Privacy Policy

This Privacy Policy describes how we process your personal data on this website, including the services offered therein.

For more information on how we process your personal data, please contact us using the contact details below.

1. General information

Publisher:
Hertel Verwaltungs GmbH
Steinbachstraße 8
95126 Schwarzenbach an der Saale, Germany
Telephone: +49 (0)9284 9500-0

Fax: +49 (0)9284 9500-55
Email: info@countrygrill.de

Responsible for the website
Markus Hertel, Rainer Hertel

Responsible for data protection
Hertel Verwaltungs GmbH
Markus Hertel, Rainer Hertel
Email: info@countrygrill.de

External Data Protection Officer:
BM Digital Consulting GmbH
Melanie Wächter
Albert-Einstein-Str. 1
95028 Hof
Phone 0171 3027921
Email: datenschutz@countrygrill.de

Managing Director:
Markus Hertel
Rainer Hertel
Telephone: +49 (0)9284 9500-0
Email: info@countrygrill.de

2.Purposes and legal bases of the processing of personal data

The legal basis of the processing of your data, unless otherwise stated, ensues from point (a) of Article 6(1) of the General Data Protection Regulation (GDPR). This enables us to process the data required to fulfill a task entrusted to us.

3. Storage period of personal data

Your data shall only be stored for as long as is necessary for the performance of the tasks, in due regard to the statutory retention periods.

4. Rights of the data subject

Insofar as we process the personal data that concerns you, you are entitled to the following rights as a data subject:
- If your personal data is processed, you have the right to obtain information your stored personal data (Article 15 GDPR).
- If inaccurate personal data is processed, you have a right to rectification (Article 16 GDPR).
-If the legal requirements are met, you may request the erasure or restriction of processing (Article 17, 18 GDPR).
- If processing is based on consent or on a contract and the data processing is carried out by automated means, you may have a right to data portability (Article 20 GDPR).
- If you have given consent to the processing and the processing is based on this consent, you may withdraw the consent at any time with future effect. The lawfulness of the
data processing carried out on the basis of the consent up to the withdrawal is not affected by this. You have the right to object, on grounds relating to your particular situation, at any time, to processing of personal data concerning you which is based on subparagraph of point (e) of Article 6(1) GDPR (sentence 1 of Article 21(1) GDPR).

5. Information on data transferred to the United States

Tools from companies based in the US, among others, are integrated on our website. When these tools are active, your personal data may be transferred to the US servers of the companies involved. Please note that the US is considered a third country that does not offer an adequate level of data protection for the purposes of EU data protection law. US companies are required to hand over personal data to security authorities without you, as the data subject, being able to take legal action against this. In view of this, it cannot be excluded that US authorities (e.g. intelligence services) process, analyze and permanently store your data on US servers for surveillance purposes. We have no control over these processing activities.

6. Withdrawal of your consent to data processing

A wide array of data processing operations are only possible with your explicit consent. You can withdraw an already given consent at any time. The lawfulness of the data processing carried out until the withdrawal remains unaffected by the withdrawal. Right to object to the collection of data in specific cases and for

a) Direct marketing purposes (Article 21 GDPR)

If the data processing is based on point (e) or (f) of Article 6(1) GDPR, you have the right to object to the processing of your personal data at any time on grounds relating to your particular situation; this also applies to profiling based on these provisions. The respective legal basis on which processing is based can be found in this Privacy Policy. If you object, we shall no longer process your personal data unless we can demonstrate compelling legitimate ground for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims (objection in accordance with Article 21(1) GDPR).

If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing. If you object, your personal data will subsequently no longer be used for direct marketing purposes (objection in accordance with Article 21(2) GDPR).

b) Right to lodge a complaint with a supervisory authority

You also have the right to lodge a complaint with the Bavarian Data Protection Authority for the Private Sector. You can contact the supervisory authority by way of the following contact details:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach, Germany
www.lda.bayern.de
Tel.: +49 (0)981 180093-0
Fax: +49 (0)981 180093-800
Email: poststelle@lda.bayern.de

7. Additional information

For more information about the processing of your personal data and your rights, you can contact us at the contact details mentioned above.

