Information on data protection
Thank you for visiting our website. The protection of your data has special priority for pharma mall Gesellschaft für Electronic Commerce GmbH. Whenever we process personal data and there is no legal basis for this, we obtain the consent of the data subject.
We process personal data such as name, address, e-mail address or telephone number of the user while taking the European General Data Protection Regulation (GDPR) and the regional data protection legislation applicable for pharma mall Gesellschaft für Electronic Commerce GmbH into account at all times. This Privacy Policy informs data subjects of the nature, scope and purpose of the processing of personal data performed by our company. In addition, it informs data subjects of their rights.
pharma mall Gesellschaft für Electronic Commerce GmbH provides information on data protection elsewhere too, and always in a way ensuring that the data subjects actually affected by the processing of personal data have easy and direct access to this information. If you applied for a job we advertised or plan to do so, you should therefore read our Privacy Policy for Applicants.
pharma mall Gesellschaft für Electronic Commerce GmbH as the data controller has implemented extensive technical and organisational measures to allow the most comprehensive protection of the data processed via this website. Nevertheless, data transfer in the Internet can exhibit security flaws, so that complete protection is not possible. All data subjects are therefore free to transmit personal data to us through other channels too.
pharma mall Gesellschaft für Electronic Commerce GmbH guarantees that the staff it employs to process personal data meet the prevailing standards of security and confidentiality.
Contents
- 1. Definition
- 2. Name and address of the controller
- 3. Name and address of the data protection officer
- 4. Cookies
- 5. Collection of general data and information
- 6. Registration on our website
- 7. E-Mail information services
- 8. Contact options provided on the website
- 9. Chat widget
- 10. Facebook/Instragram
- 11. XING
- 12. LinkedIn
- 13. Rights of the data subject
- 14. Statutory or contractual requirements for the provision of personal data
- 15. Automated decision-making
1. Definition
This Privacy Policy uses terms defined when the General Data Protection Regulation (GDPR) was issued. To make it easier to read and understand, we will first explain the terms used:
1.1. Personal data
Personal data means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
1.2. Processing
Processing is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
1.3. Restriction of processing
Restriction of processing is the marking of stored personal data with the aim of limiting their processing in the future.
1.4. Pseudonymisation
Pseudonymisation is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
1.5. Controller
The party responsible is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
1.6. Processor
The processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
1.7. Recipient
The recipient is a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. 2owever, public authorities which may receive personal data in the framework of a particular inquiry shall not be regarded as recipients.
1.8. Third party
A third party is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
1.9. Consent
Consent is any freely given, specific, informed and unambiguous indication by the data subject of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
2. Name and address of the controller
The controller according to the General Data Protection Regulation, other data protection laws applicable in the member states of the European Union and other regulations with the character of data protection legislation is as follows:
pharma mall Gesellschaft für Electronic Commerce GmbH
Westerwaldstr. 10-12
53757 Sankt Augustin
Germany
Tel.: +49-(0)2241-2543-0
E-Mail: info@pharma-mall.de
Website: www.pharma-mall.de
3. Name and address of the data protection officer
The data protection officer of the controller is as follows: Data protection officer of pharma mall Gesellschaft für Electronic Commerce GmbH
53757 Sankt Augustin
Germany
Tel.: +49-(0)2241-2543-0
E-Mail: dsb@pharma-mall.de
Website: www.pharma-mall.de
Westerwaldstr. 10-12
Data subjects can contact our data protection officer at any time with questions and suggestions concerning data protection.
4. Cookies
The web pages of pharma mall Gesellschaft für Electronic Commerce GmbH use cookies. Cookies are text files stored in a computer system using an Internet browser.
Many cookies include a unique identifier – the so-called “cookie ID”. The cookie ID allows websites and servers visited to be matched up with the Internet browser used for accessing them and storing the cookie. This allows the websites visited to distinguish the Internet browser of the data subject from other Internet browsers, which also include other cookies. This means that a certain Internet browser, and possibly also a data subject, can be recognised and identified.
The use of cookies allows pharma mall Gesellschaft für Electronic Commerce GmbH to optimise, for the benefit of the user, the display of the information and services it offers on its website. Cookies allow us to identify the users of our website. The purpose of this identification is to make our website easier to use. For example, we use so-called “session cookies” to indicate that users have already visited individual pages of our website. These session cookies are deleted automatically after you exit our website. In addition, we optimise user-friendliness by also using temporary cookies which are saved on the terminal device of the users for a certain defined period. If a user visits our website again with the aim of using our services, the system automatically detects that the user has already visited our website, and it remembers which entries and settings they made – thus ensuring that they don’t have to enter them again.
