Data protection information "Website"
Thank you for visiting our website and for your interest in our company.
We, IC Cash Services GmbH, Mehlbeerenstraße 4, 82024 Taufkirchen b. München, Germany, www.iccash.de ("IC Cash"), are the operator of this website and therefore responsible within the meaning of the General Data Protection Regulation ("GDPR") for processing the personal data of users of this website. With this information on data protection ("Privacy Policy"), we would like to inform you about the processing of your personal data in connection with the use of our website.
This Privacy Policy describes in more detail which personal data we process and for what purpose within the framework of the aforementioned legal provisions. We therefore ask you to read the following information carefully.
1. responsible body and data protection officer
The controller is IC Cash Services GmbH
Mehlbeerenstr. 4
82024 Taufkirchen
You can reach our company data protection officer at
IC Cash Services GmbH
Data Protection Officer
Mehlbeerenstr. 4
82024 Taufkirchen
Phone + 49 (0) 89 904002-223
datenschutzbeauftragter@iccash.de
2 General legal basis for the processing of personal data
We only process the personal data of users of this website insofar as this is necessary to provide a functional website and our content and services and is permitted by law, in particular in accordance with the GDPR and the German Federal Data Protection Act (BDSG).
The processing of users' personal data only takes place regularly with the user's consent. An exception applies in cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law:
- Insofar as we obtain the consent of the data subject for processing operations of personal data, Art. 6 para. 1 lit. a GDPR serves as the legal basis.
- When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.
- Insofar as the processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 para. 1 lit. c GDPR serves as the legal basis.
- In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 lit. d GDPR serves as the legal basis.
- If the processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 para. 1 lit. f GDPR serves as the legal basis for the processing.
3 General information on data erasure and storage duration
The personal data of a user of this website will be deleted or the processing restricted as soon as the purpose of the processing no longer applies. Processing may also take place if this is required by law or other regulations to which we as the controller are subject. Deletion or restriction of the processing of the data also takes place if a retention or storage period prescribed by law or other regulations to which we as the controller are subject expires, unless the need for further processing of the data is justified by the conclusion or fulfillment of a contract.
4. processing of personal data when using the website
4.1 Type and scope
"Personal data" within the meaning of this privacy policy includes, for example, your name or your address and communication data if you provide it to us, e.g. via the contact form.
If you contact us via our hotline, we will process the personal data you provide, e.g. your name and telephone number.
Each time you visit our website, our system automatically collects data and information from the computer system of the accessing computer, which your browser transmits to us, and stores this in a log file. These are
- Browser type and version used by you
- The operating system you are using
- The address of the last page you visited, from which you followed to the current page
- Host name of the accessing computer (IP address)
- Date and time of the web server request
In principle, we cannot assign this information about the use of the website to a specific person. However, the log files contain IP addresses or other data that enable an assignment to a user of the website. This could be the case, for example, if the link to the website from which the user accesses the website in question or the link to the website to which the user switches contains personal data.
This data is also stored in the log files of our system. This data is not stored together with other personal data of the user. We do not merge this data with other data sources.
The legal basis for the temporary storage of data and log files is Art. 6 para. 1 lit. f GDPR.
4.2 Purpose of the data collection
We process your personal data in the context of the balancing of interests (Art. 6 para. 1 lit. f GDPR) for the following purposes:
- To show you the websites and information you have requested.
- To give you the opportunity to contact us using the contact form or by email.
- To present the content of our website to you in the most effective and interesting way possible.
- To make our media portal available to you
- To detect and eliminate errors on the website, to check the utilization of the website and to make adjustments or improvements if necessary.
- To secure our information technology systems, in particular to detect attacks and take countermeasures.
The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session. The data is not analyzed for marketing purposes in this context.
4.3 Duration of storage
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended. In the case of the storage of data in log files, this is the case after seven (7) days at the latest. Storage beyond this period is possible. In this case, the IP addresses of the users are deleted or anonymized so that it is no longer possible to assign the data to a specific user.
4.4 Possibility of objection
The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. Consequently, the user has no option to object.
4.5 No disclosure of your personal data
We do not pass on your personal data to third parties unless this is permissible for the fulfillment of the intended purpose or for the purpose of contract processing, or if this is required or permitted by law or if you have expressly consented.
