Data Protection Declaration
Introduction
Controller
Data protection officer
Definitions
Legal basis of the processing
Technology
Cookies
Content of our website
Newsletter
Our social networking activities
Website tracking
Plugins and other services
Oase Control app
Your rights as a data subject
Routine storage, erasure and blocking of personal data
Retention period for personal data
Updates and amendments to the privacy notice
I. Introduction
The aim of the following information is to give you, as a "data subject", an overview of how we process your personal data and your rights under data protection laws. It is generally possible to use our website without entering any personal data. However, if you wish to make use of particular services that we offer via our website, it may be necessary to process personal data. If the processing of personal data is necessary and there is no legal basis for this processing, we will generally obtain your consent.
The processing of personal data, such as your name, address or email address, is always carried out in line with the General Data Protection Regulation (GDPR) and in accordance with the country-specific data protection regulations applicable to OASE GmbH. This privacy notice tells you about the scope and purpose of the personal data that we collect, use and process.
As the controller (the party responsible for data processing), we have implemented numerous technical and organisational measures to provide the most comprehensive protection possible for personal data processed via this website. However, Internet-based data transmissions can be liable to security vulnerabilities, and as such absolute protection cannot be guaranteed. For this reason, you are welcome to send personal data to us by alternative means, for example by telephone or post.
You can also take simple measures that are easy to implement to protect your data against unauthorised access by third parties. With that in mind, we would like to share some tips on how to keep your data safe:
Protect your account (login, user or customer account) and your IT system (computer, laptop, tablet or mobile device) with secure passwords.
Only you should have access to the passwords.
Make sure that you use your passwords only for one account (login, user or customer account) at a time.
Do not use the same password for different websites, applications or online services.
Particularly when using publicly accessible or shared IT systems, the following applies: You should always log out of a website, application or online service after each login.
Passwords should be at least 12 characters long and should not be easy to guess. Therefore, they should not contain common words from everyday life, your own names or relatives' names. They should contain upper- and lower-case letters, numbers and special characters.
2. Controller
The controller within the meaning of the GDPR is:
Oase GmbH
Tecklenburger Str. 161, 48477 Hörstel, Germany
Telephone: +49 (0)5454-80-0
Email: info@oase.com
Representative of the controller: Cornelius Everke, Michael Koch
3. Data protection officer
You can reach the data protection officer using the following contact details:
Thomas Otten
Email: datenschutz-oase@audatis.de
You can contact our data protection officer directly at any time should you have any questions or suggestions about data protection.
4. Definitions
The privacy notice is based on the terms used by the European legislator when adopting the General Data Protection Regulation (GDPR). Our privacy notice is designed to be easy to read and understand by the public, our customers and our business partners. To that end, we would like to explain the terms used in advance.
In this privacy notice, we use the following terms, among others:
1. Personal data
Personal data is any information that relates to an identified or identifiable natural person. An identifiable person is a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
2. Data subject
A data subject is any identified or identifiable natural person whose personal data is processed by the controller (our company).
3. Processing
Processing is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
4. Restriction of processing
Restriction of processing is the marking of stored personal data with the aim of restricting its processing in the future.
5. Profiling
Profiling is any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
6. Pseudonymisation
Pseudonymisation is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
7. Data processor
A processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
8. Recipient
A recipient is a natural or legal person, public authority, agency or another body to which the personal data is disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.
9. Third party
A third party is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
10. Consent
Consent is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which the data subject, by a statement or by another clear affirmative action, signifies agreement to the processing of personal data relating to them.
5. Legal basis of the processing
Article 6(1)(a) GDPR (in conjunction with Section 25(1) of the German Telecommunications and Telemedia Data Protection Act [Telekommunikation-Telemedien-Datenschutz-Gesetz, TTDSG]) serves as the legal basis for processing operations carried out by our company in which we obtain consent for a specific processing purpose.
If the processing of personal data is necessary for the performance of a contract to which you are party, as is the case, for example, with processing operations necessary for the delivery of goods or the provision of another service or consideration, the processing is based on Article 6(1)(b) GDPR. The same applies to processing operations that are necessary for pre-contractual measures, for example in cases of enquiries about our products or services.
If our company is subject to a legal obligation that requires the processing of personal data, for example to fulfil tax obligations, processing is based on Article 6(1)(c) GDPR.
In rare cases, processing personal data may become necessary to protect the vital interests of the data subject or another natural person. This would be the case, for example, if a visitor were injured on our premises and their name, age, health insurance data or other vital information needed to be passed on to a doctor, hospital or other third party. Processing would then be carried out in accordance with Article 6(1)(d) GDPR.
Finally, processing operations could be carried out in accordance with Article 6(1)(f) GDPR. This legal basis is used for processing operations that are not covered by any of the legal bases mentioned above, if processing is necessary to safeguard a legitimate interest of our company or a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject. We are allowed to perform such processing operations in particular because they have been specifically mentioned by the European legislator. In this respect, the legislator took the view that a legitimate interest could be assumed if you are a customer of our company (Recital 47 sentence 2 GDPR).
Our offer is generally aimed at adults. Persons under the age of 16 may not transmit any personal data to us without the consent of their parents or legal guardians. We do not request or collect personal data from children and young people or share such data with third parties.
