Data protection
The most important at a glance
erhebung.de is a platform that allows users to carry out online surveys. In doing so, we adhere to the following rules.- There is no disclosure of survey data to third parties.
- An evaluation, processing or use of the survey data by us (erhebung.de) or by third parties does not take place. This is not only rejected for marketing & usage analyses, but also for all other conceivable purposes of data processing.
- If personal data is collected in a survey, the survey author is required to provide participants with their own privacy statement.
- Subcontractors are not maintained by erhebung.de. The provision of servers, storage media, infrastructure as well as the technical development of the entire application is carried out exclusively by ourselves.
- Survey data is stored exclusively on our in-house servers and never leaves this location at any time. The storage location is in Ulm (surrounding area) in Germany (see picture).
1. Name and address of the responsible person
The person responsible for the purposes of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations can be found in the Imprint.2. General information about data processing
2.1. Scrope of processing of personal data
In principle, we collect and use personal data of our users only to the extent necessary to provide a functional website and our content and services. The survey and use of personal data of our users takes place regularly only with the consent of the user. An exception applies to cases in which prior consent is not possible for reasons of fact and the processing of the data is permitted by law.2.2. Legal basis for the processing of personal data
Insofar as we obtain the consent of the data subject for processing of personal data, Art. 6 para. 1 lit. a EU General Data Protection Regulation (GDPR) as legal basis. In the processing of personal data necessary for the performance of a contract of which the data subject is a party, Art. 6 para. 1 lit. b GDPR as legal basis. This also applies to processing operations required to carry out pre-contractual measures. Insofar as the processing of personal data is required to fulfill a legal obligation that our company is subject to, Art. 6 para. 1 lit. c GDPR as legal basis. In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 lit. d GDPR as legal basis. If processing is necessary to safeguard the legitimate interests of our company or a third party, and if the interest, fundamental rights and fundamental freedoms of the data subject do not outweigh the former interest, Art. 6 para. 1 lit. f GDPR as legal basis for processing.2.3. Data erasure and storage duration
The personal data of the data subject will be deleted or blocked as soon as the purpose of the storage is deleted. In addition, it may be stored if provided for by the European or national legislator in EU regulations, laws or other regulations to which the controller is subject. A blocking or deletion of the data takes place even if a storage period prescribed by the mentioned standards expires, unless there is a need for further storage of the data for a contract conclusion or a contract fulfillment.3. Website provision
You can interact with erhebung.de in different ways. We basically distinguish three possible roles. Depending on the actions you perform, you can act in one, two or three roles. For clarification, let's first explain the terms: Visitor, Survey Author, Survey Participant.
- You become a visitor as soon as you visit erhebung.de or any subpage.
- You become a survey author as soon as you start a survey via an instant survey or register via a standard or premium account.
- You become a survey participant as soon as you visit the participation link of a survey, fill in any form fields and finally submit them.
Visiting a participation link but not submitting the survey makes you a visitor - but not a survey participant.
Legal basis for data processing
The legal basis for the temporary storage of the data and the log files is Art. 6 para. 1 lit. f GDPR.3.1. Visitor
3.1.1. Scope of data processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer. The following data is collected:- Browser type and version
- Operating system used
- Referrer URL
- Host name & IP address of the accessing computer
- Time of the server request
3.1.2. Purpose of data processing
The storage in log files is done to ensure the functionality of the website. In addition, the data serves us to optimize the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context. These purposes are also our legitimate interest in data processing according to Art. 6 para. 1 lit. f GDPR.3.1.3. Duration of storage
The data will be deleted as soon as they are no longer required to achieve the purpose of their survey. If no security-related anomalies are detected, the above data will be removed within 14 days. If the opposite is the case, the data will be consulted for the analysis and elimination of the problem and stored for the corresponding duration.3.1.4. Possibility of objection and removal
The collection of data for the provision of the website and the storage of the data in log files is mandatory for the operation of the website. Consequently, there is no possibility of objection on the part of the user. Instead, a recurring automatic deletion is performed.3.2. Survey participants
3.2.1 Scope of data processing
- Points from 3.1.1.
