
• Date and time of access
• Websites, from which the user's system reaches our webpage.
• Websites accessed by the user's system via our website.

The data are also stored in the log files of our system. These data are not stored along with other personal data.

b) Legal basis for data processing

The legal basis for the temporary storage of data and log files is Article 6 (1) lit. f) GDPR.

c) Purpose of data processing

The temporary storage of the IP address on the system is necessary to ensure the delivery of the website to the user’s computer. For this purpose, the user’s IP address must be stored for the duration of the session. Storage is undertaken in the log files in order to ensure the functionality of the website. In addition, the data serve for us to optimise the website and to ensure the security of our IT systems. There is no evaluation of data for marketing purposes in this context. These purposes also include our legitimate interest in the processing of personal data as pursuant to Article 6 (1) lit. f) GDPR.

d) Duration of storage

The data will be deleted when they are no longer necessary for the intended purpose for which they have been collected. In the case of data capture for the provision of the website, this is the case once the respective session is finished. In the case of data storage in log files, this is the case after seven days at the latest. Storage beyond this is possible. In this case, the user's IP addresses are deleted or anonymised such that assignment to the client accessing is no longer possible.

e) Appeal and removal procedure

Data must be collected to ensure the provision of the website and they must be stored in log files for the operation of the site. Consequently, the user is not granted a right to object in this case.

a) Description and extent of data processing

Our website uses cookies. Cookies are text files that are placed in or by the internet browser on the user’s computer system. If a user accesses a site, a cookie may be placed on the user’s operating system. This cookie contains a characteristic string that allows for the clear identification of the browser for any subsequent access to the website. We place cookies to ensure our site is user-friendly. 

We use cookies on our websites that enable an analysis of the user's surfing behaviour. This allows the following data to be transmitted:

• Search terms entered
• Frequency of page accesses
• Use of website functions

The user's data collected in this way are pseudonymised by technical means. Assignment of data to the user accessing is therefore no longer possible. The data are not store together with any other of the user's personal data. On accessing our website, users are informed with an info banner about the use of cookies for analytical purposes and referred to this Data Protection Declaration. In this context, there is also a reference to how the storage of cookies can be blocked in the browser settings.

b) Legal basis for data processing

The legal basis for the processing of personal data with the use of cookies is Article 6 (1) lit. f) GDPR.

c) Purpose of data processing

The purpose of using technically necessary cookies is to simplify the use of the websites for the user. Some features of our website cannot be used without the placement of cookies. For this, it is necessary for the browser to be recognised even after switching pages.

We require cookies for the following applications:

• Remembering search terms

The user data collected by technically necessary cookies are not used to create user profiles. The use of analysis cookies serves the purpose of improving the quality of our website and its contents. Through the analysis cookies we experience how the website is used and thus we can make continual improvements to our offering. These purposes also include our legitimate interest in the processing of personal data as pursuant to Article 6 (1) lit. f) GDPR.

d) Duration of storage, appeal and removal procedure

Cookies are stored on the user’s computer and transmitted from the computer to our website. Therefore, you as a user have full control of the placement of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Previously placed cookies can be deleted at any time. This can be also done automatically. If cookies are disabled for our website, it is possible that not all functions of the website can be used fully.

a) Description and extent of data processing 

On our website it is possible to contact us via the e-mail address provided. In this case, the user's personal data submitted with the e-mail are stored. These data are not transferred to third parties. The data are used solely for the processing the conversation.

b) Legal basis for data processing

The legal basis for the processing of the data that are sent with the transmission of the e-mail is Article 6 (1) lit. f) GDPR. If the email contact serves to enter into a contract, then the additional legal basis for the processing is Article 6 (1) lit. b) GDPR.

c) Purpose of data processing

If contact is made via e-mail, then there is also a required legitimate interest in the processing of the data. The various personal data processed during the dispatching process serve to prevent misuse of the contact form and to ensure the security of our IT systems.

d) Duration of storage

The data will be deleted when they are no longer necessary for the intended purpose for which they have been collected. For the data sent by e-mail, this is the case if the respective conversation with the user has been completed. The conversation is deemed to have been completed if, based on circumstances, it is apparent that the issue at hand has been resolved. The personal data additionally collected during the dispatching process are deleted after a period of seven days at the latest.

e) Appeal and removal procedure

If the user contacts with us via e-mail, then they may object to the storage of their personal data at any time. In such a case, however, the conversation cannot be continued. All personal data that have been stored in the course of establishing contact will be deleted in this case.