8. SSL or TLS encryption

This website uses SSL or TLS encryption for reasons of security and to safeguard the transmission of confidential content, such as orders or requests that you send to us as the website operator.

You can recognize an encrypted connection if the browser address bar changes from
“http://” to “https://” and a lock symbol appears in your browser bar.
The data you transmit to us cannot be read by third parties if the SSL or TLS encryption is activated.

9. Details of the online services

a) External hosting

Our web server is operated by the ProComp GmbH. The personal data you transmit when visiting our website is therefore processed on our behalf by ProComp GmbH.

Contact information:
Name of processor: ProComp Professional Computer GmbH
Address: Industrieallee 1, 95615 Marktredwitz, Germany
Email: info@procomp.de

The personal data collected on this website is stored on the web host’s servers. This may include, but is not limited to, IP addresses, contact requests, meta data and communication data, contractual data, contact data, names, website logins and other data generated through a website.

The web host is necessary for the performance of the contract with our potential and existing customers (point (b) of Article 6(1) GDPR) and in the interest of a secure, fast and efficient provision of our online services by a professional provider (point (f) of Article 6(1) GDPR).

Our web host shall only process your data to the extent necessary to fulfill its service obligations and shall follow our instructions with regard to this data.

To ensure that processing is compliant with data protection laws, we have concluded a contract for order processing with our web host.

b) Recording

When you access this website or others, you transmit data to the web server via your browser. The following data is recorded during an ongoing connection to ensure communication between your browser and our web server:

- Date and time of the request
- Website from which the data was requested
- Browser

This data is deleted once the connection ends.

10. Cookies

a) Session cookies (technical cookies – essential)

When you access this website, we store technical cookies (small data files) called session cookies on your device which are valid while you visit the website. We use these exclusively when you visit our website and only store the browser’s current session ID. This cookie is removed again when the browser session ends. IP addresses are not stored.

b) Contailor cookies (technical cookies – essential)

This cookie allows administrators/authors to log into the admin portal to enable editing.
The following personal data is collected:

- Username (encrypted)
- Password (as defined by a set password policy) (encrypted)
- Last login

The data is stored for 3 months from the first login. The 3-month cycle always starts as soon as the corresponding user logs in to the platform.

c) Selectedlanguage (technical cookies – essential)

This cookie memorizes the language set in the browser. When you visit the website again, the selected language is displayed once more. The setting is embedded in the browser accordingly. Personal data is not collected.

d) Cookie consent with Usercentrics

This website uses the cookie consent technology developed by Usercentrics to obtain your consent to the storage of specific cookies on your terminal or to the use of specific technologies and to document this in accordance with data protection law.

This technology is provided by Usercentrics GmbH, Rosental 4, 80331 Munich, Germany; website: https://usercentrics.com/de/ (hereinafter referred to as “Usercentrics”).

The following personal data is transferred to Usercentrics when you enter our website:

- Your consent(s) or withdrawal of your consent(s)
- Your IP address
- Information about your browser
- Information about your terminal
- Time of your visit to the website

In addition, Usercentrics stores a cookie in your browser to assign the your consent or withdrawal. The data collected in this way is stored until you either request that we delete it, delete the Usercentrics cookie yourself or the purpose for storing the data no longer applies. Mandatory legal retention obligations remain unaffected. Usercentrics is contracted to obtain the statutory consents for the use of specific technologies. The legal basis ensues from sentence 1 of point (c) of Article 6(1) GDPR.

Contract for order processing

We have concluded a contract for order processing with Usercentrics. This is a contract required by data protection law and ensures that Usercentrics only processes the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.

11) Analysis of user behavior (web tracking systems, audience measurement)

a) Use of Google Analytics

This website uses features of the Google Analytics web analytics service. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables website operators to analyze the behavior of website visitors. The website operator hereby uses different usage data, such as page views, amount of time spent on the pages, operating systems used, and the origin of the user. This data may be compiled by Google in a profile which is attributed to the respective user or their end device.

