Data Privacy

Data protection provisions (Version: September 01, 2023)

The following data protection provisions apply to the website www.prosiebensat1.com ("Online Offer").

We participate in the "IAB Europe Transparency & Consent Framework" and adhere to its specifications and guidelines. We enable you to manage your consents and objections in our Consent Management Plattform with the identification number 318 ("CMP").

1.     Who are we (Controller) and how to contact us?

The person responsible in the sense of data protection law is

ProSiebenSat.1 Media SE
Medienallee 7
85774 Unterföhring

Vorstand:
Bert Habets (Vorstandsvorsitzender, Group CEO)
Martin Mildner
Christine Scheffler

Aufsichtsratsvorsitzender: Dr. Andreas Wiele

Tel.: +49 [0] 89 950710
info@ProSiebenSat1.com,

hereinafter "we" or "us". 

Exceptions are explained in this data protection provisions.

2.     Contact details of our data protection officer

For information and suggestions on the subject of data protection, we or our data protection officer will be pleased to be at your disposal at the e-mail address datenschutz@prosiebensat1.com.

If you have any questions about this data protection notice or generally about the processing of your data in the context of this online offering, please contact our data protection officer:

ProSiebenSat.1 Media SE
Data Protection Officer
Medienallee 7
85774 Unterföhring

3.     What do we process your personal data for and on what legal basis?

Personal data is any information relating to an identified or identifiable natural person. When we process personal data, this means that we collect, store, use, transmit to others or delete it.

We process your personal data for the following purposes and - to the extent required by applicable law - on the basis of the aforementioned legal grounds. In the event that the data processing is based on the legal basis of Legitimate Interest, we will also explain our legitimate interest that we pursue with the processing.

Please note your right to object to the processing of data for the purpose of direct marketing or for personal reasons (see point 10 and sections: Your right to object to direct marketing and Your right to object on personal grounds).

Purposes of processing in connection with Cookies 

Processes based on cookies are integrated into this online offering. We participate in the IAB Europe Transparency & Consent Framework and adhere to its specifications and guidelines. Below you will find information on the purposes for which we or our partners use cookies. You can learn more about this in our CMP.

4.     Who gets your personal data and why?

Disclosure of data to third parties

We will only pass on your personal data to third parties if this is necessary for the fulfillment of the contract, if we or the third party have a legitimate interest in passing on the data, if we have your consent to do so or if this is necessary for the fulfillment of a legal obligation.

We may disclose personal data to a third party in particular if

• if we are obliged to do so by law or by enforceable official or court order in an individual case;
• in connection with legal disputes (vis-à-vis courts or our lawyers) or audits (vis-à-vis auditors);
• in connection with possible criminal acts to the competent investigative authorities;
• in the event of sale of the business (to the acquirer).

If data may be transferred to other third parties on a regular basis, this will be explained in this data protection notice. In the case of transfer on the basis of consent, the explanation can also be provided when consent is obtained.

Passing on data to service providers

We reserve the right to use service providers for the collection or processing of data. Service providers only receive the personal data from us that they require for their specific activities. For example, your e-mail address may be passed on to a service provider so that they can deliver a newsletter that you have ordered. Service providers may also be commissioned to provide server capacity. Service providers are usually integrated as so-called order processors, who may only process personal data of the users of this online offer according to our instructions. 

Insofar as service providers are not already named in this data protection information, these are the following categories of service providers: 

• IT service provider (technical support), Germany, Ireland
• IT service provider (hosting), Germany, USA
• Customer support (e-mail, telephone), Germany

5.     To which countries outside the European Economic Area or Switzerland do we disclose data?

To which countries outside the European Economic Area (if you are in the EEA) or Switzerland (if you are in Switzerland) do we disclose data?

We disclose personal data to third parties or processors in the following countries where an adequate level of data protection exists under applicable law: USA (if the recipient is certified under the EU-U.S. Data Privacy Framework or the Swiss-U.S. Data Privacy Framework). Note for users in Switzerland: We also transfer your data to the European Economic Area (EEA).

Furthermore, we disclose personal data to third parties or processors in the following countries in which there is no adequate level of data protection under applicable law. The transfer or disclosure is based on the respective specified security measure or exception: USA (based on standard contractual clauses).

You can obtain from us an overview of the recipients in third countries and a copy of the specifically agreed arrangements for ensuring the appropriate level of data protection. Please use the information in the Contact section for this purpose.

6.     How long do we store your data?

We store your data for as long as this is necessary to provide our online offer and the associated services or we have a legitimate interest in the continued storage. In all other cases, we delete your personal data with the exception of data that we must retain in order to comply with legal (e.g. tax or commercial) retention periods (e.g. invoices).

We block data that is subject to a retention period until the period expires. 

Specifically, the following retention periods apply to the personal data processed as part of this online service:

Log files: 7 to 10 days

Information on the storage period of cookies and app identifiers can also be found in the CMP .

7.     Are you obliged to provide us with personal data?

In principle, you are not obliged to provide us with your personal data. However, the use of certain services of this online offer may require the provision of personal data, e.g. registration or participation in a competition. If this is the case, we will point this out to you. Mandatory data is regularly marked with an *. If you do not wish to provide us with the required data, you will unfortunately not be able to use the corresponding services.

