Privacy policy
Name and Contact according to Article 4 Sect. 7 GDPR
HL Online Service GmbH
Co-CEOs: Zuzana & Jakob Hager
Sihleggstrasse 23
CH-8832 Wollerau, Switzerland
Security and Protection of Your Personal Data
Definitions
Personal Data
Processing
Restriction of Processing
Profiling
"Pseudonymization" is the processing of personal data in a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and subject to technical and organizational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.
Filing System
"Controller" means a natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
Processor
Recipient
Third Party
Consent
Lawfulness of Processing
Use of Cookies
In addition to the data mentioned above, cookies are stored on your computer when you use our website. Cookies are small text files stored on your hard drive, associated with the browser you are using, and through which the entity that sets the cookie receives certain information. Cookies cannot run programs or transmit viruses to your computer. They serve to make the website more user-friendly and effective overall.
This website uses the following types of cookies, the scope and functionality of which are explained below: Transient cookies (see a) Persistent cookies (see b).
Transient cookies are automatically deleted when you close the browser. These include session cookies in particular. They store a so-called session ID, which allows different requests from your browser to be assigned to the shared session. This enables your computer to be recognized when you return to our website. Session cookies are deleted when you log out or close the browser.
Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can delete cookies at any time in your browser’s security settings.
You can configure your browser settings according to your preferences, e.g., refusing to accept third-party cookies or all cookies. "Third-party cookies" are cookies set by a third party rather than the actual website you are visiting. Please note that by deactivating cookies, you may not be able to use all the functions of this website.
We provide our users with the option to select which cookies they wish to allow. Some cookies serve security purposes or are necessary for operating our online services (e.g., to display the website) or to save users’ choices when confirming the cookie banner, thus allowing them to decide for or against specific cookies. Additionally, we and our technology partners use cookies for reach measurement and marketing purposes, which we inform users about in the privacy policy. Users can opt-out of the use of cookies for marketing purposes in the cookie banner (prompted upon first visiting the website).
A general objection to the use of cookies for online marketing purposes can be declared via various services, especially for tracking, on the US site //www.aboutads.info/choices/ or the EU site //www.youronlinechoices.com/. Additionally, cookies can be disabled in the browser settings to prevent their storage. Please note that this may restrict the functionality of our online offerings.
If users do not want cookies for advertising purposes to be stored, they can specify these preferences in a pop-up upon visiting the website. This will prevent any advertising-related cookies from being used.
If users generally do not want any cookies stored on their computers, they are requested to disable the corresponding option in their browser’s system settings. Stored cookies can be deleted in the browser’s system settings. Disabling cookies may restrict the functionality of this online service.
Additional functions and offers on our website
In addition to the purely informational use of our website, we offer various services you may use if interested. Generally, you must provide additional personal data for this, which we use to provide the respective service, applying the same principles for data processing as previously mentioned.
We occasionally use external service providers to process your data. These providers are carefully selected and commissioned by us, bound by our instructions, and regularly monitored.
Additionally, we may share your personal data with third parties if we offer participation in events, competitions, contract conclusions, or similar services jointly with partners. You will receive further details when providing your personal data or below in the description of the offer.
If our service providers or partners are based in a country outside the European Economic Area (EEA), we will inform you of the consequences of this in the description of the offer.
Use of our Online Academy
To use our academy (academy.app.mentortools.com), you need a customer account, as this allows you to log in with your email address and password to view your learning progress and ask questions in our forum. Required information for contract processing is marked separately, while additional information is optional. Access to the academy is free; any fee-based additional offerings are marked separately. Access to these additional offerings, unless otherwise stated, is provided through the academy (together with the free offerings there).
We generally store your access data to the academy indefinitely, providing you with unlimited access to the academy content, forum, and any purchased additional offerings. If you wish to delete your customer account and all related information, please contact us, and we will proceed with the deletion, except for data we must retain due to legal obligations (e.g., tax documentation). Access to this data, however, is restricted.
To prevent unauthorized third-party access to your personal data, it is encrypted using SSL technology.
Product Purchases
Our website links to products from the provider digistore24.com (Digistore24 GmbH, St.-Godehard-Straße 32, 31139 Hildesheim, Germany). DigiStore24 is the seller of the products; we are the product manufacturer. We do not operate our own online store and use third-party payment service providers.
For information on the processing of personal data during the purchase of these products from DigiStore24, please refer to www.digistore24.com.
Newsletter
With your consent, you may subscribe to our newsletter, through which we inform you of our latest offers. The advertised goods and services are listed in the consent form.
