PRIVACY

What this statement covers

• Controller and contact
• Hosting and server logs
• Database
• Sending email
• Fonts
• Cookies and local storage
• Share buttons
• Contact form
• Polls
• Tip-offs, submissions and protection of sources
• Newsletter
• Processing for journalistic purposes
• Overview of our processing
• Your rights
• Right to lodge a complaint
• Changes to this statement

Controller and contact

The controller within the meaning of the General Data Protection Regulation (GDPR, in German DSGVO) is MBG International Premium Brands GmbH, Oberes Feld 13, 33106 Paderborn, represented by Andreas W. Herb and Peter Jürgens. We answer questions about data protection at info@mbgglobal.com. The data protection officer of the operator is Carola Sieling, Technologiewerft Compliance GmbH, Deichstraße 1, 20459 Hamburg, Telefon 040 37601 00.

Hosting and server logs

Our pages are held on a virtual server of Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. The server stands in a data centre in France. When you call up our pages it processes technically necessary data (IP address, time, page requested, browser identification) in order to deliver and secure them. The legal basis is Art. 6(1)(f) GDPR. We have a data processing agreement with Hostinger under Art. 28 GDPR. Where sub-processors of Hostinger process data outside the European Economic Area, that is covered by EU standard contractual clauses. We keep no access log, and the website itself stores no IP addresses. Only if a technical error occurs while a page is being delivered does the web server write an error message; it shortens the IP address in it before storing (for IPv4 by the last block, for IPv6 to the first 32 bits), so that it can no longer be assigned to any person.

Database

Our content is held in a database at Supabase Pte. Ltd. in the Frankfurt region. It is accessed solely through our own servers, never directly from your browser. Transfer to a third country is covered by EU standard contractual clauses.

Sending email

Email — for instance the message that tells the editorial team about a note from the contact form, and the newsletter — we send through the service Resend of Plus Five Five, Inc., 2261 Market Street, no. 5039, San Francisco, CA 94114, USA. Resend receives the recipient address and the text of the respective message. We have a data processing agreement with the provider under Art. 28 GDPR. The messages are sent through a data centre in Ireland; the provider also processes data in the USA. That transfer is covered by EU standard contractual clauses. Whether you open a message or click a link in it is not something we evaluate.

Fonts

We deliver fonts from our own server. Your browser makes no connection to Google Fonts or any other font service.

Share buttons

Below pieces and videos there are buttons with which you can pass the piece on via Facebook, via LinkedIn, via WhatsApp or by email. These are ordinary links. We embed no buttons of those services, load no third-party script and set no counting pixel: as long as you click none of these buttons, none of the services learns of your visit.

If you do click a button, the sharing page of that service opens, and from that moment its privacy policy applies. The link contains only the address of the piece, no information about you. The service reads the title and the preview image from the shared page itself. If you would rather pass nothing on, you will find the address to copy below.

Cookies and local storage

On the public pages we set cookies only when you vote: one that remembers the day of your vote; in a survey of the series DEUTSCHLAND ENTSCHEIDET one that remembers your consent for a few hours; and, at your express wish, one that remembers which questions of the series you have answered (see the section on polls). In the editorial area, signing in sets a technically necessary session cookie; it is signed, cannot be read by scripts in the browser and ends with the session (§ 25(2) no. 2 TDDDG, the German act on data protection in telecommunications and digital services, and Art. 6(1)(b) GDPR).

If you choose between the light and the dark design, your browser stores that choice locally. This happens only once you actively choose, and serves solely to keep your setting for your next visit (§ 25(2) no. 2 TDDDG). This information does not leave your device.

Contact form

The mandatory fields of the contact form are the email address and the message; the name is voluntary. We process this information solely in order to answer you (Art. 6(1)(f) GDPR, for pre-contractual enquiries Art. 6(1)(b)). We store the message, the email address, the piece concerned and the time of receipt. We store neither your IP address nor your browser identification. Against automated submissions we use a hidden field and a timestamp, no third-party tool.

If we notify the editorial team of your message by email, that happens through Resend (see the section on sending email). Matters that contain a report of an error or a suggestion for a check we additionally store in our database, so that we can demonstrably work through them. Six months after a matter is settled we remove the message and the email address automatically; tip-offs that led to a published correction we keep longer, because they evidence our corrections policy. In our change log we store neither the message nor the email address. The notification to the editorial team we likewise delete six months after the matter is settled.

Polls

In our polls you choose an answer; you need no account and no email address for that. Because an answer to a political question is a political opinion, we process it only with your express consent (Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR). You can withdraw your consent at any time. Because we do not store who voted how, a counted vote can afterwards no longer be assigned to any person and cannot be removed individually.

