A. About homify  

homify is an online architecture and design portal (hereinafter 'Portal’) connecting companies offering goods and services (hereinafter 'professionals') and prospective users and buyers (hereinafter 'user') worldwide. It especially allows professionals to introduce, advertise and offer their services and products. Users can obtain information from the website, find inspiration and contact professionals. The portal therefore features various functions to display contents, contacting providers, and for members to communicate via the portal. Active participation of both professionals as well as users is required for the portal to work. In line with the portal and its services personal data of users is processed in this context. Below we would like to explain in detail how your data is handled in line with the portal. 

B. Processing of personal data 

I.             General information about processing 

1.            Terms 

The following explanation uses the following terms, among others:  

Visitor: Persons visiting the portal without registering (allows limited use of portal functions and services). 

Professionals: Persons with a registered account for the portal, using the portal in connection with a user relationship based on the terms of use of the controller to present and market their company and services. 

User: Persons with a registered account to use the portal, using the portal in connection with a user relationship based on the terms of use of the controller to obtain information and inquire about the services of professionals on the portal. 

2.            Website service provider

Within the scope of hosting and maintaining our website and the respective IT systems our select service providers may, in strict compliance with the relevant data protection regulations, receive the data collected on the website. This is based on data processing contracts under which the carefully selected service providers are bound by contract and we remain the controller with respect to data processing. 

II.           Visiting the portal and contact  

1.           Visiting our portal 

1.1.       Description of data processing 

When visiting our portal (websites under homify.de,  homify.co.uk, homify.es, homify.fr, homify.it,   homify.pt,   homify.com.br,   homify.com.mx,   homify.in,   homify.hk, homify.sg,   homify.jp, homify.co.kr,   homify.nl,   homify.com.tr,   homify.pl,   homfiy.ru,   homify.com.ar,   homify.com.ve,   homify.com.co,   homify.co.za,   homify.com.my,   homify.ae,  homify.com.eg,   homify.pe,   homify.cl,   homify.co.th,  homify.co.id,   homify.pk,   homify.ph,   homify.tw,   homify.vn,   homify.ca,   homify.com,   homify.sa,   homify.sa,   homify.be,   homify.bg,   homify.cz,   homify.se,   homify.si,   homify.sk,   homify.fi,   homify.hr,   homify.no,   homify.rs,   homify.dk,   homify.hu,   homify.gr), the browser being used on your device automatically transmits information to the server hosting our portal/website. The following information is collected in the process: 

• IP address  
• Date and time visited 
• Information about the browser type and the version used 
• Operating system  

This data is further saved to our system’s so-called log files. This data is not stored together with other personal data. It is also not shared with third parties.  

1.2.       Purpose of data processing 

The system temporarily storing the IP address is necessary to enable delivery of the website. This requires storing the IP address for the duration of the session. The data is saved to log files to ensure the functionality of the website. The files further serve optimizing the website and to ensure our IT systems are secure. 

1.3.       Legal basis for processing 

The legal basis for temporary data storage and saving to log files is Article 6(1)(f) DSGVO. The required legitimate interest in data processing is the processing purposes specified under Item 1.2. 

1.4.       Duration of processing/erasure of data 

Data is erased as soon as it is no longer required for the purposes for which they were collected, or if processing is no longer required. With respect to data collection and storage to provide the website this is the case when the respective session has ended. For data saved to log files this is at the latest three months from the time it was collected.   

1.5.       Right to object 

According to Article 21 DSGVO you have the right to object to data being processed according to Item 1.1 at any time for reasons arising from your particular situation. This data will then no longer be processed unless we can verify compelling sensitive reasons for processing which override your interests, rights and freedoms if processing is necessary to establish, exercise or defend legal claims. The visitor can contact us to exercise this objection, especially by e-mailing [email protected]. If the objection is legitimate, the data will be erased. 

2.            Contact form and e-mail contact 

2.1.       Description and scope of data processing 

When using our contact form the data entered in the input screen is transmitted to us and stored.  When submitting your message we will obtain your consent to data processing, referencing this privacy policy. We can further be contacted using the specified e-mail address. In this case the visitor’s personal data transmitted by e-mail will be stored.  The data is only used to process the respective request. Data will not be shared with third parties in this context. With respect to the contact form and e-mail inquiries we use service providers  (processors) located in the USA. These are certified under the EU-US Privacy Shield. Based on this agreement between the USA and the European Commission, the latter established an appropriate level of data protection for Privacy Shield certified companies. 

2.2.       Purpose of data processing 

Personal data from the input screen or your  e-mail is only used to process your inquiry. When  contacting us by e-mail this also constitutes the necessary legitimate interest in processing the data. Other personal data transmitted during the send process will be processed for the purpose of preventing misuse of the contact form and to protect our IT systems. 

