データ保護に関するステートメント

During your use of the websites and online services of the Leica Camera Group, we will collect, process and use your personal data as described in more detail below. Because the protection of our users’ privacy is important to us, below we would like to inform you of what personal data we collect when you are using the websites and online services and for what purposes the data is used. The websites and online services of the Leica Camera Group may contain links to websites or online services of other providers to which this Privacy Policy does not apply.

1 Controller / Contact Details of the Data Protection Officer

The controller within the meaning of data protection law is Leica Camera AG, Am Leitz-Park 5, 35578 Wetzlar. 

The data protection officer can be contacted at: data-protection@leica-camera.com

2 Collection and Further Processing of Your Personal Data

2.1 Automated Data Collection during General Use of the Websites

During the use of the websites, we collect and store certain data that your end device transmits automatically for technical reasons. This includes:

• the IP address or device ID allocated to the respective end device, which we need in order to transmit the requested information (e.g. content, shopping basket, text, images and product information, as well as files provided for download, etc.)
• the type of the respective end device
• the URL of the previously visited website
• the browser type and operating system used
• the date and time at which the site was used

This data processing takes place for technical reasons, to facilitate your use of the websites, and in order to detect and track cases of misuse. 

The data is processed on the basis of legal provisions that authorize data processing because this is necessary for the provision of the website to the user (Art. 6 para. 1(b) GDPR), or because we have a legitimate interest in ensuring the security and functionality of the service as well as its proper use without the affected data subjects having an overriding interest (Art. 6 para. 1(f) GDPR).

We store this information as long as is necessary for the purpose of detecting and tracking misuse. Furthermore, we delete or anonymize user data including IP addresses as soon as it is no longer required for the aforementioned purposes.

2.2 Account

You can create an account in order to use additional functions of the websites and online services such as product registration.

In order to place orders in our Leica Camera online stores, you need to create an account or alternatively use the “Direct to PayPal” function (see 2.3.5). 

2.2.1 Registering an Account

2.2.1.1 Mandatory Details
When creating the account, you must provide the following information:

• country 
• language
• title
• first and last name
• email address

When registering your account, you set your own personal password. You can change this password.

In order to log in to an existing account, the following data must be entered:

• user ID (the email address given during registration)
• password

We process this data in order to provide you with the functions of the account and to fulfill and process orders. It is also processed in order to prevent and detect fraud.

The data is processed on the basis of legal provisions that authorize data processing because this is necessary for the fulfillment and processing of orders or for the provision of functionalities from the account (Art. 6 para. 1(b) GDPR), or because we can assert a legitimate interest in preventing and detecting fraud without the affected data subjects having an overriding interest (Art. 6 para. 1(f) GDPR).

Where, as described above, we process your data for the purpose of providing your account, you are contractually obliged to provide us with the required mandatory details. Without this information, we are unable to provide you with an account. 

Your data is generally erased once the purpose for which it was collected has been fulfilled. For the data described above, this is the case when you delete your account. Should the data be processed for the fulfillment and processing of orders, it is erased following the complete fulfillment of the contract or following the expiry of the statutory warranty obligations or contractual guarantee. Data that we process for the prevention and detection of fraud will be deleted once it is no longer required for this purpose. Should it be necessary to store data beyond this period for legal reasons, it will be blocked. The data will then no longer be available for further use.

2.2.1.2 Voluntary Disclosures
You can voluntarily enter further information, which is saved in your account. This comprises the following details:

• address
• interests (e.g. photography interests, preferred Leica Camera store, etc.)

We process this data in order to provide you with all functions of your account. In providing these functions, we also have a legitimate interest in data processing as per Art. 6 para. 1(f) GDPR.

You are not obliged to provide the voluntary disclosures described above. However, without this information, we are unable to provide you with all the functions of your account. 

Your data is generally erased once the purpose for which it was collected has been fulfilled. For the data described above, this is the case when you delete your account. Should it be necessary to store data beyond this period for legal reasons, it will be blocked. The data will then no longer be available for further use.

2.2.2 Product Registration

2.2.2.1 Mandatory Details
After creating the account, Leica products can be registered. To do so, we collect:

• the model designation and 
• serial number of the product

We process this data in order to provide you with the functionality of product registration. 