What we store: one counter per poll and answer, plus the same counters per full hour for the chart over time. We store no information about you in doing so.

So that nobody votes more than once a day, the page sets a cookie after your vote that contains only the day of the vote, not your answer. Your browser sends it only to the poll pages; it cannot be read by scripts in the browser and expires after two days. For the poll you wish to take part in it is strictly necessary (§ 25(2) no. 2 TDDDG).

In a survey of the series DEUTSCHLAND ENTSCHEIDET you consent once at the start for all questions of that survey. So that you need not do so again at every question, a cookie remembers for at most six hours that you have consented and whether you want your progress remembered; it contains no answers. It cannot be read by scripts in the browser, is sent only to the poll pages and is deleted when you end the survey. For the survey you have started it is strictly necessary (§ 25(2) no. 2 TDDDG).

In the series DEUTSCHLAND ENTSCHEIDET you can additionally tick “remember my progress”; the box is voluntary and not pre-selected. A further cookie then remembers the numbers of the questions you have answered, not your answers. Your browser sends it only to the poll pages, which use it to show how many questions you have answered; on our server we store none of this. It cannot be read by scripts in the browser and expires one year after your last answer. The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You withdraw it with the button that deletes your progress on the overview page of the series, or by deleting the cookie in your browser.

Against automated mass voting we also count the votes per poll, day and internet connection; we accept no more than 20 a day from one connection. For that we store not the IP address but a hash value computed with a secret key, for at most two days (Art. 6(1)(f) GDPR). Counters and hash values are held in our database (see the section on the database).

Tip-offs, submissions and protection of sources

We protect those who give us tip-offs. Your name is voluntary; we need the email address only for follow-up questions, and it need not carry your name. We store no IP address with a submission. For journalistic research the duty of confidentiality under § 23 Medienstaatsvertrag, the German interstate media treaty, applies; it continues to apply after the activity has ended.

Newsletter

With our newsletter you receive one email for every new piece, with the headline, the standfirst and a link, and nothing else. To subscribe we need only your email address and your consent, which you give with the tick box in the form. The legal basis is that consent (Art. 6(1)(a) GDPR).

You are subscribed only once you open the link in our confirmation message and confirm there (double opt-in). The link is valid for 48 hours. Without confirmation we send you nothing further; an unconfirmed subscription we remove entirely after three days.

What we store: your email address, when you subscribed and confirmed, which version of the consent text you saw, random identifiers for the confirmation and the unsubscribe link, and on which day which issue was sent to you. We store neither your IP address nor your browser identification, and we do not evaluate whether you open a message or click a link in it. The data is held in our database (see the section on the database); it is sent through Resend (see the section on sending email).

You can withdraw your consent at any time with effect for the future: with the unsubscribe link in every message, one click is enough; with the “unsubscribe” button that many mail programs display; or informally to info@mbgglobal.com. When you unsubscribe we remove your email address at once, and after that no further message goes to you. So that we can evidence that we wrote only with consent (Art. 7(1) GDPR), we keep for three years the times, the version of the consent text and a check value of your address. The check value is a SHA-256 hash; the address cannot be calculated back from it, only an address presented to us compared against it. The legal basis for this is our legitimate interest in being able to evidence the consent (Art. 6(1)(f) GDPR). After three years, the standard limitation period (§ 195 Bürgerliches Gesetzbuch, the German Civil Code), we remove this information too.

So that nobody uses the form to fill other people’s mailboxes with confirmation messages, we send at most three confirmation messages a day to the same address and accept at most five subscriptions an hour from one internet connection. For the second limit our server counts a hash value of the connection in its memory for one hour; it is not stored (Art. 6(1)(f) GDPR). Against automated subscriptions we also use a hidden field and a timestamp, no third-party tool. Whether an address is already subscribed is something the form tells nobody.

Processing for journalistic purposes

Personal data of people in public life whose statements we check we process for journalistic purposes. The media privilege applies to this (§ 23 Medienstaatsvertrag in conjunction with Art. 85 GDPR). Those concerned can approach the editorial team with a reply, a notice of an error or a complaint. Our corrections policy describes the way.

Overview of our processing

Your rights

You have the right to information, rectification, erasure, restriction, data portability and objection, in so far as the media privilege does not stand in the way, as well as the right to lodge a complaint with a data protection supervisory authority. An informal request to info@mbgglobal.com is enough.

Right to lodge a complaint

The competent supervisory authority is Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf. You can also approach the supervisory authority where you live.

Changes to this statement

If something changes in our technology or in our service providers, we change this statement. Every substantial change appears as a policy change in the corrections log, with the date and the reason. The status of this version is stated at the top of the page.