6. Technology
6.1 SSL/TLS encryption
This site uses SSL or TLS encryption to ensure the security of data processing and to protect the transmission of confidential content, such as orders, login data or contact requests, that you send to us as the operator. You can recognise an encrypted connection by the "https://" and padlock symbol in your browser address bar instead of "http://".
We use this technology to protect your transmitted data.
6.2 Data collection when visiting the website
If you use our website for information purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the data that your browser transmits to our server (in server log files). Our website collects a range of general data and information each time you or an automated system visits a page. This general data and information is stored in the server log files. The following may be collected:
1. the browser types and versions used,
2. the operating system used by the accessing system,
3. the website from which an accessing system reaches our website (known as a referrer),
4. the sub-websites accessed via an accessing system on our website,
5. the date and time of the visit to the website,
6. an abbreviated Internet protocol address (anonymised IP address) and
7. the Internet service provider of the accessing system.
When using this general data and information, we do not make any inferences about you as a person. Rather, this information is needed to
1. deliver the contents of our website correctly,
2. optimise the content of our website as well as the advertising for it,
3. ensure the long-term functionality of our IT systems and the technology used to deliver our website and
4. provide law enforcement authorities with the information necessary for prosecution in the event of a cyber attack.
We therefore analyse this data and information that is collected statistically as well as in order to improve data protection and data security at our company with the ultimate aim of ensuring an optimal level of protection for the personal data we process. The anonymous data in the server log files is stored separately from any personal data provided by a data subject.
The legal basis for this data processing is Article 6(1)(f) GDPR. Our legitimate interest is derived from the data collection purposes listed above.
6.3 Encrypted payment transactions
If, after concluding a fee-based contract, there is an obligation to provide us with your payment data (e.g. the provision of the account number when issuing the direct debit authorisation), this data is required for payment processing.
Payment transactions executed via standard methods of payment (Visa/MasterCard or direct debit) are carried out exclusively via an encrypted SSL or TLS connection. You can recognise an encrypted connection by the fact that the "http://" in your browser address bar changes to "https://" and a padlock symbol appears.
We use this technology to protect your transmitted data.
7. Cookies
7.1 General information about cookies
Cookies are small files that your browser automatically creates and are stored on your IT system (laptop, tablet, smartphone etc.) when you visit our site.
The cookie stores information that results from the connection with the specific end device used. However, this does not mean that we immediately learn your identity.
The purpose of cookies is to make the use of our website a more pleasant experience for you. We use what are referred to as session cookies to recognise when you have already visited individual pages of our website before. These cookies are deleted automatically after you leave our site.
We also use temporary cookies, which are stored on your device for a specific period of time, to optimise the user experience. If you visit our website again to use our services, it will automatically detect that you have visited the site before and remember which entries and settings you made so that you do not have to repeat them.
In addition, we use cookies to collect statistics on the use of our website and to evaluate our website in order to optimise it for you. These cookies allow us to automatically recognise that you have visited our website before when you return to our site. The cookies used for this purpose are automatically deleted after a set period of time. The relevant storage duration of the cookies can be found in the settings of the consent tool used.
8. Content of our website
8.1 Data processing in connection with the opening of a customer account and the performance of a contract
Pursuant to Article 6(1)(b) GDPR, data may be collected and processed if you have provided us with this data in connection with the performance of a contract or the opening of a customer account. The types of data that are collected can be determined from the relevant input forms. You can delete your customer account at any time, for example by emailing the controller (using the email address provided above). We will store and use the data that you provide for performance of the contract. Once the contract has been performed in full or your customer account has been deleted, your data will be blocked until expiry of the relevant retention periods under tax and commercial law and then erased, unless you have expressly consented to further use of your data or we are permitted by law to continue using the data; we will inform you below of any such permitted uses of your data.
8.2 Data processing for order handling
To the extent necessary, and within the framework of contract performance, the personal data that we collect will be transferred to the shipping company responsible for delivering the goods. Insofar as is necessary for the purpose of processing your payment, we will transfer your payment details to the relevant financial institution. If payment service providers are used, we will explicitly inform you thereof in the following paragraphs. The legal basis for this transfer of data is Article 6(1)(b) GDPR.
8.3 Conclusion of contracts for online shop, dealers and shipment of goods
We only transfer personal data to third parties if this is necessary in connection with performance of the contract, for example to the companies responsible for delivering the goods or the financial institution responsible for processing the payment. Further data transfers will not take place or will only take place if you have expressly consented to them. Your data will not be transferred to third parties, e.g. for advertising purposes, without your express consent.
The basis for data processing is Article 6(1)(b) GDPR, which permits the processing of data in connection with the performance of a contract or pre-contractual measures.
8.4 Contact/contact form
Your personal data will be collected if you make contact with us (e.g. via a contact form or by email). The types of data collected if you use a contact form to contact us can be determined from the relevant contact form. The data will be stored and used exclusively for the purpose of answering your query or for making contact, and for the associated technical administrative matters. The legal basis for the processing of the data is our legitimate interest in responding to your query pursuant to Article 6(1)(f) GDPR. If you have made contact for the purpose of concluding a contract, Article 6(1)(b) GDPR will serve as an additional legal basis for processing. Once your query has been answered, your data will be deleted; this can be assumed to be the case if it is clear from the circumstances that the matter has been concluded and if there are no statutory retention obligations that would prevent deletion of the data.
