How do we analyze your activity on our websites? Which advertising is presented to you? How can you view your personal data if you are a digital subscriber or registered user? In short, how do we deal with the data that arises from the users of our digital products and services? We aim to answer these and many other questions in this data protection declaration, which applies to all the titles of our media group: the SPIEGEL product family, manager magazin and manager lounge, Harvard Business Manager, Planestream and bento.
The regulations for data collection, processing and usage defined here apply as soon as you use one of our digital products or services, set up a user account or navigate one of our sites in any other way. They define the basis for data protection on our sites. Important: For some actions we work with selected partners -- on service pages, for example, or when you buy products, for competitions, in the analysis of usage of our content, products and services as well as the integration of advertising. In these cases, you may find additional references to the data protection regulations of these partners. If the content of third parties -- particularly of social networks and platforms - is integrated, this may also contain data; this will be explained at greater length later on.
You may reject any analysis or services that are not essential for the operation of the products and services we offer, which we will also explain.
1. The essentials in brief
Before we begin, though: A list of our approved advertising service providers and their opt-out options (meaning to deactivate the tracking) can be found here. Detailed information on advertising tracking can be found here. If you want to deactivate advertising tracking, you must opt out of all the service providers listed there. It is not sufficient to activate the do-not-track mode in one of your browsers.
To simplify the process, however, you can use a central option for deselecting tracking services using an "opt-out."
The list on the website Your Online Choices will show you which trackers are active on your current browser. You can deactivate each of them with one click. However, we cannot guarantee that all of the approved service providers for our site can be deactivated via Your Online Choices.
The Digital Advertising Alliance offers a similar service with its YourAdChoices initiative. Your browser is checked for currently active services, which are then displayed in an overview. You can reject tracking by participant in the initiative with a single click. You can find the Web Browser Check in English here.
The deactivated services are not just blocked for our services, but also generally for the device that you are using. The settings are stored in cookies with your browser (more on cookies below). Should you be using multiple browsers on multiple devices, you must (de-)activate settings on each browser individually, because we are neither able nor permitted to synchronize opt-outs for you.The list of services will change, so please revisit this page regularly. Generally, we are also updating this declaration constantly to comply with legal framework conditions. However, this will in no way affect your fundamental right to data protection. Should we hold personal data about you, you have the right to information and rectification at any time, and in most cases to restriction of processing, erasure, blocking and/or transfer of the data to you. If you have questions, you can contact us at any time at Datenschutz@spiegelgruppe.de. As mentioned, all further and detailed information about advertising tracking can be found here.
2. What we promise you
We will store, process and use your data only in the manner described in this declaration, and in compliance with German and European data protection legislation. Naturally, we maintain data secrecy. We treat your data confidentially and do not pass it on to third parties other than to closely associated service providers, who may process subscriptions, payment services, video delivery, advertising business or other services on our behalf. These service providers are under obligation to use your data only for the purpose provided for in the relevant contract, and not to pass it on to anyone else under any circumstances. When we refer to "we" in this declaration, this also includes these closely associated service providers.
For each visit, we temporarily record the IP address used for your Internet access, as well as the pages you access. If you are accessing the site from an app, we temporarily record the device number so that basic services like access authorization can function. However, we never use this data to identify you personally.
We, our external cooperation partners and content providers as well as advertising service providers who activate advertising on our site - more on this below - store cookies on your browser. These are small files with information that serves to differentiate users (using software and device IDs, etc.), as well as settings for advertising trackers and usage preferences. You may delete or deactivate cookies in your browser, but you must then log in again and create new settings, etc. Generally, you are able to use our sites without cookies. You can find out more about cookies at www.meine-cookies.org. Generally, we and our cooperation partners establish no reference to you as an individual from the cookies, but rather use them at most as pseudonyms. The legal basis for this is the European ePrivacy Directive in conjunction with the German Telemedia Act (Telemediengesetz; Par 12 et seq.) and/or the European General Data Protection Regulation (Art. 6(1)(b) and (f)).
Only when you are registered and logged in with us will your user account - including concrete details about you - be stored in cookies, so that you can use our products and services without having to log in every time. To personalize the products and services which use advertising and market research, this personal data is only used in limited scope and with your express consent which you may grant on a case-by-case basis.
For all of our purchasing and order sites to which you may submit personal data, we use only the latest SSL security standard (256-bit Secure Sockets Layer). Your data is encrypted directly upon transfer, and all information that may be subject to data protection such as credit card numbers, routing numbers, account numbers, names and addresses are stored in a protected database in encrypted form. In order to administer your basket, we use a session cookie (which is deleted when the browser closes) or alternatively a session identifier in the access path of the website (12 characters with a leading dollar sign) which becomes invalid after half an hour of inactivity (in which case the basket and data are discarded).
