Information obligations pursuant to Article 14 of the EU General Data Protection Regulation (hereinafter “GDPR”)

1. Person responsible for data processing/data protection officer

Responsible for the data processing is:

AZ Direct GmbH (hereinafter “AZ Direct”)
Carl-Bertelsmann-Str. 161s
33311 Gütersloh
Germany
Telephone: +49 5241 80-70800
Fax: +49 5241 80-9317
E-mail: az@bertelsmann.de

When reference is made below to “we” or “us”, this always refers to “AZ Direct”. We process your data on the basis of the provisions of the GDPR and the German Federal Data Protection Act 2018 (hereinafter “BDSG”). Of course, we have registered our data protection officer with the responsible data protection supervisory authority.

If you have any questions about data protection, you can also contact our data protection officer at any time. You can reach him by post, telephone or email at

AZ Direct GmbH
Data Protection Officer
Carl-Bertelsmann-Str. 161s
33311 Gütersloh
Germany
Phone: +49 5241 5274730
Fax: +49 5241 80-66909
E-mail: datenschutz@az-direct.com

2. What categories of your data are processed in dialog marketing?

We process consumer addresses and business addresses from the Federal Republic of Germany.

2.1 If available, we have stored the following address data from you:

First name, last name, street, house number, postal code, city, title, academic degree, year of birth, e-mail, telephone number, professional, industry or business name.

2.2 Furthermore, we may have stored criteria for advertising selection. You can find more information on this under section 3.1.

3. Processing purposes and their legal basis

3.1 We process the data referred to in section 2.1 in order to send you advertising from reputable companies (hereinafter referred to as “contractual partners”). Furthermore, the processing of your address data serves to enrich the address databases of our contractual partners. This processing is carried out on the basis of Art. 6 para. 1f GDPR, insofar as the respective processing is necessary to safeguard our legitimate interests or the legitimate interests of a third party, i.e. our respective contractual partner, and your interests in this regard or your fundamental rights and freedoms do not prevail. In the first step, dialog marketing requires address data with details of the available communication channels. The basis is either collected by the contractual partner itself, or provided by other market participants for whom we act as a list broker, or by us. The second step involves selecting the data of the addressees who could potentially be interested in the products and services advertised by our contractual partner. Our contractual partners therefore often order addresses on the basis of target groups. We carry out the necessary selection with regard to the data stored by us on the basis of anonymized data using our specially developed and patented Data Secure[hoch]TTP[/hoch] process. The aim of the selection is to select a group of addressees who share a potential interest in certain products or services. The desired addresses are selected or ordered from our address list on the basis of these target groups. This advertising selection is carried out using information (= selection characteristics) on gender and age, among other things, but also with the help of mathematical procedures and statistical probabilities as well as on the basis of structural information such as building type or age, micro and macro geography and market research results. The non-personal characteristics are used, for example, to make probability statements on socio-demographics and psychographics, consumer characteristics or phases of life. As part of the balancing of interests carried out by us, it was determined that your interests in excluding the selection do not outweigh our interests or the interests of our contractual partners in carrying out the selection. The selected addresses are updated and corrected to improve data quality. Finally, we compare the addresses against our in-house advertising objection list and against the advertising objection lists listed below. If the communication channels require consent, the consent status is checked.

We only use your address data for advertising purposes or only provide our contractual partners with your data mentioned under point 2 if a legitimate interest that outweighs your interests has been credibly demonstrated in individual cases. Recital 47 of the GDPR expressly clarifies that the processing of your data for the aforementioned purpose of direct marketing can be regarded as processing that serves a legitimate interest. With our aforementioned services, we ensure, in particular against the background of economic and ecological interests, that only those consumers who are potentially eligible for our contractual partner receive advertising. Your interests as the person affected by the advertising measure are adequately protected by the transparency requirement, your right to information and your right to object (see sections 7 and 8) as well as your other rights as a data subject. We also observe the Robinson lists (blocking lists) of the Deutscher Dialogmarketing Verband e.V. (DDV) www.ichhabediewahl.de and the I.D.I. Interessenverband Deutsches Internet e.V., Info- und Schutzgemeinschaft für Internet und Kommunikation, www.robinsonliste.de for every postal advertising mailing. If you are entered in one of these blacklists, you will not receive any advertising via AZ as the responsible body.

3.2 In addition, the processing of your address data serves to update and validate the address databases of our contractual partners and our own databases. This processing is carried out on the basis of Art. 6 para. 1 f GDPR. We only provide our contractual partners with the data mentioned under section 2.1 if they have credibly demonstrated a legitimate interest that outweighs your interests in individual cases. A legitimate interest in this sense is the obligation to ensure the “accuracy” of data as set out in Art. 5 para. 1 d GDPR. However, a legitimate interest also exists if our contractual partners wish to protect themselves from postage costs for presumably undeliverable mailings to non-existent or incorrectly recorded addresses.