The data is processed on the basis of legal provisions that authorize data processing because this is necessary in order to provide you with this functionality (Art. 6 para. 1(b) GDPR).

Where, as described above, we process your data for the purpose of product registration, you are contractually obliged to provide us with the required mandatory details. Without this information, we are unable to provide you this functionality.

Your data is generally erased once the purpose for which it was collected has been fulfilled. For the data described above, this is the case when you delete your account. Should it be necessary to store data beyond this period for legal reasons, it will be blocked. The data will then no longer be available for further use.

2.2.2.2 Voluntary Disclosures
You can voluntarily provide us with the following additional details:

• date of purchase
• a comment

Non-Leica products can also be registered voluntarily; for this purpose, the brand of the registered product is collected.

We process this data in order to offer you a full overview of your camera and sport optics portfolio. In providing these enhanced functionalities, we also have a legitimate interest in data processing as per Art. 6 para. 1(f) GDPR.

You are not obliged to provide the voluntary disclosures described above. However, without this information, we are unable to offer you this overview. 

Your data is generally erased once the purpose for which it was collected has been fulfilled. For the data described above, this is the case when you delete your account. Should it be necessary to store data beyond this period for legal reasons, it will be blocked. The data will then no longer be available for further use.

2.3 Orders in the Online Store

2.3.1 Ordering

2.3.1.1 New Customer Ordering (Retail Customer)
If you are a retail customer placing an order in our online store, we need:

• salutation
• name
• address
• country
• email address

If   you create an account during the ordering process, you will also needto provide a password. However, you do not need an account to place the order.

You can also make voluntary disclosures. These disclosures include:

• telephone number
• date of birth

If   you want your order to be delivered to a different delivery address, we will also need additional information about the recipient:

• salutation
• name
• address
• country

You can optionally make additional disclosures about the recipient. They include:

• company
• department

2.3.1.2 New Customer Ordering (Business Customer)
If you are a business customer placing an order in our online store, we need:

• company name
• VAT no.
• salutation
• name
• address
• country
• email address

If you create an account for yourself during the ordering process, you will also need to provide a password. However, you do not need an account to place the order.

You can also make voluntary disclosures. These disclosures include:

• telephone number
• date of birth
• department

If you want your order to be delivered to a different delivery address, we will also need additional information about the recipient:

• salutation
• name
• address
• country

You can optionally make additional disclosures about the recipient. They include:

• company name
• department

2.3.1.3 Current Customer Ordering (Retail or Business Customer)
If you are already a customer of ours, we use the information provided in your account to fulfill the orders that you place. We process the personal data specified in item 2.3.1 that is required to be disclosed in order to fulfill our contractual obligations and to provide you with the respective product. We need your email address in order to confirm receipt of your order and communicate with you for the purpose of executing the order. Furthermore, you receive confirmation of your order and shipping via your email address.

If   you also create an account with us during the ordering process, the requisite personal data is processed for the purpose of providing the account (you can find further information on the processing of the data in connection with the account in item 2.2).

The data is processed on the basis of legal provisions that authorize data processing because this is necessary for the purpose of executing theorder or for providing the account (Art. 6 para. 1(b) GDPR).

If you are a business customer’s employee placing an order, processing takes place on the basis of our legitimate interest in executing the order and/or providing the account (Art. 6 para. 1(f) GDPR).

Voluntary disclosures regarding your company, department and telephone number are processed on the basis of our legitimate interest in ensuring proper delivery (Art. 6 para. 1(f) GDPR).

Your date of birth is processed to verify your legal capacity and this processing is based on our legitimate interest in verifying your legal capacity (Art. 6 para. 1(f) GDPR).

Where, as described above, we process your data that must be disclosed for the purpose of executing your order, you are contractually obliged to provide us with the required mandatory details. Without this information, it is not possible for us to execute the order.

2.3.1.4 Data Collection From a Third Party
In the event that you are the the recipient but not the ordering party, we will receive your personal data from the ordering party. The disclosure of your personal data is necessary in order for us to execute the order as instructed. This constitutes our legitimate interest in processing (Art. 6 para. 1(f) GDPR).