3. What we know about you as an individual
In each case, we first ask for your consent and then only use the respective data relating to you as an individual in the provision of the actual products and services for which you have registered. If you contact us as an identifiable individual, through a contact form, for example, in addition to your name and email address we may also store such details in our system as the time and place a registration takes place or a message is sent to us; the download, purchase or attempted purchase of products or services; in some cases, also the dispatch or opening of newsletters, emails and push messages; also contact via email or interest in individual products or services. As long as and to the extent that we do not need to make the data available, you may revoke your consent for usage at any time. This often requires nothing more than unsubscribing from the product or service in question, but naturally this means that you can no longer use it. You can always find more information on unsubscribing in the product or service in question. For newsletters, you can unsubscribe from the newsletter itself, for the WhatsApp service from WhatsApp, and so on.
Essentially, we only process personal data to fulfill our contractual obligations to our users. We need to process data to be able to suggest suitable contacts to you, for instance, or products and services, or information. With certain products and services, we have to ensure that access requests come from humans and not automated programs. To prevent such abuses, we use Google's reCaptcha service, which uses a truncated version of your IP address and other necessary data (only in the event of technical outage in Europe, for instance, is it possible that the IP address will be truncated in the USA). The reCaptcha data is not merged with other Google data.
Please note that if you make a purchase through one of our apps, the payment is usually processed by Apple or Google as the operator of the respective app store. The companies receive your order information and link it to your App Store account to complete the purchase transaction and inform us of your eligibility to access paid products like subscriptions. Under no circumstances, however, do we receive your personal profile and payment data from the stores in question - that is the responsibility of the companies in the U.S.
4. How we analyze the usage of our products and services
Which articles are currently being read? How often? By how many people? How much time do viewers spend watching videos? How often do users visit our sites? For us it is important to learn about the preferences and desires of our readers. That's why we use analysis services which can offer us trending topics in real time and comparison with the competition on a daily or monthly basis. The legal basis for this is the European ePrivacy Directive in conjunction with the German Telemedia Act (Telemediengesetz; Par 12 et seq.) and/or the European General Data Protection Regulation (Art. 6(1)(b) and (f)). These services are largely integrated via the Google Tag Manager, which does not collect any data itself and these services never record you as an individual with your identity data, rather they use a pseudonym at most. They also do not present advertising or other products or services.
To comprehensively optimize our offerings, we use the analysis service provided by Adobe, which employs cookies to monitor usage of our website both in real-time and on the long term. The information collected, including your IP address, is transmitted to the service's servers in Europe, where it is anonymized (replaced by a generic string of characters) and stored. We use this information to evaluate user activity on our website, to compile reports on website activity and to offer personalized services relating to website and internet use. Because of the anonymization process, no personal or pseudonymous data is stored. You can block cookies, and thus also prevent Adobe analytics, by changing your browser settings. Assistance in doing so can be found here.
5. What social networks and external tools can see about you through us
On our site, we integrate posts and recommendation functions from platforms such as Facebook, YouTube, Twitter, Instagram, Giphy, Imgur, Spotify, TikTok or the mapping service Mapbox, most of which are located in the U.S. but are nonetheless subject to the applicable data protection regulations in EU and EEA countries. If, for instance, you actively use a recommendation switch on our site or read an article with an embedded post, YouTube video or Spotify playlist, the embedding technology may transfer general framework data such as your IP address back to the social networks and platforms. We have no influence over the way these platforms use the data. Please consult Facebook, Twitter, Spotify, TikTok and YouTube directly for more information, and adjust your privacy settings.
For social networks and on other external platforms, the companies' respective data protection regulations apply, even if we distribute information and maintain presences there with our brands. With Snapchat, in particular, we are active outside our internet presence, for example with SPIEGEL ONLINE in Snapchat's Discover section. The U.S. company provides us with its content management system and general usage data, such as the number of hits, the length of usage, the demographics of readers and the user names of all contacts. You can read the network's data protection rules here.
6. How advertising works in our products and services
Advertising ensures the existence of our products and services, and advertisers require reliable information on the number of readers viewing their advertisements. Moreover, they are interested in preferentially presenting their advertising to those who are interested in certain products or topics. For this we allow our advertising partners to track usage data for "usage-based" online advertising (in which advertising is tailored to the user's interests), in other words to collect and process it in usage profiles in pseudonymized form. This data helps ensure that you are presented with advertising to which you are likely to be more attentive. You can identify this "advertising tracking" by the OBA symbol, a turquoise triangle with an "i" in the middle. We explained at the very beginning of this privacy statement how you can reject tracking by advertising partners.