- Survey form entries
3.2.2. Purpose of data processing
The purpose of data processing is determined by the intention and intent of the survey author. The survey author has the option of writing his or her own privacy policy for the survey created. In this privacy statement, the survey author is required to disclose the scope of the collected data as well as the legal basis, purpose & duration of the data processing and the possibility to object.3.2.3. Duration of storage
The survey author is free to archive or delete the participants' data at any time. In particular, even if the survey has not yet been completed. A concrete, generally valid date for the deletion is not provided in principle - unless the survey author clarifies this otherwise.3.2.4. Possibility of objection and removal
The participant has the possibility to revoke his consent to the processing of personal data or to request information at any time. If a survey author has mentioned the individual objection possibility for his survey participants, this way should be used. If this is not the case, the survey participant can request an extraordinary revocation by e-mail
to erhebung.de. The survey author will then be notified by us. If the revocation is not accepted by the survey author, it will be carried out by erhebung.de. In this way, the survey participant can at any time and categorically object to the storage of his/her personal data or ask for information in this regard. If no personal data has been collected, it cannot be removed. In such a case, the conversation cannot be continued.3.3. Survey author via instant survey
3.3.1. Scope of data processing
- Points from 3.1.1.
- Email address of the survey author
3.3.2. Purpose of data processing
The e-mail address is stored for the purpose of maintaining a communication channel with the survey author. This is important, among other things, if the survey author loses access to his surveys or if a data protection-relevant notification is pending.3.3.3. Duration of storage
The data is stored for the duration of the account use.3.3.4. Possibility of objection and removal
Deletion of data entails account deletion and can be requested at. Here, the request for account deletion must be sent from the same e-mail address as the e-mail address of the account to be deleted. Requests that meet this criterion will not be carried out.3.4. Survey author via standard account
3.4.1. Scope of data processing
- Points from 3.3.1.
- First & last name
- Password (the password itself is not stored, but an irreversibly encrypted stamp).
3.4.2. Purpose of data processing
The storage of the email address, the first & last name and the stamp derivative of the password is done for the purpose of maintaining a communication channel with the survey author and authentication of the user. This is important, among other things, if the survey author loses access to his surveys or a privacy-related notification is pending.3.4.3. Duration of storage
The data is stored for the duration of the account use.3.4.4. Possibility of objection and removal
see 3.3.4.3.5. Survey author via premium account
3.5.1. Scope of data processing
- Points from 3.4.1.
- Your name / name of the company
- Address (address, city, postal code)
- Phone no.
- Desired subdomain
- Invoice email address
- Payment method
3.5.2. Purpose of data processing
The storage of the email address and other data is mainly for the purpose of maintaining a communication channel with the user of the premium account, contacting support requests, authentication & authorization and invoicing.3.5.3. Duration of storage
The data is stored for the duration of the account use.3.5.4. Possibility of objection and removal
building on 3.3.4., data from 3.5.1. for a Premium Account shall remain stored at least until the end of the agreed usage period.4. Use of cookies
4.1. Description and scope of data processing
Our website uses only technically necessary cookies. Cookies are text files that are stored in the Internet browser or the Internet browser on the user's computer system. When a user visits a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string that allows the browser to be uniquely identified when the website is reopened. We use cookies to make our website more user-friendly. Some elements of our website require that the calling browser be identified even after a page break. In addition, cookies of external services are avoided. The cookies store only session and authentication data. If you are a non-logged in visitor to our website, only one session cookie will be created. Each cookie will be automatically deleted after its expiration date.4.2. Legal basis for data processing
The legal basis for the processing of personal data using cookies is Article 6 (1) lit. f GDPR.4.3. Purpose of data processing
The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the user's browser is recognised even after a page change. The user data collected through technically necessary cookies are not used to create user profiles. If you are merely a visitor to this web platform, only your current session is stored in a cookie. If you also register as a user (survey author), there is another cookie that serves to authenticate and authorise your user. Apart from the technically necessary cookies mentioned above, no cookies are used. Therefore, there are no cookies for usage analysis, user tracking, marketing, profiling or any other conceivable purpose. And therefore there is no request to website visitors to agree to the setting of these cookies or to reject them.4.4. Duration of storage, opposition and disposal options