2.3.1.5 Erasure
Your data is generally erased once the purpose for which it was collectedhas been fulfilled. Where the data is processed for the fulfillment and processing of orders and/or the provision of the account, the data is erased following the complete fulfillment of the contract and/or following the expiration of the statutory warranty obligations or contractual guarantee or, with respect to the account, when you delete the account. Should it be necessary to store data beyond this period for legal reasons, it will be blocked. The data will then no longer be available for further use.

2.3.2 Forwarding of Data

Payment service providers

In order to process payments and, if necessary, provide you with a refund, we use the services of our payment service provider Adyen B.V., Simon Carmiggeltstraat 6 - 50, 1011 DJ Amsterdam, Netherlands (“Adyen”). Adyen collects and processes your payment data in order to process the payment. For this purpose, we automatically forward the following required data to Adyen:

• IP address
• price
• payment ID
• credit card data
  (The credit card data is encrypted upon collection by Adyen. We do not have access to this data at any time.)
• customer number
• email address

Adyen may forward the data collected by Adyen to credit agencies. This is performed for the purpose of an identity and credit check. Adyen may also forward your data to third parties, should this be necessary in order to fulfill the contractual obligations. Adyen may also forward data if the data is to be processed on Adyen’s behalf.

The data is processed on the basis of legal provisions that authorize data processing because this is necessary for the purpose of executing the order and process the payment (Art. 6 para. 1(b) GDPR). 

Where, as described above, we process your data for the purpose of payment processing, you are contractually obliged to provide us with the required mandatory details. Without this information, it is not possible for us to process the payment and thereby execute the order. 

We erase data that we process in order to process the payment and thereby execute the order following the complete fulfillment of the contract or following the expiry of the statutory warranty obligations or contractual guarantee. Should it be necessary to store data beyond this period for legal reasons, it will be blocked. The data will then no longer be available for further use.

Logistics companies

We also process your address data in order to dispatch the ordered items to you. To this end, we forward your address data to the respective logistics company. 

The data is processed for the purpose of executing the order on the basis of legal provisions that authorize data processing because this is necessary for the purpose of executing this order (Art. 6 para. 1(b) GDPR).

Where, as described above, we process your data for the purpose of executing your order, you are contractually obliged to provide us with the required mandatory details. Without this information, it is not possible for us to execute the order. 

If you have provided us with your telephone number for this purpose, we will also transmit this number to the logistics company hired to transport your shipment. Providing the telephone number allows the logistics company to contact you to ensure delivery, for example, in cases where the delivery person cannot find the specified address or cannot immediately locate you. For this purpose, your telephone number is printed on the shipping label where it may be read by third parties if the item is dropped off at a Paket Shop or similar drop-off location or left with a neighbor for example. Providing the telephone number is voluntary. The data is processed on the basis of our legitimate interest in ensuring proper delivery (Art. 6 para. 1(f) GDPR).

Should the data be processed for the fulfillment and processing of orders, it is erased following the complete fulfillment of the contract or following the expiry of the statutory warranty obligations or contractual guarantee. Should it be necessary to store data beyond this period for legal reasons, it will be blocked. The data will then no longer be available for further use.

2.3.3 Forwarding of Data for Reservation and In-Store Collection

In order to allow you to reserve items and collect them in-store, we need your

• name
• address
• email address
• telephone number

and your reservation data:

• your chosen store
• product
• price
• quantity
• item number 

This data is forwarded to your chosen store for the purpose of reservation and collection.

The data is processed on the basis of legal provisions that authorize data processing because this is necessary for the purpose of executing the order (Art. 6 para. 1(b) GDPR).

Where, as described above, we process your data for the purpose of reservation and collection, you are contractually obliged to provide us with the required mandatory details. Without this information, it is not possible for us to execute the order. 

Your data is generally erased once the purpose for which it was collected has been fulfilled. Should the data be processed for the purpose of reservation and collection, it is erased following the complete fulfillment of the contract or following the expiry of the statutory warranty obligations or contractual guarantee. Should it be necessary to store data beyond this period for legal reasons, it will be blocked. The data will then no longer be available for further use.