a) Content of the newsletter

Our newsletters contain in particular information on new products, events or promotions from the publisher Mediengruppe Deutscher Apotheker Verlag.

b) Credentials

When you register to receive free newsletters, the data you enter in the input mask are transmitted to us. To subscribe to the newsletter, it is sufficient to enter your e-mail address. To enable us to address you personally and to tailor the newsletter to your information needs, we request you to voluntarily provide your name and professional environment.

c) Newsletter distribution service provider

For the newsletter distribution we use the service CleverReach of CleverReach GmbH & Co. KG, Mühlenstr. 43, 26180 Rastede, Germany. For the purpose of sending the newsletter, we transmit to CleverReach the e-mail address and the information provided voluntarily. CleverReach may use the recipient data in pseudonymous form for service optimization and statistical purposes. For more information about CleverReach's data protection, please visit http://www.cleverreach.de/datenschutz/. 

d) Double opt-in and logging

Registration for our newsletter takes place in a so-called double opt-in procedure. This means that after you have registered for the newsletter, you will receive an e-mail asking you to confirm your subscription. This confirmation is necessary so that no one can log in with third-party e-mail addresses. In order to be able to prove the registration process according to the legal requirements, subscription to the newsletter is logged.

e) Legal basis

Data processing is based on your consent Art. 6 para. 1 lit. a DSGVO or on the basis of our legitimate interest in direct advertising in accordance with Article 6 (1) lit. f) GDPR. You can revoke your consent at any time by unsubscribing from the newsletter. The legality of the data processing activities already carried out remains unaffected by the revocation.

f) Purpose of data processing

Collection of the user's e-mail address is used to deliver the newsletter. Collection of other personal data during the registration process serves to prevent misuse of the services or the e-mail address used and to statistically analyse the reach of the newsletter.

g) Storage period

The data you provide us with for the purpose of receiving the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted from our servers as well as from the CleverReach servers after you unsubscribe from the newsletter. Data that has been stored by us for other purposes remains unaffected by this.

h) Possibility of objecting

Subscription to the newsletter can be cancelled by the particular user at any time. You will find a corresponding link in every newsletter for this purpose. This also enables the revocation of consent to the storage of personal data collected during the registration process or objection to data processing.

a) Advertising by e-mail

With your express consent, which can be revoked at any time, we will inform you by e-mail for the purposes of our own market research and to advertise our digital and printed publishing products (newspapers, magazines and articles) and the advantages of such subscriptions, Article 6 (1) lit. a) GDPR, Article 7 (2) no. 3 UWG [German unfair competition act]). Of course, you can object to this at any time at basic rates (Article 6 (1) lit. f) GDPR, Article 7 (3) UWG).

b) Competitions/promotions

If you participate in our competitions or sales promotions, we and our cooperation partners (e.g. sponsors) process the data to carry out the competition or sales promotion (Article 6 (1) lit. b) GDPR). We and, if applicable, the respective cooperation partner also process data for their own customer analyses and advertising.

d) Storage period

Data collected for advertising purposes will be stored as long as the advertising purpose exists or until we receive revocation of your consent or your objection to the processing of your data for advertising purposes.

We maintain publicly accessible profiles in social networks for information and communication purposes. In some cases, data is processed outside the EU, which can restrict the enforcement of data subject rights under GDPR.

The use of social networks enables operators to comprehensively analyse user behaviour and triggers processing operations under data protection law. For example, user data is processed for marketing and market research purposes, user profiles are created with personal interests and preferences, and these are displayed for displaying interest-based advertising on all devices on which users are or were logged in.

Unfortunately, not all processing procedures of the portal operators can be traced. This means it is possible for operators to carry out further data processing. You can find details on this in provisions on data protection and terms of use for the respective social media providers.

The above-mentioned information and communication purposes as well as guaranteeing optimal online presence constitute a legitimate interest on our part within the meaning of Article 6 (1) lit. f) GDPR. If consent has been given to the social media provider regarding processing, Article 6 (1) lit. a) GDPR is the relevant legal basis.

Together with the social media provider, we are responsible for the data processing activities triggered when visiting the platform. Data subject rights can most effectively be asserted with the social media provider. We would be happy to provide support.

• Vimeo without tracking (Do-Not-Track)

This website uses plugins from the Vimeo video portal. The provider is Vimeo Inc, 555 West 18th Street, New York, New York 10011, USA.

When you visit one of our sites featuring Vimeo videos, a connection to the servers of Vimeo is established. This informs the Vimeo server which of our pages you have visited. In addition, Vimeo obtains your IP address. However, we have set Vimeo so it will not track your user activity or set cookies.