Cookies are stored on the computer of the user and transmitted by this on our side. Therefore, as a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Already saved cookies can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may not be possible to use all the functions of the website to the full.5. Contact form and e-mail contact
5.1. Description and scope of data processing
On our website is a contact form available, which can be used for electronic contact. If a user realizes this possibility, the data entered in the input mask is transmitted to us and stored. These data are:- First and last name
- Company
- Email-Address
- Phone number (optional)
- Message
- The IP-Address of the user
- Date and time
5.2. Legal basis for data processing
Legal basis for the processing of the data is in the presence of the consent of the user Art. 6 para. 1 lit. a GDPR. The legal basis for the processing of the data transmitted in the course of sending an e-mail is Article 6 (1) lit. f GDPR. If the e-mail contact aims to conclude a contract, then additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR.5.3. Purpose of data processing
The processing of the personal data from the input mask serves us only to process the contact. In the case of contact via e-mail, this also includes the required legitimate interest in the processing of the data. The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.5.4. Duration of storage
The data will be deleted as soon as it is no longer necessary to achieve the purpose of their survey. For the personal data from the input form of the contact form and those sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation ends when it can be inferred from the circumstances that the matter in question has been finally clarified. The additional personal data collected during the sending process will be deleted at the latest after a period of seven days.5.5. Opposition and removal possibility
The user has the opportunity to revoke his consent to the processing of personal data at any time. If the user contacts us by e-mail, he may object to the storage of his personal data at any time. In such a case, the conversation can not continue. All personal data stored in the course of contacting will be deleted in this case.6. Social Media & Mailing
6.1. Social Media Plug-ins
Currently, no social media plug-ins are used on our web platform. However, we reserve the right to use them at a later date: We reserve the right to use our website on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR Use social plug-ins from the social networks Facebook and Instagram to promote our platform. The underlying commercial purpose is to be regarded as legitimate interest within the meaning of the GDPR. The responsibility for the operation compliant with data protection is to be guaranteed by their respective providers. The integration of these plug-ins by us takes place in the way of the so-called two-click method, in order to protect visitors of our website in the best possible way.6.1.1. Facebook
Our website uses social media plugins from Facebook to personalize their use. For this purpose we use the "LIKE" or "SHARE" button. This is an offer from Facebook. If you visit a page of our website that contains such a plugin, your browser establishes a direct connection to the Facebook servers. The content of the plugin is transmitted by Facebook directly to your browser and integrated by this in the website. By integrating the plugins, Facebook receives the information that your browser has accessed the corresponding page of our website, even if you do not have a Facebook account or are currently not logged in to Facebook. This information (including your IP address) is transmitted from your browser directly to a Facebook server in the US and stored there. If you are logged in to Facebook, Facebook can directly assign the visit to our website to your Facebook account. If you interact with the plugins, for example, press the "LIKE" or "SHARE" button, the corresponding information is also transmitted directly to a Facebook server and stored there. The information will also be posted on Facebook and displayed to your Facebook friends. Facebook may use this information for the purpose of advertising, market research and tailor-made Facebook pages. For this purpose, Facebook uses user, interest and relationship profiles, e.g. to evaluate your use of our website in relation to the advertisements displayed on Facebook, to inform other Facebook users about your activities on our website, and to provide other services related to the use of Facebook. If you do not want Facebook to assign the data collected via our website to your Facebook account, you must log out of Facebook before visiting our website. The purpose and scope of the data collection and the further processing and use of the data by Facebook, as well as your rights and options to protect your privacy, please refer to the privacy policy of Facebook.6.1.2. Instagram