2.3.4 Forwarding of Personal Data for Financing

If you have opted for purchase price financing, we will forward the following data

• name
• address
• purchase price details

to our financing partner, CreditPlus Bank AG, Strahlenberger Straße 110-112, 63067 Offenbach, for the purposes of checking and processing your financing application. The data forwarded to CreditPlus Bank AG may be forwarded to credit agencies by CreditPlus Bank AG. This is performed for the purpose of an identity and credit check. CreditPlus Bank AG may also forward your data to third parties, should this be necessary in order to fulfill the contractual obligations. CreditPlus Bank AG can also forward data if the data is to be processed on its behalf. See the privacy policy of CreditPlus Bank AG for more information on the associated processing of your data by CreditPlus Bank AG (German language only): https://www.creditplus.de/service/datenschutzhinweise/. 

The data is processed on the basis of legal provisions that authorize data processing because this is necessary for the purpose of executing the order in connection with the financing of the purchase price (Art. 6 para. 1(b) GDPR).

Where, as described above, we process your data for the purpose of executing your order, you are contractually obliged to provide us with the required mandatory details. Without this information, it is not possible for us to execute the order in connection with the financing of the purchase price. 

Your data is generally erased once the purpose for which it was collected has been fulfilled. Should the data be processed for the fulfillment and processing of orders in connection with the financing of the purchase price, it is erased following the complete fulfillment of the contract or following the expiry of the statutory warranty obligations or contractual guarantee. Should it be necessary to store data beyond this period for legal reasons, it will be blocked. The data will then no longer be available for further use.

2.3.5 Forwarding and Collection of Personal Data when Using the “Direct to PayPal” Functionality

Alternatively to creating an account, you can use the “Direct to PayPal” functionality. The European operating company of PayPal is PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg. In such a case, you can place an order by logging into your existing PayPal account by clicking the button with the text “Direct to PayPal” when visiting our websites and confirming that PayPal may provide us with your data in order to process your order. We then use this data in order to execute your order as described above and process the payment via PayPal. 

If you use the “Direct to PayPal” functionality, your data that is required for the forwarding to your PayPal account is automatically transmitted to PayPal. This comprises the following data:

• IP address
• total amount of the order
• reference to the PayPal account

The data transmitted to PayPal may be forwarded to credit agencies by PayPal. This is performed for the purpose of an identity and credit check. PayPal may also forward your data to third parties, should this be necessary in order to fulfill the contractual obligations. PayPal can also forward data if the data is to be processed on PayPal’s behalf. See the privacy policy of PayPal for more information on the associated processing of your data by PayPal: https://www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=en_en.

If you have entered your PayPal account in our online shop, your email address assigned to the PayPal account can also be accessed via PayPal. PayPal will then transmit the following data to us in order to process the order:

• encrypted PayPal account number
• email address
• name
• delivery address     

The data is processed on the basis of legal provisions that authorize data processing because this is necessary for the purpose of executing the order and process the payment via the “Direct to PayPal” functionality (Art. 6 para. 1(b) GDPR).

Where, as described above, we process your data for the purposes of executing your order and processing the payment via the “Direct to PayPal” functionality, you are contractually obliged to provide us with this data. Without this information, it is not possible for us to execute the order via the “Direct to PayPal” functionality. 

Your data is generally erased once the purpose for which it was collected has been fulfilled. Should the data be processed to execute the order and process the payment via the “Direct to PayPal” functionality, it is erased following the complete fulfillment of the contract or following the expiry of the statutory warranty obligations or contractual guarantee. Should it be necessary to store data beyond this period for legal reasons, it will be blocked. The data will then no longer be available for further use.

2.4 (Joint) Management of customer data from the online store and our Leica stores in our customer database and data analysis for statistical purposes

We process your data, which we have collected in connection with your account (2.2) and orders (2.3) in our online store, in our customer database for the purpose of managing our customer relationships. This enables us to manage your data and provide relevant, targeted answers to any questions. The associated processing is permitted on the basis of our legitimate interests in managing our customer relationships (Art. 6 para. 1(f) GDPR).