The following advertising partners, which also use tracking options, perform particular functions on our site. In some cases you may need to unsubscribe from them separately:
In general, tracking means that your usage of our products and services is captured, for instance individual clicks, subpages visited, advertising banners viewed, etc. Because it can never be entirely discounted that the data may be indirectly associated with you, all usage data is saved with a random pseudonym, and this pseudonymous data cannot be personalized again. To enable ads to be tailored to your needs in places where cookies do not work optimally, in apps on smartphones, for example, cookie-like technologies may be used. To prevent this, go to the app "Google Settings" on Android smartphones or scroll down to "Google" in the General Settings app, tap "Ads Settings" and tap the on-off slider next to "Personalized advertising." On iOS devices, for which we use Apple's Advertising Identifier, go to the Settings app, then to "Privacy," then to "Advertising" and make your specific settings.
Finally, we use a service from Sourcepoint to prevent the use of ad blockers on our site. This stores data on usage of our site in cookies to repel advertising blockers and record your settings. All analysis is carried out anonymously and not in a personalized way. Private data such as IP addresses are used only in truncated form.
7. What our editorial cooperation partners analyze
In our articles, we often use services from cooperation partners, for surveys or discussion questions, for instance. As with social networks and platforms, the following applies: If, as an example, you read an article with an embedded survey, theoretically general framework data such as your IP address may be transferred back to the social networks and platforms. You can also find more information on their data protection policies on their websites:
8. How we advertise ourselves
We, too, advertise our products and services on the Internet. We use various options for individualized advertisements with which we aim to reach you and other potential readers directly:
9. Also good to know
The responsible authority for data processing is the company within the SPIEGEL Group named in the respective legal notice (Impressum), represented by its management. You can always contact the SPIEGEL Group, Kennwort Datenschutz, Ericusspitze 1, 20459 Hamburg or send an email to firstname.lastname@example.org if you have questions about the way we collect, process or use your data; if you wish to rectify, delete or block such data; or if you have any other general questions that have not been answered. You can also contact the Data Protection Officer for the SPIEGEL Group in this way. We will always address your concern promptly as long as we are not legally prevented from doing so. If we do not address your concern within the legal time limit or fail to address it sufficiently, you may lodge a complaint with the responsible supervisory authority. Generally speaking, the authority applicable to the headquarters of the company is responsible, so for us this is the Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information).
One last thing: This declaration applies to all digital products and services of the SPIEGEL Group. When we link to other websites, we have no influence and no control over whether the service provider complies with data protection provisions. If you wish to raise possible problems on a linked site or with one of our partners, please email us.
10. Details on individual services
Our websites use the measurement procedure known as "next-generation innovative scalable central measurement process," or SZMnG, from INFOnline GmbH for calculating key statistical figures on the usage of our products and services. The goal of usage measurement is to statistically determine the number of visits to our websites, the number of website visitors and their surfing behavior - on the basis of a uniform standard procedure - and so obtain values that are comparable across the market. For all digital products and services that are members of the Informationsgemeinschaft zur Feststellung der Verbreitung von Werbeträgern e.V. (IVW; German Audit Bureau of Circulation) or take part in studies of the Arbeitsgemeinschaft Online-Forschung e.V. (AGOF; Working Group for Online Media Research), usage statistics on reach are regularly processed further by AGOF and the Arbeitsgemeinschaft Media-Analyse e.V. (agma; Media Analysis Working Group) and published with the performance value "unique user" as well as the performance values "page impression" and "visits" from IVW. These reach values and statistics can be seen on the respective websites.
1. Legal basis for processing
Measurement using INFOnline GmbH's SZMnG process is carried out on the basis of legitimate interest as defined by Art. 6(1)(f) GDPR. The purpose of processing personal data is the generation of statistics and the formation of user categories. The statistics help us understand and verify the usage of products and services. The user categories form the basis for provision of advertising material and/or advertising measures aligned with your interests. For the marketing of our website, usage measurement that guarantees comparability with other market participants is vital. Our legitimate interest arises from the economic usability of the findings generated by statistics and user categories and the market value of our website - including direct comparison with the websites of third parties - which can be determined using statistics. Moreover, we have a legitimate interest in making available the pseudonymized data from INFOnline, AGOF, agma and IVW for the purposes of market research (AGOF, agma) and for statistical purposes (INFOnline, IVW). Moreover, we have a legitimate interest in making available the pseudonymized data from INFOnline for further development and provision of advertising materials aligned with interests.
2. Type of data
INFOnline GmbH collects the following data which, according to the GDPR, may contain references to individuals:
The validity of cookies is restricted to a maximum of one year.
3. Usage of data
INFOnline GmbH's measurement process, which is used on this website, communicates usage data. This occurs for the collection of the performance values "page impressions," "visits" and "clients" and to generate other key figures from them (e.g. qualified clients). Moreover, we may use the measurement data as follows:
4. Storage duration of the data
INFOnline GmbH does not store the complete IP address. The truncated IP address is stored for a maximum of 60 days. The usage data in connection with the unique identifier is stored for a maximum of six months.
