Data protection information
We at Paycy-one GmbH take the protection of your personal data seriously and would like to in-form you about the collection, processing and use of your data.
Below we provide you with an overview of the type, scope, purpose, duration and legal basis of the processing of your data by us (see Article 13 and 14 GDPR).
|1. General information||This part is always relevant for you.|
|2. Visiting websites||This part is relevant for you if you use our Internet offer.|
3. Business customers and part-ners
|This part is relevant for you if you want to work with us as a customer, service provider, supplier or similar partner, are already in an ongoing business relationship with us or have been in the past.|
1 General information
Paycy-one GmbH, Moorfuhrtweg 13, 22301 HamburgPhone: +49 40 227433-0
Fax: +49 40 227433-1333
If you have any further questions regarding the processing of your personal data, please contact us directly at sales(at)paycy.eu.
1.2 Processing purposes and legal basis
In principle, any processing of personal data is prohibited by law and only permitted if the data processing falls under one of the following justifications:
- Article 6 para. 1 sent. 1 lit. (a) GDPR (“consent”): if the data subject has voluntarily, in an in-formed manner and unambiguously indicated by a statement or other unambiguous affirma-tive act that they consent to the processing of personal data relating to them for one or more specific purposes;
- Article 6 para. 1 sent. 1 lit. (b) GDPR: if processing is necessary for the performance of a con-tract to which the data subject is party or in order to take steps at the request of the data sub-ject prior to entering into a contract;
- Article 6 para. 1 sent. 1 lit. (c) GDPR: is necessary for compliance with a legal obligation to which the controller is subject (e.g. a legal obligation to keep records);
- Article 6 para. 1 sent. 1 lit. (d) GDPR: if processing is necessary in order to protect the vital interests of the data subject or of another natural person;
- Article 6 para. 1 sent. 1 lit. (e) GDPR: if processing for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- Article 6 para. 1 sent. 1 lit. (f) GDPR (“legitimate interests”): if processing is necessary for the purposes of the legitimate (especially legal or commercial) interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental
For the processing operations carried out by us, we indicate below the applicable legal basis in each case. Processing may also be based on several legal bases.
1.3 1.3 Terms
- Processor (Article 4 (8) GDPR) is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller, in particular in accordance with the controller’s instructions (e.g. IT service provider). In particular, a processor is not a third party in the sense of data protection law.
- Third party (Article 4 (10) GDPR) means any natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authori-ty of the controller or processor, are authorised to process personal data; this also includes other group-affiliated legal persons.
- Consent (Article 4 (11) GDPR) of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which the data subject, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to them.
- Personal data (Article 4 (1) GDPR) is any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, loca-tion data, an online identifier or to one or more factors specific to the physical, physiological, ge-netic, mental, economic, cultural or social identity of that natural person. The identifiability can also be given by means of a linkage of such information or other additional knowledge. The origin, form or embodiment of the information is irrelevant (photos, video or audio recordings can also contain personal data).
- Controller (Article 4 (7) GDPR) means the natural or legal person, public authority, agency or oth-er body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
- Processing (Article 4 (2) GDPR) means any operation which is performed on personal data, whether or not by automated (i.e. technology-based) means. This includes, in particular, the col-lection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consulta-tion, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data, as well as the alteration of a pur-pose or intended purpose on which a data processing operation was originally based.
If you contact us, the information of the inquiring persons is processed. As a matter of course, we will use the personal data transmitted to us in this way exclusively for the purpose you provide it for when contacting us.
The answering of contact requests in the context of contractual or pre-contractual relationships is carried out to fulfil our contractual obligations or to answer (pre-)contractual requests (Article 6 para. 1 sent. 1 lit. (b) GDPR) and otherwise on the basis of legitimate interest in answering the requests (Article 6 para. 1 sent. 1 lit. (f) GDPR).
1.5 Data deletion and storage period
For the processing operations we carry out, we indicate below in each case how long the data will be stored by us and when it will be deleted or blocked. Unless an explicit storage period is speci-fied below, your personal data will be deleted or blocked as soon as the purpose or legal basis for the storage no longer applies. Your data will only be stored on our servers in Germany, subject to any transfer in accordance with the regulations of the individual tools. However, storage may take place beyond the specified time in the event of a (threatened) legal dispute with you or other legal proceedings or if storage is stipulated by legal regulations to which we are subject as the respon-sible party. If the storage period prescribed by legal regulations expires, the personal data will be blocked or deleted unless further storage by us is necessary and there is a legal basis for this.besteht.
1.6 Data security
We protect your data by means of technical and organisational security measures to prevent the accidental or intentional manipulation, loss, destruction or access by unauthorised persons. Our security measures, such as data encryption, are regularly improved in accordance with the devel-opment of the technology.