If you are a Leica store customer, we manage your data – which has been collected in the Leica store in connection with a purchase or an order – in our customer database for the aforementioned purposes (Art. 6 para. 1(f) GDPR). This data includes, without limitation:

• name
• address
• country
• customer and bill-to party, which may also be the company or Leica store that places your order in the Leica store
• name and address of the Leica store where you made your purchase or placed your order
• invoice number 
• product and item number
• quantity 
• date of purchase 
• purchase price and currency

If you are also an online store customer, we combine this data with the data that we have collected on you in connection with your account and orders in our customer database in order to manage it centrally and streamline our processes. This constitutes our legitimate interest in processing (Art. 6 para. 1(f) GDPR).

We also process the data stored or combined in our customer database for statistical analysis and market research purposes. This allows us to better understand our customers’ interests and purchasing habits and adapt and optimize our advertising and sales activities accordingly. We anonymize your data before processing it for this purpose.

If   anonymization is not possible in individual cases, we pseudonymize your data before processing it for the aforementioned purposes. We do not engage in individual profiling. In these cases, processing is based on our legitimate economic interest in optimizing our sales and advertisingactivities (Art. 6   para. 1(f) GDPR).

Whenever your data is pseudonymized for statistical analysis purposes, it is deleted immediately after the analysis has been carried out.

2.5 Consent to Receiving Advertising Information and to Data Processing for Advertising Purposes

If   you have given us your consent to receiving advertising information, we will use the information you have disclosed to us (including data that you may have saved in your account and that we may have received throughyour interactions with us) on the basis of your consent (Art. 6 para. 1(a) GDPR) to send you advertising information about Leica Camera products, services, events and advertising campaigns in accordance with your chosen preferences – by email,telephone, push notification via Leica Camera mobile apps and social media (Facebook, Instagram and YouTube).

The consent is deemed to be granted to the Leica Camera Group.

To enable us to adapt the communications to your interests and behavior and offer you an optimally personalized experience, we may analyze and combine more of your personal data. This can include the following data:

1. Data that you actively provided us with, e.g.:

• name
• date of birth
• age
• a further email address
• mailing address
• gender 
• telephone number
• the data you have made provided us with via social networks
• personal interests, e.g. photography, professional imaging, hunting, nature observation
• product registration

2. Data that we obtain through your interactions with us:
Data on your interactions, such as purchases in Leica Camera stores (POS) and Leica Camera online shops, Customer Care inquiries, your use of the digital Leica Camera channels such as social media, websites, emails, Leica Camera apps and your use of networked Leica Camera products. This data can include the following:

• IP address
• cookies
• device information
• information you have clicked on
• location information
• websites you have visited
• Leica Camera apps you have used 
• your purchases (products)
• your inquiries to Leica Camera Customer Care

The provision of this data is voluntary. However, without this data we are unable to provide you with the corresponding information.

We verify your consent using what is known as a double opt-in process: We send you an email requesting that you actively confirm your consent before we contact you with advertising information. We use the information on the confirmation to document your consent and, if necessary, verify it.

2.5.1 Newsletter Tracking

Newsletters and other advertising information that we provide you with via email in accordance with the areas of interest previously selected by you contain what are known as web beacons. Web beacons are pixel-sized files which are downloaded from the server of the sender when the email is opened. Technical information about you is initially collected together with this request, such as:

• delivery of the newsletter
• browser information
• information on the system used
• IP address
• time of retrieval

We also collect the following data about you:

• location of retrieval, which we determine on the basis of your IP address
• information on whether you have opened the email
• information on which of the links in the email you have clicked on

This information will be used for statistical purposes in order to bring about a technical improvement in the services on the basis of the technical data or the target groups and their reading behavior. Although this information can be assigned to the individual recipients for technical reasons, the analyses are merely for the purposes of recognizing the reading behavior of our users and adapting our content accordingly, improving it or sending different content in accordance with the interests of our users.

The provision of this data is voluntary. However, without this data we are unable to adapt our content to you, improve it or send different content in line with your interests.

The legal basis for the processing of your data for the aforementioned purposes is the consent you have provided (Art. 6 para. 1(a) GDPR). 

2.5.2 Forwarding of Your Data to Leica Camera Group Companies for Marketing Purposes

If it is necessary in order to fulfill the aforementioned purposes, the data specified above will be forwarded between the companies of the Leica Camera Group. 

The legal basis for the transmitting of the data and its further processing by the companies of the Leica Camera Group is the consent you have provided (Art. 6 para. 1(a) GDPR).