8.5 Application management/list of vacancies
We collect and process job applicants' personal data for the purpose of handling the application procedure. This data may also be processed electronically. In particular, this will be the case if an applicant sends us the relevant application documents electronically, for example by email or via a web form on the website. If we enter into an employment or service contract with an applicant, the data that has been transferred will be stored in accordance with the statutory provisions for the purpose of handling the employment relationship. If we decide not to enter into a contract with the applicant, the application documents will automatically be deleted two months after the applicant has been notified of the corresponding decision, provided that there are no other legitimate interests on our part that would prevent their deletion. Other legitimate interests in this connection include e.g. an obligation to provide evidence in proceedings under the German General Equal Treatment Act [Allgemeines Gleichbehandlungsgesetz, AGG].
The legal basis for the processing of your data is Article 88 GDPR in conjunction with Section 26(1) of the German Federal Data Protection Act [Bundesdatenschutzgesetz, BDSG].
8.6 Handling of customer and supplier data
We will process your data (including your personal data) for the purpose of arranging, performing and handling contractual relationships, for preparing offers and for invoicing, as well as for making contact and providing information as part of the customer service relationship.
1. Legal basis for data processing
The processing of data is necessary for performance of a contract or pre-contractual measures pursuant to Article 6(1)(b) GDPR or to protect our legitimate interest pursuant to Article 6(1)(f) GDPR, and there are no overriding interests or fundamental rights and freedoms on the part of the data subject.
2. Categories of recipients
Internal recipients include Consulting, Contract Management, Accounting, Controlling and Back Office. We also use service providers (contract processors) to fulfil our tasks, such as IT service providers and hosting providers, and transfer data to authorities or courts within the scope of our legal obligations.
8.7. Handling of visitor data
We will process your data (including your personal data) for the purpose of checking whether you are entitled to access the building. We will store the following data in this connection:
contact details of visitors (title, surname, first name, email address)
details of the actual visit (location, building, date, time)
1. Legal basis for data processing
Processing is necessary for the purpose of monitoring access to the building and protecting our legitimate interest pursuant to Article 6(1)(f) GDPR; there are no overriding interests or fundamental rights and freedoms on the part of the data subject.
2. Retention period
Your personal data will be stored for a period of one year from your last visit.
9. Newsletter
9.1 Newsletter for existing customers
If you have provided us with your email address when purchasing goods or services, we reserve the right to send you regular offers by email regarding goods or services from our range that are similar to those that you have already purchased. Pursuant to Section 7(3) of the German Act against Unfair Competition [Gesetz gegen den unlauteren Wettbewerb, UWG], we do not have to obtain any separate consent from you for this. Data will be processed in this connection solely on the basis of our legitimate interest in personalised direct advertising pursuant to Article 6(1)(f) GDPR. If you initially object to the use of your email address for this purpose, we will not send you any emails. You are entitled to object to the use of your email address for the aforementioned advertising purposes at any time with future effect, by emailing the controller (email address provided above). You will only be charged the transmission costs in accordance with the basic tariffs. Once we receive your objection, we will immediately stop using your email address for advertising purposes.
9.2 Advertising newsletter
You can subscribe to our company's newsletter on our website. The personal data transferred to us is defined from the input screen when you subscribe to the newsletter.
We send a newsletter to our customers and business partners at regular intervals to inform them about our offers. As a basic principle, you may only receive our company's newsletter if
1. you have a valid email address, and
2. you have registered to receive a newsletter.
For legal reasons, a double opt-in confirmation email will be sent to the email address you first provided when subscribing to the newsletter. This confirmation email is used to check that you are the owner of the email address and that you have authorised a subscription to the newsletter.
When you register for the newsletter, we also store the IP address (assigned by your Internet Service Provider or ISP) of the IT system you used at the time you registered, as well as the date and time of your registration. It is necessary to collect this data as a basis for investigating any (potential) misuse of your email address at a later date, or in other words as a means of protecting our legal interests.
The personal data collected in connection with a subscription to the newsletter will be used exclusively for the purpose of sending out the newsletter. Subscribers to the newsletter may also receive emails insofar as this is necessary for operation of the newsletter service or if an additional registration is required, for example if changes are made to the newsletters that are offered or if technical changes are made. The personal data collected in connection with a subscription to the newsletter is not transferred to third parties. You can cancel your subscription to our newsletter at any time. Consent to the storage of personal data that has been granted for the purpose of receiving the newsletter can be withdrawn at any time. Each newsletter contains a link that can be followed to withdraw consent. It is also possible to unsubscribe from the newsletter at any time directly on our website or to contact us in another way with an unsubscribe request.
The legal basis for processing data for the purpose of sending out the newsletter is Article 6(1)(a) GDPR.
9.3 Episerver
We use Episerver to send newsletters. The provider is Episerver GmbH, Wallstraße 16, 10179 Berlin. Episerver is a service that can be used to organise and analyse newsletter delivery. The data entered to receive the newsletter (e.g. email address) is stored on Episerver's servers.
Our newsletters sent via Episerver enable us to analyse the behaviour of newsletter recipients. For example, we can analyse how many recipients have opened the newsletter and how often each link in the newsletter was clicked on. With the aid of conversion tracking, we can also analyse whether a predefined action (e.g. purchase of a product on our website) has taken place after clicking on the link in the newsletter.
