I. NAME AND ADDRESS OF THE COMPANY RESPONSIBLE
The legal entity responsible in the sense of the General Data Protection Regulation and other national data protection laws in member states as well as further data protection regulations is:
At Winkfield House
Western Cape | South Africa
36 Scholtz Road | Somerset West 7130
Tel +27 82 455 72 35
info@winkfieldhouse.com
www.winkfieldhouse.com
II. GENERAL INFORMATION ABOUT DATA PROCESSING
1. EXTENT OF PERSONAL DATA PROCESSING
In general, we collect and process personal data concerning our users only insofar as it is necessary to provide a functioning website for our contents and service. The collection and use of the personal data concerning our users is reviewed regularly but only with the consent of the user concerned. There is one exception in those cases where it is not possible to obtain prior consent for practical reasons and the processing of the data is allowed by legal regulations.
2. LEGAL BASIS FOR PROCESSING PERSONAL DATA
Art. 6 §1 a) of the EU-Data Protection Basic Regulations (DSGVO) serves as the legal basis for processing personal data insofar as we obtain prior consent from the person concerned for processing personal data concerning them.
Art. 6 §1 b) DSGVO serves as the legal basis when processing personal data necessary to comply with a contract to which the data subject is party. This is also true for the processing necessary for the implementation of pre-contractual measures.
Art. 6 §1 c) DSGVO serves as the legal basis should it be necessary to process person-related data to comply with legal obligations to which our company is subject.
Art. 6 §1 d) DSGVO serves as the legal basis should vital interests of the person concerned or another natural person make person-related processing necessary.
Art. 6 §1 f) DSGVO is to serve as the legal basis for the processing should the processing be necessary for the protection of a legitimate interest of our company or a third party and should the interests, civil rights and fundamental freedoms of the person concerned not outweigh the first mentioned interest.
3. DATA ERASURE AND DATA STORAGE
The personal data of the person concerned will be erased or blocked as soon as the original purpose for storing the data no longer exists. Further storage of the data may be permitted beyond that if provision has been made for this by the European Commission or national legislation in European Union regulations, laws or other requirements to which the responsible service provider is subject. The blocking or erasure of the data also occurs if the retention period covered by one of the standards already mentioned has expired unless necessity for further data storage for concluding or fulfilling a contract exists.
III. AVAILABILITY OF THE WEBSITE AND CREATION OF LOG FILES
1. DESCRIPTION AND SCOPE OF THE DATA PROCESSING
Every time our internet website is contacted, our system registers the automated data and information of the computer system of the visiting computer.
The following data will be collected on this occasion:
- Information about the type of browser and the version used
- The user’s operating system
- The user’s IP address
- The date and time of access
The data is also stored in the log files of our system. This data is not stored in connection with any other personal data of the user.
2. LEGAL BASIS FOR DATA PROCESSING
The legal basis for temporarily storing the data and the log files is Art. 6 §1 f) DSGVO.
3. PURPOSE OF DATA PROCESSING
The temporary storage of the IP address by the system is necessary to allow the website to be delivered to the user’s computer. To do this, the user’s IP address has to be stored for the duration of the session.
The log file storage is to ensure the website functions properly. In addition, the data serves to optimise the website and to ensure the safety of our information technology systems. The data is not evaluated for marketing purposes in this connection.
For these purposes, our interest in processing the data is justified according to Art. 6 §1 f) DSGVO.
4. DURATION OF STORAGE
The data is erased as soon as the purpose for its collection has been achieved and it is no longer needed. As far as collecting the data in order to deliver the website is concerned, this is as soon as the individual session is over.
In the case of data storage in log files, this is the case after 180 days at the latest. Storing the data over and above this period is possible. In this case, the user’s IP addresses are deleted or distorted so that it is no longer possible to assign them to the client visiting the website.
5. POSSIBILITY FOR OBJECTION AND REMOVAL
The collection of data to provide access to the website and the storage of data in log files is mandatory for operating the website. Consequently the user is not able to appeal against it.
IV. CONTACT FORM AND E-MAIL CONTACT
1. DESCRIPTION AND SCOPE OF THE DATA PROCESSING
There is a contact form on our website which can be used for contacting us electronically. If a user takes advantage of this contact form, then the data entered in the input mask will be transmitted to us and stored. In addition the following data is stored when the message is transmitted:
- the IP-address of the user
- the date and time it was sent
Alternatively, it is also possible to contact us by using the e-mail address provided. In this case, only the personal user data transmitted with the e-mail is stored.
