Version: July 2021

RAL stands for quality in many areas of daily life. This also applies to the processing of your data. In order to ensure the security and privacy of your data, it is our aim to collect as little personal data as possible from you and to handle any required data as securely as possible.
Please find information below on what personal data we collect and how we process this data.

1. Name and contact details for the responsible entity

RAL gemeinnützige GmbH
Fränkische Straße 7
53229 Bonn
Telephone: +49 228 68895 0
Fax: +49 228 68895 431
E-mail: info@ral.de

Chief Executive Officer: Rüdiger Wollmann, Attorney-at-Law
Managing Director: Thomas Roßbach, Lawyer

2. Contact details for the Data Protection Officer

If you have any questions about the collection and processing of your personal data or a request for information, our external Data Protection Officer would be pleased to assist you. The contact details are:

Viehoff Consult GmbH
Stephan Viehoff
Cockerillstraße 100
52222 Stolberg
E-mail: datenschutz@viehoff-consult.de

3. Scope and purpose of the processing of personal data

3.1 Personal data

According to Art. 4 (1) of the EU GDPR, personal data describes all information relating either directly or indirectly to an identified or identifiable natural person. This includes, for example, your name, your contact details and data which you provide when registering for a customer account, processing your orders or as part of an application.

3.2 Server statistics

Every time our website is accessed, data is automatically transferred to the web server by the respective Internet browser and stored in log files. The following data is stored till its deletion:

  • name and URL of the accessed web page
  • IP address at the time the respective page is accessed
  • date, time and success of the access to the web page
  • website from which the user accessed our web page (so-called referrer URL)
  • type and version of the browser
  • operating system of the end device used to access the web page

The data is processed for the following purposes:

  • to enable the connection to the website
  • to enable the optimised presentation of the website
  • to check and guarantee the security and stability of the systems and
  • to enable and improve the administration of the website

The stored data is not combined with other sources of data. It is generally not possible for us to assign the data to any specific person. The data is not processed for the purpose of gaining further information about the respective visitor to the website.

We reserve the right to store the IP addresses of visitors to our websites for a maximum time period of three months. The logging of this data serves to recognise advanced persistent threats and limit and resolve faults, as well as for ensuring system and data security.

We have a legitimate interest in the sense of Art. 6 (1) Sentence 1 f) of the EU GDPR for processing the data for the purposes described above.

3.3 Contact (information by telephone, contact form)

Visitors can request information by telephone and send messages to us using a contact form on the website. All information is transferred to us voluntarily by the person making the enquiry and they thus give their consent for the processing of their personal data. In order for us to answer the enquiry by email, it is necessary for the person to provide us with a valid email address. The data is exclusively processed for the purposes of providing advice on the telephone or for handling and answering enquiries submitted using the contact form.

The processing of this data is carried out based on the consent given voluntarily in accordance with Art. 6 (1) Sentence 1 a) of the EU GDPR. The personal data collected due to the use of the contact form is automatically deleted as soon as the enquiry has been dealt with and there is no reason for it to be stored for a longer period of time.

3.4 Newsletter

By subscribing to the newsletter, you expressly give your consent for the processing of the personal data that was voluntarily submitted to us. The data collected during the subscription process is exclusively used for sending the newsletter. We use a double opt-in process to ensure that you only receive the newsletter when you really want to. After subscribing to the newsletter for the first time, we send you an email containing a link to confirm that you really want to receive our newsletter. It is possible to unsubscribe from our newsletter at any time. This is possible using a special link at the end of every newsletter or by sending us an email. Please refer to section 5.7 “Right to withdraw consent” for more details.

The legal basis for the processing of personal data for the distribution of newsletters and the associated activities is your consent given in accordance with Art. 6 (1) Sentence 1 a) of the EU GDPR.

3.5 Cookies

Our website uses cookies. Cookies are small text files that are stored on the customer’s digital end device or data medium so that they can make optimum use of all the functions of our website. Most of the cookies we use are deleted from the digital end device or data medium after the end of the current browser session and are thus described as session cookies. Cookies that enable us to check the main functions involved in the operation of our website are left on the digital end device or data medium. For security reasons, we use cookies on various pages of our website that are required for the use of certain functions or for the optimum performance of our application portal. This is the case, in particular, on the login page and the user area. These cookies ensure that the interested person does not need to enter the same information again every time they switch between the individual pages on our website.