The use of Vimeo is in the interest of an appealing presentation of our online offers. This constitutes a legitimate interest within the meaning of Article 6 (1) lit. f) GDPR. If a corresponding consent was requested, the processing is carried out exclusively on the basis of Article 6 (1) lit. a) GDPR; consent can be revoked at any time.

Vimeo is certified under the EU-US Privacy Shield, which is designed to ensure that personal data is processed in the US in accordance with EU standards.

For more information on how Vimeo handles user data, please see Vimeo's data protection declaration at: https://vimeo.com/privacy.

a) Description and extent of data processing

We use the Matomo open-source web analytics service on our website. Matomo enables us to recognize users across sites by means of device fingerprinting. The information required for this purpose is stored exclusively on our servers. There is no outflow of data to third parties. Before storage, the IP address is anonymised, so we are able to record and analyse the usage behaviour of visitors to our website, but we cannot draw any direct conclusions about the person behind the anonymised data. With the help of the data collected in this way, we learn which pages are accessed by our website visitors, but also from which region our website visitors come. Log files (e.g. IP address and the browser used) are also recorded. With regard to the IP address, we would like to point out that this is only stored incompletely, so that no conclusions can be drawn about the IP address. We are able to evaluate the data and inform ourselves, for example, about what website visitors have specifically searched for, or which pages are accessed most.

b) Legal basis for data processing

The use of this analysis tool is based on Article 6 (1) lit. f) GDPR. We have a legitimate interest in the anonymous analysis of user behaviour, because we can use this data to continuously develop our offer, but we also need the data for cooperation with our advertising partners. With regard to advertising partners, it should be pointed out that, e.g. the frequency of visits to a website is a value-creating factor, similar to the volume of print media.

c) Hosting

To ensure the best possible data protection, we host Matomo exclusively on our own servers.

You have the option of preventing us from collecting anonymized data using Matomo. This allows you to better protect your privacy even more, but on the other hand, it also makes it more difficult for us to improve our services based on user behavior.

If you still do not want us to collect the data described above, you can use this checkbox to prevent the collection of your data.

We would like to point out that by using the opt-out function, Matomo must be enabled to take this setting into account for future visits. For this purpose, a cookie is set, which in turn does not collect any personal data.

As soon as your personal data are processed, you assume the role of the data subject as pursuant to the General Data Protection Regulation and are therefore granted the following rights vis-à-vis the Controller: 

A) Right of Access 

You have the right to obtain from the Controller confirmation as to whether or not personal data concerning you are being processed by us.

If this is the case, you may request access to following information from the Controller: 

(1) the purposes of the processing of personal data

(2) the categories of personal data concerned

(3) the recipients or categories of recipient to whom the personal data have been or will be disclosed

(4) the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period

(5) the existence of the right to request from the Controller rectification or deletion of personal data or restriction of processing of personal data concerning you or to object to such processing

(6) the right to lodge a complaint with a supervisory authority

(7) where the personal data are not collected from the data subject, any available information as to their source

(8) the existence of automated decision-making, including profiling, referred to in Article 22 (1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject

You are entitled to the right to request information on whether your personal data are transferred to a third country or to an international organisation. In this context, you have the right to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer. 

b) Right to rectification 

You have a right to rectification and/or completion vis-à-vis the Controller insofar as the processed personal data concerning you is incorrect or incomplete. The Controller must make the correction without undue delay. 

c) Right to restriction of processing 

You may request the restriction of processing of personal data concerning you under the following conditions: 

(1) You have contested the accuracy of the personal data for a period enabling the Controller to verify the accuracy of the personal data

(2) The processing is unlawful, and you oppose the deletion of the personal data and request the restriction of their use instead

(3) The Controller no longer needs the personal data for the purposes of the processing, but you require them to assert, exercise or defend legal claims or

(4) You have objected to processing pursuant to Article 21 (1) GDPR pending the verification of whether the legitimate grounds of the Controller override yours 

Where processing of personal data concerning you has been restricted, such data shall, apart from storage, only be processed with your consent or for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.

Where the restriction of processing is carried out pursuant to the aforementioned conditions, you will be informed by the Controller before the restriction of processing is lifted. 

d) Right to deletion 

a. You may request the Controller to have personal data concerning you deleted without delay. The Controller is required to delete these data without delay, unless one of the following reasons applies: 

(1) The personal data concerning you are no longer required for the purposes for which they were collected or processed.