In this context, no data will be passed on to a third party. The data will be only used for the further processing of the mail contact.
2. LEGAL BASIS FOR THE DATA PROCESSING
The legal basis for processing data arising when a message is transmitted to us is Art. 6 §1 f) DSGVO as well as Art. 6 §1 b) DSGVO.
3. REASON FOR THE DATA PROCESSING
Processing personal data concerning you in the input mask or e-mail serves solely to contact you and process your enquiry.
The other personal data processed when the e-mail is transmitted only serves to prevent abuse of the contact form and to ensure the safety of our information technology system and this provides the necessary justified interest for the processing of the data.
4. DURATION OF DATA STORAGE
The data is erased as soon as it is no longer needed to achieve the purpose for which it was collected. This is the case for personal data concerning you which was entered in the input mask of the contact form as well as the data transmitted by e-mail when the contact or e-mail conversation with the user is over. The conversation is then over when the circumstances indicate that the issues have been resolved.
The personal data additionally collected when the message was transmitted is erased at the latest after a period of seven days.
5. OPTION TO OBJECT AND REMOVE
The user can at any time revoke his consent to processing personal data. If the user contacts us by e-mail, he may at any time object to the storage of personal data concerning him. In such a case it is not possible to continue the e-mail conversation.
Both in this connection as well as for other questions dealing with personal data concerning them, users may contact us at any time under the address given in Paragraph 1 of this declaration or they can send a direct message to info@winkfieldhouse.com senden.
In this case, all personal data stored during this contact will be erased.
V. SOCIAL MEDIA
Via our social media pages (Facebook, Instagram, Twitter, Google+), we also provide you with extensive personal support and the ability to stay in contact with us. These social media services also collect their own personal data, for example via the profile you created there or via so-called social plug-ins which are implemented in websites of third parties.
If you send us an enquiry using one of these social media, it will be treated confidentially. The data will only be used for answering your question.
To be able to contact us via social media, you have to register yourself with these services. When you do this, the company responsible for the service in question will also collect, store and use personal data. We have no influence on the kind of data, the scope and the processing of this data. The same is also true for pictures/videos uploaded into social media. Please note that the rights for these where applicable are also transferred to the social media services. The details are to be found in the terms of the privacy policy and terms of use of the respective provider.
VI. LEGAL RIGHTS OF THE PERSON CONCERNED
When personal data concerning you is processed, you are an affected person in the sense of the DSGVO and you therefore have the following legal rights:
1. RIGHT TO INFORMATION
You can request confirmation from the person responsible as to whether personal data concerning you is being processed by us.
Should such processing have occurred, you can request the following information from the person responsible:
(1) The reasons why personal data is being processed;
(2) The categories of personal data which are being processed;
(3) The recipient or the categories of recipients to whom the personal data concerning you has been disclosed or is still to be disclosed;
(4) The duration of the storage planned for the personal data in question or, if definite particulars here are not available, the criteria for determining the duration of storage;
(5) The existence of a right to rectification or erasure of the personal data concerning you, a right to restrict the processing by the person responsible or a right of objection to the processing;
(6) The existence of a right to complain to a regulatory body;
(7) All available information about the origin of the data if the personal data has not been collected from the person concerned;
(8) The existence of an automatic decision-making system including profiling according to Art. 22 §1 and 4 DSGVO and – at least in these cases – convincing information about the logic involved as well as the impact and desired scope of such processing for the person concerned.
You have the right to request information about whether the personal data in question has been transmitted to a third country or an international organisation. According to Art. 46 DSGVO, in this connection you can also request suitable guarantees concerning information about the transmission.
2. RIGHT OF RECTIFICATION
You have a right to rectification and/or completion vis-à-vis the person responsible, insofar as the processed personal data concerning you is wrong or incomplete. The person responsible has to make the corrections promptly.