It is possible to deactivate the saving of cookies at any time. The help function in the menu for most browsers (e.g. Internet Explorer or Firefox) will describe how users and visitors to our application portal can prevent the browser accepting cookies, how the user and visitor to our website can be informed by the browser when they receive a new cookie or also how he or she can delete all of the cookies already received and block the saving of any cookies in the future. In the latter case, the previously described functions (login and administration options) will no longer be available. It is necessary to remove the block on cookies in order to use these functions.

3.6 Google Analytics

This website uses functions provided by the web analysis service Google Analytics. The supplier is Google Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA.

Google Analytics uses so-called “cookies”. These are small text files that are saved on your computer and which enable an analysis of the use of the website. The information collected by the cookie about your use of this website is generally transferred to and stored on a Google server in the USA.

The saving of cookies from Google Analytics is carried out on the basis of Art. 6 (1) f) of the EU GDPR. The operator of the website has a legitimate interest in analysing the user behaviour in order to optimise both their website and also their advertising.

IP anonymisation

We have activated the IP anonymisation function on this website. As a result, your IP address will be shortened by Google within the member states of the European Union or in other states that are contracting parties to the Agreement on the European Economic Area before it is transferred to the USA. Only in exceptional cases is the full IP address transferred to a Google server in the USA and then shortened. On behalf of the operator of this website, Google uses this information to evaluate your use of the website, to create reports on the activity on the website and to provide additional services connected with the use of the website and the Internet. The IP address transferred by your browser during the use of Google Analytics is not combined with other data from Google.

Browser plugin

You can prevent cookies from being saved on your computer by changing the corresponding setting in your browser software; we expressly inform you, however, that you may not be able to use the full scope of all of the features of this website in this case. Furthermore, you can prevent the collection of the information generated by the cookie that is related to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plugin that can be found under the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

Withdrawing your consent for the collection of data

You can prevent the collection of your user data by Google Analytics by clicking on the following link. This will save an opt-out cookie on your system that will prevent the collection of your data during future visits to this website: Deactivate Google Analytics.

More information on how Google Analytics handles user data can be found in the privacy policy published by Google: https://support.google.com/analytics/answer/6004245?hl=en.

Deactivate Google Analytics

This website use the function “Demographics” from Google Analytics. This enables reports to be created that contain information on the age, gender and interests of the visitors to the website. This data is sourced from interest-related advertising, as well as from visitor data from third party providers. This data cannot be assigned to a specific person. You can deactivate this function at any time via the display settings in your Google account or generally prohibit the collection of your data by Google Analytics as described in the section “Withdrawing your consent for the collection of data”.

Google reCAPTCHA

We use “Google reCAPTCHA” (hereinafter called “reCAPTCHA”) on our websites. The supplier is Google Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA (“Google”).

reCAPTCHA checks whether the data entered on our websites (e.g. in contact forms) comes from a human or an automated program. For this purpose, reCAPTCHA analyses the behaviour of a visitor to the website based on various different characteristics. This analysis begins automatically as soon as the visitor accesses the website. reCAPTCHA evaluates various information during the analysis (e.g. IP address, length of time the visitor remains on the website or the mouse movements made by the user). The data collected during this analysis is transferred to Google.

These reCAPTCHA analyses run completely in the background. Visitors to the website are not informed that an analysis is being carried out.

This data is processed on the basis of Art. 6 (1) f) of the EU GDPR. The operator of the website has a legitimate interest in protecting their website against improper automated spying and spam. Further information on Google reCAPTCHA and the privacy policy published by Google can be found via the following links: https://policies.google.com/privacy?hl=en and https://www.google.com/recaptcha/intro/android.html.

3.7 Social networks

Our websites contain logos from social networks in the form of buttons featuring the respective logos of the operators. These social networks include, amongst others:

  • Facebook, operated by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland,
  • Instagram, operated by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland and
  • Twitter, operated by Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, Ireland.

