Privacy Policy
English version – for information only. German version prevails.
We, Dwinity Media GmbH, Nördliche Münchener Str. 9c, 82031 Grünwald, Germany (hereinafter referred to as Dwinity), inform you here about the processing of personal data for which we are responsible within the meaning of the EU General Data Protection Regulation (GDPR). In addition to the option of contacting us by post, you can also contact us at any time via .
We have compiled the most important information on data processing for you below. Where the term “data” is used in the text, this refers solely to personal data within the meaning of the GDPR.
1. Users of the website
1.1 Server log data
When using the website, certain information is sent to the server of our website by the browser used on the end device for technical reasons. This data is stored and processed on our server.
(i) The purposes of data processing are to provide the website content you have accessed, to ensure security and stability and to statistically evaluate and technically optimize the website. There are no plans to change these purposes.
(ii) The processed data is HTTP data: HTTP data is protocol data that is generated for technical reasons when the website is accessed via the Hypertext Transfer Protocol (Secure) (HTTP(S)): This includes IP address, type and version of Internet browser, operating system used, the page accessed, the previously visited page (referrer URL), the set language, date and time of access. HTTP(S) data is also collected on the servers of our service providers (e.g. when accessing third-party content).
(iii) The legal basis for the processing is our legitimate interest in operating the website and ensuring stability and quality (Art. 6 para. 1 lit. f GDPR and Section 25 para. 2 no. 2 TTDSG).
(iv) The data is automatically provided by the user’s browser. It is determined by a pixel or a log file. No cookies are set.
(v) The recipients of the personal data are IT service providers that we use as part of an order processing agreement. Please refer to the list at https://dwinity.com/dienstleister/ for the service providers we currently use and their role under data protection law.
(vi) IP addresses are anonymized after 24 hours at the latest. Usage data is deleted after 8 weeks for system-related reasons.
(vii) It is not possible to use the website without disclosing personal data. Communication via the website is not technically possible without providing data.
1.2 Technically required cookies
We use cookies on the website. Cookies are small text files that can be stored on the respective end device via the browser when the website is visited. When the website is called up again with the same end device, we can read and process the information stored in cookies. In doing so, we use the processing and storage functions of the end device’s browser and collect information from the end device’s browser memory.
In the structure of this data protection notice, we differentiate between technically necessary cookies and statistics cookies. Cookies that are technically necessary for the function of the website cannot be deactivated via the cookie management function of this website. However, cookies can generally be deactivated in the respective browser at any time. Different browsers offer different ways to configure the cookie settings in the browser. However, we would like to point out that some functions of the website may not work or may no longer work properly if cookies are generally deactivated in the respective browser.
a) Consent cookies
We use consent cookies to store the consents, possible revocations of consents and objections of the users of our website against the use of cookies on our website.
(i) The purpose of data processing is to store user decisions regarding cookies (consent, revocation, opt-out). There are no plans to change the purposes.
(ii) The processed data are
- HTTP data
HTTP data is protocol data that is generated for technical reasons when the website is accessed via the Hypertext Transfer Protocol (Secure) (HTTP(S)): This includes IP address, type and version of Internet browser, operating system used, the page accessed, the previously visited page (referrer URL), date and time of access. - Decisions on cookies:
Decision on individual cookies or groups of cookies, time of decision and last visit.
(iii) The legal basis for the processing is our legitimate interest in the simple and reliable control of cookies in accordance with the respective decision (Art. 6 para. 1 lit. f GDPR and § 25 para. 2 no. 2 TTDSG).
(iv) The data is actively provided by you (decision on cookies) or automatically by your browser (log data, time stamp).
(v) Please refer to the list at https://dwinity.com/dienstleister/ for the service providers we currently use and their role under data protection law.
(vi) The decision with regard to cookies is stored for 182 days.