1.7 Cooperation with order processors
We use external domestic and foreign service providers to process our business transactions (e.g. for IT, logistics, telecommunications, sales and marketing). They will only act on our instructions and have been contractually obliged to comply with the data protection provisions in accordance with Article 28 GDPR.
If personal data from you is passed on by us to our affiliated companies or is passed on to us by our subsidiaries (e.g. for advertising purposes), this is done on the basis of existing order pro-cessing relationships.
1.8 Your rights
Your right to access information
According to Article 15 GDPR, you always have the right receive information about the origin, recipient, purpose and duration of data processing of the data retained by us in respect of you. You can submit a request by post or e-mail to the addresses provided above.
Right to request the rectification of inaccurate data
You have the right to demand the rectification of your personal data without undue delay if it is inaccurate (Article 16 GDPR). In this regard, please contact us via the contact addresses above.
Right to erasure
You have a right to the erasure (“right to be forgotten”) of your personal data without undue delay if one of the legal grounds in terms of Article 17 GDPR applies. Such grounds are, for example, if the personal data is no longer necessary for the purposes for which is was originally processed, if you have withdrawn your consent and there is no other legal basis for the processing, if you object to the processing and there are no overriding reasons for processing.
In order to assert your right to erasure, please contact us via the contact addresses provided above.
Right to data portability
You have the right to data portability in terms of Article 20 of the GDPR. You have the right to receive the data concerning you, which you provided us with, in a conventional, structured and machine-readable format and to have this data transferred to another controller, such as another service provider. This is subject to the conditions that the processing is based on consent or on a contract and can be carried out using automated procedures. In order to assert your above-mentioned right, please make contact us via the contact addresses provided above.
Right to the restriction of processing
You have the right to restrict processing if one of the conditions applies in accordance with the provisions of Article 18 GDPR. Thereafter, the restriction of processing may be required, in particular, if the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of the use of the personal data instead or if the data subject objects to the processing pursuant to Article 21 para. 1 GDPR pending verification of whether our legitimate grounds override your rights. In order to assert your above-mentioned right, please make contact us via the contact addresses provided above.
Right to object
You have the right to object, at any time, in terms of Article 21 GDPR on grounds relating to your particular situation to the processing of your personal data which is based, i. a., on Article 6 para. 1 lit. (e) or (f) GDPR. In which event, we will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing is for the purpose of asserting, pursuing or defending a legal claim. In order to assert your above-mentioned right, please make contact us via the contact addresses provided above.
Right to lodge a complaint
You have the right to lodge a complaint in terms of Article 77 GDPR with the competent supervisory authority if you are of the opinion that the processing of your personal data is unlawful:
Free and Hanseatic City of Hamburg
The Hamburg Commissioner for Data Protection and Freedom of Information
2 Visiting websites
2.1 Information über die Erhebung personenbezogener Daten
When you visit our websites, our web servers automatically save the following data:
- Information about the browser type and version used
- The operating system of the user
- The Internet service provider of the user
- The IP address of the user
- Date and time of when the site was accessed
- External websites from which the system of the user accessed our website
- External websites accessed by the system of the user from our website
2.2 Purpose and legal basis of data processing
The data is saved to ensure the functionality of the website. The data is also used to optimise the website and to safeguard the security of our IT systems. We also process this data to detect and track misuse. In this regard, the legal basis is Article 6 para. 1 lit. (f) GDPR. Our legitimate interest in processing the data is to ensure that our website functions properly and to safeguard the transactions processed by means thereof.
Your personal data will however be processed if you provide it to us, for example, in the context of a request or placing an order for information or registering for a newsletter. This is based on the provisions of Article 6 para. 1 lit. (a) GDPR.
2.3 Duration of data processing
The data is stored in the log files of our servers for seven days and then deleted automatically.
In this regard, the data is not evaluated for marketing purposes.
2.4 Automated data collection on our websites
- Technical cookies: these cookies are mandatory to move around the website, use basic functions and ensure the security of the website; they do not collect information about you for marketing purposes nor do they store which websites you have visited.
- Performance cookies: these cookies collect information about how you use our website, which pages you visit and, for example, whether errors occur during website use; they do not collect information that could identify you – all information collected is anonymous and is only used to improve our website and find out what interests our users.
- Advertising cookies, targeting cookies: these cookies are used to offer the website user tailored advertising on the website or offers from third parties and to measure the effectiveness of these offers. Advertising and targeting cookies are stored for a maximum of 13 months.
- Sharing cookies: these cookies are used to improve the interactivity of our website with other services (e.g. social networks). Sharing cookies are stored for a maximum of 13 months.
2.5 Tools used on the website
We use YouTube on our website. This is a video portal of YouTube LLC, 901 Cherry Ave, 94066 San Bruno, CA, USA, hereinafter referred to as “YouTube”.