Should we forward your data to companies of the Leica Camera Group or other recipients outside the European Union or the European Economic Area for the purposes specified in 2.3 and on the basis of your consent, it shall only be forwarded in harmony with the requirements of the GDPR:

• Forwarding to recipients on the basis of an adequacy decision

  Forwarding to recipients on the basis of an adequacy decision The European Commission has decided that an adequate level of dataprotection exists in the following third countries (adequacy decision, Art. 45 GDPR). We transmit your data to the following countries for which an adequacy decision has been taken:

  • Leica Camera AG (Switzerland) – decision dated July 26, 2000
  • Leica Camera Japan Co., Ltd. (Japan) – decision dated January 23, 2019

• Forwarding to recipients on the basis of standard contractual clauses

  Furthermore, we also transfer the aforementioned data to Leica Group companies in third countries that are not currently covered by an EU adequacy decision according to which such third countries generally have an adequate level of data protection. We therefore use the European Commission’s standard contractual clauses as per Art. 46 para. 2(c) GDPR when defining the contractual relationships with Leica Group companies in such third countries in order to establish an adequate level of data protection. The standard contractual clauses can be accessed at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0915 at any time.

2.5.3 Right to Withdraw Consent

You can withdraw your consent with effect for the future, either in full or partially, at any time by sending an email to data-protection@leica-camera.com. The withdrawal of your consent does not affect the lawfulness of the processing performed on the basis of your consent prior to its withdrawal. Should you withdraw your consent, we will no longer use this data to send you advertising information.

You can also set your preferences in your account under your profile and thereby change the communication channels through which you wish to receive advertising information.

2.5.4 Forwarding of Your Data to Facebook, Instagram and YouTube for Marketing Purposes

In order for us to send you advertising information, we process your email address, country and language and, if necessary, forward them to the following companies on the basis of your consent (Art. 6 para. 1(a) GDPR):

2.5.4.1 Facebook and Instagram

Information to Be Forwarded to Facebook 
We want to ensure that the ads are only shown to users who are interested in our advertising information. This is why we use Facebook services to show you personalized advertising. The operator of Facebook and Instagram for users outside the US and Canada is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For users in the US and Canada, the operator is Facebook Inc., 1601 South California Avenue, Palo Alto, CA 94304, USA.

If you have a Facebook profile, Facebook can match this data withthe information Facebook has already stored about you. Where applicable, Facebook will also combine this data with other data.

Facebook may share your information within the Facebook group of companies or with other third parties. This may lead to a transfer of personal data to the US and to other third countries not covered by an EU adequacy decision. According to Facebook's own statements, Facebook uses EU standard contractual clauses approved by the European Commission to ensure an adequate level of dataprotection when transferring data to the US and to other third countries not covered by an EU adequacy decision.

You can find general information on the further processing and use of your data by Facebook and your configuration options for protecting your privacy when you use Facebook in the Facebook Privacy Policy at https://www.facebook.com/about/privacy/.

Custom Audiences
We use the “Custom Audiences from File” process. If you have given your consent, we will transfer your email address or telephone number that we have on file to Facebook in hashed form. Facebook matches this information to information stored by Facebook. If Facebook detects a match, it will deliver personalized advertising.

2.5.4.2 YouTube
We also transfer the aforementioned data to YouTube. For users in the European Union, the European Economic Area or Switzerland, the operator of YouTube is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For users outside the European Union, the European Economic Area and Switzerland, the operator is Google LLC,1600 Amphitheatre Pkwy Mountain View, California 94043, USA.

If   you have a Google account, Google can match this data with the information Google has already stored about you. Where applicable, Google will also combine this data with other data.

Google may share your information with other Google companies or other third parties. This may lead to a transfer of personal data to the US and to other third countries not covered by an EU adequacy decision.According to Google’s own statements, Google in this case uses EU standard contractual clauses approved by the European Commission to ensure an adequate level of data protection when transferring data to the US and to other third countries not covered by an EU adequacy decision.

You can find general information about the processing of your personal data by Google at: https://policies.google.com/privacy.