3.3 Our AZ PICK procedure is used to verify the reachability/deliverability of a person at an address (statement of a probability value). AZ PICK “extends” the process of a simple postal address validation (building level) by checking whether a person can probably be reached at the requested address (person level). For this purpose, an address (= address + person's name) is formatted and structured, validated by post (address check) and then compared with the AZ PICK reference database using a duplicate matching program. A statement on a probability value is made for each requested address and the corresponding confirmation feature is issued to the requesting contractual partner. Our contractual partner can receive the following information:

Our contractual partners in this regard are often web stores. All contractual partners are aware that they only receive probability values. Our respective contractual partner uses this information in conjunction with its own or other third-party data to control its business processes. According to Article 22 GDPR, this is not a decision based solely on automated processing. The processing of your data in the context of AZ Pick is based on Art. 6 para. 1 f GDPR. Your interests as a data subject affected by the advertising measure are adequately protected by the transparency requirement, your right to information and right to object (see sections 7 and 8) and your other rights as a data subject. If your person or your building is unknown to us, you also have the option of disclosing your address here.

3.4  Processing of your data using a Connector ID (C-ID)

3.4.1 Creation of the Connector ID (shared responsibility)

We transmit your name, address and, if available, your contact details (e.g. email address, telephone number, household/personal ID) to Bertelsmann Data Services GmbH, Carl-Bertelsmann-Str. 270, 33311 Gütersloh (“BDS”). BDS processes this data to generate a unique Connector ID (“C-ID”). This data is then deleted by the BDS. The C-ID is an identifier that enables the Bertelsmann company involved to determine in which databases of the other Bertelsmann companies involved a person present in their databases is stored.

In addition, we transmit the ID (customer ID) that we have assigned to your data record in our database as well as an anonymous data catalog to the BDS.  The anonymous data catalog is aggregated, non-personal information about the data stored in our customer database (“anonymous data catalog”). The BDS records and manages the C-ID, the customer ID, information on the Anonymous Data Catalog and which consents to a C-ID have been obtained from the participating Bertelsmann companies centrally for all participating Bertelsmann companies.

The data processing described above is carried out to protect our legitimate interests and those of the other Bertelsmann companies involved on the basis of Article 6 (1) (f) GDPR. This is done first of all so that we and the other Bertelsmann companies involved can assess which participating Bertelsmann companies have the same C-ID and what potential the Anonymous Data Catalog can offer for data exchange by making an inquiry to the BDS. Furthermore, it should enable us and the other Bertelsmann companies involved to exchange data with each other using the C-ID on the basis of the balancing of interests (see section 3.4.2) or, if available, your consent, in order to provide you with interesting and useful offers and advertising and to design the respective websites, products and services to meet your needs.

You can call up the Bertelsmann companies currently involved at https://dataservices.bertelsmann.de/participatingcompanies/ or request them by post or e-mail at  bedata(at)bertelsmann.de.

We and BDS are jointly responsible under data protection law for data processing when generating the C-ID. In this respect, we and BDS have defined in a joint agreement pursuant to Art. 26 GDPR which of us fulfills which obligations under the GDPR. This relates in particular to the exercise of the rights of data subjects and the fulfillment of information obligations in accordance with Articles 13 and 14 GDPR.

This agreement is necessary because personal data is processed in different process stages when generating the C-ID, which are either operated by us, the BDS or jointly. Even if there is joint responsibility, the parties fulfill the data protection obligations according to their respective responsibilities for the individual process sections as follows: 

a) We are responsible for the process of transmitting the above-mentioned data to the BDS.

b) We and the BDS are jointly responsible for the generation of the C-ID.

c) The BDS is responsible for managing the C-ID and for deleting the data described above that was transmitted to the BDS to generate the C-ID. 

You can exercise your data protection rights both with us, as described in more detail in Section 1 under Data Protection Officer, and with Bertelsmann Data Services GmbH, Corporate Data Protection, Carl-Bertelsmann-Str. 270, 33311 Gütersloh, Germany, or by e-mail at bedata(at)bertelsmann.de. You will generally receive the information from the body to which the rights were asserted.

3.4.2  Processing using the C-ID regardless of your consent

Irrespective of your consent, we and the other Bertelsmann companies involved may, if the requirements of Article 6 (1) (f) GDPR are met, share and use your name, your address, your contact details (if available), your date of birth (if available) and interest categories using the C-ID in order to provide you with interesting and useful offers and advertising or to design our respective websites, products and services in line with your needs. An interest category means belonging to an addressee group that has similar general characteristics (e.g. belonging to the same age group) or a comparable potential interest in certain products or services (e.g. purchases from the same product category, users of the same media content, e.g. series lovers). When selecting target group-specific advertising or needs-based design of the offers, we may also store and use anonymous information and data that we have received from data service providers on the basis of Article 6 (1) (f) GDPR, taking appropriate account of your interests.