2.3.       Legal basis for data processing   

The legal basis for processing the data with the visitor’s consent (for inquiries using the contact form) is Article 6(1)(a) DSGVO.   The legal basis for processing data transmitted by sending an e-mail is Article 6(1)(f) DSGVO. If the e-mail is for the purpose of entering into a contract, the additional legal basis for processing is Article 6(1)(b) DSGVO. 

2.4.       Duration of processing 

The data will be erased as soon as it is no longer required for the purposes for which it was originally collected. With respect to personal data from the input screen in the contact form and those transmitted by e-mail, this is when the respective conversation or inquiry with the visitor is completed. The conversation is completed when circumstances indicate the respective matter has been conclusively resolved.  

2.5.       Right to object or withdraw consent  

The visitor may at any time withdraw his consent to the processing of personal data provided when using the contact form. The withdrawal of consent does not apply to data processed prior to withdrawing the consent. If the visitor contacts by e-mail, he may object to his personal data being stored at any time according to Article 21 DSGVO. In this case the conversation cannot be continued. The visitor can especially submit his objection or withdraw his consent by e-mailing [email protected].  In these cases the data saved in line with contacting us will be erased. 

III.          Registration and profiles  

1.            Registering with homify  

1.1.       Description and scope of processing 

Some services and functions of our portal require registering as a professional or user. This first requires the following access information: 

• E-mail address 
• Password 

Select user or professional  accepting the terms of use and privacy policy 

When submitting your registration the following data (log file data) will also be stored: 

• The user’s IP address 
• Date and time 

Without the above data we are unable to enter into or implement a contract. This data – except log file data – is entered in the respective input screen. All data is saved by us and process for the purpose of entering into and implementing the user contract to use the services or functions of the portal. E-mail address and password, accepting the terms of use and privacy policy, and log file data are not public on the portal and are not shared with third parties. Information about your role as professional or user is public on the portal with respect to the professional or user being assigned the respective platform roup and can be searched accordingly. With respect to implementing the contract the e-mail address is specifically also processed for the purpose of sending the user or professional messages or notifications related to the functions of the portal. If the professional or user registers with his Facebook account, we will receive the respective e-mail address directly from Facebook. In this case the controller does not prompt for a password. Please also note the Facebook privacy policy in this context. 

1.2.       Purpose of processing 

The data collected during registration is processed for the purposes of entering into and implementing the user contract with the professional or user related to use of the portal or its services and functions. The log file data is further also used to prevent misuse of the registration and to ensure our IT systems are secure. 

1.3.       Legal basis for processing 

The legal basis for processing login data collected during registration is Article 6(1)(b) DSGVO.  

1.4.       Duration of processing 

After completing implementation of the user contract to use the services on the portal or erasing the professional or user profile the data will be erased or processing restricted if it is subject to file retention periods under commercial and tax law. The data will be erased at the end of the statutory retention periods at the latest unless the professional or user has expressly consented to further use of the data. 

2.            Professional profile information 

2.1.       Description and scope of processing 

The professional creates a professional profile to make his company information and his services public on the portal. To create the profile the following required information is obtained from the professional and stored: 

• User name 
• Company name 
• Company category 
• City and ZIP 
• Country 

We will also collect and save additional optional information from the professional as indicated in the respective input screen. The above data is processed for the purpose of contract implementation or to provide the functions offered on the portal. This data is specifically also used for the own presentation and to advertise the company and services offered by the professional.  At the time the profile information is saved, the following non-public data (log file data) is also collected: 

The IP address of the professionals 

Date and time 

2.2.       Purpose of processing 

The data collected during registration is processed for the purpose of implementing the user contract with the professional to use the portal or its services and functions. The log file data is further used to prevent misuse of the registration and to ensure our IT systems are secure. 

2.3.       Legal basis for processing 

The legal basis for processing the professional’s data is Article 6(1)(b) DSGVO. 

2.4.       Duration of processing 

After completing implementation of the user contract to use the portal service or after deleting your professional profile your data will be deleted or processing restricted if required based on retention periods under tax and commercial law. Your data will be erased at the end of the statutory retention periods at the latest unless you have expressly consented to further use of your data. 

3.            User profile information 

3.1         Description and scope of processing 

In line with using the portal the users create a user profile. When creating this profile the only required information collected and stored is the user name. We will also collect and save additional optional information from the professional as indicated in the respective input screen.  At the time the profile information is saved, the following non-public data (log file data) is also collected: 

• The user’s IP address 
• Date and time 

3.2         Purpose of processing 

The data collected during registration is only used for the purpose of implementing the user contract with the user to use the portal or its services and functions. The log file data is further used to prevent misuse of the registration and to ensure our IT systems are secure. 

3.3         Legal basis for processing 

The legal basis for processing the professional’s data is Article 6(1)(b) DSGVO. 

3.4         Duration of processing 

After completing implementation of the user contract to use the portal service or after deleting your user profile your data will be deleted or processing restricted if required based on retention periods under tax and commercial law. The data will be erased at the end of the statutory retention periods at the latest unless the user has expressly consented to further use of the data. 

