This privacy notice informs you which personal data we process when you visit vidensus.eu, when you register, during consultations and when you make a payment, for what purpose, on what legal basis and for how long.
1. Controller
The controller for this processing is Bonavivet UG (haftungsbeschränkt), Adolf-Kaschny-Straße 19, 51373 Leverkusen, Germany, telephone +49 214 83097072. For questions concerning data protection you can reach us through the contact form at https://www.vidensus.eu/c.php or at the e-mail address stated in our legal notice.
2. Visiting the website
Server logs. Each time a page is accessed, our web server stores the IP address, the date and time, the page requested, the page visited before, the browser type and the operating system. We use this data to deliver the website, to detect malfunctions and to fend off attacks. The legal basis is Art. 6(1)(f) GDPR. The logs are deleted after a short period, as soon as they are no longer needed for these purposes.
Technically necessary cookies. We set a session cookie that recognises you during your visit and keeps you logged in, and a cookie of our load balancer that assigns your requests to the same server. Both are deleted when the session ends. The legal basis is Section 25(2) no. 2 TDDDG (German Act on Data Protection in Telecommunications and Digital Services) in conjunction with Art. 6(1)(f) GDPR.
Campaign and referral cookies. If you come to us through an advertising link or a referral, we store the identifier of the campaign or of the referrer in a cookie for 40 days. This allows us to attribute a later registration to the advertising source. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in measuring the success of our advertising.
You can delete cookies in your browser at any time or prevent cookies from being set. Without the session cookie it is not possible to log in.
3. Reach measurement
We use analytics software on a server of our own. No data is transferred to third parties in the process. The software records the pages accessed, the time spent, the browser, the operating system, the screen resolution, the referring page and the IP address shortened by its last octet. It sets the cookies _pk_id (13 months) and _pk_ses (30 minutes) in order to recognise returning visitors. For customers who are logged in we link the usage to the customer number in order to improve processes in the customer area. It also records technical errors in the browser so that malfunctions can be remedied.
The purpose is to improve our services and to evaluate our advertising campaigns. The legal basis is Art. 6(1)(f) GDPR. We delete raw data after 12 months and aggregated reports after 24 months. The software respects the Do Not Track setting of your browser.
4. Prevention of fraud and abuse
Check on registration. In order to prevent automated sign-ups, multiple accounts and misuse of the free initial consultations, we use a specialised provider for the detection of abuse on our registration page. In doing so, technical characteristics of your device, your browser and your internet connection are collected and combined into a visitor identifier, on the basis of which the risk of an abusive registration is assessed. The identifier is stored temporarily in a cookie and, upon successful registration, with your customer account. The processing takes place exclusively in the provider's EU region.
Automated decision. If the check produces a high risk score, the registration is refused automatically. This decision is necessary for entering into the user contract (Art. 22(2)(a) GDPR). In this case you have the right to request a review by a member of our staff through our contact form and to state your point of view.
Further measures. We check telephone numbers for multiple use, maintain block lists of telephone numbers and e-mail addresses that have been used abusively, and log failed login attempts together with the IP address. We store these logs only for as long as is necessary to fend off automated attacks and to trace abuse.
The legal basis for these measures is Art. 6(1)(f) GDPR, our legitimate interest in the security of our service, and Section 25(2) no. 2 TDDDG.
5. Customer account and registration
For registration we collect your form of address, first name, surname, e-mail address, telephone number and a password, together with the date and IP address of the sign-up as evidence. We verify your telephone number by an activation call, without which no consultation can be booked. In your customer account we also store your credit balance, your top-ups, the consultations you have had with date, duration and adviser, your ratings as well as credits and bonus minutes received.
The purpose is the performance of the user contract and of the consultations booked (Art. 6(1)(b) GDPR). The data remains stored for as long as your customer account exists. After a termination we delete the account at your request. We are required to retain accounting data for up to ten years under Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB) (Art. 6(1)(c) GDPR).
6. Consultations
Telephone. For a telephone consultation we use your telephone number in order to connect you and the adviser, either by a call-back from our system or when you dial a service number. In the process traffic data arises: telephone numbers, the beginning, the end and the duration of the call. We use it for billing and for troubleshooting. The connection is established by our telecommunications providers, which process the traffic data under the data protection rules for telecommunications providers in the German Act on Data Protection in Telecommunications and Digital Services. Your telephone number is not shown to the adviser.
Chat and e-mail. In the case of consultations by chat or e-mail we store the content of the exchange in your customer account so that you and the adviser can access it.