The buttons act as hyperlinks to the relevant web pages. No data is transferred by merely linking to these sites.

3.8 Embedding of videos

Videos from the YouTube platform are sometimes embedded into our websites. YouTube is a portal provided by YouTube LLC., 901 Cherry Ave., 94066 San Bruno, CA, USA and a subsidiary of Google LLC., 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA. While playing the video files from YouTube, a connection to the YouTube servers is established and data about accessing this video is transferred to YouTube. This includes at least the following information: the IP address, data and time of access and the website you are visiting. If you are also logged into your YouTube account at the same time, information on the accessed video file will be allocated to your YouTube account. If you want to prevent this from happening, you either have to log out from your YouTube account before visiting our website or activate the corresponding settings in your YouTube user account.

We use the “privacy-enhanced mode” function to ensure that the connection data is only transferred to the YouTube server if a video is actually played.

To ensure the functionality of the platform and analyse user behaviour, YouTube permanently saves cookies on your end device. If you do not agree to the saving of this data, you can prevent it using the corresponding settings on your Internet browser. You can find further information about this above under 3.5 “Cookies”.

Our legitimate interest lies in improving the quality of our Internet presence. The legal basis for the processing of this data is thus Art. 6 (1) f) of the EU GDPR.

Further information on the collection and use of data and your rights and protection options have been provided by Google in their privacy policy that is available at https://policies.google.com/privacy?hl=en.

3.9 E-mail and security

Please bear in mind that emails are not protected against unauthorised access, falsification, etc. Therefore, please do not send any confidential information (e.g. account number, passwords, etc.) to us by email.

4 Transferring data

Personal data is only transferred to a third party if:

  • the data subject has expressly given their consent for the data to be used for this purpose in accordance with Art. 6 (1) Sentence 1 a) of the EU GDPR,
  • in the event of the transfer of data in accordance with Art. 6 (1) Sentence 1 f) of the EU GDPR, this is required for the establishment, exercise or defence of legal claims and there is no reason to believe that the data subject has an overriding legitimate interest for the non-transfer of their data,
  • in the event of the transfer of data in accordance with Art. 6 (1) Sentence 1 c) of the EU GDPR, a legal obligation to this end exists and/or
  • it is necessary in accordance with Art. 6 (1) Sentence 1 b) of the EU GDPR for the performance of a contract to which the data subject is party.

4.1 Processing of payments

For the processing of payments (e.g. in our colours shop) your personal data might get transferred to the chosen financial service provider. Your personal data is transferred in accordance with Art. 6 (1) Sentence 1 b) of the EU GDPR for the performance of a contract to which the data subject is party or in order to which the data subject is party.

4.2 Logistics and completion of orders

We usually process your orders in-house. For the delivery of ordered products your personal data is transferred to delivery or freight companies. With the voluntary surrender of your personal data, you comply that the personal data is used to fulfil the completion of your desired transactions therefor transferring it to third parties.

Your personal data is transferred in accordance with Art. 6 (1) Sentence 1 b) of the EU GDPR for the performance of a contract to which the data subject is party or in order to which the data subject is party.

4.3 RAL events and RAL academy

For the registration to different events of RAL or RAL academy your personal data is processed in the required scope of the execution of these events. RAL academy partially is carried out by external lecturers. Therefor it is required to transfer your personal data partially to those lecturers.

Your personal data is transferred in accordance with Art. 6 (1) Sentence 1 a) of the EU GDPR if consent was given and registration or in accordance with Art. 6 (1) Sentence 1 b) of the EU GDPR for the performance of a contract to which the data subject is party or in order to which the data subject is party.