Google Analytics uses technologies which enable the recognition of the user for the purpose of analyzing user behavior (e.g. cookies and device fingerprinting). The information collected by Google about the use of this website will generally be sent to a Google server in the USA, where it will be stored.

The use of this analysis tool takes place on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the analysis of the user behavior, in order to optimize both its website and its advertising. Provided that the according consent has been obtained (e.g. consent to the storage of cookies), the processing will take place exclusively on the basis of Art. 6(1)(a) GDPR, but the consent can be withdrawn at any time.

The data transfer to the USA is based on the standard contractual clauses of the European Commission. You will find the details here: https://privacy.google.com/businesses/controllerterms/mccs/.

IP anonymization

We have activated the IP anonymization feature on this website. Your IP address will thereby be shortened by Google within member states of the European Union or other signatory states of the Agreement on the European Economic Area before transfer to the USA. Only in exceptional circumstances will the full IP address be sent to a Google server in the USA, where it will be shortened. On behalf of the operator of this website, Google will use this information in order to analyze your use of the website, compile reports about the website activities, and provide the website operator with other services related to the website use and the use of the internet. The IP address sent from your browser as part of Google Analytics will not be joined with other Google data.

12) Use of plugins

a) Google Maps

This site uses the Google Maps map service. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

In order to use the features of Google Maps, it is necessary to store your IP address. This information will generally be sent to a Google server in the USA, where it will be stored. The provider of this site has no influence on this data transfer.

The use of Google Maps takes place in the interest of an appealing presentation of our online services and ability to easily find the places specified by us on the website. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. Provided that the according consent has been obtained, the processing takes place exclusively on the basis of Art. 6(1)(A) GDPR, and the consent can be withdrawn at any time. The data transfer to the USA is based on the standard contractual clauses of the European Commission.

You will find the details at
https://privacy.google.com/businesses/gdprcontrollerterms/ and
https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.

You will find more information about the handling of user data in the Google privacy policy: https://policies.google.com/privacy?hl=de.

b) Use of YouTube

We use the YouTube.com platform to post our videos online and render them publicly available. YouTube is the service of a third party that is not affiliated with us, namely YouTube LLC.

Some of our product webpages contain links or connections to YouTube services. In general, we bear no responsibility for the content of the linked websites. All the same, should you follow a link on YouTube, we wish to highlight that YouTube stores the data of its users (e.g. personal information, IP address) in accordance with its own data usage guidelines and uses it for business purposes.

Furthermore, YouTube may store various cookies on your terminal or use similar recognition technologies (e.g. device fingerprinting). In this manner, YouTube can obtain information about visitors to this website. This information is used, among other things, to collect video statistics, improve user experience, and prevent fraud attempts.

If you are logged into your YouTube account, you authorize YouTube to assign your surfing behavior directly to your personal profile. You can avoid this by logging out of your YouTube account.

YouTube is used to present our online services in an appealing manner. This constitutes a legitimate interest within the meaning of point (f) Article 6 (1) GDPR. If a corresponding consent was requested, the processing is based exclusively on point (a) of Article 6(1) GDPR; the consent can be withdrawn at any time.

The user’s active consent is needed before a connection to YouTube can be established. This consent may be withdrawn at any time.

The following data is transmitted to the third-party provider:
- IP address
- Date and time of the request
- Time zone difference from Greenwich Mean Time (GMT)
- Content of the request (specific webpage)
- Login status/HTTP status code
- Amount of data transferred in bytes in each case
- Webpage from which the request originates (link)
- Browser used
- Operating system and interface
- Language and version of the browser software

As soon as you play an embedded video by clicking on it and actively confirm your consent to us, YouTube stores a corresponding cookie on your terminal. These cookies can be refused by adjusting the appropriate browser settings and extensions.