To subscribe to our newsletter, we use a so-called double opt-in procedure. This means we will send you an email to the address provided, asking you to confirm that you wish to receive the newsletter. If you do not confirm your subscription, your information will be locked and automatically deleted after one month. Additionally, we store your IP addresses and times of registration and confirmation to provide proof of your subscription and to clarify any potential misuse of your personal data.
The only mandatory information required to receive the newsletter is your email address. Providing additional, separately marked data is optional and used to address you personally. After your confirmation, we store your email address for the purpose of sending the newsletter. The legal basis is Art. 6(1) Sentence 1(a) GDPR.
You may withdraw your consent to receive the newsletter at any time and unsubscribe. You may declare your withdrawal by clicking the link provided in each newsletter email or by contacting [email protected].
Please note that we evaluate your user behavior when sending the newsletter. For this evaluation, the emails sent include web beacons or tracking pixels, which are single-pixel image files stored on our website. We link the data mentioned in §3 and the web beacons to your email address and a unique ID for the evaluations. Data is collected exclusively in a pseudonymized form, so the IDs are not linked to your other personal data, excluding any direct relation to individuals. You may object to this tracking at any time by clicking the dedicated link in each email or by contacting us via another communication channel. The information is stored as long as you subscribe to the newsletter. Upon unsubscribing, we store the data purely statistically and anonymously.
Children
Our offerings are generally aimed at adults. Persons under the age of 18 should not transmit personal data to us without the consent of their parents or guardians.
Rights of the Data Subject
Withdrawal of Consent
If the processing of personal data is based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the legality of processing based on consent before its withdrawal. To exercise the right of withdrawal, you may contact us at any time.
Right to Confirmation
You have the right to request confirmation from the controller as to whether we are processing personal data concerning you. You may request confirmation at any time using the contact details provided above.
Right of Access
If personal data is being processed, you may request access to this personal data and the following information at any time:
- the purposes of the processing;
- the categories of personal data being processed;
- the recipients or categories of recipients to whom the personal data has been or will be disclosed, particularly recipients in third countries or international organizations;
- where possible, the planned duration for which the personal data will be stored or, if not possible, the criteria used to determine that duration;
- the existence of a right to rectification or deletion of your personal data or to restriction of processing by the controller or a right to object to such processing;
- the existence of a right to lodge a complaint with a supervisory authority;
- if the personal data is not collected from the data subject, any available information as to its source;
- the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) GDPR, and, at least in these cases, meaningful information about the logic involved as well as the significance and intended consequences of such processing for the data subject. Where personal data is transferred to a third country or an international organization, you have the right to be informed about the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer. We provide a copy of the personal data undergoing processing. For any additional copies you request, we may charge a reasonable fee based on administrative costs. If the request is made electronically, the information must be provided in a commonly used electronic format unless otherwise specified. The right to obtain a copy under paragraph 3 must not adversely affect the rights and freedoms of others.
Right to Rectification
You have the right to request the rectification of inaccurate personal data concerning you without undue delay. Taking into account the purposes of processing, you have the right to have incomplete personal data completed, including by means of a supplementary statement.
Right to Erasure (“Right to be Forgotten”)
- You have the right to request the controller to delete personal data concerning you without undue delay, and we are obliged to delete personal data without undue delay if one of the following reasons applies:
- The personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
- The data subject withdraws consent on which the processing is based according to Article 6(1)(a) or Article 9(2)(a) GDPR, and where there is no other legal ground for the processing.
- The data subject objects to the processing pursuant to Article 21(1) GDPR, and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) GDPR.
- The personal data has been unlawfully processed.
- The erasure of personal data is required for compliance with a legal obligation under Union or Member State law to which the controller is subject.
- The personal data was collected in relation to the offer of information society services referred to in Article 8(1) GDPR. Where the controller has made the personal data public and is obliged to delete it pursuant to paragraph 1, the controller shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform controllers processing the personal data that the data subject has requested the deletion of any links to or copies or replications of that personal data.
The right to erasure (“right to be forgotten”) does not apply to the extent that processing is necessary:
- for exercising the right of freedom of expression and information;
- for compliance with a legal obligation requiring processing under Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) GDPR;
- for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1) GDPR, insofar as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
- for the establishment, exercise, or defense of legal claims.