4.6 Contact form
If you submit enquiries to us via the contact form, the information you provide in the enquiry form, including the contact details entered there, will be stored by us for the purpose of processing your enquiry and in case of any follow-up questions. We will not disclose this data without your consent.
The processing of this data is based on Art. 6(1)(b) GDPR where your enquiry is related to the performance of a contract or is necessary in order to take steps prior to entering into a contract. In all other cases, the processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR), where such consent has been requested. You may withdraw your consent at any time.
The data entered by you in the contact form will remain with us until you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies, for example once your enquiry has been fully processed. Mandatory statutory provisions, in particular statutory retention periods, remain unaffected.
ALTCHA (spam protection)
To protect our online forms against automated submissions and spam, we use the open-source software ALTCHA. ALTCHA uses a cryptographic proof-of-work mechanism in which a technical challenge is solved by the user’s browser and subsequently verified on our server infrastructure.
ALTCHA is operated entirely on the server infrastructure used by us. ALTCHA does not set any cookies and does not perform any tracking or fingerprinting. No data is transmitted to the provider of ALTCHA or to any other third parties.
Where connection data is processed by our web server as part of the technical provision of the service, such processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our website and online forms against abusive automated use and spam.
4.7 Conditions for applying by e-mail
When you apply by e-mail, we process the personal data you provide (e.g. e-mail address, surname, first name, content of the message, documents). This data is used exclusively for the purpose of analyzing the application documents and assessing the applications and is not processed further or forwarded to third parties. We may retain your data for up to 6 months from the end of the recruitment process.
The legal basis for data processing is based on Art. 6 para. 1 lit. b GDPR (fulfillment of a contract/implementation of pre-contractual measures). You can find more information about the processing of your data in this privacy policy. You can also contact our data protection officer at any time: datenschutzbeauftragter@iccash.de
We would like to point out that when applying by e-mail, your data may be transmitted unencrypted over the Internet. You can prevent this by using our application form.
4.8 Processors
We use processors as part of the provision of this website and its functions: Hosting provider, agency for the application form, bot and spam protection in the contact form.
5 Cookies, web analysis services and targeting
5.1 Cookies
a. Description and scope of data processing
Our website uses cookies. Cookies are text information that is stored in the Internet browser or by the Internet browser on your computer system. When you access a website, a cookie may be stored on your computer system. This cookie contains a characteristic string of characters, for example, which enables the browser to be uniquely identified when the website is called up again.
We use cookies to make our website more user-friendly. Some elements of our website require that the accessing browser can be identified even after a page change. Cookies are used to process the following data:
- Language settings
- Items in a shopping cart
- Log-in information
- Search terms entered
- Frequency of page views
- Use of website functions
When you access our website, you will be informed about the use of cookies for analysis purposes and your consent to the processing of the personal data used in this context will be obtained. In this context, reference is also made to this privacy policy.
b. Legal basis for the use of cookies
The legal basis for the processing of personal data using technically necessary cookies is Art. 6 para. 1 lit. f GDPR. The legal basis for the processing of personal data using cookies for analysis purposes is Art. 6 para. 1 lit. a GDPR if the user has given consent to this.
c. Purpose of processing when using cookies
The purpose of using technically necessary cookies is to simplify the use of our website for you. Some functions of our website cannot be offered without the use of cookies, for which it is necessary that the browser is recognized even after a page change. We require cookies for the following applications:
- Remembering search terms
- To log in
Analysis cookies are used for the purpose of improving the quality of our website and its content. Through the analysis cookies, we learn how the website is used and can thus constantly optimize our offer (see section Web analysis services).
These purposes also constitute our legitimate interest in the processing of personal data in accordance with Art. 6 para. 1 lit. f GDPR.
d. Duration of storage, objection and removal options for cookies
Cookies are stored on your computer and transmitted by it to our website or our web server. You therefore also have full control over the use of cookies by your computer system. You can deactivate or restrict the transmission of cookies by changing the settings in your Internet browser. Cookies that have already been saved can be deleted at any time, and this can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website to their full extent.
5.2 Web analysis services
a. Processing of data using MatomoOur website uses the free web analysis software "Matomo", licensed under the "General Public License" (GPL) and available at https://matomo.org/, provided by InnoCraft Ltd, 150 Willis St, 6011 Wellington, New Zealand, ("Matomo").