We process the data with the help of cookies on the basis of our legitimate interests as described above (Article 6 (1) point (f) GDPR).
The data subject can prevent the storage of cookies by our website at any time by making the relevant settings in his or her Internet browser and, thus, permanently object to the storage of cookies. Cookies already stored can be deleted at any time. This can be done in all usual Internet browsers. If the data subject deactivates the cookies, he or she may not be able to use the functions of our website to the full.
5. Collection of general data and information
Every time a data subject or an automated system accesses our website, a certain amount of general information is collected. This general information is stored in the log files of our web server. The data collected can include the browsers and versions used, the operating system used by the accessing system, the website from which an accessing system accesses our website, the sub-websites accessed on our website, date and time of access to our website, an Internet protocol address (IP address), the Internet service provider of the accessing system and other similar information which can help to repel dangerous attacks on our systems.
When using this general information, pharma mall Gesellschaft für Electronic Commerce GmbH generally makes no inferences concerning a data subject. However, this information is required in order to display the content of our website correctly and optimise advertising for it, safeguard the permanent operability of our systems and the technology used on our website and provide the law enforcement authorities with the information necessary for criminal proceedings in the case of a cyber attack.
In addition, the information collected is evaluated statistically by pharma mall Gesellschaft für Electronic Commerce GmbH. This information is then analysed in order to increase data protection and data security and ensure the protection of the personal data we process. The log files are stored separately from the personal data entered by the data subject.
The legal basis for data processing is Article 6 (1) point (f) GDPR. Our legitimate interest results from the data collection purposes listed above. The so-called ‘log files’ are deleted regularly after one week.
6. Registration on our website
The data subject can register on our website by providing personal data. The personal data transferred to the controller stem from the entry mask used for registration in each case. The personal data entered by the data subject are collected and stored for registration purposes only, unless stated to the contrary in this section 6. The verification of the valid pharmacy operating licence and the certificate of purchase for narcotics is carried out in order to confirm the authorisation to purchase certain products only available in pharmacies and is required as proof of legitimation on the basis of legal regulations.
The legal basis for the processing is Article 6 (1) point (b) GDPR inasmuch as the data are necessary for the conclusion and performance of the user agreement, and Article 6 (1) point (c) GDPR insofar as proof has to be submitted on the basis of legal regulations. Inasmuch as, eventually, registration as a user requires filling in information that is neither directly necessary for the performance of the agreement nor necessary for the controller to obtain in order to comply with its statutory obligations (in particular, as regards the data subject’s VAT ID), the collection and further processing of such personal data is based on the controller’s legitimate interest (1) to ensure that, in accordance with the Terms of Use, only entrepreneurs can successfully register for the services, and (2) to anticipatorily collect all information that would be required for the swift execution of possible future services (such as returning products received from manufacturers) (Art. 6 (1) point (f) GDPR).
To safeguard the security and confidentiality of the personal data which pharma mall Gesellschaft für Electronic Commerce GmbH collects online, the company safeguards the registration process by means of SSL encryption. SSL (Secure Socket Layer) is a protocol allowing secure data transfer via the internet. The controller can have the data transferred on to one or several processors who also use the personal data for internal purposes only. This usage is attributable to the controller.
When you register on the website, the system stores the IP address allotted by the data subject’s Internet service provider as well as the date and time of registration. The storage of these data helps to prevent abuse of our services. The data can also help to clear up crimes. They are never sent on to third parties unless there is a legal obligation to do so or forwarding the data would be helpful for the purposes of prosecution.
The legal basis for this processing is Article 6 (1) point (f) GPDR. Our legitimate interest in data processing results from the purposes described above.
When data subjects register and provide personal data, the controller is able to provide them with content or services which are only offered to registered users. The legal basis for this processing is GDPR Article 6 (1) point (b) GDPR, namely the performance of the user agreement. Only registered users are able to use the website to order products from the associated manufacturers. We hereby point out that ordering is only possible following the additional activation of this function by the manufacturer. The controller will automatically transmit to the respective manufacturer the data provided in the course of the registration procedure, in order to make such activation process as easy and swift as possible for all parties concerned and to avoid inconsistencies between the stored data sets. Such data may be transmitted either upon a request from the data subject for activation of such manufacturer’s shop, or, without the data subject’s individual request for activation, in accordance with a respective agreement between the controller and a manufacturer for the purpose of further accelerating activation procedures. Transmission will include all information provided during the registration procedure and, therefore, also the pharmacy operating licence and the certificate of purchase for narcotics. These transmissions are covered by a legitimate interest of the controller and the affected manufacturers for the reasons stated above (Art. 6 (1) point (f) GDPR).