Right to Restriction of Processing
You have the right to request that we restrict the processing of your personal data if one of the following conditions is met:
- the accuracy of the personal data is contested by the data subject for a period enabling the controller to verify the accuracy of the personal data, the processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead
- the controller no longer needs the personal data for processing purposes, but the data subject requires it for the establishment, exercise, or defense of legal claims, or the data subject has objected to processing pursuant to Article 21(1) GDPR pending verification of whether the controller’s legitimate grounds override those of the data subject. Where processing has been restricted under the conditions above, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise, or defense of legal claims, or for protecting the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State. To exercise the right to restrict processing, the data subject may contact us at any time at the contact details provided above
Right to Data Portability
You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format, and you have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that: the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) or on a contract pursuant to Article 6(1)(b) GDPR and the processing is carried out by automated means
In exercising your right to data portability pursuant to paragraph 1, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible. The exercise of the right to data portability shall not affect the right to erasure ("right to be forgotten"). This right does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Right to Object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you, which is based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defense of legal claims. Where personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes. In the context of using information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.
You may exercise your right to object at any time by contacting the respective responsible party.
Automated Individual Decision-Making, Including Profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision:
- is necessary for entering into, or performance of, a contract between you and the controller,
- is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights, freedoms, and legitimate interests, or
- is based on your explicit consent.
The controller shall implement suitable measures to safeguard your rights, freedoms, and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view, and to contest the decision.
This right can be exercised by the data subject at any time by contacting the respective responsible party.
Right to Lodge a Complaint with a Supervisory Authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.
Right to an Effective Judicial Remedy
Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR, you have the right to an effective judicial remedy if you consider that your rights under this Regulation have been infringed due to non-compliant processing of your personal data.
Use of Google Analytics
This website uses Google Analytics, a web analytics service provided by Google Inc. ("Google"). Google Analytics uses "cookies," text files stored on your computer that allow an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. By default, we use the "IP anonymization" function. In this case, your IP address is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before transmission. Only if you expressly agree in the cookie banner that we may store cookies for marketing purposes will the full IP address be transmitted to a Google server in the USA and used accordingly. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, compile reports on website activity, and provide other services related to website and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google.
Objection to Cookies by Google Analytics
You can prevent the storage of cookies by selecting the appropriate settings in your browser software; however, please note that in this case, you may not be able to use all functions of this website to their full extent. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) by Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link: //tools.google.com/dlpage/gaoptout?hl=en.
This website uses Google Analytics with the extension "_anonymizeIp()". This means that IP addresses are processed in a shortened form, excluding the possibility of direct personal reference. If the data collected about you is personally identifiable, it will be immediately excluded and the personal data thus promptly deleted.
We use Google Analytics to analyze the use of our website and to regularly improve it. The statistics obtained allow us to improve our offer and make it more interesting for you as a user. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. The legal basis for the use of Google Analytics is Art. 6 para. 1 sentence 1 lit. f GDPR.
Third-party provider information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Terms of Use: //www.google.com/analytics/terms/de.html, Data Protection Overview: //www.google.com/intl/de/analytics/learn/privacy.html, and Privacy Policy: //www.google.de/intl/de/policies/privacy.
This website also uses Google Analytics for a cross-device analysis of visitor flows, which is carried out via a user ID. You can deactivate the cross-device analysis of your usage in your customer account under "My Data," "Personal Data."
Use of Social Media Plugins
We currently use the following social media plugins: [Facebook, YouTube, Twitter]. We use the so-called two-click solution. This means that when you visit our site, initially no personal data is passed on to the providers of these plugins. You can recognize the plugin provider by the marking on the box over its initial letter or logo. We offer you the opportunity to communicate directly with the plugin provider via the button. Only when you click on the marked field and thereby activate it does the plugin provider receive the information that you have accessed the corresponding website of our online offer. In addition, the data mentioned under § 3 of this declaration is transmitted. In the case of Facebook and Xing, according to the respective providers in Germany, the IP address is anonymized immediately after collection. By activating the plugin, personal data is thus transmitted from you to the respective plugin provider and stored there (for US providers in the USA). Since the plugin provider mainly collects data via cookies, we recommend that you delete all cookies via your browser's security settings before clicking on the grayed-out box.
We have no influence on the collected data and data processing operations, nor are we aware of the full extent of data collection, the purposes of processing, or the storage periods. We also have no information regarding the deletion of the collected data by the plugin provider.
The plugin provider stores the data collected about you as user profiles and uses them for purposes of advertising, market research, and/or tailored website design. Such an evaluation is carried out in particular (even for non-logged-in users) to display tailored advertising and to inform other users of the social network about your activities on our website. You have the right to object to the formation of these user profiles, whereby you must contact the respective plugin provider to exercise this right. Through the plugins, we offer you the opportunity to interact with social networks and other users so that we can improve our offer and make it more interesting for you as a user. The legal basis for the use of plugins is Art. 6 para. 1 sentence 1 lit. f GDPR.
