17. Data protection information for our Facebook fan page

 

We operate a so-called Facebook fan page on the social media platform Facebook. Facebook Ireland Ltd (“Facebook”) provides us as the operator with “Facebook Insights”. These are various statistics that provide us with information about the use of our Facebook fan page by visitors. Further information can also be found at https://www.facebook.com/business/pages/manage#page_insights .

 

Various information provided by you (including personal data) is processed by Facebook in order to create these statistics.

 

With regard to the processing of the Insights data, there is a joint responsibility between Facebook and us within the meaning of Art. 26 GDPR. For detailed regulation of the respective responsibility, Facebook has created an updated Page Insights supplement, which came into force on November 28, 2019 and will apply to the further use of Facebook pages from this date.

 

We make this information from Facebook available to you in the wording below in the course of the required transparency; You can also find this directly on Facebook at https://www.facebook.com/legal/terms/page_controller_addendum .

 

* * *

Information about page insights

 

When people use Facebook products such as pages, Facebook (also "we" or "us") collects information as described in the Facebook data policy under "What types of information do we collect?" (Information on how we use cookies and similar Use technologies, see our cookie policy ).

 

This includes information about how people use Facebook products, such as the types of content they view or interact with, or the actions they take (see “Things You and Others Do and Provide” below "In the Facebook data guideline ), as well as information about the devices used by you (e.g. IP addresses, operating system, browser type, language settings, cookie data; see under" device information "in the Facebook data guideline ). The information Facebook actually collects depends on whether and how people use Facebook products .

 

As explained in the Facebook data policy under “How do we use this information?”, Facebook also collects and uses information to provide analysis services, so-called page insights , for website operators so that they can obtain information about how people use their pages and with interact with the content associated with them. The processing of personal data for Page Insights may be subject to the following agreement on joint responsibility (Page Insights supplement regarding the person responsible).

 

Data processing for page insights

Page insights are aggregated statistics that are created based on specific events that are logged by the Facebook servers when people interact with pages and the content associated with them.

 

Such events consist of different data points, which, depending on the respective event, include, for example, the following:

 

• An act. This includes, for example, the following actions (you can see the actions available for your page in the Insights section of your page):

  • View a page, post, video, story, or other content related to a page

  • Interact with a story

  • Subscribe or no longer subscribe to a page

  • Mark a page or post with "Like" or "Dislike"

  • Recommend a page in a post or comment

  • Comment on, share, or respond to a page post (including how you respond)

  • Hide a post or report it as spam

  • Move the mouse over a link to a page or the name or profile picture of a page to preview the content of the page

  • Click the website, phone number, "plan route" button, or any other button on a page

  • See the event on a page, respond to an event (including the type of response), click an event ticket link

  • Start a Messenger conversation with the site

  • View or click on items in a side shop

• Information about the action, the person who performed the action and the browser / app used for it. These are for example:

  • Date and time of the action

  • Country / City (estimated using the IP address or imported from the user profile for logged-in users)

  • Language code (from the HTTP header of the browser and / or the language setting)

  • Age / gender group (from the user profile, only for logged in users)

  • Previously visited websites (from the browser's HTTP header)

  • Whether the action was carried out on a computer or on a mobile device (from the browser user agent or from app attributes)

  • Facebook user ID (only for logged in users)

We use cookies that we use in accordance with our cookie policy to determine whether the person is a logged-in Facebook user. Only a few events can be triggered by people who are not logged into Facebook. This includes visiting a page or clicking a photo or video in a post to view it.

 

Site operators do not have access to the personal data that is processed in the context of events, but only to the summarized page insights. Events that are used to create page insights do not save any IP addresses, cookie IDs or any other identifiers that are assigned to people or their devices, except for a Facebook user ID for people logged into Facebook.

The events that Facebook logs in order to create page insights are exclusively determined by Facebook and cannot be set up, changed or otherwise influenced by the website operator.