IV.          Adding contents 

1.            Adding projects 

1.1.       Description and scope of processing 

The portal allows professionals to present their services or work as projects, thus also advertising their company and services. The projects published by professionals are public on the portal.  When adding the project the professional is able to provide optional information about the project in the input screen. If the professional publishes his project it is published in various areas of the portal to advertise the professional's service and linked to the following information from the professional’s profile - also public - for the purpose of matching the project with the respective professional: 

• Profile picture
• Company name (required)
• Company category (required)
• City and ZIP (required)
• Phone number
• Social media profile
• URL for the company website
• Professional’s achievements 

If the professional uploads pictures of his project under the optional project information, registered users on the portal can also add these project pictures to their ideabook (see Item III.2.). The respective professional will be listed as the reference for the project picture, thus advertising the professional’s service or company.  Apart from this, the project data is not shared with third parties. In strict compliance with the relevant data protection regulations, in line with creating and hosting projects, the carefully selected service providers used by us may, however, receive the data. This is based on data processing contracts under which the carefully selected service providers are bound by contract and we remain the controller with respect to data processing.   With respect to creating the projects we use service providers (processors) located in the USA to host any project pictures provided by the professional. These are certified under the EU-US Privacy Shield. Based on this agreement between the USA and the European Commission, the latter established an appropriate level of data protection for Privacy Shield certified companies. 

1.2.       Purpose of processing  

The professional’s project data is processed to publish the services or work of the professionals in line with the professional’s overall presence on the portal. This processing is therefore for the purpose of implementing the functions on the portal in line with the user relationship and used by the professional. 

1.3.       Legal basis for processing 

The legal basis for processing project data is Article 6(1)(b) DSGVO. 

1.4.       Duration of processing 

The professional may at any time deleted his projects. In this case, or at the latest after completing implementation of the user contract to use the portal service or after deleting your professional profile your data will be deleted or processing restricted if required based on retention periods under tax and commercial law. The data will be erased at the end of the statutory retention periods at the latest unless the professional has expressly consented to further use of the data. The data deleted generally does not include project pictures provided by the professional in line with the user relationship which under the terms of use of the portal in individual cases can also be used after terminating the professional’s registration and for die duration of the license granted. In this case the pictures will no longer be linked to the respective professional in the portal, and any personal reference will be removed when deleting the other data. 

2.            Creating an ideabook 

2.1.       Description and scope of processing 

Both users and professionals are able to create so-called ideabooks and publish these on the portal. In these ideabooks primarily pictures of projects from professionals on the portal are published again. On one hand this is to allow users and professionals to find ideas and inspiration on the portal, and on the other hand to match professionals with platform users, thus marketing the professionals and their services. When creating an ideabook the input screen collects a required title for the ideabook, which is then stored. The input screen also allows the person creating the ideabook to add other optional information about his ideabook. The user or professional can specifically add pictures from projects of the professionals who published these on the portal and add these to the public ideabook. In the process the respective professional along with his profile may be referenced on the portal in connection with the project picture, thus advertising the professional’s service or company. Apart from this, the data from ideabooks is not shared with third parties. Within the scope of hosting the ideabooks the data may be shared with our select service providers in strict compliance with the relevant data protection regulations. This is based on data processing contracts under which the carefully selected service providers are bound by contract and we remain the controller with respect to data processing.   In line with creating the ideabooks we use service providers (processors) located in the USA for the purpose of hosting the professional’s project pictures. These are certified under the EU-US Privacy Shield. Based on this agreement between the USA and the European Commission, the latter established an appropriate level of data protection for Privacy Shield certified companies. 

2.2.       Purpose of processing 

The data related to the ideabook is processed to publish the services or work of the professionals on the portal and therefore services implementing the portal functions offered based on the relationship and used by the professional. This data is further processed to allow portal users and experts to find ideas and inspirations, specifically also for exchange and interaction between portal users and experts for which the portal is intended, thus to implement the functions offered users and professional in line with the user relationship. 

2.3.       Legal basis for processing 

The legal basis for processing project data is Article 6(1)(b) DSGVO. 

2.4.       Duration of processing 

The user or professional may at any time delete their ideabooks. In this case or at the latest after completing implementation of the user contract or after the professional’s or user’s profile has been deleted, the data will be deleted or processing restricted if required based on retention periods under tax and commercial law. The data will be erased at the end of the statutory retention periods at the latest unless the user or professional has expressly consented to further use of the data. The data deleted generally does not include project pictures provided by the professional in line with the user relationship which under the terms of use of the portal in individual cases can also be used after terminating the professional’s registration and for die duration of the license granted. In this case the pictures will no longer be linked to the respective professional on the portal if the respective expert has closed his portal account, thus removing any personal reference. 