(vii) It is not possible to use the website without disclosing personal data. Communication via the website is not technically possible without providing data.
b) Google Tag Manager
Google Tag Manager is a tool that enables us to integrate tracking or statistical tools and other technologies on our website. The Google Tag Manager itself does not create any user profiles, does not store any cookies and does not carry out any independent analyses. It is only used to manage and display the tools integrated via it. However, the Google Tag Manager records your IP address. It is possible that Google may also use the IP address collected via our website for its own purposes or for the purposes of other Google customers (e.g. to display individualized third-party advertisements). Such further processing of the data and the processing of the data after it has been transmitted by us to Google is carried out by Google as the sole controller under data protection law. In this context, Google, as the sole controller under data protection law, may store data about you in the USA. The European Court of Justice has ruled that the USA is a country with an inadequate level of data protection. In this context, there is a particular risk that your data will be processed by American institutions/authorities for control and monitoring purposes without you having sufficient legal recourse against this.
(i) The purpose of data processing is to control the display of statistics cookies on our website and to ensure the security of the application. There are no plans to change the purposes.
(ii) The processed data is HTTP data. This is protocol data that is generated via the Hypertext Transfer Protocol (Secure) (HTTP(S)) for technical reasons. This includes IP address, type and version of your Internet browser, operating system used, the page accessed, the previously visited page (referrer URL), date and time of access. HTTP(S) data is also collected on servers of service providers (e.g. when accessing third-party content). Your IP address is automatically anonymized during processing.
(iii) The legal basis for the processing is our legitimate interest in the simple and reliable control of cookies and the legally compliant presentation of the cookie notice text (Art. 6 para. 1 lit. f GDPR, § 25 para. 2 Alt. 2 TTDSG).
(iv) The data is automatically provided by the user’s browser.
(v) The recipient of the data within the scope of order processing is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. In the event of disruptions and malfunctions, Google may also access the servers in Germany from so-called third countries such as the USA in order to carry out maintenance work. The EU standard contractual clauses (2021/914) have been concluded (Art. 46 para. 2 lit. c GDPR). You can request a copy of the main contractual contents of the EU standard contractual clauses at any time. Google is also certified in accordance with the EU-US Data Privacy Framework (Art. 45 GDPR).
(vi) Usage data is deleted after 9 or 18 months due to the system.
(vii) The provision of data is not required by law or contract or necessary for the conclusion of a contract. There is no obligation to provide the data. If the data is not provided, we will not be able to use the Google Tag Manager.
1.3 Statistics cookies
The user’s consent is required for the use of statistics cookies. Consent is given by means of a so-called “cookie banner”: When you visit our website, we display our cookie banner. In our cookie banner, users can give their consent to the use of all cookies requiring consent on this website by clicking on the “Allow all” button. Without such consent, the cookies requiring consent will not be activated. By clicking on the “Reject all” button, the use of cookies requiring consent can also be completely rejected. The user’s decision is stored in a cookie. Alternatively, they have the option of clicking on the button to access our “cookie board”. In the cookie board, you can make an individual selection of cookies and customize them at a later date. We store the respective cookie settings in the form of a cookie on the user’s end device in order to determine whether they have already made cookie settings when they visit the website again.
Google Analytics
If the relevant consent has been given, we use the web analysis tool Google Analytics on our website. With the help of Google Analytics, we can examine user behavior on our website in pseudonymized form.
Users can deactivate data processing by Google Analytics at any time in our cookie board. Alternatively, Google Analytics cookies can be deactivated for the browser currently used by the respective user by deactivating the storage of cookies in the browser settings.
(i) The purposes of data processing are the analysis of user behavior and the measurement of reach on our website and of advertisements placed to optimize our website. There are no plans to change the purposes.
