Data Protection Statement for Facebook Fan pages 23/01/19

Introduction

We are happy about your interest in our Facebook Fan page („Fanpage“) and our company. The protection of your personal data is of great importance to us. We respect the statutory provisions on data protection and data security.
Therefore we have to comply with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.
Below you will find information concerning which personal data we collect when providing this service and how we handle such data.

 

1. Responsible party/ Contact details

Henkel Limited, Wood Lane End, Hemel Hempstead, Hertfordshire HP2 4RQ („we“, „us“ or „Henkel“) is the responsible party for the data processing required to provide the service and as described in this data protection statement. This excludes the data processing concerning the so-called “Site-Insights”, for which we share the responsibility with Facebook Ireland Limited (“Facebook”).
Please keep in mind that the use of our Fan page leads to further processing of your personal data by Facebook, not limited to the “Site-Insights”-option. Insofar (in particular with regard to the technical possibility to use this Fanpage) we refer to the data protection statement by Facebook under https://www.facebook.com/privacy/explanation.
Should our Fan page be linked to other websites or online-contents, the data protection statements of those services respectively apply.
You can contact us via email dataprivacy.ukirl@henkel.com

 

2. General processing of data

 

2.1 Communication with us

If you contact us, for instance, to ask a question about a product that we presented on our Fan-page, we will use your name, eventually your e-mail-address and further data provided by you to answer your query.
The processing is based on statutory provisions, which allow us to process personal data, as far as it is necessary to answer your query (e.g. Art. 6 para. 1 b) GDPR) or because of our legitimate interest to provide you with the desired information (Art. 6 para. 1 f) GDPR).
After answering your query, we delete your query and all information within three years from the end of the calendar year in which your query was answered.

 

2.2 Community-Features

You can choose from different features which we offer on our Fan page to interact with other users, such as posting a comment on our wall, leaving a comment, and liking or sharing a post.
We would like to point out, that this part is public and therefore all information you post or provide for registration, can be seen by others. We cannot control how other Fan page users process this information. We especially cannot prevent others from sending you messages.
All data you provide for the community-features we process to ensure the correct functioning of these features. Without this data we are not able, to offer you the community-features. The processing of this data is based on statutory provisions which allow us to process personal data, as far as it is necessary for the use of our services or the performance of a contract (e.g. Art. 6 para. 1 b) GDPR), or because it constitutes a legitimate interest, to make the use of our features as easy and efficient as possible (Art. 6 para 1 f) GDPR). Content that has been posted in the community-area can be saved for an unlimited time. If you wish to remove content at any time, please send us an e-mail to the address noted above.

 

2.3 Sweepstakes and other competitions

From time to time we offer sweepstakes and other competitions on our Fan page. If you want to participate we will ask you to provide identification and contact details (e.g. name, date of birth, address, e-mail-address etc.; further information may be necessary for the competition, such as the answer to a quiz, photos or the result of an online game). We use this information to properly carry out the sweepstakes or competition, and if necessary for legal defence or to detect misuse.
You will find further details in the participation terms for each sweepstake/competition. If you gave us your consent when participating in the sweepstakes/competition, we use your information for the purposes listed in the declaration of consent.
The processing of data is based on statutory provisions, which allow us to process personal data if it is necessary to properly carry out the sweepstakes/competition (e.g. Art. 6 para. 1 b) GDPR), because you gave us your consent (Art. 6 para. 1 a) GDPR) or to follow our legitimate interest to prevent fraud or to safeguard an effective legal defence (Art. 6 para. 1 f) GDPR).
The duration of data storage will be included in the respective data protection statement for each sweepstake/competition.

 

2.4 Invitation to events

From time to time we announce events on our Fan page, which might require registration. If you register for one of our events, we process the personal data supplied by you at the registration, such as your name, address, details of contact and communication (phone number and e-mail address) as well as further information necessary for the event (e.g. to create the guest list, accreditation, entrance control, room planning and catering) and/or information necessary to send you your invitation and information for the specific event. Furthermore, we might use your information to detect misuse and for our legal defence.
The processing of data is based on statutory provisions, which allow us to process personal data if it is necessary for the registration and participation for an event (Art. 6 para. 1 b) GDPR) or because we have a legitimate interest to prevent fraud or to safeguard an effective legal defence (Art. 6 para. 1 f) GDPR).