 

Page insights supplement regarding the person responsible

If an interaction of people with your Page and the content connected to it triggers the creation of a Page Insights event that contains personal data that you (and / or any third party for whom you create or manage the Page) the Determine the means and purposes of the processing together with Facebook Ireland Limited, you acknowledge in your own name (and as a representative for and on behalf of each such third party) and agree that this Page Insights supplement regarding the person responsible ("Page Insights supplement "):

 

• You and Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbor, Dublin 2, Ireland (“Facebook Ireland”, “we” or “us”; together the “parties”) acknowledge and agree to be jointly responsible according to Article 26 DSGVO for the processing of this personal data in events for page insights ("Insights data"). The joint responsibility includes the creation of these events and their consolidation in page insights, which are then made available to the page operators. The parties agree that Facebook Ireland and, if applicable, you, will remain independent and responsible for any other processing of personal data in connection with a page and / or the content connected to it, for which no joint decision is made on the purposes and means .

• The processing of the Insights data is subject to the provisions of this Page Insights Supplement. These apply to all activities in the course of which Facebook Ireland, its employees or its processor (s) process Insights data.

• With regard to the fulfillment of the obligations under the GDPR by Facebook Ireland and you with regard to the processing of Insights data, the following is stipulated:

  • Facebook Ireland: Facebook Ireland ensures that it has data Insights a legal basis for the processing of that in the data directive set out by Facebook Ireland (see "What is our legal basis for the processing of data?"). Unless otherwise stated in this page insights supplement, Facebook Ireland assumes the fulfillment of the obligations under the GDPR for the processing of Insights data (including Articles 12 and 13 GDPR, Articles 15 to 21 GDPR, Articles 33 and 34 GDPR) . Facebook Ireland takes appropriate technical and organizational measures in accordance with Article 32 GDPR to ensure the security of processing. This includes the measures listed in the annex below (this will be updated from time to time to take into account, for example, technological developments). All Facebook Ireland employees involved in processing the Insights data are obliged to maintain the confidentiality of the Insights data by means of suitable agreements.

  • Site operator: You should make sure that you also have a legal basis for processing the Insights data. In addition to the information that Facebook Ireland provides to the data subjects via the information on page insights , you should provide your own legal basis, if applicable including the legitimate interests you are pursuing, the responsible person (s) on your page, including his / her your contact details, as well as the contact details of the data protection officer (Article 13 Paragraph 1 lit. a - d GDPR), if relevant.

• Facebook Ireland provides the data subjects with the essentials of this page insights supplement (Article 26 (2) GDPR). This is currently done using the information on Page Insights data, which can be accessed from all pages.

• Facebook Ireland will determine, in its sole discretion, how to perform its obligations under this Page Insights Addendum. You acknowledge and agree that only Facebook Ireland is authorized to implement decisions regarding the processing of Insights data. You also acknowledge and agree that the Irish Data Protection Commission is the lead supervisory authority for the joint processing (without prejudice to Article 55 (2) GDPR, as applicable).

• This Page Insights supplement does not grant you the right to request the disclosure of personal data processed in connection with Facebook products from Facebook users. This applies in particular to the page insights that we provide to you.

• The parties specify the contact options specified in the information on Page Insights data or in a subsequent document as a contact point for data subjects.

• If data subjects assert their rights against you according to the GDPR with regard to the processing of Insights data (Article 26 Paragraph 3 GDPR) or a supervisory authority contacts you with regard to the processing of Insights data (each a "request"), you are obliged to forward all relevant information about such inquiries to us immediately, but at the latest within seven calendar days. For this purpose you can submit this form . Facebook Ireland undertakes to answer inquiries from data subjects in accordance with the obligations incumbent on us under this Page Insights Supplement. You agree to use all reasonable endeavors in a timely manner to cooperate with us in responding to any such request. You are not authorized to act or respond on behalf of Facebook Ireland.

• By using any site, you agree that any claim, claim, or dispute you may have against us that arises out of or is related to this Site Insights Supplement shall be resolved solely by the courts of Ireland, that you will irrevocably submit to the jurisdiction of the Irish courts in any litigation regarding any such claim and that this Page Insights Supplement will be governed by Irish law, regardless of any conflict of laws provisions. If you are a consumer with permanent residence in a member state of the European Union, only section 4.4 of our Terms of Use applies.