3.4.3. Right of objection

You can object to the use of your data for the data processing described in sections 3.4.1 and 3.4.2 at any time, as described in section 1 Data Protection Officer. Your data will then no longer be used for these purposes in the future.

4. Recipients of your personal data

Within AZ Direct, those departments that require personal data to fulfill our contractual and legal obligations will have access to it.

Recipients in relation to the processing mentioned in section 3 are exclusively contractual partners of AZ Direct. These are in particular advertising companies and processors, e.g. lettershops, and service providers in dialog marketing and debt collection. These are mainly mail order and e-commerce companies, telecommunications and insurance companies, financial service providers (e.g. banks, credit card providers), debt collection companies, energy supply and service companies.

We will use processors commissioned by us (e.g. lettershops, data centers) in accordance with instructions for the above-mentioned processing. Our processors will only have access to your data to the extent and for the period necessary to provide the services.

5. Transfer to third countries

The processing of personal data generally takes place in the European Union (EU) or the European Economic Area (EEA) with a focus on Germany.

Data is only transferred to countries outside the EU or the EEA (so-called third countries) if this is required by law, if you have given us your consent, to fulfill our contractual obligations, or as part of our legitimate interest. Such processing may include, for example, the theoretical possibility of accessing a data set in the data center, triggered by a remote maintenance activity.

Your data will only be processed in third countries if certain measures ensure that there is an adequate level of data protection (e.g. adequacy decision of the EU Commission or so-called suitable guarantees, Art. 44 et seq. of the GDPR).

6. Duration of storage/deletion periods

We only store your data for the period of time during which storage is necessary within the meaning of Art. 17 para. 1 lit. a) GDPR. Every quarter we check whether your data - including pre-addresses - may still be stored. Your data will be deleted/blocked if this check shows that longer storage is no longer necessary.

If parts of your data are subject to statutory retention obligations, e.g. because they were the basis of invoices, we will store this information for a period of 6 (see Section 257 HGB) or 10 years (see Section 147 AO).

If you assert your data protection rights, we will process your data in accordance with the provisions of Articles 15, 16, 17, 18 and 21 GDPR. We store the correspondence conducted in this regard for a period of 3 years.

Entries in AZ Direct's internal advertising blacklist are stored permanently so that we can ensure that you are excluded from advertising by AZ Direct. You can of course have your entry in our advertising blacklist deleted at any time using the communication channels specified in section 1.

7. Right to information in accordance with Article 15 GDPR

If you would like to know what data we have stored about you and to whom we have transmitted which data, we will be happy to provide you with a written self-disclosure free of charge. We ask for your understanding that we do not provide any information by telephone for data protection reasons. The reason for this is that it is not possible to clearly identify you by telephone. In order to prevent misuse of the right to information by third parties, we therefore require the following information:

If you request data protection information on the basis of a specific advertisement, please enclose a copy of the advertising material you have received or mention this in your request.

To request information, please contact the data protection officer at the address given in section 1.

Please be patient with your request for information: Article 12(3) GDPR stipulates that information must be provided to the data subject within one month of receipt of the request for information. We endeavor to process every request within 10 working days.

8. Your other rights as a data subject and in particular your right to object

If the data stored about you is incorrect or no longer up to date, you have the right to request that it be corrected. In addition, you have the right to request the deletion or restriction of processing in accordance with Art. 17 or 18 GDPR at any time.

You can object to the use of your data for advertising purposes at any time. This also applies to the advertising profiling described in section 3.1. If we receive your objection, we will save your address in our advertising objection list and will no longer use your data for advertising purposes.

If you are entered in the Robinson lists (blocking lists) of the Deutscher Dialogmarketing Verband e.V. (DDV) www.ichhabediewahl.de and the I.D.I. Interessenverband Deutsches Internet e.V., Info- und Schutzgemeinschaft für Internet und Kommunikation, www.robinsonliste.de, you will not receive any advertising from us.

If you wish to exercise your rights or have general questions about data protection, you can contact our data protection officer at any time using the contact channels listed in section 1.

You also have the right to contact the supervisory authority responsible for us

Landesbeauftragte für Datenschutz und
Informationsfreiheit Nordrhein-Westfalen
Kavalleriestr. 2-4
40213 Düsseldorf
Germany
Telephone:+49 211/38424-0
Fax:+49 211/38424-10
E-mail: poststelle@ldi.nrw.de

and file a complaint there. You can also contact the data protection authority in your federal state, which will then forward your request to the supervisory authority responsible for us.

9. Automated decision-making and profiling

We do not use fully automated decision-making or profiling measures in accordance with Article 22 GDPR. If we use these procedures, we will inform you of this if this is required by law.

10. Origin of the data

The data originates from publicly accessible sources, from data and address service providers, opt-in brokers and other cooperation partners, in particular from distance selling and the media industry (usage contracts).

Status: Februar 2021