When individual pages of our website are accessed, the following data is stored
Two bytes of the IP address of the user's accessing system
- The website accessed
- The website from which the user accessed the website (referrer)
- The subpages that are accessed from the accessed website
- The time spent on the website
- The frequency with which the website is accessed
Matomo sets the cookies:
- _pk_ses.2.cb80, storage duration: session cookie
- _pk_id.2.cb80, storage duration 4 weeks
The legal basis for the processing of personal data using Matomo and the cookies generated by Matomo is Art. 6 para. 1 lit. a GDPR.
c. Purpose of the processing
The data obtained using Matomo is used for the statistical analysis of user behavior on our website. Pseudonymized user profiles can be created and evaluated for the same purpose. Cookies can be used for this purpose.
The information collected in this way is used exclusively to evaluate the use of our website and to compile reports on it. The information generated by the cookie in the pseudonymized user profile is not used to personally identify the visitor to this website and is not merged with personal data about the bearer of the pseudonym.
d. Deletion, possibility of objection
The data is deleted as soon as it is no longer required for our recording purposes. In our case, this is the case after six (6) months.
If you do not wish cookies to be used, you can set your browser so that the storage of cookies is not accepted. Please refer to the information in section 5.1 d) and at the end of this privacy policy.
If you do not agree to the storage and analysis of this data from your visit, you can object to the storage and use at any time by clicking the mouse. Matomo only tracks your data with your consent. You can revoke this consent at any time by clicking on the shield icon in the bottom left-hand corner of the screen to open the data protection settings and deactivate analysis tracking there.
You can decide whether a unique web analysis cookie may be stored in your browser to enable the operator of the website to collect and analyze various statistical data.
6. contact form and e-mail contact
6.1 Description and scope of processing
There is a contact form on our website that can be used to contact us electronically. If you use this option, the data entered in the input mask will be transmitted to us and stored. These data are
- Last name (mandatory)
- First name (mandatory)
- Company (mandatory)
- Street (mandatory)
- Zip code, city (mandatory)
- Email (mandatory)
- Telephone number (optional)
6.2 Legal basis
The legal basis for the processing of the data is Art. 6 para. 1 lit. a GDPR if consent has been given. The legal basis for the processing of data transmitted in the course of sending an email is Art. 6 para. 1 lit. f GDPR. If the e-mail contact is aimed at the conclusion of a contract, the additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR.
6.3 Purpose of the data processing
The processing of the personal data from the input mask serves us solely to process the contact. If you contact us by email, this also constitutes the necessary legitimate interest in processing the data. The other personal data processed during the sending process is used to prevent misuse of the contact form and to ensure the security of our information technology systems.
6.4 Duration of storage
The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. For the personal data from the input screen of the contact form and those sent by email, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.
The additional personal data collected during the sending process will be deleted after a period of seven (7) days at the latest.
If your inquiry and our responses to it are subject to statutory retention obligations, we will store your personal data for as long as the applicable statutory retention periods require. IC Cash Services GmbH is subject in particular to the German Commercial Code (HGB), the German Fiscal Code (AO), the German Payment Services Supervision Act (ZAG), the German Banking Act (KWG) and the German Money Laundering Act (GwG). The retention and documentation periods stipulated in the AO and HGB are generally ten (10) years.
6.5 Possibility of objection and removal
You have the option to revoke your consent to the processing of personal data at any time. If you contact us by e-mail, you can object to the storage of your personal data at any time. In such a case, the conversation cannot be continued. All personal data stored in the course of contacting us will be deleted in this case, subject to any statutory retention obligations.
7 Data security
All information that you transmit to us is stored for us on servers located within the European Union.
The transmission of information via the Internet can be insecure. We cannot influence the route the information takes before it reaches our systems. Therefore, we cannot generally guarantee the security of the transmission of data sent to our website.
However, we take technical and organizational measures on our website and other associated IT systems to protect against loss, destruction, access and alteration and also to protect them against the dissemination of your data by unauthorized persons. These measures include the encryption of data transmission between your computer system and our website. Encryption makes it very difficult for unauthorized persons to view information transmitted between computers. It is therefore very unlikely that anyone has read this page while it was being sent over the network.