3.            Writing magazine articles 

3.1 Description and scope of processing 

The portal’s online magazine (part of the portal) in some cases also publishes editorials on the work or projects of professionals. These are written by homify or writers we have hired. In line with this suitable project pictures from the professionals are used which were uploaded by the professional and the professional has granted homify license. These reports also name the respective professional. In line with writing editorials for the magazine the pictures of professionals along with the professional’s name and company name may therefore be shared with the writer we have hired.   To expand the reach of the articles and for the purpose of marketing the portal and the professionals and their projects being reported on, homify also publishes these articles on third-party websites and in the homify newsletter. The articles and the data included are solely shared with third party publishers for the purpose of advertising or making these public (to the same extent made public on the portal). Within the scope of creating and hosting as well as product delivery the data may be shared with our select service providers in strict compliance with the relevant data protection regulations. This is based on data processing contracts under which the carefully selected service providers are bound by contract and we remain the controller with respect to data processing.  In line with writing the articles we use service providers (processors) located in the USA to host any project pictures of the professional. These are certified under the EU-US Privacy Shield. Based on this agreement between the USA and the European Commission, the latter established an appropriate level of data protection for Privacy Shield certified companies. 

3.2         Purpose of processing 

The purpose of processing is to write editorials for the magazine section of the portal which specifically also serve to inform and inspire portal users and to market the professionals.  

3.3         Legal basis for processing 

The legal basis for processing the project pictures and the name or company name of the professional to write articles for the magazine is Article 6(1)(f) DSGVO. The legitimate interest is reporting or exercising the right to free speech. 

3.4         Duration of processing 

Subject to the professional’s legitimate objection (see Item 3.5 below) which would result in data being erased, the data is erased after achieving the purpose for which it was collected or the legitimate interest of the controller in reporting no longer exists or if weighing interests according to Article 6(1)(f) DSGVO the interests or fundamental rights and freedoms of the professional requiring the protection of personal data prevail.  

3.5         Right to object 

Under Article 21 DSGVO you generally have the right to object against data processing according to Item 3.1 at any time for reasons arising from your personal situation. We will then no longer process the data unless we can establish compelling grounds for processing which override your interests, rights and freedoms or processing serves asserting, exercising or defending legal claims. The user can especially submit his objection to us by e-mailing [email protected]. If the objection is legitimate, the data will be erased. 

V.           Comments and reviews  

1.            Comments 

1.1.       Description and scope of processing 

Both professionals and users are able to comment on the projects of professionals and ideabooks of users or professionals. These comments are intended for asking questions about the respective projects or ideabooks, providing feedback about these contents and to receive assistance on matters related to the respective publications. The user or professional adds his comment using the respective input screen. There is no additional information related to professional or user comments. After the user or professional posts the comment it is public on the portal. Users comments are published under their user name, professional comments under the company name along with the professional’s profile picture (if a profile picture was added). homify notifies the professional or user who published the content which was commented on of the comment on his content using the e-mail address provided. This also includes the user name of the user who commented or the company name of the professional who commented. Users and professionals are able to disable this notification in their profile settings. 

Apart from this the comment data is not shared with third parties.  

1.2.       Purpose of processing 

The comment function is intended for marketing the professional or his services, and to promote interaction between members of the portal. The comment function further serves the needs of users to obtain information about individual contents or receive assistance with their matters. This processing therefore serves the functions provided in the portal in line with the user relationship and used by the professional or user. 

1.3.       Legal basis for processing 

The legal basis for processing project data is Article 6(1)(b) DSGVO. 

1.4.       Duration of processing 

The user or professional can delete his comments at any time. The author of the respective content which was commented on can further delete the content at any time, which will also delete the associated comments. In these cases or at the latest after full performance of the user contract on the use of the portal services or deleting the professional or user profile – whether commenting or the author of the content which was commented on – the data of the commenting person is deleted. 

2.            Reviews 

2.1.       Description and scope of processing  

Users are able to add a review about their experience with professionals. The respective input screen for this purpose is found on the portal. The person submitting the review can also provide information about the project the professional was used for (such as the project address). The user’s review is published on the profile of the reviewed professional (public). This includes the submitted review information (except the project address) and the user name of the user. This user name then also links to the profile of the user who submitted the review. The professional reviewed is notified of this review by e-mail along with the user name of the reviewer. This notification can be disabled in the profile settings. The professional is further able to request a user he on a project for to submit a review. In this case the professional also uses an input screen under his profile. In this the professional adds the respective free text and the e-mail address of the user he would like to submit a review. The respective user then receives a notification and is able to submit a review using the review input screen. 

2.2.       Purpose of processing 

Processing serves the purpose of reviewing professional services on the portal. This provides the user of the portal with another option to contact the respective professional and further post his opinion. For professionals the review is an opportunity to set themselves apart from competitors and also use this to market their service or company. This processing therefore serves the functions provided in the portal in line with the user relationship and used by the professional or user. 