• We may update this Page Insights Supplement from time to time. By continuing to use the Pages after any notification of an update to this Page Insights Supplement, you consent to be bound by it. If you do not agree to the updated Page Insights Supplement, please stop using any of the Pages. If you are a consumer with permanent residence in a member state of the European Union, only Section 4.1 of our Terms of Use applies.

• If any part of this Page Insights Supplement is found to be unenforceable, the remaining provisions will remain in full force and effect. Failure on our part to enforce any part of this Page Insights Supplement does not constitute a waiver of rights. Any change or waiver of these Terms of Use that you request must be made in writing and signed by us.

• This page insights supplement only applies to the processing of personal data within the scope of Regulation (EU) 2016/679 ("GDPR"). "Personal data", "processing", "controller", "processor", "supervisory authority" and "data subject" have the meanings assigned to them in the GDPR in this Page Insights supplement.

 

Appendix: Security

"Covered Products" includes Facebook Pages and Page Insights.

1. Organization of information security
   Facebook has a dedicated security officer who has overall responsibility for security in the organization. Facebook has staff responsible for monitoring the safety of the products it covers.

2. Physical and environmental security
   The security measures from Facebook include controls to be in place to ensure an appropriate manner that the physical access to the data processing devices only to authorized personnel only and that environmental controls are set up to detect damage due to environment-related hazards, to prevent and control them. The controls include:

   1. Logging and checking of physical access to the data processing facility by employees and service providers;

   2. Camera surveillance systems on the respective data processing device;

   3. Systems that monitor and control temperature and humidity for the computer systems in the data processing facility;

   4. Power supply and emergency power generators in the data processing device;

   5. Procedures for the secure deletion and destruction of data in accordance with the terms of use for the products covered; and

   6. Procedures that require ID cards to enter all Facebook premises for all persons who work on the products covered.

3. staff

   1. Training. Facebook ensures that all personnel with access to Insights data complete security training.

   2. Screening and background checks. Facebook is holding proceedings

      1. Verifying the identity of those who have access to Insight data, and

      2. To the extent permitted by law, to conduct background checks in accordance with Facebook standards for staff working on or assisting aspects of the Covered Products.

   3. Violation of safety by employees. In the event of unauthorized access to Insights data by Facebook staff, Facebook will take disciplinary action, from sanctions to termination, as far as this is legally permissible.

4. Security tests
   Facebook regularly conducts security and vulnerability tests to assess whether key controls are properly implemented and effective.

5. Access controls

   1. Password management. Facebook has developed password management procedures for its staff to ensure that passwords are tied to the respective person and inaccessible to unauthorized persons. These procedures include at least the following:

      1. Provision of passwords, including procedures for verifying the identity of the user before a new, replacement or temporary password is issued;

      2. cryptographic protection of passwords when stored on computer systems or during transmission over the network;

      3. Change of all default third party passwords;

      4. strong passwords relative to their intended use; and

      5. Best practice training on passwords.

   2. Access management. In addition, Facebook uses the following measures to control and monitor access to its systems by its staff:

      1. Procedure for the immediate change and revocation of access rights and user IDs;

      2. Procedure for reporting and revoking compromised credentials (passwords, access tokens, etc.);

      3. Keeping suitable security logs, if necessary with user ID and time stamp;

      4. Synchronization of clocks using NTP; and

      5. Logging of at least the following events in user access management:

         • Changes to authorization;

         • Failed and successful authentication and access attempts; and

         • Reads and writes.

6. Communication security

   1. Network security

      1. Facebook uses technologies that meet industry standards for separating networks.

      2. Remote network access to Facebook systems requires the use of encrypted communication via secure protocols and the use of multi-level authentication.

   2. Protection of data during transmission. Facebook enforces the use of suitable protocols to protect the confidentiality of data when it is transmitted over public networks.

7. Vulnerability management
   Facebook has a vulnerability management program that also includes the products it covers. This also includes defining roles and responsibilities for monitoring vulnerabilities, risk assessing vulnerabilities, and deploying patches.