Our website also uses so-called social plugins ("plugins") operated by Instagram LLC, 1601 Willow Road, Menlo Park, CA 94025, USA ("Instagram"). The plugins are marked with an Instagram logo, for example in the form of an "Instagram camera". When you visit a page of our website that contains such a plugin, your browser connects directly to Instagram's servers. The content of the plugin is transmitted by Instagram directly to your browser and integrated into the page. Through this integration, Instagram receives the information that your browser has accessed the corresponding page of our website, even if you do not have an Instagram profile or are currently not logged in to Instagram. This information (including your IP address) is sent from your browser directly to an Instagram server in the US and stored there. If you are logged in to Instagram, Instagram can immediately assign the visit to our website to your Instagram account. If you interact with the plugins, for example by clicking on the "Instagram" button, this information is also transmitted directly to an Instagram server and stored there. The information will also be posted on your Instagram account and displayed there to your contacts. If you do not want Instagram to directly map the data collected through our website into your Instagram account, you'll need to log out of Instagram before visiting our website. For more information, see the privacy policy of Instagram.6.1.3. YouTube
Our website uses plugins from the Google-powered YouTube page. Site operator is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, SA. When you visit one of our sites that embed a YouTube video, it will connect to YouTube's servers. It tells the YouTube server which of our pages you've visited. If you're logged into your YouTube account, YouTube will allow you to associate your surfing behavior directly with your personal profile. You can prevent this by logging out of your YouTube account. For more information on how to handle user data, please read the YouTube Privacy Policy.6.2. Possibility to invite participants by e-mail
6.2.1. Amazon Web Services
For premium use, our web platform offers to send participants the sending of serial e-mails. This e-mail address uses a service provided by Amazon Web Services, Inc. Seattle. As a user, you have the option of choosing this type of contact by e-mail to the participants on our platform. If you choose this option, the following information should be noted. For the purpose of sending e-mails to subscribers, our application uses a web interface to Amazon Web Services, Inc. servers located in Ireland (EU). The transmission of the record occurs through an encrypted (SSL) connection. Upon successful completion of the transfer of the data, Amazon Web Services Technologies, Inc will be aware of the sender, recipient and content of the e-mail and will be able to send the e-mail as requested. Amazon Web Services will never have access to personal information such as IP address or browser data. The use of Amazon Web Services is in the interest of a uniform and secure communication with our customers - this constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. For more information, see the privacy policy of Amazon Web Services, Inc.7. Rights of persons that are concerned
If personal data is processed by you, you are i.S.d. GDPR and you have the following rights to the responsible person:7.1. Right of disclosure
You may ask the person in charge to confirm if personal data concerning you is processed by us. If such processing is available, you can request information from the person responsible about the following information:- the purposes for which the personal data are processed;
- the categories of personal data that are processed;
- the recipients or the categories of recipients to whom the personal data relating to you have been or will be disclosed;
- the planned duration of the storage of your personal data or, if specific information is not available, criteria for determining the duration of storage;
- the existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the controller or a right to object to such processing;
- the existence of a right of appeal to a supervisory authority;
- all available information on the source of the data if the personal data are not collected from the data subject;
- the existence of automated decision-making including profiling under Article 22 (1) and (4) GDPR and - at least in these cases - meaningful information about the logic involved, and the scope and intended impact of such processing on the data subject.
7.2. Right to rectification
You have a right to rectification and / or completion to the controller, if the personal data you process is incorrect or incomplete. The person in charge must make the correction without delay.7.3. Right to restriction of processing
You may request the restriction of the processing of your personal data under the following conditions:- if you contest the accuracy of your personal information for a period of time that enables the controller to verify the accuracy of your personal information;
- the processing is unlawful and you refuse to delete the personal data and instead request the restriction of the use of the personal data;
- the controller no longer needs the personal data for the purposes of processing, but you need them to assert, exercise or defend legal claims; or
- if you have objected to the processing pursuant to Art. 21 (1) GDPR and it is not yet certain whether the legitimate reasons of the person responsible outweigh your reasons.