3. RIGHT TO RESTRICT THE PROCESSING
Under the following conditions you can request the restriction of the processing of the personal data concerning you:
(1) If you contest the accuracy of the personal data concerning you for a period which allows the person responsible to check the accuracy of the personal data;
(2) If the processing is unlawful and you refuse to have the personal data erased, but instead request the use of the personal data to be restricted;
(3) If the person responsible no longer needs the personal data for processing purposes, but you need them however for the establishment, exercise and defence of legal claims, or
(4) If you filed an objection to the processing according to Art. 21 §1 DSGVO and it has not yet been determined whether the justified reasons of the person responsible outweigh your reasons.
Should the processing of the personal data concerning you be restricted, then this data – apart from its storage – may only be processed with your permission or for the establishment, exercise and defence of legal claims or to protect the rights of another natural or legal person or for reasons of substantial public interest of the European Union or a Member State
Should the restriction on processing be restricted according to the above-mentioned conditions, then you would be informed by the person responsible before the restriction is lifted.
4. RIGHT TO ERASURE
a) OBLIGATION TO ERASE
From the person responsible you can demand that the personal data concerning you is erased immediately and the person responsible is obliged to erase the data immediately as long as one of the following reasons applies:
(1) The personal data referring to you is no longer needed for the purposes for which it was collected or otherwise processed.
(2) You revoke your consent which was the basis for the processing according to Art. 6 §1 a) or Art. 9 §2 a) DSGVO and there is no other legal basis for the processing.
(3) You object to the processing according to Art. 21 §1 DSGVO and there are no overriding justifiable reasons for the processing, or you file an objection to the processing according to Art. 21 §2 DSGVO.
(4) The personal data concerning you has been processed unlawfully.
(5) The erasure of the personal data concerning you is necessary to comply with a legal obligation according to European Union law or the law of the Member States to which the person responsible is subject.
(6) The personal data concerning you was collected in connection with services provided by the information society according to Art. 8 §1 DSGVO.
b) INFORMATION PASSED ON TO THIRD PARTIES
If the person responsible has publicised personal data concerning you and if he is obliged to erase it according to Art. 17 §1 DSGVO, he has to take suitable measures, also technical, and taking the technology available and the costs of implementation into consideration, to inform the person responsible for the data processing that you as the person concerned demand from him the deletion of all links to this personal data or the copies or replications of this personal data.
c) EXCEPTIONS
The right to deletion does not exist as long as the processing is needed:
(1) To exercise the right to free speech and information;
(2) To comply with a legal obligation which requires the processing to be in accordance with European Union law or law of a Member State, to which the person responsible is subject, or the performance of a task in the public interest, or in the exercise of public authority vested in the person responsible;
(3) For reasons of public interest in the field of public health according to Art. 9 §2 h) and i) as well as Art. 9 §3 DSGVO;
(4) For reasons of public interest in the field of archive, scientific or historical research purposes or for statistical purposes according to Art. 89 §1 DSGVO, insofar as the right mentioned in section a) is likely to make achieving these objectives impossible or seriously compromised,
(5) Or for the establishment, exercise or defence of legal claims
5. RIGHT TO BE INFORMED
If you have exercised your rights to the rectification, erasure or restriction of data processing concerning you vis-à-vis the person responsible, he/she is obliged to inform all recipients to whom the personal data concerning you was disclosed about this rectification, erasure or restriction of the data processing, unless this should prove to be impossible or involving disproportionate efforts.
The person responsible shall have the right to be informed of such recipients.
6. RIGHT TO DATA PORTABILITY
You have the right to receive the personal data concerning you, which had been provided by you to the person responsible, in a structured, common and machine-readable format. In addition, you have the right to pass this data on to another person in charge without obstruction from the person responsible to whom the personal data was originally given, provided that:
(1) The processing is based on consent according to Art. 6 §1 a) DSGVO or Art. 9 §2 a) DSGVO or on a contract according to Art. 6 §1 b) DSGVO;
(2) The processing is effected by means of automated methods.
In exercising this right, you also have the right to request that the personal data concerning you be transferred directly from one person responsible to another person responsible, insofar as this is technically feasible. Freedoms and rights of other persons may not be affected by this.
The right of data portability is not only valid for the processing of personal data necessary for performing a task that lies in the public interest or in the exercising of public authority conferred on the person responsible.
7. RIGHT TO OBJECT
You have the right, for reasons which arise from your special situation, to object at any time on the basis of Art. 6 §1 e) or f) DSGVO to the processing of the personal data concerning you which has taken place; this is also true for a profiling which is based on these provisions.