Data transfer occurs regardless of whether you have an account with the plugin provider and are logged in there. If you are logged in with the plugin provider, your data collected by us is directly assigned to your existing account with the plugin provider. If you activate the button and, for example, link the page, the plugin provider also stores this information in your user account and publicly shares it with your contacts. We recommend that you log out regularly after using a social network, especially before activating the button, to avoid assignment to your profile with the plugin provider.
Further information on the purpose and scope of data collection and its processing by the plugin provider can be found in the privacy policies of these providers provided below. There you will also find further information about your rights in this regard and settings options for protecting your privacy.
Addresses of the respective plugin providers and URL with their privacy notices:
Data Processors
We use external service providers (data processors), e.g., for shipping goods, newsletters, or payment processing. A separate data processing agreement has been concluded with the service provider to ensure the protection of your personal data. We work with the following service providers:
1. ActiveCampaign
Address: ActiveCampaign LLC, 1 N Dearborn, 5th Floor, Chicago, IL 60601, United States. We use ActiveCampaign as a CRM system and email marketing system. ActiveCampaign is certified under the EU-U.S. Privacy Shield agreement, and data exchange is therefore permitted under European data protection law. (https://www.privacyshield.gov/participant?id=a2zt0000000GnH6AAK&status=Active). You can find ActiveCampaign's Privacy Policy here: https://www.activecampaign.com/privacy-policy/
2. YouCanBookMe
Address: Youcanbookme Ltd, Bedford I-Kan, 38 Mill St, Bedford MK40 3HD, United Kingdom. We use Youcanbookme in combination with Hubspot to provide a clear calendar where interested parties can voluntarily select an appointment for a consultation. You can find the Privacy Policy of HubSpot here: https://youcanbook.me/privacy
3. DigiStore24
Address: Digistore24 GmbH, St.-Godehard-Straße 32, 31139 Hildesheim, Germany. We link to DigiStore24 because we, as product manufacturers, work with this company that sells our products as a vendor. You can find DigiStore24's Privacy Policy here: https://www.digistore24.com/page/privacy
4. Google
Address: Google Inc., 1600 Amphitheater Parkway, Mountainview, California 94043, USA. We use Google as a provider for our email mailboxes and to store documents in the cloud. Google is certified under the EU-U.S. Privacy Shield agreement, and data exchange is therefore permitted under European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active). You can find Google's Privacy Policy here: https://policies.google.com/privacy
5. Facebook
Address: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. We use Facebook plugins on our websites to give our users the opportunity to easily share content from our blog on Facebook. Facebook is certified under the EU-U.S. Privacy Shield agreement, and data exchange is therefore permitted under European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active). You can find Facebook's Privacy Policy here: https://www.facebook.com/policy.php
6. Intercom
Address: Intercom Inc., 55 2nd Street, 4th Fl., San Francisco, CA 94105, USA. We use Intercom to offer our customers and prospects fast and easy live chat and support. Intercom is certified under the EU-U.S. Privacy Shield agreement, and data exchange is therefore permitted under European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000TNQvAAO&status=Active). You can find Intercom's Privacy Policy here: https://www.intercom.com/de/terms-and-policies
7. Hetzner
Address: Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. We use Hetzner to host our websites. The personal data is encrypted and cannot be viewed by Hetzner. You can find Hetzner's Privacy Policy here: https://www.hetzner.de/rechtliches/datenschutz/
8. The Rocket Science Group LLC d/b/a MailChimp
Address: The Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA. We use Mailchimp/Mandrill as a system for sending emails that are directly related to our users' actions, e.g., sending order confirmations. The Rocket Science Group is certified under the EU-U.S. Privacy Shield agreement, and data exchange is therefore permitted under European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000TO6hAAG&status=Active). You can find The Rocket Science Group's Privacy Policy here: https://mailchimp.com/legal/privacy/
9. Klick-Tipp
Address: KLICK-TIPP LIMITED, 15 Cambridge Court, 210 Shepherd’s Bush Road, London W6 7NJ, United Kingdom, Company Number: 7349350, VAT-ID: GB113364153, Legal Representatives: Michael Toohig, Josef Wolosz, Representative according to Article 27 GDPR: Michael Kapst, Rotherstrasse 21, 10245 Berlin, [email protected], Data Protection Officer: Attorney Dr. Stephan Gärtner, StanhopeONE, Voßstraße 20, 10117 Berlin, [email protected], Tel. +49 30 8186 6371, Fax +49 30 120 530 979. We use the Klick-Tipp CRM system and email marketing system.