(ii) The processed data are
- Google Analytics HTTP data:
This is log data that is generated for technical reasons when using the web analysis tool Google Analytics used on the website via the Hypertext Transfer Protocol (Secure) (HTTP(S)): This includes IP address, type and version of your Internet browser, operating system used, the page accessed, the previously visited page (referrer URL), date and time of access. - Google Analytics end device data:
Data generated by the web analysis tool Google Analytics and assigned to your end device: This includes a unique ID for (re)recognizing returning users (so-called “client ID”), as well as certain technical parameters for controlling data collection for web analytics. - Google Analytics measurement data:
Device-related raw data (so-called “dimensions” and “measurement data”) that is collected and analyzed when our website is used: This primarily includes information about the sources through which the user reaches our website, information about the location, the browser used and the end device used, information about the use of the website (in particular page views, frequency of visits and time spent on pages accessed), as well as information about the fulfillment of certain goals (e.g. transactions in the online store or downloads and registrations). The data is assigned to the client ID assigned to your end device. As a result, device-related usage profiles are created in which all device-related raw data is combined into a client ID. The data that we collect using Google Analytics does not enable us to identify you personally (i.e. by your real name). We also do not combine the device-related raw data and the resulting device-related usage profiles with data that directly identifies you personally without your consent. Furthermore, we can use Google Analytics to record your mouse and scroll movements and clicks, among other things. Google Analytics also uses various modeling approaches to supplement the data records collected and uses machine learning technologies for data analysis. Google Analytics uses technologies that enable the recognition of the user for the purpose of analyzing user behavior (e.g. cookies or device fingerprinting). - Google Analytics report data:
Data contained in aggregated segment- and device-related reports that are created based on the analysis of the raw device-related data.
(iii) The legal basis for processing is consent (Art. 6 para. 1 lit. a GDPR, § 25 para. 1 TTDSG).
(iv) The data is automatically provided by the user’s browser.
(v) The recipient of the data as part of order processing is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. In the event of disruptions and malfunctions, Google may also access the servers in Germany from so-called third countries such as the USA in order to carry out maintenance work. The EU standard contractual clauses (2021/914) have been concluded (Art. 46 para. 2 lit. c GDPR). You can request a copy of the main contractual contents of the EU standard contractual clauses at any time. Google is also certified in accordance with the EU-US Data Privacy Framework (Art. 45 GDPR).
(vi) In addition, as a precautionary measure, we have obtained the consent of users via the cookie banner (Art. 49 para. 1 lit. a GDPR). You can revoke your consent at any time with effect for the future via the button on the cookie board.
(vii) The data will be deleted after 2 months.
(viii) The provision of data is not required by law or contract. If the data is not provided, we will not be able to analyze user behavior using Google Analytics.
1.4 Protection against cyber attacks
We use cyber security tools to protect our website from cyber attacks of all kinds.
(i) The purpose of data processing is to protect our website from unwanted access or malicious cyber attacks. There are no plans to change the purposes.
(ii) The data processed includes your IP address, the time and source of login attempts and log data (e.g. the browser used).
(iii) The legal basis for the processing is our legitimate interest in protecting our website as effectively as possible against cyberattacks (Art. 6 para. 1 lit. f GDPR).
(iv) The data is automatically provided by the user’s browser.
(v) Please refer to the list at https://dwinity.com/dienstleister/ for the service providers we currently use and their role under data protection law.
(vi) The data will be deleted after 60 days.
(vii) The provision of data is not required by law or contract. If data is not provided, we will not be able to use the tools.
1.5 When contacting us by e-mail, telephone, fax or contact form
If you contact us by e-mail, telephone, fax or contact form, we will store and process your request, including all personal data resulting from it, for the purpose of processing your request. We will not pass on this data without your consent.
(i) The purpose of the processing is the preparation and execution of a contractual relationship or other communication. There are no plans to change the purposes.
(ii) The processed data are name, contact details, communication content, time and technical metadata of the communication.
(iii) In the case of contracts with natural persons, the legal basis for processing your data is the initiation of a contract or the contract itself (Art. 6 para. 1 lit. b GDPR), in the case of contracts with legal entities, our legitimate interest in communicating with the contact persons relevant to the contract (Art. 6 para. 1 lit. f GDPR), and always legal obligations, in particular tax and commercial law regulations (Art. 6 para. 1 lit. c GDPR). In the case of pure communication, the legal basis is our legitimate interest in the documentation of communication processes (Art. 6 para. 1 lit. f GDPR).