The services provided by pharma mall Gesellschaft für Electronic Commerce GmbH include the e-mail information service allowing important manufacturer information to be transferred to our registered users, for example “blue hand information”, “red hand information”, obligatory information approved by the German Federal Institute for Drugs and Medical Devices (BfArM), recall campaigns, delivery availabilities, risk of confusion or danger warnings (danger for life and limb). The e-mail information service does not contain any manufacturer advertising. We process the contact data submitted and any preferences specified.
The legal basis for this processing is GDPR Article 6 (1) point (b) GDPR, namely the performance of the user agreement.
7. E-Mail information services
As part of its information service, pharma mall Gesellschaft für Electronic Commerce GmbH sends e-mails to registered users of the platform. These e-mails are part of e-mail activities according to the services promised in the General Terms and Conditions, for example red/blue hand information and recall activities of the manufacturers. In this sense, the legal basis for sending is Article 6 (1) point (b) GDPR. In addition, as a result of its legitimate interest in informing its users about newly activated webshops on the platform or new functions of the platform itself, pharma mall Gesellschaft für Electronic Commerce GmbH sends information to this effect to registered users. This is done on the basis of Article 6 (1) point (f) GDPR.
The e-mails belonging to the aforementioned information services of pharma mall Gesellschaft für Electronic Commerce GmbH are sent with the help of the services of rapidmail GmbH, Freiburg, as a processor working on behalf of pharma mall Gesellschaft für Electronic Commerce GmbH. The e-mails contain so-called “counting pixels”. A counting pixel is a miniature pixel embedded in e-mails sent in the HTML format to permit log file recording and analysis. This allows success or failure of online marketing campaigns to be evaluated statistically. With the help of the embedded counting pixel, pharma mall Gesellschaft für Electronic Commerce GmbH can detect whether, and if so when, an e-mail was opened, and which links in the e-mail were selected. These counting pixels are only active when the user’s e-mail client loads images from e-mails (some persons block external images for security reasons or refrain from loading them in order to save bandwidth, for example on mobile terminal devices).
The personal data collected in this way are stored and evaluated by pharma mall Gesellschaft für Electronic Commerce GmbH in an aggregated statistical form only. This is done with the aim of optimising the information service and better adapting the content to the interests of the recipients in future. In other words, no evaluation is performed as to whether a certain data subject has viewed a certain e-mail or clicked on links in an e-mail. In contrast, the evaluation options of pharma mall Gesellschaft für Electronic Commerce GmbH are limited to detecting how many recipients in all and which percentage of the recipients opened an e-mail coming from the information service. The legal basis for this is Article 6 (1) point (f) GDPR. The merely statistical evaluation of e-mails helps us to improve our services. As individual persons are not referred back to and data are not transferred on to third parties, the interests of users, which are worthy of protection, are only affected to a minor degree and our interest in evaluation outweighs other interests. Lists of recipients are deleted 30 days after being sent.
8. Contact options provided on the website
The website of pharma mall Gesellschaft für Electronic Commerce GmbH contains an e-mail address, a fax number and a telephone number to allow you to contact our company and communicate directly with it.
Data subjects can also communicate with us using the contact form provided on the website. We can only respond to your request if you provide a valid e-mail address and a name in addition to the actual message and the subject line.
If a data subject makes contact with the controller by e-mail or using a contact form, the personal data transferred by the data subject are stored automatically. Personal data of this kind which have been transferred to the controller on a voluntary basis are only stored for the purposes of processing or contacting the data subject. These personal data are not transferred to third parties.
Data processing for the purpose of contacting us is performed according to Article 6 (1) point (a) GDPR on the basis of the consent given by the data subject, or according to Article 6 (1) point (b) GDPR in the sense that the reason for contacting us was a (pre-)contractual request directed towards us.
The personal data we process to allow use of the contact forms are deleted after the request is processed unless – in the case of (pre-)contractual requests – legal data retention obligations exist or come into being as a result of processing the request.
9. Chat widget
As an alternative to telephone and e-mail contact, pharma mall Gesellschaft für Electronic Commerce GmbH also offers users a chat function on the website of the controller. Here it is possible to communicate with the employees of the customer service of pharma mall Gesellschaft für Electronic Commerce GmbH.