8 Data protection for third-party websites
The Website may contain hyperlinks to and from third party websites. If you follow a hyperlink to one of these websites, please note that we cannot accept any responsibility or guarantee for third-party content or data protection conditions. Please check the applicable data protection conditions before you transmit personal data to these websites.
9 Your rights as a data subject
If your personal data is processed, you are a "data subject" within the meaning of the GDPR and you have the following rights vis-à-vis the controller - i.e. us, IC Cash Services GmbH:
9.1 Right to information
You can request confirmation from the controller as to whether personal data concerning you is being processed by us. If such processing is taking place, you can request the following information from the controller
- the purposes for which the personal data are processed
- the categories of personal data being processed
- the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed
- the envisaged period for which the personal data concerning you will be stored, or, if specific information on this is not possible, the criteria used to determine that period
- the existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the controller or a right to object to such processing
- the existence of a right to lodge a complaint with a supervisory authority
- all available information about the origin of the data if the personal data is not collected from the data subject
- the existence of automated decision-making, including profiling, referred to in Art. 22 (1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
9.2 Right to rectification
You have a right to rectification and/or completion vis-à-vis the controller if the processed personal data concerning you is incorrect or incomplete. The controller must make the correction without delay.
9.3 Right to restriction of processing
You may request the restriction of the processing of personal data concerning you under the following conditions
- if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;
- the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead
- the controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims, or
- if you have objected to processing pursuant to Art. 21 (1) GDPR pending the verification whether the legitimate grounds of the controller override your grounds.
If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.
9.4 Right to erasure
a) Obligation to erase
You have the right to obtain from the controller the erasure of personal data concerning you without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
- The personal data concerning you are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
- You revoke your consent on which the processing was based pursuant to Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR and there is no other legal basis for the processing.
- You object to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 para. 2 GDPR.
- The personal data concerning you has been processed unlawfully.
- The deletion of personal data concerning you is necessary to fulfill a legal obligation under Union law or the law of the Member States to which the controller is subject.
- The personal data concerning you have been collected in relation to the offer of information society services referred to in Art. 8 (1) GDPR.
b) Information to third parties
Where the controller has made the personal data concerning you public and is obliged pursuant to Art. 17 (1) GDPR to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you as the data subject have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
c) Exceptions
The right to erasure does not apply if the processing is necessary
- to exercise the right to freedom of expression and information
- for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
- for reasons of public interest in the area of public health in accordance with Art. 9 para. 2 lit. h and i and Art. 9 para. 3 GDPR;
- For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 para. 1 GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
- for the establishment, exercise or defense of legal claims.
9.5 Right to information
If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.
You have the right vis-à-vis the controller to be informed about these recipients.
9.6 Right to data portability
You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where
- the processing is based on consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract pursuant to Art. 6 para. 1 lit. b GDPR and
- the processing is carried out by automated means.
9.7 Right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions.
The controller will then no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.
If the personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct marketing.
If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.
You have the option of exercising your right to object in connection with the use of information society services - notwithstanding Directive 2002/58/EC - by means of automated procedures that use technical specifications.
The objection can be made informally, stating your name, address and, if applicable, the IP or e-mail address used, to the following address:
IC Cash Services GmbH,
"Data protection - Objection"
Mehlbeerenstraße 4
82024 Taufkirchen near Munich
Germany.
9.8 Right to revoke the declaration of consent under data protection law
You have the right to withdraw your declaration of consent under data protection law at any time. The right of revocation also applies to the revocation of declarations of consent that were issued to us before the GDPR came into force, i.e. before May 25, 2018. Please note that the revocation only takes effect for the future. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
9.9 Automated decision-making in individual cases, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision
- is necessary for the conclusion or performance of a contract between you and the controller
- is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
- with your express consent.
With regard to the cases referred to in bullet points 1 and 3 above, the data controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.
9.10. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.
The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
9.11 General information on exercising your rights
If you ask us to disclose or delete personal data, we can only comply with these requests in relation to your own data. Therefore, please understand that we may require you to provide proof of your identity in order to protect the data of other users. Since we generally only collect a very limited amount of data in connection with this website, which is usually deleted very soon, and which may only be assigned to a specific person - such as you - with great effort, we reserve the right to request additional information from you so that we can identify the relevant data about you that is covered by your request.