2.3.       Legal basis for processing 

The legal basis for processing project data is Article 6(1)(b) DSGVO. 

2.4.       Duration of processing 

The reviewer can delete the review – except for the ratings – at any time. This will also delete the review data. If the profile of the reviewed professional is deleted, all reviews are also permanently deleted, including the respective data. If the reviewer deletes his user profile the reviews along with the respective data are also deleted except for ratings (which stay without reference to the user).  

VI.          Matchmaking – requesting quotations 

The term matchmaking refers to the ability for visitors as well as registered users to contact professionals on the portal directly with their request, especially quotations for projects. This provides professionals on the portal with another option to market their services. 

1.            Description and scope of processing 

Various areas of the portal and input masks related to ads on advertising networks (the respective ads reference the different privacy policies of the advertising partners), allow visitors and users of the portal to request quotations for services offered by the professionals on the portal. Depending on the specific request the request is either sent directly to professionals or forwarded to the respective professional through homify.   The data collected from the input screen is processed solely for processing the request of the user or visitor.   If the user or visitor consented in the input screen, his inquiry is also forwarded to the financial institutions specified in the input screen to obtain a financing offer for the respective project. Apart from this the data is not shared with third parties. In line with the controller notifying the professionals on one hand or the user and visitor on the other hand using the e-mail addresses we use a service provider (processors) located in the USA to send the e-mail. These are certified under the EU-US Privacy Shield. Based on this agreement between the USA and the European Commission, the latter established an appropriate level of data protection for Privacy Shield certified companies. 

2.            Purpose of processing 

Data processing serves the purpose of processing and responding to the inquiry of the user or visitor and is therefore also in the interest of the inquirer as well as the interest of the professional marketing his services. Processing is therefore for the purpose of implementing a key function of the portal. 

3.            Legal basis for processing 

With respect to the professionals and users or visitors of the portal the legal basis for processing is Article 6(1)(b) DSGVO. With respect to the inquiry to obtain a financing offer from the financial institutions the legal basis is Article 6(1)(a) DSGVO. 

4.            Duration of processing 

The controller deletes the data he stored for in-house processing after completing the request for a quotation or limits processing if required based on retention periods under tax and commercial law. The data is at the latest deleted at the end of the respective statutory retention period unless the data subject expressly consented to further use of their data. 

VII.        Purchasing additional paid services 

1.            Purchasing a premium membership 

1.1.       Description and scope of processing 

The professional can purchase a premium membership for the portal which provides additional services on the portal as described. When placing an order we collect the data from the order form on the portal. Required data is marked accordingly since we absolutely require this data for entering into a contract or contract performance and the professional is unable to complete the order without this data. The data required for payment is transmitted to our external payment service whose website the professional is redirected during checkout. On said site the payment service collects additional information directly which is not shared with homify. The privacy policies of the respective payment service apply in this respect. 

1.2.       Purpose of processing 

The aforementioned data processing is carried out for the purpose of entering into a contract and for the purpose of implementing the contract. 

1.3.       Legal basis for processing 

The legal basis for processing is Article 6(1)(b) DSGVO. 

1.4.       Duration of processing 

After complete performance of contract your data is restricted from further processing and erased after the retention periods required under tax and commercial law unless you have expressly consented to further use of your data or we have reserved the right to further use your data in a way permitted by law as disclosed in this privacy policy. 

2.            Obtaining quotations or products 

2.1.       Description and scope of processing 

The portal further allows the professional to receive inquiries from users or visitors to the portal requesting a quotation from the professional for the respective user’s or visitor’s projects free of charge. The professional is further able to purchase special publications in line with the portal for a fee.  When placing the order we collect the data from the respective order form on the portal. Required data is marked accordingly since we absolutely require this data for entering into a contract or contract performance and the professional is unable to complete the order without this data. The data required for payment is transmitted to our external payment service whose website the professional is redirected during checkout. On said site the payment service collects additional payment information directly from the professional which is not shared with homify. The privacy policies of the respective payment service apply in this respect. 

2.2.       Purpose of processing 

The aforementioned data processing is carried out for the purpose of entering into a contract and for the purpose of implementing the contract. 

2.3.       Legal basis for processing 

The legal basis for processing is Article 6(1)(b) DSGVO. 

2.4.       Duration of processing 

After complete performance of contract your data is restricted from further processing and erased after the retention periods required under tax and commercial law unless you have expressly consented to further use of your data or we have reserved the right to further use your data in a way permitted by law as disclosed in this privacy policy. 