Address and link to the privacy policy of the third-party provider:

Google/YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – Privacy policy: https://policies.google.com/privacy

c) Use of Facebook plugins: Facebook pixel

Our webpages contain integrated plugins of the Facebook social network. The provider is Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA.

Facebook pixel

We use the Custom Audience remarketing feature of Facebook, the so-called Facebook pixel of the Facebook social network.

We are thereby able to address targeted advertisements to the visitors of our website when they visit the Facebook social network. For this purpose, we integrate the Facebook remarketing tag (Facebook pixel) on our website. Via the Facebook pixel, a connection to the Facebook servers is established when visiting the website. Facebook thereby receives information about which websites you have visited. Facebook will attribute this information to your Facebook user account.

Legal basis

The legal basis for the data processing described in relation to the use of Facebook plugins is Art. 6(1)(a) GDPR. Consent is obtained via the according cookie banner.

Recipients of the data and storage period

Facebook has the ability to attribute the visit to our website to your user account. We would like to point out that as the provider of the website, we do not receive any knowledge about the content of the data transferred or their use by Facebook. You will find further information in the Facebook privacy policy at https://de-de.facebook.com/policy.php.

If you do not want Facebook to be able to attribute the visit to our website to your Facebook user account, please log out of your Facebook user account.

According to the privacy policy of Facebook (Facebook Ireland Ltd., 4 Grand Canal Square

Grand Canal Harbour, Dublin 2 Ireland), the information will be shared internally within the corporate group or with third parties. Information which is collected within the European Economic Area ("EEA") may be sent to countries outside the EEA, for example, for the purposes described in the policy. Facebook declares that it applies standard contractual clauses approved by the European Commission, applies other measures in accordance with EU law, and obtains your consent in order to legitimize data transfers from the EEA to the USA and other countries.

Facebook states that the data will be stored for as long as necessary, in order to provide products and services to users and others. The information associated with the user account will remain with Facebook until the deletion of the account, unless Facebook no longer requires the data in order to provide products and services.

Withdrawal and rectification

Information about how you can manage your content and information on Facebook can be found at https://www.facebook.com/about/privacy. If you do not want Facebook to attribute the gathered information directly to your Facebook user account, you can deactivate the "Custom Audience" remarketing function via https://www.facebook.com/ads/website_custom_audiences/. In order to do this, you must be registered with Facebook.

13. Collection of additional data

a) Contact form – “Chicken & More” category:

If you enter personal or business information (email addresses, names, addresses, etc.) on our website, this data shall be used exclusively for the submission of the requested information or for the purposes stated in the form. Your data shall be encrypted during the transmission to the mail server using software (SSL) and is protected against third-party access. The subsequent transmission by email is unencrypted (see item 13). The data shall not be disclosed to third parties. The use of the services offered shall be on a voluntary basis.

Data categories:
- Company (optional)
- Title (mandatory)
- First name (mandatory)
- Last name (mandatory)
- Email address (mandatory)
- Street address (optional)
- Postal code/City (optional)
- Country (mandatory)
- Telephone (mandatory)
- Mobile phone (optional)
- Message (mandatory)

c) Contact form – “Become a partner” category:

If you enter personal or business information (email addresses, names, addresses, etc.) on our website, this data shall be used exclusively for the submission of the requested information or for the purposes stated in the form. Your data shall be encrypted during the transmission to the mail server using software (SSL) and is protected against third-party access. The subsequent transmission by email is unencrypted (see item 13). The data shall not be disclosed to third parties. The use of the services offered shall be on a voluntary basis.

d) Audio and video conferences

Data processing

For communication with our customers, we use online conference tools, among other items. The individual tools we use are listed below. If you communicate with us via video or audio conference on the internet, your personal data will be collected and processed by us and the provider of the respective conference tool. The conference tools will thereby collect all the data you provide/insert to use the tools (email address and/or your phone number). The conference tools will also process the duration of the conference, the start and end (time) of participation in the conference, the number of participants, and other "context information" in connection with the communication process (metadata). The provider of the tool will also process all technical data required for the handling of the online communication. This includes in particular IP addresses, MAC addresses, device IDs, device types, operating system types and versions, client versions, camera types, microphones and speakers, and the type of connection.