5. Transfer of data
Neither the IP address nor the truncated IP address is transferred. In generating the AGOF study, data is transferred to the following AGOF service providers with client identifiers:
6. Rights of data subjects
Data subjects have the following rights:
For any inquiries related to these rights, please contact email@example.com. Please note that for this type of inquiry, we must be able to establish that we are dealing with the data subject. The data subject has the right to lodge a complaint with the data protection authorities. You can find further information on the measurement process on the website of INFOnline GmbH, which operates the measurement process, the data protection website of AGOF and the data protection website of IVW.
About Our Partnership with IP Deutschland GmbH
Various companies are involved in the marketing of our Internet products and services, both in the collection of data and in the serving of advertising. These companies play different roles. In some cases, they are individually responsible for data processing (controller) or act purely as a service provider carrying out the instructions of a controller (processor). In the context of advertising marketing, IP Deutschland GmbH, Picassoplatz 1, 50679 Cologne, Germany, e-mail: firstname.lastname@example.org, is responsible and are thus, together with us, "joint controllers" under Article 26 of the EU General Data Protection Regulation in terms of our internet products and services. You can find more details about this, about roles and about other responsible parties here.
2) Collection of data in the context of marketing (tracking, profiling, etc. ...)
In order to personalize advertising, design it according to interests and find suitable target groups, to collect information for billing, measure reach and control/limit the serving of ads through frequency capping, a system is used in online advertising that examines user behavior and produces pseudonymized profiles of users, which can then be used in the serving of advertising. As part of that process, products and services that have been visited, content that has been clicked on, etc., are captured and stored. This data is stored within a profile in a database that can be accessed with a cookie or by another means of identification. Names and personal data of users are not stored. The cookie is essentially a pseudonym and does not contain the real name or identity of the user. In some cases, data from other sources, e.g. parts of profiles from registered areas or also technical data about the device used, the time the activity occurred or data from party sources can also be stored. Behavior patterns of users of our products and services are stored and analyzed within the profile and it is in part supplemented by sociodemographic data or assumptions about sociodemographic data (so-called statistical twins of profiles with known data that are compared based on similar or identical surfing behavior). The formation of this profile is also possible across networks, i.e. across a number of internet products or services.
3) Legal basis
Both the operators of the products and services and the other marketers and other entities that serve advertising on the products and services have a legitimate interest in marketing and monetizing their (marketed) products and services through the target group-specific serving of advertising as well as measuring the reach and controlling the serving of advertising with the use of frequency capping. The same applies to the creation of user profiles that make this possible in the first place. This purpose could not be achieved without data processing. Given the pseudonymous nature of the data, users of the products and services will not be individually identifiable to us or our marketers beyond the recognition of the browser and end devices used. Incursions on the user's right of informational self-determination are justified by the fact that the user's data is pseudonymized and is only used for relatively short periods of time. Because users are informed transparently of the procedures used in data protection statements and are also provided with effective possibilities for opting out, incursions on users' rights are minimal and at the expected level. Furthermore, no profiles are produced that focus on children. The legal basis for all processing of data in the scope of marketing is Art. 6 1f of the GDPR ("legitimate interests") or § 15, para. 3 of the German Telemedia Act (Telemediengesetzt).
4) Detailed information about options for objecting
Here, you can find detailed information about the individual data processing procedures and the service providers and participants involved. This overview contains general and detailed information about the names and addresses of the companies that collect, process and/or make personal data available to other third parties, the data categories collected, the purpose of processing and the opt-out options, recipients of data, transfer to third countries, duration of storage and data sources and provides the ability to contact the data protection officer of IP Deutschland GmbH.
To enable advertisements to be delivered in services that lack cookie technology - in mobile apps, for example - technologies similar to cookies may be employed. To disable personalized advertising on your mobile device, please follow the instructions below.
1. Depending on the device, you will find Google Settings at one of the following places:
a. in a separate app called Google Settings
b. scroll through your main Settings app and tap Google
2. Tap on Ads
3. Tap the on-off slider to deactivate personalized ads
iOS devices use Apple's Advertising Identifier. You can find further information about the different possibilities for using this identifier in the app settings on your device.
You can find it as follows:
1. Tap "Settings"
2. Tap "Privacy"
3. Tap "Advertising." From there, you select specific settings using a slider.
Right to object
Should you not wish to take part in measurement on websites, you can object at the following link: https://optout.ioam.de. For technical reasons a cookie must be set to guarantee your exclusion from measuring. Should you delete the cookies in your browser, you will need to repeat the opt-out process at the link above. You can reject measuring in settings; in apps you can deactivate them in settings: for iOS in iOS Settings > App > AGOF-Zählung for Android directly in the app menu under Data protection > IVW/AGOF-Zählung.
© SPIEGEL ONLINE 2018
Alle Rechte vorbehalten
Vervielfältigung nur mit Genehmigung