VIII.       Newsletter  

1.            Newsletter  

1.1.       Description and scope of processing 

In line with their profile on the portal, users and professionals are able to subscribe or unsubscribe the free newsletter. When subscribing through the notification settings the subscribed newsletter is sent to the e-mail address specified by the user or professional. When subscribing to the newsletter the user is prompted to consent to receiving it and is specifically informed the consent can be withdrawn for future newsletters at any time. This can be done by simply unsubscribing under the notification settings in the profile of the user or professional, from the actual e-mail, or by e-mailing [email protected]. This option is also clearly specified in each notification / newsletter.  Within the scope of delivery of our newsletter the data may be shared with our select service providers in strict compliance with the relevant data protection regulations. This is based on data processing contracts under which the carefully selected service providers are bound by contract and we remain the controller with respect to data processing.  In this context we use service providers (processors) located in the USA to host any project images from the professional and to send the newsletter. These are certified under the EU-US Privacy Shield. Based on this agreement between the USA and the European Commission, the latter established an appropriate level of data protection for Privacy Shield certified companies. 

1.2.       Purpose of processing 

The e-mail address of the professional or user is processed for the purpose of sending the newsletter.  

1.3.       Legal basis for processing 

The legal basis for data processing in connection with sending the newsletter is Article 6(1)(a) DSGVO. 

1.4.       Duration of processing 

The data will be erased as soon as it is no longer required for the purposes for which it was originally collected. The e-mail address of the user or professional is then stored as long as the newsletter is still subscribed. After this the e-mail address is deleted unless the user or professional consented to further use for other purposes or we are permitted by law to use the e-mail address for other purposes.  

1.5.       Right to withdraw consent 

The user or professional may withdraw their consent at any time and cancel the newsletter subscription. In this case processing the e-mail address remains untouched until consent is withdrawn. 

IX.          Cookies, web analysis and other third-party services 

1.            Cookies 

1.1.       Description and scope of processing 

The portal uses cookies. These are small text files the browser on your device stores to your device which provide the entity which added the cookie with information.  We use these cookies to make the visit to our portal appealing, to enable use of certain functions, and to enable us to show you products tailored to you. Some of the cookies used in connection with the portal are deleted at the end of the respective session, so after closing your browser (so-called session cookies). Other cookies, however, remain on your device after closing the session and allow us to recognize your browser when you return to portal (persistent cookies).  You can see how long the respective cookies are stored in the list under your browser’s cookie settings. You can further configure your browser to be notified before cookies are added and decide whether to accept the cookie, or block certain or all cookies. Please refer to the respective cookie settings for your browser.  However, please note that blocking cookies may limit the functionality of our portal.   The cookies used also collect data about your browsing behavior on our portal. However, technical measures are in place to pseudonymize the data collected. The data therefore can no longer be matched with the respective user. 

1.2.       Purpose of data processing 

The purpose of processing is for one to make the website easier for the user to navigate. In addition, some functions on our portal cannot be offered without the use of cookies. These further require being able to recognize the browser after switching pages. 

Cookies are used for analysis purposes to improve the quality and contents of our website. These analysis cookies provide us with information about the use of the website so we can continue to improve our service. 

The above purposes also constitute our legitimate interest in data processing according to Article 6(1)(f) DSGVO. 

1.3.       Legal basis for processing 

The legal basis for data processing through cookies is Article 6(1)(f) DSGVO. 

1.4.       Duration of processing 

The cookies are saved to your device and transmitted to our portal. The respective user is therefore in complete control of the use of cookies. You can block or restrict the use of cookies by changing the cookie settings in your internet browser. Cookies which were previously saved to your device can be deleted at any time. This can also be done automatically. However, when blocking cookies for our website you may not be able to make full use of all functions of the portal. 

 

2.            Google Analytics 

2.1.       Description and scope of processing 

We also use Google Analytics on our portal for web analysis purposes. This is an analysis service provided by Google LLC (www.google.com). Google Analytics uses methods which enable analyzing how the respective user uses our portal. This allows us to optimize our service and tailor it to the needs of the users. The information about your use of this website which the cookie collects automatically is typically transmitted to a Google server in the USA, where it is then stored. IP anonymization is enabled on our portal, which truncates the IP address prior to transmission within member states of the European Union or in other states party to the Agreement on the European Economic Area. The full IP address will only be transmitted to a Google server in the USA and truncated there in exceptions. The anonymous IP address transmitted by your browser in line with Google Analytics is never merged with other Google data. Google LLC is headquartered in the USA and is certified under the EU-US Privacy Shield. Based on this agreement between the USA and the European Commission, the latter established an appropriate level of data protection for Privacy Shield certified companies. 

2.2.       Purpose of processing 

The purpose of processing is to analyze browsing behavior to optimize the service and to tailor our portal to the needs of the users. This also constitutes our legitimate interest according to Article 6(1)(f) DSGVO. 

2.3.       Legal basis for processing 

The legal basis for data processing in line with web analysis is Article 6(1)(f) DSGVO. 

2.4.       Duration of processing, objection or removal 

If the purpose no longer applies and we no longer use Google Analytics the data collected in this context will be erased. You can prevent the data about your use of the website generated by the cookie (including your IP address) from being transmitted to Google and processed by Google by downloading and installing the browser plugin: http://tools.google.com/dlpage/gaoptout http://tools.google.com/dlpage/ga...