If content is exchanged, uploaded or provided in any other way within the tool, this content will also be stored on the servers of the tool provider. Such content includes, in particular, cloud recordings, chat/instant messages, voicemails, uploaded photos and videos, files, whiteboards and other information which is shared during the use of the service.

Please note that we do not have complete influence on the data processing methods of the tools used. Our means depend considerably on the corporate policy of the respective provider. You will find further information about the data processing through the conference tools in the privacy policies of the respective tools used, which we have listed underneath this text.

Purpose and legal basis

The conference tools are used to communicate with prospective or existing contract partners, or offer specific services to our customers (Art. 6[1][1][B] GDPR). The use of the tools also enables the general simplification and acceleration of communication with us and our company (legitimate interest within the meaning of Art. 6[1][f] GDPR). Provided that consent has been obtained, the use of the respective tools takes place on the basis of this consent, and the consent can be withdrawn at any time with future effect.

Storage duration

The data gathered directly by us via the video and conference tools will be erased by our systems as soon as you ask us to delete them, if you withdraw your consent, or if the purpose of the data storage ceases to apply. Stored cookies will remain on your end device until you erase them. Mandatory statutory retention periods remain unaffected. We have no influence on the duration of storage of your data which is stored by the operators of the conference tools for their own purposes. For details about this storage, please consult the operators of the conference tools directly.

We use the following conference tool:

Microsoft Teams

We use Microsoft Teams. The provider is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. You will find details about the data processing in the privacy policy of Microsoft Teams:

https://privacy.microsoft.com/de-de/privacystatement.

Conclusion of an order processing contract

We have entered into an order processing contract with the provider of Microsoft Teams and implement the strict standards of the German data protection authorities when using Microsoft Teams.

14. Email

Third parties may read unencrypted information that you send to us by email. Generally speaking, we cannot verify your identity and do not know who is behind an email address. Legally-compliant communication by simple email is therefore not guaranteed. We use - - filters against unsolicited advertising (hereinafter referred to as “SPAM filters”). In rare cases, these can incorrectly and automatically classify normal emails as unsolicited advertising and delete them. Emails that contain harmful programs (hereinafter referred to as “viruses”) are always automatically deleted by us.

If you wish to send us messages with sensitive content, we recommend that you encrypt and sign them to prevent unauthorized inspection and falsification during transmission, or send the message to us by post.

Please inform us whether and how we can send you encrypted emails to respond to your messages. If you cannot receive encrypted emails, please inform us about how you wish to be contacted to answer your messages in a safe manner.

15. Subcontractor/commissioned data processor

Hertel Verwaltungs GmbH provides personal data to the following companies as a subcontractor on the basis of order processing and following the instructions of the client:

Hertel Grilltechnik GmbH
Steinbachstrasse 8
95126 Schwarzenbach / Saale, Germany
Telephone: +49 (0)9284 9500-0
Fax: +49 (0)9284 9500-55
Email: info@hertel-grilltechnik.de

Under this order fulfilment, the following personal data is transmitted to the commissioned data processor:
-             First name, last name
-             Address
-             Telephone
-             Email

The purpose of the subcontracting relationship is the performance of the contract with our potential and existing customers (point (b) of Article 6(1) GDPR) and in the interest of a professional order processing and customer service (point (f) of Article 6(1) GDPR).

The commissioned data processor shall process your data to the extent necessary to fulfill its service obligations and shall follow our instructions with regard to this data.

To ensure that processing is compliant with data protection laws, we have concluded a contract for order processing with Hertel Grilltechnik GmbH.