In the case of newsletters sent to our existing customers, the analysis is carried out on the basis of our legitimate interest in determining the success of our newsletter as well as optimising the content of the newsletter (Article 6(1)(f) GDPR). If you register to receive our newsletter, the analysis is carried out on the basis of your consent to this processing, which was granted as part of the registration process (Article 6(1)(a) GDPR).
If you do not want the Episerver analysis to be conducted, you must unsubscribe from the newsletter. We provide an unsubscribe link in every newsletter for this purpose. You can also unsubscribe from the newsletter directly on the website.
We will retain the data that you have provided in order to subscribe to the newsletter until you unsubscribe from the newsletter. Once you have unsubscribed from the newsletter, this data will blocked on both our servers and Episerver's servers so that it cannot be used to send any further newsletters. If you wish to request the deletion of your data stored for the purposes of the newsletter, please notify us accordingly. Data that we have stored for other purposes (e.g. email addresses for the member area) is not affected by this.
For more information on Episerver's privacy policy, visit: https://www.episerver.com/de/legal/datenschutz.
10. Our social networking activities
We have our own pages on social networks in order to communicate with you and provide you with information about our services. If you visit one of our social media pages, we and the provider of the social media platform concerned are jointly responsible for the processing operations triggered by this visit in accordance with Article 26 GDPR.
We are not the original provider of these pages; we use them only within the scope of the opportunities offered to us by the relevant providers.
As a precautionary measure, we would therefore like to point out that your data may also be processed outside the European Union or the European Economic Area. Use of the data may therefore involve data protection risks since it may be more difficult for you to exercise your rights, e.g. the right to information, the right to erasure, the right to object etc., and data is frequently processed directly by social networks for advertising purposes or to analyse user behaviour in a manner that is beyond our control. If the provider creates user profiles, this often involves the use of cookies or the assignment of user behaviour to the member profile you have created on the social networks.
The described processing of personal data is carried out in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest and the legitimate interest of the respective provider in communicating with you in a timely manner or informing you about our services. If you, as a user, are required to give your consent to data processing to the respective provider, the legal basis is Article 6(1)(a) GDPR in conjunction with Article 7 GDPR.
Since we do not have access to the providers' databases, we would like to point out that it is advisable for you to contact the relevant provider directly to exercise your rights (e.g. to information, correction, erasure etc.). Further information on the processing of your data by social networks is listed below for the individual providers of social networks on which we have a presence:
10.1 Facebook
(Joint) data controller in Europe:
Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
Privacy policy:
10.2 Instagram
(Joint) data controller in Germany:
Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
Privacy policy:
10.3 LinkedIn
(Joint) data controller in Europe:
LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland
Privacy notice:
10.4 YouTube
(Joint) data controller in Europe:
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Privacy notice:
11. Website tracking
11.1 Google Analytics
On our website we use Google Analytics, a web analytics service provided by Google Ireland Limited (https://about.google/intl/en/) Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). In this context, we create pseudonymous user profiles and use cookies (see the section "Cookies"). The information generated by the cookie concerning your use of the website, such as
1. the browser type/version,
2. the operating system used,
3. the referrer URL (the last page you visited before our website),
4. the host name of the computer used to access the website (IP address) and
5. the time of the server request,
are transferred to a Google server in the USA and stored there. This information is used to assess the use of the website, to compile reports on website activities and to provide other services related to the use of the website and of the Internet for the purposes of market research, as well as to allow us to design our website to better suit user needs. This information may also be transferred to third parties if required by law or if these third parties are processing this data on our behalf. Under no circumstances will your IP address be combined with other data from Google. IP addresses are anonymised to ensure that it is not possible to make any associations (IP masking).
You can prevent the storage of cookies using the appropriate settings in your browser; however, please note that if you do so, you may not be able to access the full functionality of some of the features of our website.
These processing operations will only be carried out if you grant express consent pursuant to Article 6(1)(a) GDPR.
You can also prevent the collection of data generated by the cookie and related to your use of this website (including your IP address) as well as Google's processing of this data by downloading and installing a browser add-on (https://tools.google.com/dlpage/gaoptout?hl=en-GB).
As a US company, the parent company Google LLC is certified under the EU-US Data Privacy Framework. Accordingly, an adequacy decision has been issued pursuant to Article 45 GDPR, which means that personal data may be transferred without the provision of further guarantees or additional measures.
The privacy policy for Google Analytics can be viewed at: https://support.google.com/analytics/answer/6004245?hl=en-gb.
12. Plugins and other services
12.1 Google Maps
We use Google Maps (API) on our website. Google Maps is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland Limited is part of the Google group of companies headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Maps is a web service used to display interactive (land) maps to visualise geographic information. For example, this service allows us to show you our location and makes it easier for you to reach us.
When you visit subpages that incorporate Google Maps, information about your use of our website (such as your IP address) is transferred to Google servers in the USA and stored there, provided that you have given your consent in accordance with Article 6(1)(a) GDPR. In addition, Google Maps downloads Google Fonts, Google Photos and Google Stats. The provider of these services is also Google Ireland Limited. When you visit a page that incorporates Google Maps, your browser loads the web fonts and photos required to display Google Maps into your browser cache. The browser that you use also establishes a connection to Google's servers for this same purpose. This lets Google know that our website has been accessed via your IP address. This happens regardless of whether Google provides a user account that you are logged into or whether there is no user account. If you are logged into Google, your data will be assigned directly to your account. If you do not want this data to be associated with your Google profile, you must log out of your Google user account. Google stores your data (even for users who are not logged in) as user profiles and analyses them. You have the right to object to the creation of these user profiles, and must contact Google to exercise this right.