If a data subject posts a comment in the chat provided on this website, not only the comments posted by this data subject are stored, but also information on the time at which the comment was posted and the user name (pseudonym) used by the data subject. The IP address assigned to the data subject by the Internet service provider is also logged.
Data processing for the purpose of contacting us is performed according to Article 6 (1) point (a) GDPR on the basis of the consent given by the data subject, or according to Article 6 (1) point (b) GDPR provided that the object of this is a (pre-)contractual request directed towards us. In exceptional cases such as instances in which a message communicated via the chat function includes unlawful content, we reserve the right to send messages of this kind on to the law enforcement authorities. The legal basis of any such possible transfer of data is Article 6 (1) point (f) GDPR, and our legitimate interest in data processing results from the purposes described above.
The personal data we process to allow use of the chat function are deleted after processing of the request, usually after 30 days, unless – in the case of (pre-)contractual requests – legal data retention obligations exist or come into being as a result of processing the request.
10. Facebook/Instragram
On the basis of Article 6 (1) point (f) GDPR, we place links to the social networks Facebook and Instagram on our website in order to present ourselves via these platforms and make ourselves more well-known. The underlying advertising function expressed here can be considered as a legitimate interest in terms of the GDPR.
For users from member states of the European Union, Facebook and Instagram are services provided by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Information on data protection on Facebook can be accessed under https://www.facebook.com/about/privacy/, and similar information for Instagram can be accessed under https://help.instagram.com/519522125107875?helpref=page_content. Additional information on the rights of the users and the available options for protecting their privacy can be found within these networks.
When a data subject visits our website, personal data of the users are initially not communicated to the operators of the social networks. Only when a data subject clicks on the marked field and opens the link does the operator in each case receive the information that a user has accessed the relevant website of our online presence. In addition, personal data (in particular the IP address) are transferred to the operator of the social network in each case.
In conjunction with Facebook, we are partly joint controllers as regards the data processing in connection with the presence of our company there. This is true in the sense that, when someone visits our Facebook page, Facebook collects data such as the IP addresses of the data subjects and other information present on the PCs of the data subjects in the form of cookies. This information is used to provide us as the operators of the Facebook pages with statistical information on access to those pages. Facebook provides more detailed information under the following link: http://de-de.facebook.com/help/pages/insights. Data subjects consent to evaluating their visit to our Facebook pages (also by us) in this way when they accept the conditions of use for Facebook (Article 6 (1) point (a) GDPR). However, we should point out that statistical evaluation does not allow us to make any inferences whatsoever with regard to concrete users.
In addition, we provide information on our own data processing activity on Facebook and Instagram in that we may react to your comments and assessments with comments of our own. For this purpose, we make use of our legitimate interest in interaction with active users of our presence in the social networks (Article 6 (1) point (f) GDPR). If you have questions of any kind, we offer you the option of contacting us via Facebook with the help of personal messages. The user name of the data subject within the social network is then communicated to us automatically (see also section 8).
On the basis of Article 6 (1) point (f) GDPR, we reserve the right to analyse information you publish as part of your profile on Facebook or Instagram. Evaluation of this kind corresponds with our legitimate interest in potentially making contact with you, adding you to our network or contacting you via Facebook or Instagram. It can also be performed for the purpose of starting a future customer or supplier relationship with you and your company.
11. XING
On the basis of Article 6 (1) point (f) GDPR, we place links to the social network XING on our website in order to present ourselves via this platform and make ourselves more well-known. The underlying advertising function expressed here can be considered as a legitimate interest in terms of the GDPR.
XING is a service offered by XING SE (“XING”), Dammtorstraße 30, 20354 Hamburg, Germany. You can access the up-to-date data protection information of XING in each case on the following website: https://privacy.xing.com/de/datenschutzerklaerung. There you will also find information on the rights of users and the setting options for protecting privacy within this network.
When a data subject visits our website, their personal data are initially not communicated to XING as the operator of the social network. Only when a data subject clicks on the marked field and opens the link does the operator in each case receive the information that a user has accessed the website of our online presence. In addition, personal data (in particular the IP address) are then communicated to the operator of the social network in each case.
We also provide information on our own data processing activity on XING in that your comments and assessments may prompt us to react to them with comments of our own. For this purpose, we have recourse to our legitimate interest in interaction with active users of our presence in social networks (Article 6 (1) point (f) GDPR). If you have questions of any kind, we give you the option of contacting us via personal messages on XING. When this happens, the user name of the data subject within the social network is communicated to us automatically (see also section 8).