10. changes to this data protection information
We reserve the right to amend this data protection information at any time with effect for the future. A current version is available on the website and applies to all accesses from the date of publication of the version. Please visit the website regularly and inform yourself about the applicable privacy policy.
Data protection information "Cardholder"
We operate ATMs and are therefore the controller within the meaning of the General Data Protection Regulation ("GDPR") for the processing of the personal data of users of these ATMs. With this data protection information ("Privacy Policy"), we would like to inform you about the processing of your personal data in connection with the use of our ATMs.
This Privacy Policy describes in more detail which personal data we process and for what purpose within the framework of the aforementioned statutory provisions. We therefore ask you to read the following information carefully.
Our data protection declaration uses the terms used by the European legislator for the adoption of the GDPR.
1. responsible body and data protection officer
The controller is IC Cash Services GmbH
Mehlbeerenstr.4
82024 Taufkirchen
You can reach our company data protection officer at
IC Cash Services GmbH
Data Protection Officer
Mehlbeerenstr.4
82024 Taufkirchen
Phone + 49 (0) 89 904002-223
datenschutzbeauftragter@iccash.de
2 General legal basis for the processing of personal data
We only process the personal data of users of this website insofar as this is necessary to provide a functional website and our content and services and is legally permissible, in particular in accordance with the GDPR and the Federal Data Protection Act in the version applicable from 25.05.2018 ("BDSG 2018").
- The processing of users' personal data takes place regularly only with the consent of the user. An exception applies in cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law:
- Insofar as we obtain the consent of the data subject for processing operations of personal data, Art. 6 para. 1 lit. a GDPR serves as the legal basis.
- When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.
- Insofar as the processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 para. 1 lit. c GDPR serves as the legal basis.
- In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 lit. d GDPR serves as the legal basis.
- If the processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 para. 1 lit. f GDPR serves as the legal basis for the processing.
3 General information on data erasure and storage duration
The personal data of a user of this website will be deleted or the processing restricted as soon as the purpose of the processing no longer applies. Processing may also take place if this is required by law or other regulations to which we as the controller are subject. Deletion or restriction of the processing of the data also takes place if a retention or storage period prescribed by law or other regulations to which we as the controller are subject expires, unless the need for further processing of the data is justified by the conclusion or fulfillment of a contract.
4. processing of personal data of cardholders
4.1 Type and scope
For the purposes of this Privacy Policy, "personal data" includes the following for withdrawals using
1. girocards
- Bank sort code of the account-holding institution
- Account number
- Transaction PIN
- Credit card number
- Transaction PIN
4.2 Purpose of data collection
We process your personal data to fulfill contractual obligations (Art. 6 para. 1 lit. b GDPR) for the processing of a withdrawal at an ATM.
As a payment institution, we are also subject to the Money Laundering Act and the Payment Services Supervision Act. The purposes of processing therefore also include the prevention of fraud and money laundering and the fulfilment of organizational control and reporting obligations. Insofar as the processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 para. 1 lit. c GDPR serves as the legal basis.
4.3 Recipients of personal data
For girocards, the payment data collected for processing the payment is transmitted to the card-issuing bank for further processing via a "head office"; for all other cards, it is transmitted via the "head office" to the responsible regulated acceptance company for credit card billing (acquirer) or its processor. If criminal offences are suspected, the data may be transmitted to the law enforcement authorities.
4.4 Transmission to a third country or to an international organization?
Data is transferred to bodies in countries outside the European Union (so-called third countries) if this is necessary to process the payment.
4.5 Duration of storage
The data is stored as long as this is necessary for the fulfillment of contractual or legal obligations. Statutory retention obligations for IC Cash arise from the German Commercial Code (10 years), the German Fiscal Code, the German Money Laundering Act and the German Payment Services Supervision Act, as well as for the preservation of evidence within the framework of the statutory limitation periods. According to §§ 195 ff of the German Civil Code, these limitation periods can last up to 30 years, whereby the regular limitation period is 3 years.
