Privacy Policy

This privacy policy explains how we, as the party responsible for data processing, handle the nature, scope, and purpose of processing personal data in connection with our website, in accordance with the requirements of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR).

Definitions

‘Personal data’: All information relating to an identified or identifiable natural person.
‘Identifiable’: A natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.
‘Processing’: Any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
‘Controller’: The natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. If these purposes and means are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
‘Recipient’: A natural or legal person, public authority, agency, or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients. The processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.

General Information
Data Controller

Glasso GmbH

Zietenstraße 52

40476 Düsseldorf

Germany

Email: glassode@icloud.com

Contact Details of the Data Protection Officer

A company data protection officer has not been appointed, as there is no legal obligation to do so. For questions regarding data protection, please contact: Glasso GmbH at the address or email listed above.

Legal Basis

We process personal data based on at least one of the following legal grounds:

Consent: The data subject has given consent to the processing of their personal data for one or more specific purposes (Art. 6 (1) (a) GDPR).
Contractual performance: Processing is necessary for the performance of a contract with the data subject or to take steps at the request of the data subject prior to entering into a contract (Art. 6 (1) (b) GDPR).
Legal obligation: Processing is necessary for compliance with a legal obligation to which we are subject (Art. 6 (1) (c) GDPR).
Vital interests: Processing is necessary to protect the vital interests of the data subject or another natural person (Art. 6 (1) (d) GDPR).
Legitimate interests: Processing is necessary for the purposes of the legitimate interests pursued by us or by a third party (Art. 6 (1) (f) GDPR).

Disclosure of Data to Recipients

We only pass on personal data to recipients (processors or other third parties) to the extent necessary and under one of the following conditions:

The data subject has consented to the disclosure.
The disclosure serves to fulfill contractual obligations or pre-contractual measures at the request of the data subject.
We are legally obligated to disclose the data.
The disclosure is based on our legitimate interests or those of a third party.

Third Countries

Transfer of personal data to a country or international organization outside the European Union (EU) or the European Economic Area (EEA) takes place only subject to legal or contractual permissions and the requirements of Art. 44 et seq. GDPR. This means an adequacy decision by the EU Commission exists (Art. 45 GDPR), appropriate safeguards are in place (Art. 46 GDPR), or binding corporate rules (Art. 47 GDPR) apply. In individual cases, a transfer may be permitted based on an exception in Art. 49 GDPR.

Note on USA Transfers: We may have integrated external services from providers based in the USA. If active, personal information may be collected and transmitted to servers in the USA. The European Court of Justice assesses the USA as a country with an insufficient level of data protection. There is a risk that US authorities may access and use this data for control and monitoring purposes without notification or legal remedies.

Rights of the Data Subject

As a data subject, you have the following rights:

Access (Art. 15 GDPR): To request information about your processed data, purposes, categories, recipients, storage duration, origin, and the existence of automated decision-making/profiling.
Rectification (Art. 16 GDPR): To demand the immediate correction or completion of your data.
Erasure (Art. 17 GDPR): To request the deletion of your data, unless processing is required for free expression, legal obligations, public interest, or legal claims.
Restriction (Art. 18 GDPR): To restrict processing if accuracy is contested, processing is unlawful, or data is needed for legal claims.
Data Portability (Art. 20 GDPR): To receive your data in a structured, commonly used, machine-readable format or transfer it to another controller.
Objection (Art. 21 GDPR): To object to processing based on legitimate interests (Art. 6 (1) (f) GDPR) or for direct marketing.
Withdrawal of Consent (Art. 7 (3) GDPR): To withdraw consent at any time, effective for the future.
Complaint (Art. 77 GDPR): To lodge a complaint with a supervisory authority.

Deletion and Restriction of Personal Data

Data is deleted when it is no longer necessary for its original purpose and no legal retention periods prevent its deletion. If data is required for other legally permissible purposes, processing is restricted instead of deleted (Art. 18 GDPR).

Commercial/Tax records: Retained for 6 years (e.g., commercial letters, accounting documents).
Accounting/Tax records: Retained for 10 years (e.g., books, records, management reports, invoices).

Cookies