 

2.5 Chatbot

We supply a chatbot on our Fan page. It is possible to use the chatbot without sharing personal data. In case you enter personal information in the text box while using the chatbot,we will use your data only to answer your question. If we save your question for an internal review-process we will delete your personal data beforehand.
The processing of data is based on statutory provisions, which justify the processing of personal data that is necessary to answer your question (Art, 6 para. 1 b) GDPR) or because we have a legitimate interest to prevent fraud or to safeguard an effective legal defence (Art. 6 para. 1 f) GDPR).
If you did not agree to a longer storing period, e.g. within our customer relations management, we will store your data just as long as needed to fulfil the above-mentioned purposes or as long as necessary to comply with the legal obligation to retain the data.

 

2.6 Analysis of use / Site-Insights

In shared responsibility with Facebook, we analyse, how you use our Fan page (Site-Insights).
The information required by the GDPR pertaining to the processing of data for Site-Insight can be found on the Facebook website; at the moment you will find Facebook´s data protection statement under https://www.facebook.com/privacy/explanation.
Facebook will supply you with the relevant details about the contract between Facebook and Henkel Limited regarding the processing of data as joint controllers as per Art. 26 GDPR; at the moment you will find this information by clicking this Link: https://www.facebook.com/legal/terms/page_controller_addendum.
In the context of Site-Insight we will only receive anonymized statistics– therefore we have no access to personal data which are being processed by Facebook.

 

3. Transfer of personal data

Disclosure of your personal data occurs in the following cases:

    • Personal data will be disclosed to criminal prosecution authorities as well as, if necessary, harmed third parties if necessary to investigate illegal or abusive use of our services. However, this only occurs if there are specific indications of illegal use or misuse. Disclosure can also take place if this serves to enforce the terms and conditions for the use of our services or other agreements or if necessary, to assert, exercise or defend legal claims. Our legitimate interest for the processing is safeguarding the proper functioning of our website and to assert, exercise or defend legal claims, as the case may be. We are also required by law to provide information to certain governmental agencies. These are the criminal prosecution authorities, public authorities that prosecute administrative misdemeanours sanctioned with fines and the tax authorities. Our legitimate interest for the processing is to prevent misuse, prosecute criminal offences and to assert, exercise or defend legal claims, as the case may be (e.g. Art. 6 para. 1 f) GDPR).
    • For the fulfilment of our service,s we must rely on third-party companies and external service providers under contractual relationships (“processor”). Categories of such processors can be agencies, fulfilment-service provides, an IT-Service provider.
    • In such situations, information will be disclosed to these companies or individual persons, in order to enable further processing. We carefully select these external service providers and regularly examine them in order to make sure that your privacy is safeguarded. Processors are only allowed to use the data for the purposes determined by us. They are also obligated under contracts with us to treat your data exclusively in accordance with this data protection statement as well as the European and German laws on data protection. Within the framework of potential transfers described above, it might occur that the third party bound by instructions might process the data in states outside the EU (“third countries”).
    • Every disclosure of data to a party outside the EU is carried out in compliance with applicable data protection laws. To the extent the EU-Commission has not declared that a third country provides an adequate level of data protection, we will provide sufficient guarantees to establish adequate protection of your data. For this purpose, a contract with the processor might be concluded that incorporates the EU Standard Contract Clauses (http://ec.europa.eu/justice/data-protection/international-transfers/transfer/index_en.htm).
    • During the course of the further development of our business, it is possible that the structure of Henkel Limited will change by changing the legal form, establishing, purchasing or selling subsidiaries, company divisions or parts of the company. In case of such transactions, the customer information is passed on together with the part of the business which is transferred. To this extent, we make sure that each disclosure of personal data to third parties is carried out in accordance with this data protection statement and applicable data protection laws. Such a transfer of personal data can be justified by a legitimate interest to adapt the structure of our company to economic and legal circumstances if required (Art. 6 para. 1 f) GDPR).

 

4. Your right as a data subject

As a data subject, you have the right to obtain information at any time about the data stored about you. Furthermore, you have the right to rectify, right to erasure, a right to the restriction of processing as well as potentially the right to data portability. Additionally, you have the right to complain to a data protection supervisory authority.
IN ADDITION, YOU MAY OBJECT TO DATA PROCESSING FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION; IF THE PROCESSING OF YOUR PERSONAL DATA IS BASED ON ART. 6 PARA. 1 LIT. EUR LIT. F GDPR.
Should you have given your consent to the processing of your personal data, you can withdraw it at any time with effect for the future.
As far as the processing of personal data by Site-Insights is concerned, Facebook acts as the joint contact point and handles all applications concerning the exercise of the above-mentioned rights.

 

5. Changing of this data protection statement

This data protection statement was last updated on 23/01/19.
The development of our Fan page can have effects on the way we handle personal data. We retain the right to adopt this data protection statement in line with applicable data protection laws. Therefore, we recommend to visit our Fanpage from time to time, to stay informed about possible updates of our data protection statement.