8.     Log-files

Every time you use an online service, certain information is automatically transmitted by your terminal device and stored by us to determine malfunctions and for security reasons (e.g. to clarify attempted attacks) and then deleted. Log files whose further storage is necessary for evidentiary purposes are exempt from deletion until the final clarification of the respective incident and may be passed on to investigating authorities in individual cases. In den Log-Dateien werden insbesondere folgende Informationen gespeichert: 

• IP address (Internet Protocol address) of the terminal device from which the online service is accessed;
• Internet address of the website from which the online offer was accessed (so-called origin or referrer URL);
• Name of the service provider through which the online offer is accessed;
• Name of the retrieved files or information;
• Date and time and duration of the retrieval;
• Volume of data transferred; 
• Operating system and information about the terminal device used; and
• http status code (e.g. "request successful" or "requested file not found").

Log files are also used for analysis purposes.

9.     Cookies

Cookies are small text files that are sent when a website is visited and stored in the user's browser. If the corresponding website is called up again, the user's browser sends back the content of the cookies and thus enables recognition of the user. Certain cookies are automatically deleted at the end of the browser session (so-called session cookies), others are stored for a specified time or permanently in the user's browser and then delete themselves automatically (so-called temporary or permanent cookies).

What data is stored in the cookies?

Cookies do not store any data that identifies you as a person (e.g. no names, e-mail addresses or IP addresses). Instead, cookies typically contain a code (so-called identifier) as well as information on the storage period and possibly also certain technical features (e.g. security functions). Cookies can, however, be used to create usage profiles.

How can you adjust your cookie settings or delete cookies?

With the exception of essential cookies (cookies that are absolutely necessary), we only use cookies with your consent. You can give this consent via our Consent Management Platform ("CMP") and subsequently revoke it at any time with future effect by configuring your privacy settings.

Furthermore, you can delete already stored cookies in your browser at any time. Please note, however, that this online offer may not function or may only function to a limited extent without cookies.

10.     Your rights (rights of the data subject)

How can you enforce your rights?

Please use the information in the Contact section to assert your rights. In doing so, please ensure that we are able to clearly identify you. 

Alternatively, you can also use the settings options in your user account to correct the data you provided during registration or for your advertising objection. In addition, you can use the "Unsubscribe" link at the end of the respective e-mail for this purpose.

You can adjust your settings regarding cookies and/or advertising identifiers and the data processing based on them at any time in our CMP.

Your rights of access and rectification

You can request that we confirm whether we process personal data relating to you and you have a right of access with regard to your data processed by us. If your data is incorrect or incomplete, you may request that your data be corrected or completed. If we have disclosed your data to third parties, we will inform them of the rectification to the extent required by law.

Your right to deletion

You may, if the legal requirements are met, demand that we delete your personal data without delay. This is particularly the case if

• your personal data is no longer required for the purposes for which it was collected;
• the legal basis for the processing was exclusively your consent and you have revoked it;
• you have objected to the processing for advertising purposes ("advertising objection");
• you have objected to processing based on the legal basis of Legitimate Interest on personal grounds and we cannot demonstrate that there are overriding legitimate grounds for processing;
• your personal data have been processed unlawfully; or
• your personal data must be deleted to comply with legal requirements.

If we have passed on your data to third parties, we will inform them of the deletion, insofar as this is required by law.

Please note that your right to delete data is subject to restrictions. For example, we do not have to or are not allowed to delete data that we still have to retain due to legal retention periods. Data that we need to assert, exercise or defend legal claims are also excluded from your right of deletion.

Your right to restrict processing

You may, if the legal requirements are met, request us to restrict processing. This is particularly the case if

• the accuracy of your personal data is disputed by you, and then until we have had the opportunity to verify the accuracy;
• the processing is not lawful and you request restriction of use instead of erasure (see the previous section for this);
• we no longer need your data for the purposes of processing, but you need it to assert, exercise or defend your legal claims;
• you have objected on personal grounds, and then until it is determined whether your interests are overridden.

If there is a right to restrict processing, we mark the data concerned to ensure that it is only processed within the narrow limits that apply to such restricted data (namely, in particular, for the defense of legal claims or with your consent).

Your right to data portability

You have the right to receive personal data that you have given us for the fulfillment of a contract or on the basis of consent in a transferable format. In this case, you may also request that we transfer this data directly to a third party, insofar as this is technically feasible.

Your right to revoke consent

If you have given us consent to process your data, you can revoke this at any time in our CMP with effect for the future. The legality of the processing of your data until the revocation remains unaffected.

Your right to object to direct marketing

You can also object to the processing of your personal data for advertising purposes ("advertising revocation") at any time. Please take into account that for organizational reasons there may be an overlap between your revocation and the use of your data in the context of an already running campaign.  

Your right to object on personal reasons

You have the right to object to data processing by us for reasons arising from your particular situation, insofar as this is based on the legal basis of legitimate interest. We will then stop processing your data unless we can prove - in accordance with the legal requirements - compelling reasons for further processing that are worthy of protection and which outweigh your rights.

Your right to complain to a supervisory authority

You have the right to file a complaint with a data protection authority. In particular, you can contact the data protection authority that is responsible for your place of residence or your federal state or that is responsible for the place where the violation of data protection law has occurred. Alternatively, you can also contact the data protection authority responsible for us.