If you do not consent to the future transfer of your data to Google in connection with the use of Google Maps, there is also the option to deactivate the Google Maps web service completely by disabling the JavaScript application in your browser. It will then not be possible to use Google Maps or the map display on this website.
These processing operations will only be carried out if you grant express consent pursuant to Article 6(1)(a) GDPR.
Google's terms of service can be viewed at https://policies.google.com/terms?hl=en-gb, and the additional terms of service for Google Maps can be found at https://www.google.com/intl/en-gb/help/terms_maps/.
As a US company, the parent company Google LLC is certified under the EU-US Data Privacy Framework. Accordingly, an adequacy decision has been issued pursuant to Article 45 GDPR, which means that personal data may be transferred without the provision of further guarantees or additional measures.
The privacy policy for Google Maps can be viewed at: https://www.google.com/policies/privacy/.
12.2 Google Photos
We use Google Photos, a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, to store the images that are embedded on our website.
Embedding involves the integration of certain third-party content (text, video or image data) that is provided by another website (Google Photos) and then appears on our own website. An embed code is used for the embedding. If we have integrated an embed code, the external content from Google Photos is displayed immediately by default as soon as our website is visited.
As part of the technical implementation of the embed code, which enables the Google Photos images to be displayed, your IP address is transferred to Google Photos. Google Photos also collects our website, the type of browser used, the browser language and the time and length of access. In addition, Google Photos may collect information about which of our subpages you have visited and which links you have clicked on, as well as other interactions you have performed on our site. This data may be stored and analysed by Google Photos.
These processing operations will only be carried out if you grant express consent pursuant to Article 6(1)(a) GDPR.
This US company is certified under the EU-US Data Privacy Framework. Accordingly, an adequacy decision has been issued pursuant to Article 45 GDPR, which means that personal data may be transferred without the provision of further guarantees or additional measures.
Google's privacy policy can be viewed at: https://www.google.com/policies/privacy/.
12.3 Google Tag Manager
We use the Google Tag Manager service on this website. Google Tag Manager is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland Limited is part of the Google group of companies headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
This tool allows "website tags" (i.e. keywords that are embedded in HTML elements) to be implemented and managed via an interface. Google Tag Manager enables us to automatically track which button, link or personalised image you have actively clicked on and then record which content on our website is particularly interesting to you.
The tool also triggers other tags that may collect data about you on your device. Google Tag Manager does not access this data. If a deactivation has been made at the domain or cookie level, it remains in place for all tracking tags, insofar as these are implemented with the Google Tag Manager.
These processing operations will only be carried out if you grant express consent pursuant to Article 6(1)(a) GDPR.
As a US company, the parent company Google LLC is certified under the EU-US Data Privacy Framework. Accordingly, an adequacy decision has been issued pursuant to Article 45 GDPR, which means that personal data may be transferred without the provision of further guarantees or additional measures.
For more information on Google Tag Manager and Google's privacy policy, please visit: https://www.google.com/policies/privacy/.
12.4 Google Fonts
Our website uses web fonts to ensure that fonts are displayed consistently. Google Fonts is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland Limited is part of the Google group of companies headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
These processing operations will only be carried out if you grant express consent pursuant to Article 6(1)(a) GDPR.
As a US company, the parent company Google LLC is certified under the EU-US Data Privacy Framework. Accordingly, an adequacy decision has been issued pursuant to Article 45 GDPR, which means that personal data may be transferred without the provision of further guarantees or additional measures.
Further information on Google Fonts can be found at https://developers.google.com/fonts/faq and Google's privacy policy is available at https://www.google.com/policies/privacy/.
12.5 YouTube videos in extended data protection mode (YouTube-NoCookies)
Some subpages on our website contain links to YouTube. As a general rule, we are not responsible for the content on linked websites. However, if you follow a link to YouTube, we would like to point out that YouTube stores the data of its users (e.g. personal information, IP address) in accordance with its own data use policies and uses it for business purposes.
YouTube is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA.
We also directly incorporate videos stored on YouTube on some of the subpages of our website. This means that content from the YouTube website is displayed in sections of a browser window. If you visit a (sub)page of our website that contains integrated YouTube videos, a connection to the YouTube servers is established and the content is displayed on the website by sending a corresponding message to your browser.
YouTube content is only incorporated in "extended data protection mode". This mode, which is provided by YouTube itself, ensures that YouTube does not initially store cookies on your device. However, when you visit the pages concerned, the IP address and, where necessary, other data is transmitted. In particular, this includes information on which of our webpages you have visited. However, this information cannot be linked to you unless you have logged into YouTube or another Google service or are permanently logged in before you visit the site. Because YouTube content is incorporated in extended data protection mode, when you click on an incorporated video to start playing it, YouTube will only store cookies on your device that do not contain personally identifiable data, unless you are currently logged into a Google service. You can prevent these cookies from being stored by configuring your browser settings and extensions accordingly.