The person responsible does not process the personal data concerning you unless he can establish compelling legitimate reasons for the processing which outweigh your interests, rights or freedoms, or the processing serves the establishment, exercising or defence of legal claims.
Should the personal data concerning you be processed to engage in direct advertising, you have the right at any time to object to the processing of the personal data concerning you for the purpose of such advertising; this is also true for profiling, insofar as it is connected to such direct advertising.
If you object to the processing for purposes of direct advertising, then the personal data concerning you will no longer be used for these purposes.
You are also able to make use of your right of objection by means of automated procedures in connection with using the services of the information society – notwithstanding directive 2001/58/EG – where technical specifications are used.
8. RIGHT TO WITHDRAWAL OF THE DATA PROTECTION DECLARATION OF CONSENT
You have the right at any time to withdraw your data protection declaration of consent. By withdrawing your consent, the legality of the processing carried out based on your consent up to its withdrawal is not affected.
9. AUTOMATED DECISION ALSO ON A CASE-BY-CASE BASIS INCLUDING PROFILING
You have the right not to be subject to a decision based exclusively on automated processing – including profiling – which can result in a legal effect or compromise you badly in a similar way. This is does not apply if the decision is:
(1) Necessary for the conclusion or fulfilment of a contract between you and the person responsible;
(2) Permissible based on the legal regulations of the European Union or the Member States to which the person responsible is subject, and these legal regulations contain suitable measures to guarantee your rights and freedoms as well as your legitimate interests; or
(3) Concluded with your express consent.
However, these decisions may not be based on special categories of personal data according to Art. 9 §1 DSGVO, as long as Art. 9 §2 a) or g) do not apply and suitable measures to protect your rights and freedoms as well as your justified interests are taken.
With regard to the cases mentioned in (1) and (3), the person responsible is to take suitable measures to guarantee your rights and freedoms as well as your justified interests, whereby at least the right to obtain the intervention of a person by the person responsible, to present one’s own point of view and to challenge the decision should be included
10. RIGHT TO MAKE A COMPLAINT TO A SUPERVISORY BODY
Irrespective of any other administrative or legal remedies, you retain the right to complain to a supervisory body, especially in the Member State of your place of residence, workplace, or the place of the presumed infringement, if you are of the opinion that the processing of the personal data concerning you is an infringement of the DSGVO
The supervisory authority which accepts the complaint will inform the complainant about the status and results of the complaint including the possibility of legal action according to Art. 78 DSGVO.
VII. USING COOKIES
a) Description and scope of the data processing
Our website uses cookies. Cookies are text files which are stored in the internet browser or by the internet browser on the user’s computer system. While visiting a website, a cookie can be stored on the user’s operating system. This cookie contains a distinguishing string of characters which allows the browser to be identified explicitly the next time the website is visited.
We also use cookies on our website which allow the user’s surfing habits to be analysed.
In this way, the following data can be transmitted:
- Search terms entered
- Frequency of visits to website
When using our website, the user is informed about the use of cookies for analytic purposes and the user’s consent to the processing of his personal data in this connection obtained. In this context a reference is also made to this privacy statement.
b) Legal basis for the data processing
The legal basis for the processing of personal data using cookies for analytic purposes is the existence of the user’s consent concerning this matter according to Art. 6 §1 a) DSGVO.
c) Reason for processing the data
The reason for using analysis cookies is to improve the quality of our website and its contents. By using analysis cookies, we can find out how the website is used and thus continually optimise what we offer.
The exact use of the individual analysis cookies can be found in the above table. For these reasons we have a justified interest in processing personal data according to Art. 6 §1 f) DSGVO.
e) Duration of storage; Objection and removal possibility
Other cookies are stored on the user’s computer and transferred from it to our website. Most of the cookies used by us are so-called “session cookies”. They are automatically deleted at the end of the session. The storage period of the further analysis cookies can be found in the table under III. a).
As a user you also have complete control of how the cookies are used. By altering the settings in your internet browser you can deactivate or restrict the transference of cookies. Cookies already stored there can be deleted at any time. This can be done automatically. If you deactivate the cookies for our website, then it is possible that you may not be able to use all the website functions to their fullest extent.