3. Google AdSense 

3.1         Description and scope of processing 

We also market advertising space on our portal to advertise for third-party service providers and advertising networks. For this purpose we use Google AdSense. Google AdSense is a service provided by Google LLC (www.google.com). In line with the use of the Google AdSense service we also use the Google DoubleClick cookie. This enables the service to generate certain information about browsing behavior to be able to determine the interests of the user from visits to our portal and other websites and show related advertising. In this respect the user is associated with a user ID pseudonym. Google LLC is headquartered in the USA and is certified under the EU-US Privacy Shield. Based on this agreement between the USA and the European Commission, the latter established an appropriate level of data protection for Privacy Shield certified companies. For additional information about this Service and related data processing please refer to the Google privacy policy at https://policies.google.com/privacy 

3.2         Purpose of processing 

The purpose of the aforementioned data processing is optimization and effective operation of our portal. This also constitutes our legitimate interest in processing. 

3.3         Legal basis for processing 

The legal basis for data processing is Article 6(1)(f) DSGVO. 

3.4         Objection / removal 

You can use the following link https://adssettings.google.com/authenticated https://adssettings.google.com/auth... to block the DoubleClick cookie.

4. Hotjar web analysis 

4.1         Description and scope of processing 

Our portal also uses Hotjar for web analysis. This is an Analysis service provided by Hotjar Ltd., Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta, Europe. Hotjar allows us to log and analyze the browsing behavior on our website. In addition to information relate to browsing behavior, it collects information about the operating system, the internet browser, incoming or outgoing links, the geographic origin, and information about the device being used. Hotjar can further obtain direct feedback. The data is processed anonymously.  For more information please visit Hotjar at https://www.hotjar.com/privacy.  You can further block web analysis using Hotjar. By clicking the link https://www.hotjar.com/opt-out your browser will store a cookie on your device which prevents further analysis. Please note, after deleting cookies on your device you will need to click the link again. 

4.2         Purpose of processing 

The purpose of processing is to analyze browsing behavior to optimize the service and to tailor our portal to the needs of the users. This also constitutes our legitimate interest according to Article 6(1)(f) DSGVO. 

4.3         Legal basis for processing 

The legal basis for data processing in line with web analysis is Article 6(1)(f) DSGVO. 

4.4         Objection / removal 

You can prevent web analysis through Hotjar at any time. By clicking the link https://www.hotjar.com/opt-out your browser will store a cookie on your device which prevents further analysis. Please note, after deleting cookies on your device you will need to click the link again. 

5. Google AdWords with conversion tracking 

5.1         Description and scope of processing 

Our portal uses Google AdWords along with so-called conversion tracking (Google AdWords) to analyze our marketing efforts. This is a service provided by Google LLC (www.google.com). When clicking on an ad placed by Google a conversion tracking cookie is added to your device. These cookies are temporary and contain no personal data. They can therefore not be used to identify the user. When visiting our website and the cookie is still valid, both we and Google can determine you clicked the respective Google ad and as a result visited our website. The information collected through conversion tracking are used to compile so-called conversion statistics. This provides us with information about the total number of users who have clicked on one of our ads and were redirected to a page with a conversion tracking tag. It does not enable identifying the user. For more information please refer to the Google privacy policy: ( https://policies.google.com/privacy Google LLC is headquartered in the USA and is certified under the EU-US Privacy Shield. Based on this agreement between the USA and the European Commission, the latter established an appropriate level of data protection for Privacy Shield certified companies. 

5.2         Purpose of processing 

Processing serves the purpose of analyzing and optimizing of our marketing efforts, thus also the effective operation of our portal. This also constitutes our legitimate interest according to Article 6(1)(f) DSGVO. 

5.3         Legal basis for processing 

The legal basis for processing is Article 6(1)(f) DSGVO. 

5.4         Objection / removal 

You can prevent cookies from being saved and your browsing behavior being analyzed at any time by configuring your browser settings accordingly. However, please note that in this case you may not be able to make full use of all functions of the portal. You can also disable customized ads in the Google advertising settings. For instructions please visit https://support.google.com/ads/answer/2662922 https://support.google.com/ads/.... Controller, contact information and rights of the data subject. When your personal data is processed, you are the data subject as defined by DSGVO and have the following rights against us, the controller (unless already disclosed above under D in connection with the respective processing of your data):

I.             Controller name, address and contact information 

The controller as defined by the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations with respect to processing personal data related to this portal is:

Homify Online GmbH & Co. KG

Holländerstraße 34

13407 Berlin

Deutschland

Telefon: +49 (0) 30 16634680

E-Mail: [email protected]

Website: www.homify.de

II.           Data protection officer contact information 

The data protection officer for the controller can be contacted at: 

Herr Felix Lux

Telefon: +49 (0) 234 567 8990

E-Mail: [email protected]

III.          Rights of data subjects 

1.            Right of access 

According to Article 15 DSGVO you can request the controller to confirm whether we process personal data concerning you.  