8. Security Incident Management

   1. Facebook maintains a security incident response plan with which it monitors, detects and processes possible security incidents that affect Insights data. The response plan for security incidents includes at least the definition of roles and responsibilities, communication and post-mortem reviews, including root cause analyzes and remediation plans.

   2. Facebook monitors its systems for possible security breaches and malicious activities affecting Insights data.

 

* * *

 

Below you will find the essential information of the agreement concluded between Facebook and us in accordance with. Art. 26 GDPR.

For the processing are jointly responsible

 

Facebook Ireland Ltd
4 Grand Canal Square
Dublin 2
Ireland

 

and

 

DRIVE Consulting GmbH

Bachstrasse 20

52066 Aachen

Germany

Tel: +49 241 51 88 65 10

info@drive-consulting.de

www.drive-consulting.de

 

Facebook has assumed primary responsibility for all obligations under the GDPR for data processing. This means in particular:

 

• Facebook takes on the necessary information obligations (e.g. in accordance with Art. 13 GDPR),

• Affected rights can be asserted against Facebook (e.g. right to information or deletion, objection to data processing or revocation of a given consent),

• Ensuring the technical and organizational measures for data processing.

Facebook provides detailed information about data processing at https://www.facebook.com/ (Art. 13 GDPR). In order to provide you with an overview of the essential information, we also refer to the content provided and the links provided by Facebook in this data protection notice.

 

Regardless of Facebook's primary responsibility, you can exercise your rights in accordance with You can also assert GDPR directly against us. We will then forward your request to Facebook using a form provided for this purpose.

The legal bases and the purposes of processing by Facebook can be found at https://www.facebook.com/about/privacy/legal_bases and https://de-de.facebook.com/policy.php .

 

We have a legitimate interest in being able to understand user behavior on our Facebook fan page; accordingly, the legal basis for processing the data is Art. 6 Para. 1 lit. f GDPR. In this way, it is possible for us to record the range and effectiveness of our activities such as campaigns and postings using prepared statistics. So we can - which also according to GDPR represents the purpose of processing - continuously optimize our website and our offer as required.

 

In particular, Facebook can process the following data:

 

• User interaction, such as click behavior, postings, likes, viewing videos, page views, etc.

• Cookies

• Demographic characteristics such as age, gender, state, etc.

• IP address

• System and device information (browser type, operating system, etc.)

When you visit our Facebook fan page, the exact processing of your data depends on whether you have a Facebook account or not. If you have a Facebook account, Facebook can permanently assign the data to your account in order to find out more about you.

 

But even if you don't have a Facebook account, Facebook can save your data. This can be done through the use of cookies. This allows Facebook to save and process information about you, even without you having a Facebook account. You can find more information about Facebook cookies at https://de-de.facebook.com/policies/cookies/ .

 

We only receive anonymized statistics from Facebook about the use of our fan page. We can only see how many users have carried out which interactions, but not which user has carried out a specific action. The statistics of the Insights data therefore do not allow us to draw any conclusions about a specific person.

 

In an appendix to the information on page insights, Facebook also provides information on the technical and organizational measures taken in accordance with. Art. 32 GDPR to protect your data.

 

In cases of joint responsibility, you can assert your aforementioned rights directly against Facebook or us.

 

At https://de-de.facebook.com/policies/cookies/ you can also adjust your settings for the use of cookies. Under the sections "If you have a Facebook account" (Facebook account available) and "Public" (no Facebook account available) you will find information on how you can object to processing by Facebook.

You can determine the storage duration of the respective cookies via your browser when you display the cookies (usually by clicking on the "i" next to the address bar, e.g. in Firefox or Google Chrome).

 

Note on data transfer to the USA: The service provider is headquartered in the USA. In a judgment of July 16, 2020, the ECJ declared the agreement on the so-called EU-US Privacy Shield to be invalid (C-311/18).

We would like to point out that the USA is not a safe third country within the meaning of EU data protection law. US companies are obliged to surrender personal data to security authorities without you as the person concerned being able to take legal action against this. It cannot therefore be ruled out that US authorities (e.g. secret services) process, evaluate and permanently store your data on US servers for monitoring purposes. We have no influence on these processing activities.