The request for the video also constitutes your consent to the placement of the corresponding cookie (Article 6(1)(a) GDPR).
This US company is certified under the EU-US Data Privacy Framework. Accordingly, an adequacy decision has been issued pursuant to Article 45 GDPR, which means that personal data may be transferred without the provision of further guarantees or additional measures.
YouTube's privacy policy can be viewed at: https://www.google.com/policies/privacy/.
12.6. ThingLink
ThingLink processes data visually (videos, panoramas etc.) for our website. ThingLink collects the following data in an embedded display: IP address, browser, statistics (views, hovers, clicks per image). This data is stored for 30 days. The provider is Thinglink Oy, Bulevardi 7, 00120 Helsinki, Finland. Privacy notice: https://www.thinglink.com/privacy.
The legal basis for the processing is based on your consent given in accordance with Article 6(1)(a) GDPR.
12.7 Sklik/imedia.cz
We use the Seznam Sklik conversion tracking technology and retargeting feature on our website. This service is provided by seznam.cz, a.s., Prag 5- Smíchov, Radlická 3294/10, 15000, Czech Republic (hereinafter: Sklik).
This technology enables personalised ads to be displayed in the Sklik partner network for visitors to our website.
Sklik provides further information on its privacy practices at
12.8 Fastly
We use the CDN service "Fastly" provided by Fastly, Inc., Attention:General Counsel, 475 Brannan St., Suite 300 San Francisco, CA 94107. This is a content delivery network (CDN). A CDN is a network of powerful servers that cache content in multiple locations around the world. The legal basis for the use of Fastly and the transfer of your data to it is Article 6(1)(f) GDPR (legitimate interest in data processing), unless otherwise specified for the service concerned. The legitimate interest arises from our need for our website to load quickly without any technical issues and our need to relieve the burden on our IT infrastructure.
For more information on how user data is handled, see Fastly's privacy policy: https://www.fastly.com/privacy/.
13. Privacy Notice for the OASE Control App and the OASE Switch App
We are delighted that you are interested in our mobile applications. The following information explains which personal data we process in connection with the use of the OASE Control App and the OASE Switch App, the purposes for which this is done, the legal basis for the processing, to whom data may be disclosed, how long data is stored and what rights you have. This information is provided in a precise, transparent, comprehensible and easily accessible form.
13.1 Scope
This privacy notice applies to the use of the OASE Control App, the OASE Switch App and the associated functions, in particular user accounts, device integration, cloud functions, fault and service communications, optional voice assistants, support tickets, multi-user/sharing functions, error reports and – where actually used – statistical and BI-based analyses. The privacy policies of the respective app store operators also apply to the mere use of app stores.
13.2 App download via the Apple App Store / Google Play
When downloading the app, technically necessary information is transmitted to the respective app store operator. We have only limited influence over this processing. Insofar as we arrange for the app to be made available in the stores, the associated processing is based on our legitimate interest in the distribution of the app or – insofar as a user agreement is already established through the download – on the initiation or performance of the contract. Information regarding any transfers to third countries is also governed by the terms and conditions of the respective store operator.
13.3 Processing in connection with the OASE Control app
When you use the OASE Control app, we process, in particular, account data, login details, device and controller assignments, configurations, usage events, operational and sensor data, fault and status messages, synchronisation events, support details and – where you have enabled them – data relating to voice assistants and error reports. This processing is generally necessary in order to provide you with the app, your user account, cloud synchronisation, remote control, history, alarm notifications and the management of multiple devices or multiple users. The legal basis for this is generally Article 6(1)(b) of the GDPR.
13.4 Cloud synchronisation, history and remote access
Where you use cloud functions, operational, status, measurement and sensor data are transmitted to our cloud infrastructure to enable device history, cross-device synchronisation of your account and control outside your local network. If you disable cloud interactions in the settings, certain data and control functions will only be available to you locally. This cloud data is processed for the purpose of fulfilling the contract. Categories, frequencies and technical details of the synchronisation are also set out in the Data Act information for the relevant products.
13.5 Local operation without the cloud
Depending on your device configuration, certain functions of the OASE Control app can be used purely locally within your network. In this case, operational, status and sensor data are processed only locally, provided that no other function you have activated triggers a transmission to OASE or a third-party provider. Insofar as data remains exclusively on your device or within your local network and is not accessible to us, our role is limited to providing the software functionality.
13.6 Account sharing and invitation function
If you invite other people to a device, household or system network, we process the authorisation and assignment data required for this. Depending on the technical setup, invitation links, QR codes, email addresses, names or other identifying characteristics of the users involved may be processed. The legal basis is the performance of the contract, insofar as you consciously use this function. Where invitation emails are sent, we use an email service provider for this purpose. Before granting access, you should be aware that, depending on the role and access model, invited persons may receive information about the system and about the user sending the invitation.
13.7 Transaction emails and service communications
We send emails that are necessary for the set-up, security and use of your user account or your devices. These include, in particular:
Registration and verification emails,
Password reset emails,
Emails regarding changes to account details,
Invitations relating to account-sharing and authorisation features,
Alerts and error messages from devices,
Safety and service information,
other technically necessary notifications relating to the use of our apps and services.
To send these emails, we use the Twilio SendGrid service, a service provided by Twilio Inc., 101 Spear Street, 5th Floor, San Francisco, CA 94105, USA.
