Submitted by timo_admin on

 

A. Information about the processing of your personal data

 

I. Data controller and data protection officer

 

Data controller of this website:

 

0xNXT GmbH,

c/o Omnicom Holding Germany GmbH,

Königsallee 92, 40212 Düsseldorf.

 

II. Provision of website and creation of the log files

 

1. What personal data is processed for what purpose?

 

Every time you access content on the website, data is temporarily stored that may allow identification. The following data is collected in particular: 

 

  • Date and time of access
  • IP address
  • Host name of the accessing computer
  • Website from which the website was accessed
  • Websites accessed via the website
  • Page visited on our website
  • Message whether the retrieval was successful
  • Transmitted data volume
  • Information about the browser type and version used
  • Operating system.

 

The temporary storage of data is necessary in order to enable the delivery of the website. Further storage in log files takes place in order to ensure the functionality of the website and the security of the information technology systems. Our legitimate interest in data processing is also based on these purposes.

 

2. On what legal basis are these data processed?

 

The data are processed on the basis of Art. 6(1)(f) GDPR.

 

3. Are there other recipients of the personal data besides the controller?

 

The website is hosted by Amazon Web Services. The host provider receives the above data as a data processor.

 

4. How long will the data be stored?

 

The log files are kept for a maximum of up to 7 days.

 

II. YouTube

 

If you have given your consent, we use YouTube on our website to be able to show you certain content in the form of videos. YouTube is a video hosting service provided to users in the EU by Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").

 

For more information, please see YouTube's privacy policy: https://policies.google.com/privacy 

 

1. What data is processed for what purpose?

 

To protect your privacy, we offer this service as so-called "2-click buttons". The "2-click solution" prevents data (e.g. your IP address) from being transmitted to YouTube when you enter our website. For this purpose, the buttons are deactivated by default and are only activated by clicking on the embedded video for the first time. YouTube also collects personal data after activation and sends it to its own servers where it is stored, for example:

 

  • http data
  • IP address.

 

In addition, the activated service sets a cookie with a unique identifier when the relevant website is accessed. 

 

The data transfer takes place regardless of whether you have an account with YouTube and are logged in there. If you are logged in to YouTube, the data we collect is assigned to your existing account.

 

2. On what legal basis are these data processed?

 

The legal basis for the processing of personal data is your consent according to Art. 6(1)(a) GDPR and § 25(1) TTDSG.

 

3. Are there other recipients of the personal data besides the controller?

 

Recipients of the data can be

 

  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland 
  • Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

 

Note: Since July 16, 2020, the (partial) adequacy decision for the USA, the so-called Privacy Shield, no longer exists. The USA is thus currently a so-called unsafe third country. This means that the same level of data protection is not provided in the USA as in the EU. There is therefore a risk that personal data may be processed for the purposes of third parties without your knowledge, that the data may not be protected against access by third parties and that you may not be able to assert your data protection rights (e.g. by means of a complaint to a data protection authority). In particular, there may be government access in the U.S., for example in the context of intelligence collection powers under Section 702 FISA and Executive Order 12 333. EU citizens have no effective legal protection against such access in the U.S. or the EU.

 

In order to establish an appropriate level of protection for your data, we have concluded EU standard contractual clauses with the service provider with the recipients and implemented additional safeguards. In these standard contractual clauses, the recipient assures to protect the data sufficiently and thus to ensure a level of protection comparable to the GDPR.

 

For the data collection and transmission to YouTube, we and Google Ireland Limited are jointly responsible for data processing (Art. 26 DSGVO). For information on the processing of your data by Youtube/Google and on your data subject rights against Youtube/Google, please refer to Google's data policy: https://policies.google.com/privacy?hl=en 

 

4. How long will the data be stored?

 

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. For more information about the storage duration, please see YouTube's privacy policy: https://policies.google.com/privacy?hl=de 

 

B. Data subject rights

 

I. Right to obtain and access

 

You can request information in accordance with Art. 15 GDPR about your personal data that we process.

 

II. Right of objection

 

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data carried out on the basis of Article 6(1)(f) GDPR. The controller will then no longer process the personal data unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims. The collection of data for the provision of the website and the storage of log files are absolutely necessary for the operation of the website.

 

III. Right of rectification

 

If the information concerning you is not (or no longer) correct, you can request a correction in accordance with Art. 16 GDPR. If your data is incomplete, you can request that it be completed.

 

IV. Right to erasure

 

You can request the deletion of your personal data in accordance with Art. 17 GDPR.

 

V. Right to restriction of processing

 

According to Art. 18 GDPR, you have the right to request a restriction of the processing of your personal data.

 

VI. Right to complain

 

If you believe that the processing of your personal data violates data protection law, you have the right to complain to a data protection supervisory authority of your choice in accordance with Art. 77(1) GDPR.

 

VII. Right to data portability

 

In the event that the requirements of Art. 20(1) GDPR are met, you have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to third parties. The collection of data for the provision of the website and the storage of log files are absolutely necessary for the operation of the website. They are therefore not based on consent according to Art. 6(1)(a) GDPR or on a contract according to Art. 6(1)(b) GDPR, but are justified according to Art. 6(1)(f) GDPR. The requirements of Article 20(1) GDPR are therefore not fulfilled.

 

C. Status of Privacy Policy

 

The Privacy Policy is as of May 11th, 2023 and is permanently available at http://nxt.mercedes-benz.com.