5. Your rights as the data subject

If your personal data has been processed due to your visit to our website, you have the following rights as the “data subject” in the sense of the EU GDPR:

5.1 Right to obtain information

You can request information from us about whether we are processing personal data about you. No right to obtain information exists if the data cannot be deleted due to legal or contractual retention periods or has been processed exclusively for data backup or data security purposes and the provision of this information would require a disproportionate amount of cost and effort and any processing of the data for other purposes is excluded using suitable technical and organisational measures. Where applicable, you can request information about:

  • the purposes of the processing
  • the categories of your personal data that were processed
  • the recipients or categories of recipients to whom your personal data is made public, especially recipients in third countries
  • if possible, the period for which your personal data will be stored, or if that is not possible, the criteria used to determine that storage period
  • the existence of a right to rectification or erasure or restriction of processing of the data about you as the data subject or a right to object to this processing
  • the right to lodge a complaint with a data protection supervisory authority
  • if the personal data was not obtained from you as the data subject, any available information on the source of the data
  • if relevant, the existence of automated decision-making including profiling and meaningful information on the logic involved, as well as the scope and envisaged consequences of such automated decision-making
  • if the personal data is transferred to a recipient in a third country, insofar as the EU Commission has not issued a resolution on the adequacy of the level of protection in accordance with Art. 45 (3) of the EU GDPR, information on what appropriate safeguards in accordance with Art. 46 (2) of the EU GDPR have been provided to protect the personal data

5.2 Right to rectification and completion

If you establish that the personal data we hold about you is incorrect, you can request that we rectify the incorrect data. You also have a right to request that incomplete data is completed.

5.3 Right to erasure

You have a right to erasure (“right to be forgotten”) if one of the following grounds applies:

  • the personal data is no longer required for the purposes for which they were processed
  • you have withdrawn you consent for the processing of the data
  • you have objected to the processing of your personal data that we have made public
  • you have objected to the processing of personal data that we have not made public and there are no overriding legitimate grounds for the processing of the data
  • your personal data has been unlawfully processed
  • the erasure of your personal data is required to comply with a legal obligation to which we are subject

The right to erasure does not exist if, in the event of legal non-automated data processing, the erasure of the data would only be possible at a disproportionate amount of cost and effort due to the special type of storage and you only have a low level of interest in its erasure. In this case, the processing of this data will be restricted instead of the data being erased.

5.4 Right to restriction of processing

You have the right to request a restriction of processing if one of the following grounds applies:

  • you contest the accuracy of the personal data. In this case, a restriction can be requested for the period required to verify the accuracy of the data.
  • the processing is unlawful and the data subject requests a restriction of the use of their personal data instead of the erasure of the data.
  • your personal data is no longer required by us for the purposes of the processing, but you require the data for the establishment, exercise or defence of legal claims.
  • you have raised an objection in accordance with Art. 21 (1) of the EU GDPR. A restriction of processing can be requested pending the verification of whether we have legitimate grounds that override your grounds for a restriction of processing.

A restriction of processing means that the personal data will only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest. We are obligated to inform you before the restriction of processing is lifted by us.

5.5 Right to data portability

You have a right to data portability if the processing is based on your consent according to Art. 6 (1) Sentence 1 a) or Art. 9 (2) a) of the EU GDPR or a contract to which you are a contractual party and the processing is carried out with the aid of automated means. In this case, the right to data portability includes the following rights insofar as they do not adversely affect the rights and freedoms of others:

You have the right to receive from us the personal data that you have provided to us in a structured, commonly used and machine-readable format. You have the right to have this data transferred to another controller without hindrance from us. If technically feasible, you can request that we directly transfer your personal data to another controller.

5.6 Right to object

If you believe that the processing of the personal data about you is unlawful, you can lodge a complaint with a data protection supervisory authority that is responsible for your place of residence, place of work or the place of the alleged infringement.

5.7 Withdrawal of consent

Your consent for the processing of personal data can be withdrawn at any time with future effect. The withdrawal of consent can also apply to individual sections of the data processing (e.g. unsubscribing from the newsletter).

Please note that even if you withdraw your consent, processing of the data may still be required due to legal regulations.

Please send us the notification about your withdrawal of consent using the contact details stated above in section 1 and please understand that some identification may be required in the event of a withdrawal of consent to prevent any misuse.

6 Withdrawal of consent for advertising mails

We hereby expressly prohibit the use of our contact details – published as part of our duty to publish a legal notice – for the purpose of sending us any advertising or information materials that we have not expressly requested. The operator of these websites expressly reserves the right to take legal action in the event of the unsolicited sending of advertising information such as in the form of spam emails.