In particular, the following data is processed in connection with the sending of emails:
The recipient’s email address,
Time of dispatch,
Delivery status,
Technical dispatch and delivery information,
Where applicable, the content of the message sent.
Processing is carried out for the purpose of providing and performing the services you use, as well as to ensure secure and reliable email delivery.
The legal basis for sending contract-related and technically necessary messages is Article 6(1)(b) of the GDPR.
Where dispatch and delivery logs are processed to ensure deliverability, for error analysis or to prevent misuse, this is done on the basis of our legitimate interest pursuant to Article 6(1)(f) of the GDPR.
According to Twilio, so-called ‘Email Activity Data’ is stored in the United States. Sending and delivery logs are generally stored for a period of 30 days and then deleted.
Further information on data protection at Twilio SendGrid can be found at:
13.8 Support tickets and fault handling
If you use in-app support or other support channels, we process the information you provide, e.g. contact details, a description of the problem, affected devices, error messages and the processing history in the ticketing system. Where access to cloud data or system logs is necessary to process your enquiry, this is done for the purpose of handling your support request and is therefore generally based on Article 6(1)(b) of the GDPR. Access by our support staff should only be role-based, limited to the specific purpose and logged.
13.9 Optional voice assistants
If you connect to Amazon Alexa or Google Assistant, we process the mapping and integration data required for this purpose. Activating this feature is optional and not required for the core functionality of the app. The legal basis is therefore, in principle, your consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect. Depending on the technical setup, deactivation and unpairing can be carried out in the OASE app, in the voice assistant’s app, or in both systems; the key requirement is that the actual data flow can be terminated and the user is clearly informed of this.
13.10 Error reports and app diagnostics
Where we process error or crash reports, this is done solely for the purposes of ensuring the stability, analysing errors and improving the technical performance of the app. Where such processing is not necessary for the direct performance of the contract, it should only take place on the basis of separate consent. Your consent must be voluntary, specific to the purpose and revocable; revocation must be as easy as giving consent.
13.11 Statistical Analysis and BI/Reporting
We may analyse usage, operational and service data in a manner compliant with data protection regulations for the purposes of internal statistics, product improvement, capacity planning, error analysis and service quality.
13.12 Processing in connection with the OASE Switch app
The OASE Switch App is currently designed as a locally operating application. No OASE user account is required to use it; according to your description, no control or sensor data is transmitted to an OASE cloud. The app uses Bluetooth/BLE to communicate with devices locally and may use location data locally, insofar as this is necessary for the Sunrise Timer or similar local automations. If the location data does not leave the OASE ecosystem, this should be explicitly clarified in this privacy notice. The legal basis for locally required permissions and local processing is the provision of the app’s functionality; where operating system permissions are required, these are additionally controlled by the respective OS.
13.13 Use of location data
Insofar as the OASE Switch app and OASE Control app use location coordinates for sunrise/sunset functions, this processing is carried out solely to calculate the automatic timing you have requested. According to your description, the coordinates are used locally within the app or the controller and are not transmitted to OASE.
13.14 Recipients and data processors
Depending on the function used, we may engage service providers for cloud operations, email dispatch, voice assistant integration, fault analysis, support and reporting.
The recipients and data processors we use include, in particular:
Microsoft Azure (hosting and cloud infrastructure)
Twilio SendGrid (sending transactional, verification, alert and service emails)
Google Firebase Crashlytics (error analysis and app diagnostics, where enabled)
Voice assistant providers such as Amazon Alexa or Google Assistant (only if integration is enabled); activation and deactivation of the link are carried out exclusively via the respective third-party application (e.g. Amazon Alexa or Google Home).
Providers of support and ticketing systems (where used)
Providers of reporting and business intelligence solutions (where used)
Where these service providers process personal data on our behalf, this is done on the basis of a data processing agreement in accordance with Article 28 of the GDPR or another permissible legal basis under data protection law.
If you invite other users to share devices, the data required for this purpose will be processed. This includes, in particular, the disclosure of the inviting user’s registered email address to the invited person, insofar as this is necessary to fulfil the invitation.
Security-related authentication information (e.g. device passwords or cryptographic keys) is processed only to the extent necessary for the secure operation of the system.
13.15 Transfers to third countries
Where personal data is transferred to recipients outside the European Economic Area (EEA), this is done exclusively in accordance with the legal requirements set out in Articles 44 et seq. of the GDPR.
This may, in particular, concern the following service providers:
Google Firebase Crashlytics (USA),
Twilio SendGrid (USA),
Other providers of voice assistants or technical services, where applicable.
Where data is transferred to the USA, we base this on appropriate safeguards in accordance with Article 46 of the GDPR, in particular the Standard Contractual Clauses (SCCs) adopted by the European Commission.
Where individual recipients are additionally certified under the EU-US Data Privacy Framework, the transfer may also be based on an adequacy decision in accordance with Article 45 of the GDPR.
Further information on the relevant safeguards is available on request.