6 Your rights as a data subject
If your personal data is processed, you are a "data subject" within the meaning of the GDPR and you have the following rights vis-à-vis the controller - i.e. us, IC Cash Services GmbH:
6.1 Right to information
You can request confirmation from the controller as to whether personal data concerning you is being processed by us. If such processing is taking place, you can request the following information from the controller
- the purposes for which the personal data are processed
- the categories of personal data being processed
- the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed
- the envisaged period for which the personal data concerning you will be stored, or, if specific information on this is not possible, the criteria used to determine that period
- the existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the controller or a right to object to such processing
- the existence of a right to lodge a complaint with a supervisory authority
- all available information about the origin of the data if the personal data is not collected from the data subject
- the existence of automated decision-making, including profiling, referred to in Art. 22 (1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
6.2 Right to rectification
You have a right to rectification and/or completion vis-à-vis the controller if the processed personal data concerning you is incorrect or incomplete. The controller must make the correction without delay.
6.3 Right to restriction of processing
You may request the restriction of the processing of personal data concerning you under the following conditions
- if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;
- the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead
- the controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims, or
- if you have objected to processing pursuant to Art. 21 (1) GDPR pending the verification whether the legitimate grounds of the controller override your grounds.
If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.
6.4 Right to erasure
a) Obligation to erase
You have the right to obtain from the controller the erasure of personal data concerning you without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
- The personal data concerning you are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
- You revoke your consent on which the processing was based pursuant to Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR and there is no other legal basis for the processing.
- You object to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 para. 2 GDPR.
- The personal data concerning you has been processed unlawfully.
- The deletion of personal data concerning you is necessary to fulfill a legal obligation under Union law or the law of the Member States to which the controller is subject.
- The personal data concerning you have been collected in relation to the offer of information society services referred to in Art. 8 (1) GDPR.
If the controller has made the personal data concerning you public and is obliged to erase it pursuant to Art. 17 (1) GDPR, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you as the data subject have requested the erasure by such controllers of any links to, or copy or replication of, those personal data. c) Exceptions
The right to erasure does not apply if the processing is necessary
- to exercise the right to freedom of expression and information
- for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
- for reasons of public interest in the area of public health in accordance with Art. 9 para. 2 lit. h and i and Art. 9 para. 3 GDPR;
- For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 para. 1 GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
- for the establishment, exercise or defense of legal claims.
6.5 Right to information
If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.
You have the right vis-à-vis the controller to be informed about these recipients.
6.6 Right to data portability
You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where
- the processing is based on consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract pursuant to Art. 6 para. 1 lit. b GDPR and
- the processing is carried out by automated means.
6.7 Right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions.
The controller will then no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.
If the personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.
If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.
You have the option of exercising your right to object in connection with the use of information society services - notwithstanding Directive 2002/58/EC - by means of automated procedures that use technical specifications.
The objection can be made informally, stating your name, address and, if applicable, the IP or e-mail address used, to the following address:
IC Cash Services GmbH,
"Data protection - Objection"
Mehlbeerenstraße 4
82024 Taufkirchen near Munich
Germany.
6.8 Right to revoke the declaration of consent under data protection law
You have the right to withdraw your declaration of consent under data protection law at any time. The right of revocation also applies to the revocation of declarations of consent that were issued to us before the GDPR came into force, i.e. before May 25, 2018. Please note that the revocation only takes effect for the future. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
6.9 Automated decision-making in individual cases, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision
- is necessary for the conclusion or performance of a contract between you and the controller
- is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
- with your express consent.
With regard to the cases referred to in bullet points 1 and 3 above, the data controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.
6.10 Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.
The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
6.11 General information on exercising your rights
If you ask us to disclose or delete personal data, we can only comply with these requests in relation to your own data. Therefore, please understand that we may require you to provide proof of your identity in order to protect the data of other users. Since we generally only collect a very limited amount of data in connection with this website, which is usually deleted very soon, and which may only be assigned to a specific person - such as you - with great effort, we reserve the right to request additional information from you so that we can identify the relevant data about you that is covered by your request.
7 Changes to this data protection information
We reserve the right to amend this data protection information at any time with effect for the future. A current version is available on the website and applies to all accesses from the date of publication of the version. Please visit the website regularly and inform yourself about the applicable privacy policy.