YouTube is a subsidiary of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ire-land, hereinafter referred to as “Google”.
We use YouTube in connection with the Privacy Enhanced Mode function to show you videos. This is based on the provisions of Article 6 para. 1 lit. (f) GDPR. Our legitimate interest lies in im-proving the quality of our website. According to YouTube, the Privacy Enhanced Mode function ensures that the data described in more detail below is only transmitted to the YouTube server when you actually start a video.
Without this Privacy Enhanced Mode, a connection to the YouTube server in the USA is estab-lished as soon as you call up one of our Internet pages on which a YouTube video is embedded.
This connection is necessary in order to be able to display the respective video on our website via your Internet browser. In the course of this, YouTube will at least record and process your IP ad-dress, the date and time and the website you visited. In addition, a connection is established to Google’s “DoubleClick” advertising network.
If you are logged into YouTube at the same time, YouTube will assign the connection information to your YouTube account. If you wish to prevent this, you must either log out of YouTube before visiting our website or make the appropriate settings in your YouTube user account.
For the purpose of functionality and to analyse user behaviour, YouTube permanently stores cookies on your end device via your Internet browser. If you do not agree to this processing, you have the option of preventing the storage of cookies by means of a setting in your Internet browser.
Google provides further information on the collection and use of data as well as your rights and protection options in this regard at the following URL: https://policies.google.com/privacy
3 Business customers and partners
If you or your organisation have a business relationship with us (in particular customers, prospective customers, partners, service providers and suppliers), we retain the relevant data about you. We would like to inform you about this in addition.
The respective data processed especially includes the contact data, such as your name, company, position, address, telephone number, e-mail address, as well as information about the respective business relationship, such as the contractual relationship and its processing (current and completed orders, invoices, payments).
Your data is processed for different purposes and is based on different legal grounds. Insofar as the processing of your personal data is necessary for the initiation or implementation of a contractual relationship or in the context of the implementation of pre-contractual measures, processing is lawful pursuant to Article 6 para. 1 lit. (b) GDPR. The processing includes in particular the communication for the planning, implementation, administration and billing of the contractually defined services. If necessary and required by law, we process your data beyond the actual contractual purposes for the fulfilment of legal obligations pursuant to Article 6 para. 1 lit. (c) GDPR, e.g. for the fulfilment of retention obligations pursuant to the Commercial Code and the Fiscal Code of Germany.
If you give us your express consent to process personal data for specific purposes (e.g. transfer to third parties, evaluation for marketing purposes or advertising), this processing is lawful on the basis of your consent pursuant to Article 6 para. 1 lit. (a) GDPR. Consent that was given can be revoked any time with effect for the future.
In addition, processing may be carried out to protect the legitimate interests of us or third parties in accordance with Article 6 para. 1 lit. (f) GDPR. If necessary, we will inform you separately, stating the legitimate interest, insofar as this is required by law.
Your data will only be stored in our systems for as long as this is permissible under applicable law, in particular as long as this is necessary for the performance of the contract in connection with the applicable retention obligations. Furthermore, we will delete your data if you request this or revoke your consent to processing. In these cases, we will check whether the data can be deleted or only a restriction of processing can be made due to legal requirements.
We only pass on your personal data within our company to those areas and persons who need this data to fulfil contractual and legal obligations or to implement our legitimate interest.
Paycy-one GmbH will only transfer data relating to the use of the services to third parties in accordance with the applicable statutory provisions if there is a legal obligation to do so (such as disclosures to public authorities) or if this is necessary for the enforcement of our rights (such as claims arising from a contractual relationship).
In addition, we will only disclose data to external service providers in such instances where this is necessary for the provision of products and services and a contractual agreement has been concluded. These instruction-bound service providers or processors will only use the data in terms of a contract for the purpose of performing their obligations.
Under no circumstances will the collected data be sold. Our employees are obliged to maintain and safeguard the confidentiality of the personal data provided to us.
As a matter of principle, there is no regular transfer of personal data to a third country (states outside the European Union or the European Economic Area) or an international organisation. In cases where we communicate with you via Microsoft Teams, data transfer to the USA is not excluded. In that case, the transfer is covered by the conclusion of standard data protection clauses as well as by supplementary safeguards.
Furthermore, there may be cases in which a transfer is necessary for the fulfilment of the contract or, at your request, for the implementation of pre-contractual measures, the transfer is required by law or you have given us your consent.
Status and amendment of the data protection information
Please note that we update this data protection policy from time to time so that it always complies with the most recent legal requirements and covers all our content. The latest version applies sub-ject to the following update notice.
Your statutory rights to information, rectification, restriction, erasure and to raise an objection shall remain unaffected by any such amendment.
Last Update: 27/09/2022