(2) You withdraw your consent to data processing based on Article 6 (1) lit. a) or Article 9 (2) lit. a) GDPR and there is no other legal basis for the data processing.

(3) You object to the processing as pursuant to Article 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing as pursuant to Article 21 (2) GDPR.

(4) The personal data concerning you have been processed unlawfully.

(5) The deletion of personal data concerning you is required to fulfil a legal obligation based on laws of the European Union or of a Member State to which the Controller is subject.

(6) The personal data concerning you have been collected in relation to services offered by the information society as pursuant to Article 8 (1) GDPR. 

If the Controller makes the personal data concerning you available to the public and he is obliged to delete the data as pursuant to Article 17 (1) GDPR, he must take appropriate measures, taking into account the available technology and the cost of their implementation and technical nature, to inform the data processing Controller who processes the personal data that you as the data subject have requested the deletion of all links to these personal data or copies or replication of such personal data.  

b. The right to deletion does not apply insofar as the processing is required 

(1) to exercise the right to freedom of expression and information

(2) to fulfil a legal obligation that requires processing according to the laws of the European Union or its Member States to which the Controller is subject, or the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller

(3) based on considerations of the public interest in the field of public health as pursuant to Article 9 (2) lit. h) and i) as well as Article 9 (3) GDPR

(4)       for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes as pursuant to Article 89 (1) GDPR insofar as the right listed under a) is expected to render impossible or seriously impair the achievement of the objectives of this processing, or

(5)       for the assertion, exercise or defence of legal claims 

e) Right to be informed 

If you have asserted your right to rectification, deletion or restriction pertaining to the data processing vis-à-vis the Controller, he is thus obliged to inform all recipients to whom the personal data have been disclosed of this rectification or deletion of the data or the limitation of the processing, unless this proves to be impossible or involves a disproportionate effort.

You are entitled to the right to be informed by the Controller about these recipients. 

f) Right to data portability 

You have the right to receive the personal data concerning you, which you have provided to the Controller, in a structured, commonly used and machine-readable format. Moreover, you also have the right to transmit those data to another Controller without hindrance from the Controller to which the personal data have been provided insofar as 

(1) the processing is based on consent granted as pursuant to Article 6 (1) GDPR or Article 9 (2) GDPR or on a contract pursuant to Article 6 (1) lit. b) GDPR and

(2) the processing is carried out by automated means 

In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one Controller to another, wherever technically feasible. This may not adversely affect the rights and freedoms of others.

The right to data portability does not apply to the processing of personal data if it is required for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller. 

g) Right to object 

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6 (1) lit. e) or f), including profiling based on those provisions.

The Controller shall no longer process the personal data unless he demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the assertion, exercise or defence of legal claims.

Wherever personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you may no longer be processed for such purposes.

Within the context of the use of information society services, notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications. 

h) Right to withdrawal consent to data processing 

You have the right to withdrawal your consent to data processing at any time. Upon withdrawing consent, the legality of the data processing carried out on the basis of the consent will not be affected by the withdrawal of consent. 

i) Automated decision-making, including profiling 

You have the right not to be subject to a decision that is based solely on an automated processing of data, including profiling, and that may have a legal effect on you or any similarly significant restrictive effect. This does not apply if the decision  

(1) is necessary for the conclusion or the performance of a contract between you and the Controller

(2) is permissible on the basis of legislation of the European Union or its Member States to which the Controller is subject, and these laws contain adequate measures to safeguard your rights and freedoms as well as your legitimate interests, or

(3) is made with your explicit consent 

However, these decisions may not be based on special categories of personal data as pursuant to Article 9 (1) GDPR, insofar as Article 9 (2) lit. a) or g) GDPR do not apply and appropriate measures for the protection of your rights and freedoms as well as your legitimate interests have been taken. Regarding the cases referred to in (1) and (3), the Controller must take appropriate measures to safeguard your rights and freedoms as well as your legitimate interests, which must include at least the right to obtaining of the intervention of a person on the behalf of the Controller, the right to present one’s own position and the right to contest the decision. 

j) Right to lodge a complaint with a supervisory authority

 Notwithstanding any other administrative or judicial remedies, you also have the right to lodge a complaint with the federal state supervisory authority if you believe that the processing of your personal data is in violation of GDPR. You can find out which state data protection supervisory authority is responsible for us as the Controller at the following link https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html. The supervisory authority to which the complaint is submitted informs the complainant on the status and the results of the complaint including the possibility of a judicial remedy as pursuant to Article 78 GDPR.

(Status: 30.08.2021)