If your personal data has been processed, you can request to be informed of the following: 

(1) the purposes for which the personal data is processed;
(2) the categories of personal data, which are processed;
(3) the recipients or categories of recipients, to whom your personal data was disclosed or will be disclosed;
(4) the planned duration of the storage of your personal data or, if specific information is not available here, criteria for determining the duration of storage;
(5) the existence of a right to rectification or erasure of your personal data, a right to the restriction of processing by the controller or a right to object to such processing;
(6) the existence of the right to file a complaint with a supervisory authority;
(7) all available information on the source of the data if the personal data is not collected from the data subject;
(8) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. You have the right to request information on whether or not your personal data is transmitted to a third country or an international organization. In this context, you can request being informed about the appropriate guarantees in accordance with Article 46 of the GDPR in connection with the transmission.

2.            Right to rectification  

According to Article 16 DSGVO you have the right to request the controller to rectify your data if the personal data processed concerning you is incorrect or incomplete. The controller must make the correction without delay. 

3.            Right to restriction of processing 

According to Article 18 GDPR you can request a restriction of the processing of your personal data under the following conditions: 

(1) if you contest the accuracy of the personal data for a period enabling the controller to verify the accuracy of the personal data;
(2) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
(3) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims, or
(4) you have objected to processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject. Where processing of your personal data has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. 

If processing was restricted according to the preceding conditions, you will be informed by the controller before the restriction is lifted. 

4.            Right to erasure 

4.1 Obligation to erase 

You can request the controller to immediately erase your personal data and the controller is obligated to immediately erase said data, provided that one of the following reasons applies: 

(1) Your personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
(2) You revoke your consent, which was based on processing in accordance with Article 6(1)(a) DSGVO or Article 9(2)(a) DSGVO, and where there is no other legal basis for processing.
(3) You object to processing in accordance with Article 21(1) DSGVO and there are no overriding legitimate grounds for processing, or you object to processing according to Article 21(2) GDPR.
(4) Your personal data was processed illegally.
(5) Your personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
(6) Your personal data have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR. 

4.2 Disclosure to third parties 

If the controller publicized your personal data and is obligated to erase it in accordance with Art. 17 sec. 1 of the GDPR, the controller will take appropriate measures taking the available technology and implementation costs into account, including technical means, to inform data controllers, which process the personal data, that you have requested them to erase all links to this personal data or copies or replications of this personal data.  

4.3 Exceptions 

This right to erasure specifically does not apply if processing is required
(1) to exercise the right to freedom of expression and information;
(2) to fulfill a legal obligation required by the law of the European Union or the Member States, which the controller is subject to or to carry out a task in the public interest or is carried out in exercising official authority, which was delegated to the controller;
(3) for reasons of public interest in the field of public health in accordance with Article 9(2)(h) and (i) as well as Article 9(3) of the GDPR;
(4) to assert, exercise or defend legal claims. 

5.            Right to information 

If you asserted the right to rectification, erasure or restriction of processing with the controller, according to Article 19 GDPR the controller is obligated to notify all recipients, to which your personal data was disclosed, of this correction or erasure of the data or restriction of processing, unless this proves to be impossible or involves a disproportionate effort. You have the right to request the controller to inform you of these recipients. 

6.            Right to data portability 

Under Article 20 GDPR you have the right to receive the personal data you provided to the controller in a structured, prevalent and machine-readable format. You also have the right to transfer this data to another controller without any hindrance by the controller the personal data was made available to, provided that 

(1) the processing is based on consent in accordance with Article 6(1)(a) DSGVO or Article 9(2)(a) DSGVO or on a contract in accordance with Article 6(1)(b) DSGVO and
(2) processing is conducted using automated procedures. 

In exercising this right, you also have the right to initiate that your personal data is directly transmitted to another controller by a controller, insofar as this is technically feasible. The freedoms and rights of other persons can not be affected by this. The right to data portability does not apply to the processing of personal data necessary for the performance of a task in the public interest or which takes place in exercising official authority, which was delegated to the controller. 

7.            Right to file a complaint with a supervisory authority 

Without prejudice to any other administrative or judicial remedy, according to Article 77 GDPR you have the right to file a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of your personal data infringes the GDPR.  The supervisory authority the complaint was filed with must inform the complainant of the status and results of the complaint including the possibility of a judicial remedy in accordance with art. 78 of the GDPR. 

D. Data security 

To ensure your data is secure we use the commonly used SSL protocol (Secure Socket Layer) on our website in conjunction with the highest level of encryption supported by your browser. This is typically 256 bit encryption. If your browser does not support 256 bit encryption, we will instead use 128 bit v3 technology. You can determine whether a specific page on our website is encrypted by the closed padlock icon in your address bar of your browser.