13.16 Retention period and erasure
We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention obligations. We generally store account data and associated cloud data for the duration of the active user account; following the deletion of the account, the data is deleted unless statutory obligations or legitimate grounds for temporary retention preclude this. Separate time limits apply to support tickets, dispatch logs, invitation tokens, error reports, security logs and BI pre-processes. If you do not use your account for 3 years, OASE will classify it as inactive. Once this period has expired, you will receive an email asking you to log in to your account within 3 weeks. If you do not log in to your account by the deadline specified in the email, it will be automatically deleted, including all stored data. For data stored locally in the OASE Switch app, processing generally ceases upon deletion of the app or removal of the local data from your device, provided that no server-side processing takes place.
13.17 Overview of legal bases
Where we process data because this is necessary for the provision of the app, the user account, cloud synchronisation, device control, the sharing function, alarm communication or for support enquiries, the processing is generally based on Article 6(1)(b) of the GDPR. Where we process data due to legal obligations, Article 6(1)(c) of the GDPR applies. Where we process data for IT security, fraud prevention, logging or stable technical operation, Article 6(1)(f) of the GDPR may apply, provided that a balancing of interests supports this. For optional features such as voice assistants or voluntary error reports, we rely – where necessary – on Article 6(1)(a) of the GDPR.
13.18 Your rights
The rights under the Data Act supplement your rights under section 14 insofar as data from connected products or associated services is concerned; they do not replace the GDPR.
13.19 Security and privacy-friendly default settings
We implement technical and organisational measures to protect personal data from unauthorised access, loss, alteration or unauthorised disclosure. These include, in particular, role-based authorisation schemes, access restrictions, logging, encryption, regular deletion routines and privacy-friendly default settings. Optional features involving a higher volume of data, in particular voice assistants and voluntary error reports, should remain disabled by default and only be activated following a conscious decision by the user.
13.20 Changes to this Privacy Notice
We update this privacy notice if there are significant changes to legal requirements, technical processes or the service providers we use. In the event of significant changes, we will inform users in an appropriate manner, for example within the app, by email or on our website. Where a change relates to new or amended processing operations requiring consent, we will seek consent again.
Information about your rights regarding product and related service data under Regulation (EU) 2023/2854 (the Data Act) can be found in our separate information sheet on the Data Act.
Recipient | Purpose | Legal basis |
Microsoft Corporation One Microsoft Way | Operating our app | EU standard contractual clauses + consent |
Amazon Europe Core 38 Avenue John F. Kennedy | Alexa integration | EU standard contractual clauses + consent |
Google Ireland Limited Gordon House, Barrow Street | Assistant integration | Google EU standard contractual clauses + consent |
Your data will not be subject to automated decision-making, including profiling.
14. Your rights as a data subject
14.1 Right to confirmation
You have the right to request confirmation from us as to whether personal data concerning you is being processed.
14.2 Right of access – Article 15 GDPR
You have the right to obtain information from us free of charge at any time about the personal data stored relating to you, as well as a copy of this data in accordance with the statutory provisions.
14.3 Right to rectification – Article 16 GDPR
You have the right to request the correction of inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to request the completion of incomplete personal data.
14.4 Right to erasure – Article 17 GDPR
You have the right to request that we erase the personal data concerning you immediately, provided that one of the reasons provided for by law applies and provided that the processing or retention of the data is not necessary.
14.5 Right to restriction of processing – Article 18 GDPR
You have the right to obtain the restriction of processing from us if one of the legal requirements is met.
14.6 Right to data portability – Article 20 GDPR
You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format. You also have the right to transfer this data to another controller to whom the personal data has been provided without hindrance by us, provided that the processing is based on consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR or on a contract pursuant to Article 6(1)(b) GDPR and the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
In addition, when exercising your right to data portability pursuant to Article 20(1) GDPR, you have the right to have the personal data transmitted directly from one controller to another, insofar as this is technically feasible and insofar as this does not impinge on the rights and freedoms of other persons.
14.7 Right to object – Article 21 GDPR
You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Article 6(1)(e) (data processing in the public interest) or Article 6(1)(f) (data processing based on a balancing of interests) of the GDPR.
This also applies to profiling based on these provisions in accordance with Article 4(4) GDPR.
If you file an objection, we will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing is carried out for the establishment, exercise or defence of legal claims.
In individual cases, we process personal data for direct marketing purposes. You may object to the processing of personal data for these marketing purposes at any time. This also applies to profiling, insofar as it is performed in connection with such direct marketing. If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes.
In addition, where personal data is processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) GDPR, you have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.
14.8 Right to withdraw data protection consent
You have the right to withdraw your consent to the processing of personal data at any time with effect for the future.
14.9 Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a supervisory authority responsible for data protection about our processing of personal data.
15. Routine storage, erasure and blocking of personal data
We process and store your personal data only for the period necessary to achieve the purpose of storage or for the period required by the laws applicable to our company.
Once the purpose of storage ceases to apply or a prescribed retention period expires, the personal data will be routinely blocked or erased in accordance with the statutory provisions.
16. Retention period for personal data
The criterion for the length of time that personal data is stored for is the respective statutory retention period. Once this period expires, the data concerned will be routinely erased, unless it is still required for the performance or initiation of a contract.
17. Updates and amendments to the privacy notice
This privacy notice is currently valid and was last updated in January 2024.
The further development of our website and goods and services or changes in legal or official requirements may necessitate changes to this privacy notice. The current privacy notice can be accessed and printed at any time via our website at "https://www.oase.com/gb-en/data-protection-declaration.html".