7.4. Right of deletion
7.4.1. Obligation to delete
You may require the controller to delete your personal information without delay, and the controller is required to delete that information immediately if one of the following is true:- Your personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
- You revoke your consent to the processing gem. Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR and there is no other legal basis for the processing.
- You gem gem. Art. 21 para. 1 GDPR objection to the processing and there are no prior justifiable reasons for the processing, or you lay gem. Art. 21 para. 2 GDPR objection to the processing.
- Your personal data has been processed unlawfully.
- The deletion of personal data concerning you is required to fulfill a legal obligation under Union law or the law of the Member States to which the controller is subject.
- The personal data concerning you were collected in relation to information society services offered pursuant to Art. 8 (1) GDPR.
7.4.2. Information to third parties
If the person in charge has made the personal data relating to you public and is in accordance with. Article 17 (1) of the GDPR, it shall take appropriate measures, including technical ones, to inform data controllers who process the personal data that you have been identified as being affected, taking into account available technology and implementation costs Person requested by them to delete all links to such personal data or to make copies or replicas of such personal data.7.4.3. Exceptions
The right of deletion does not exist if the processing is necessary- to exercise the right to freedom of expression and information;
- to fulfill a legal obligation which requires processing under the law of the Union or of the Member States to which the controller is subject, or to carry out a task which is in the public interest or in the exercise of official authority delegated to the controller;
- for reasons of public interest in the field of public health pursuant to Art. 9 (2) lit. h and i and Art. 9 (3) GDPR;
- for archival purposes of public interest, scientific or historical research purposes or for statistical purposes acc. Article 89 (1) GDPR, to the extent that the law referred to in subparagraph (a) is likely to render impossible or seriously affect the achievement of the objectives of that processing, or
- to assert, exercise or defend legal claims.
7.5. Right to inform
If you have the right of rectification, erasure or restriction of the processing to the controller, he / she is obliged to notify all recipients to whom the personal data concerning you have been corrected or deleted or processing restricted, unless: this proves to be impossible or involves a disproportionate effort. You have the right to be informed about these recipients.7.6. Right of data portability
You have the right to receive personally identifiable information you provide to the controller in a structured, common and machine-readable format. You also have the right to transfer this data to another person without hindrance by the person responsible for providing the personal data, provided that- the processing on a consent acc. Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract acc. Art. 6 para. 1 lit. b GDPR is based and
- the processing is done by automated methods.
7.7. Right of objection
You have the right at any time, for reasons that arise from your particular situation, to prevent the processing of your personal data, which, pursuant to Art. 6 para. 1 lit. e or f GDPR takes an objection; this also applies to profiling based on these provisions. The controller will no longer process the personal data concerning you unless he can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or the processing is for the purposes of asserting, exercising or defending legal claims. If the personal data relating to you are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct mail. If you object to the processing for direct marketing purposes, your personal data will no longer be processed for these purposes. Regardless of Directive 2002/58 / EC, you have the option, in the context of the use of information society services, of exercising your right to opt-out by means of automated procedures that use technical specifications.7.8. Right to revoke the data protection consent declaration
You have the right to revoke your privacy statement at any time. The revocation of consent does not affect the legality of the processing carried out on the basis of the consent until the revocation.7.9. Automated decision on a case-by-case basis, including profiling
You have the right not to be subjected to a decision based solely on automated processing - including profiling - that will have legal effect or similarly affect you in a similar manner. This does not apply if the decision- is required for the conclusion or performance of a contract between you and the controller,
- is permitted under Union or Member State legislation to which the controller is subject, and where such legislation contains appropriate measures to safeguard your rights and freedoms and your legitimate interests, or
- with your express consent.