16) Social media pages

Data processing by social networks

We maintain publicly accessible profiles in social networks. The individual social networks we use are:

- Facebook

- Instagram

- YouTube

- Yelp

- Twitter

Social networks such as Facebook, Twitter, etc. may generally analyze your user behavior comprehensively when you visit their websites or a website with integrated social media content (e.g. like buttons or banner ads). Your visit to our social media pages will trigger numerous processing actions which are relevant to data privacy.

a) In particular:

If you are logged into your social media account and visit our social media page, the operator of the social media portal can attribute this visit to your user account. However, in some circumstances, your personal data may also be collected if you are not logged in or if you do not have an account with the respective social media portal. In this case, this data collection takes place via cookies, for example, which are stored on your end device, or by logging your IP address.

With the aid of data collected in such a manner, the operators of the social media portals can create user profiles in which your preferences and interests are stored. You can thereby be shown interest-based advertisements within and outside the respective social media page. If you have an account with the respective social network, the interest-based advertisements can be displayed on all devices on which you are or were logged in.

Please note also that we are not able to track all processing actions on the social media portals. Depending on the provider, other processing actions may therefore be carried out by the operators of the social media portals. You will find more details in the terms and conditions of use, and the privacy policies, of the respective social media portals.

Legal basis

Our social media pages are intended to guarantee the most comprehensive presence possible on the internet. This is hereby a legitimate interest within the meaning of Art 6(1)(f) GDPR. The analysis processes initiated by the social networks may be based on different legal bases, which must be stated by the operators of the social networks (e.g. consent within the meaning of Art. 6[1][a] GDPR).

b) Controller and asserting rights

When you visit one of our social media pages (e.g. Facebook), we and the operator of the social media platform are jointly responsible for the data processing actions triggered during this visit. You can always assert your rights (information, rectification, erasure, restriction of processing, data portability and complaints) via us or via the operator of the respective social media portal (e.g. Facebook).

Please note that despite the joint responsibility with the social media portal operators, we cannot completely influence the data processing actions of the social media portals. Our means depend considerably on the corporate policy of the respective provider.

c) Storage duration

The data gathered directly by us via the social media pages will be erased by our systems as soon as the purpose of their storage ceases to apply, you ask us to delete them, or you withdraw your consent to their storage. Stored cookies will remain on your end device until you erase them. Mandatory statutory provisions – in particular retention periods – remain unaffected.

We have no influence on the duration of storage of your data which is stored by the operators of the social networks for their own purposes. For details about this storage, please consult the operators of the social networks directly (e.g. in their privacy policy; see below).

d) Social networks in detail

Facebook

We have a Facebook profile. The provider of this service is Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. According to Facebook, the data collected is also transferred to the USA and other third countries.

We have entered into a joint processing agreement with Facebook (Controller Addendum). This agreement specifies the data processing actions for which we and Facebook are responsible when you visit our Facebook page. You can see this agreement in the following link: https://www.facebook.com/legal/terms/page_controller_addendum.

You can adjust your advertising settings yourself in your user account. To do so, click on the following link and log in: https://www.facebook.com/settings?tab=ads.

You will find details in the Facebook privacy policy: https://www.facebook.com/about/privacy/.

Instagram

We have an Instagram profile. The provider is Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA. Details about how it handles your personal data can be found in the Instagram privacy policy: https://help.instagram.com/519522125107875.

YouTube

We have a YouTube profile. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Details about how it handles your personal data can be found in the YouTube privacy policy: https://policies.google.com/privacy?hl=de.

Twitter

We use the Twitter microblogging service. The provider is Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland.

You can adjust your Twitter data privacy settings yourself in your user account. To do so, click on the following link and log in: https://twitter.com/personalization.

You will find details in the Twitter privacy policy: https://twitter.com/de/privacy.

Yelp

We use Yelp as a recommendation portal for our franchise products. Yelp offers specialized search features and provides information about businesses in a specific area, predefined using addresses and postal codes. With the authorization of the moderator, visitors to the website can update entries by businesses and publish reviews accordingly.

The provider is Yelp, 140 New Montgomery St., 9th Floor, San Francisco, California 94105. You will find details in the Yelp privacy policy: https://terms.yelp.de/privacy/de_de/20200101_de_de/.

As of 8 March 2021