(iv) The contact details are actively provided by you. The communication metadata and communication data are collected automatically.
(v) Contact and contract data may be transmitted to other service providers, business partners, offices and authorities if this is necessary for the execution of the contract or order. We also use service providers as part of order processing for the provision of services, in particular for the provision, maintenance and servicing of IT systems. Please refer to the list at https://dwinity.com/dienstleister/ for the service providers we currently use and their role under data protection law.
(vi) The data of contractual partners and service providers will be deleted ten calendar years after termination of the contract or order. Inquiries and pure communication will be deleted once the purpose (e.g. completed processing of your request) no longer applies.
(vii) The processing of data is necessary for establishing contact. Communication is not possible without providing data.
1.6 Note on social media links
We also link offers from other partners and service providers (e.g. Facebook, LinkedIn) on our website. Any content is not integrated on our website. Clicking on the link will take you to the website of the respective company. The processing of your personal data there is then the responsibility of that company. Details on the processing of personal data can be found in the data protection notices on the respective websites.
2. Customers and clients
If you purchase tokens via our dashboard, further processing of your personal data will take place.
(i) We process your data for the purpose of implementing the contractual relationship and processing payments. This also includes advice, support, information about product innovations and new products. There are no plans to change the purposes.
(ii) The processed data are:
- Name, contact details
- payment data
- communication data
- Copies of identity documents and other evidence in connection with money laundering requirements
(iii) The legal basis for the processing is the performance of the respective contract (Art. 6 para. 1 lit. b GDPR), as well as our legal obligations, in particular tax and commercial law regulations (Art. 6 para. 1 lit. c GDPR). In the case of information about products, the legal basis is our legitimate interest in carrying out advertising (Art. 6 para. 1 lit. f GDPR). The legal basis for the transmission of payment data to payment service providers is our legitimate interest in centrally controlled payment processing by a payment service provider (Art. 6 para. 1 lit. f GDPR).
(iv) The data is provided by you.
(v) Recipients of data may be banks and payment service providers for the processing of payments and credit checks as well as service providers for the implementation of communication. The service providers we currently use and their role under data protection law can be found in the list under External IT service providers. In individual cases, data may be transmitted to debt collection service providers, lawyers, courts and authorities.
(vi) All contract and booking-related data is stored for a period of ten calendar years after the end of the contract in accordance with retention periods under tax and commercial law. Copies of identity documents will be deleted 6 months after the end of the business relationship in the event that no contract is concluded.
(vii) You are legally and contractually obliged to provide data. The contractual relationship cannot be established and executed without the provision of data.
3. Rights of data subjects and further information
(i) We do not use automated individual decision-making procedures.
(ii) There are no plans to change the aforementioned purposes.
(iii) If your personal data is incorrect or incomplete, you have a right to rectification and completion.
(iv) You can request the deletion of your personal data at any time, unless we are legally obliged or entitled to continue processing your data.
(v) If the legal requirements are met, you can request that the processing of your personal data be restricted.
(vi) You have the right to object to the processing if the data processing is carried out for the purpose of direct advertising or profiling.
(vii) If the processing is based on a balancing of interests, you can object to the processing by stating reasons that arise from your particular situation.
(viii) If the data processing takes place on the basis of your consent or within the framework of a contract, you have the right to transfer the data provided by you, provided that this does not affect the rights and freedoms of other persons.
(ix) If we process your data on the basis of a declaration of consent, you have the right to revoke this consent at any time with effect for the future. The processing carried out prior to a revocation remains unaffected by the revocation.
(x) You also have the right to lodge a complaint with a data protection supervisory authority at any time if you are of the opinion that data processing has taken place in breach of applicable law.
Status: January 25