We reserve the right to analyse, on the basis of Article 6 (1) point (f) GDPR, the information which you published on XING. Evaluation of this kind corresponds with our legitimate interest in potentially making contact with you, adding you to our network or contacting you via XING. It can also be performed for the purpose of starting a future customer or supplier relationship with you and your company.
12. LinkedIn
On the basis of Article 6 (1) point (f) GDPR, we place links to the social network LinkedIn on our website in order to present ourselves via this platform and make ourselves more well-known. The underlying advertising function expressed here can be considered as a legitimate interest in terms of the GDPR.
For users from member states of the European Union, LinkedIn is a service provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. Information on data protection on LinkedIn can be accessed under https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_join-form-privacy-policy#other_information, and similar information for Instagram can be accessed under https://help.instagram.com/519522125107875?helpref=page_content. Additional information on the rights of the users and the possible options for protecting their privacy can be found within these networks.
When a data subject visits our website, personal data are initially not communicated to LinkedIn as the operator of the social network. Only when a data subject clicks on the marked field and opens the link does the operator in each case receive the information that a user has accessed the website of our online presence. In addition, personal data (in particular the IP address) are then communicated to the operator of the social network in each case.
We also provide information on our own data processing activity on LinkedIn in that your comments and assessments may prompt us to react to them with comments of our own. For this purpose, we have recourse to our legitimate interest in interaction with active users of our presence within social networks (Article 6 (1) point (f) GDPR). If you have questions of any kind, we give you the option of contacting us via personal messages on LinkedIn. When this happens, the user name of the data subject is automatically communicated to us within the social network (otherwise see section 8).
We reserve the right to analyse, on the basis of Article 6 (1) point (f) GDPR, the information which you published on LinkedIn. Evaluation of this kind corresponds with our legitimate interest in potentially making contact with you, adding you to our network or contacting you via LinkedIn. It can also be performed for the purpose of starting a future customer or supplier relationship with you and your company.
13. Rights of the data subject
You have the following rights:
We are only permitted to refuse to give you information if this would reveal data which must be kept secret according to or following a legal regulation, in particular due to the overriding legitimate interests of a third party (§ 29 (1) clause (2) of the Federal Data Protection Act (BDSG)) and the public body responsible has notified us that revealing the data would endanger public safety or public order or would otherwise impair the well-being of the Federal Republic or of a Land within it (§ 34 (1) no. 1 of the Federal Data Protection Act (BDSG) in connection with § 33 (1) no. (2) point (b) BDSG). This also applies if the data are only stored because legal or statutory storage regulations do not allow them to be deleted. It is also the case if the data only serve the purpose of safeguarding data or verifying data protection, providing information would require unjustified effort and processing for other purposes is ruled out due to the use of suitable technical or organisational measures (§ 34 (1) no. (2) of the Federal Data Protection Act (BDSG)).
If your personal data are processed on the basis of legitimate interests according to Article 6 (1) point (f) GDPR, Article 21 GDPR gives you the right to object to processing of personal data concerning you, on grounds relating to your particular situation or your objection is aimed towards direct marketing. In the latter case, you have a general right to object without specifying a particular situation which we will implement.
If you wish to make use of your right to object, it is sufficient to send an e-mail to datenschutz@pharma-mall.de.
You also have a general right to lodge a complaint with the competent data protection supervision authority. The address of the competent authority in our case is
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestr. 2 - 4
40213 Düsseldorf
Tel.: +49-(0)211/38424-0
Fax: +49-(0)211/38424-10
E-mail: poststelle@ldi.nrw.de
14. Statutory or contractual requirements for the provision of personal data
We hereby notify you that the provision of personal data is in part legally prescribed (for example in the form of tax regulations) or can result from contractual arrangements (for example information on the contract partner). The conclusion of a contract can at times require a data subject to provide us with personal data which we then have to process. To conclude a contract, the data subject is obliged to provide us with personal data. If the data subject does not provide his or her personal data, it is not possible to conclude a contract with the data subject. Before providing personal data, the data subject can contact our data protection officer.
In individual cases, our data protection officer notifies the data subject as to whether there is a statutory or contractual requirement for the provision of personal, or whether it is necessary in order to enter into a contract, whether the data subject is obliged to provide the personal data, and which consequences it would have if the data subject failed to provide such data.
15. Automated decision-making
Our company does not use automatic decision-making or profiling of any kind.
Valid as of: 10. Dezember 2020