Advisers. Advisers receive your user name and the information required for the consultation. Advisers are contractually bound to confidentiality.
The legal basis is Art. 6(1)(b) GDPR. We store traffic data and consultation records for the duration of the customer account and beyond that in accordance with the retention periods under tax law.
7. Payment
Top-ups are handled through payment service providers. Depending on the payment method chosen, the provider receives the data required for the payment, such as name, e-mail address, amount and means of payment:
- payment service providers established in the EU for credit card, Apple Pay, Google Pay and SEPA direct debit;
- payment service providers established in the EU for Pay by Bank, Twint and EPS;
- PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, for PayPal;
- Klarna Bank AB, Stockholm, Sweden, for Klarna. In the case of purchase on account or payment by instalments, Klarna carries out its own credit assessment under the Klarna privacy notice.
The providers are independently responsible for processing the payment. For each payment we store the amount, the date, the payment method and the transaction identifier of the provider, but no complete card or account details. The legal basis is Art. 6(1)(b) GDPR and, for the retention of accounting vouchers for eight years and of books and records for ten years under Section 147 AO and Section 257 HGB, Art. 6(1)(c) GDPR.
8. Communication and support
Contact form and e-mail. We process enquiries sent through the contact form or by e-mail in our ticket system in order to deal with your request. Our e-mail traffic runs through an e-mail provider established outside the EU (see section 12). The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for general enquiries. We store the records until your request has been dealt with and beyond that for the duration of the statutory limitation periods.
Text messages. For activation codes and notices concerning your account we send text messages through an SMS provider established in the USA. For this it receives your telephone number and the text of the message. Through the same provider we also check whether a telephone number given to us is valid. The legal basis is Art. 6(1)(b) GDPR.
9. Advertising e-mails
As a customer you receive e-mails from us about promotions, credits and offers for consultations. We send them to the e-mail address given on registration on the basis of Section 7(3) of the German Act against Unfair Competition (UWG) and Art. 6(1)(f) GDPR. If you expressly consented to advertising on registration, the legal basis is Art. 6(1)(a) GDPR. You may object to receiving them at any time, through the unsubscribe link in every e-mail, in your customer account or through the contact form.
They are dispatched through a mailing provider in a data centre in Frankfurt am Main. For this it receives the e-mail address and the content of the message.
10. Advertising and measurement of its success
We place advertising on advertising platforms and in social networks and work with an affiliate programme. If you come to us through one of these campaigns, we load the measurement tool of the platform concerned, which sets a cookie and reports to the platform that you have visited our site and whether you have registered or topped up credit. The platform can link this information to your user account there. The measurement tool is only loaded if you have come to us through a campaign link of the platform concerned.
The platforms are established in the EU and process the data under their own privacy policies, including in the USA (see section 12). The purpose is to measure which advertising leads to registrations and top-ups. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in managing our advertising commercially. You can object to the measurement by blocking cookies of advertising platforms in your browser or by using the advertising settings of your account with the platform through whose advertisement you came to us.
11. Processors and hosting
Technical operation, hosting and maintenance of vidensus.eu and of the connected systems are carried out by MIMP TECH UG (haftungsbeschränkt), Fuggerstraße 39, 52351 Düren, on the basis of a data processing agreement under Art. 28 GDPR. The servers are located in data centres in Germany, and backup copies are likewise stored in Germany.
Further processors are the provider for the check on registration (section 4), the mailing provider for e-mails (section 9) and the SMS provider (section 8). All processors are contractually bound by our instructions.
12. Transfers to third countries
With some services data is processed outside the EU: with our SMS provider in the USA, with one of our payment service providers, with the advertising platforms referred to in section 10 through the transfer to the USA within the respective group of companies, and with our e-mail provider in a country outside the EU for which no adequacy decision exists. The basis is, for US providers certified under the EU-US Data Privacy Framework, the adequacy decision of the European Commission, and otherwise the standard data protection clauses of the European Commission under Art. 46(2)(c) GDPR. You can obtain a copy of the standard data protection clauses on request through the contact form. The provider for the check on registration processes your data exclusively in the EU.
13. Your rights
You have the right of access to the data stored about you (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). You may withdraw consent you have given at any time with effect for the future. You may object to advertising at any time without giving reasons.
To do so please contact us through the contact form or at the e-mail address stated in our legal notice. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2 to 4, 40213 Düsseldorf, https://www.ldi.nrw.de.
14. Changes
We adapt this notice when our services or the legal situation change. The version published at https://www.vidensus.eu/EN/content/datenschutzerklaerung.php applies.
Version: 07.09.2024