2.5.4.3 Right to Withdraw Consent 
You can withdraw your consent with effect for the future, either in full or partially, at any time by sending an email to data-protection@leica-camera.com. The withdrawal of your consent does not affect the lawfulness of the processing performed on the basis of your consent prior to its withdrawal. Should you withdraw your consent, we will no longer use this data to send you advertising information.

You can also set your preferences in your account under your profile and thereby change the communication channels through which you wish to receive advertising information.

2.5.5 Erasure of Your Data

If you withdraw your consent, we generally erase your data within 72 hours, provided that there is no other legal basis for its further processing. Should it be necessary to store data beyond this period for legal reasons, it will be blocked. The data will then no longer be available for further use.

2.6 Contact and Service Inquiries

You can use our websites to send us general contact queries or specific service requests. In doing so, your email address is forwarded to us. You can decide which additional data you wish to make available to us within the scope of the contact (i.e. in the content of the message).

We will process this data in order to answer your query. The data is processed on the basis of legal provisions that authorize data processing because this is necessary in order to process your queries (Art. 6 para. 1(b) GDPR).

You are not obliged to provide the voluntary disclosures described above. However, without this information, we are unable to answer your contact or service query. 

After answering your query, we will delete your query after three years at the end of the respective calendar year.

2.7 Use of Cookies

We use cookies to offer certain functions of the website (necessary cookies), analyze your use of the website (analytical cookies) and show you advertisements tailored to your interests inside and outside the Leica Camera website (social media and marketing cookies).

Cookies are text files that contain information. They are saved on your end devices (computer or mobile device) when you visit our websites or use our online services, and do not cause any damage. A general distinction can be made between two types of cookies, known as session and persistent cookies:

Session cookies are small information units containing a randomly generated identification number, which is known as the session ID. Using session IDs enables us to make information such as login data and shopping basket contents available upon the next visit as a personal setting, which also, for example, allows a login session to be continued. A session cookie also contains information on its origin and the retention period. These cookies cannot save any other data. When you log out of your customer account, the used session cookies are deleted.

Persistent cookies store information which may contain personal data from your browser. This can include the following: your anonymized IP address, your device type, the domain, browser type, language, operating system, country, time zone, previously visited websites or information about your interaction with our websites such as click behavior, purchases and preferences. The persistent cookies used on our website are subject to the additional rules described under 2.8 and 2.9.

The legal basis for the use of necessary cookies and the further processing of your data is §15 para. 1 German Telemedia Act (TMG) and Art. 6 para. 1(b) GDPR.

We use analytical cookies in order to gain a better understanding of your usage behavior of our website. This helps us to continuously improve the quality of our website. We use social media and marketing cookies in order to show you advertising tailored to your interests on our website and on the websites of third parties. Your data is collected and processed on the basis of your consent as per Art. 6 para. 1(a) GDPR.

You can withdraw your consent for the use of analytical, social media and marketing cookies and the associated processing of your data for the purposes described in 2.8 and 2.9 with effect for the future at any time by making the corresponding changes to your cookie settings here. The withdrawal of your consent does not affect the lawfulness of the processing performed on the basis of your consent prior to its withdrawal.

You can also view our website without cookies. Most websites accept cookies automatically. You can prevent cookies being saved on your computer by choosing not to accept cookies in your browser settings. To find out how this works, please refer to the help function of your browser. You can delete cookies that have been set on your end device at any time. However, if you do not accept cookies, the functionality of our offerings may be restricted.

2.8 Web Analysis

2.8.1 Usage Profiles

When you are using our website, we create usage profiles using cookies for the purposes of advertising, market research or the needs-based design of the website. In doing so, only usage data based on pseudonyms is used. In particular, this data consists of characteristics for identifying the users (pseudonym) and information on the beginning, end and scope of the use of our website.

Your data is collected and processed on the basis of your consent as per Art. 6 para. 1(a) GDPR. You can withdraw your consent with effect for the future at any time by making the corresponding changes to your cookie settings here.

2.8.2 Google Analytics

We use Google Analytics, a web analytics service offered by Google LLC, 1600 Amphitheatre Pkwy Mountain View, California 94043, USA. Google Analytics collects pseudonymous data from you about the use of our website, including a   truncated IP address, and uses cookies. This data is transmitted to a Google server in the US and stored there. Google uses this information to analyze your use of the website for us, to prepare reports on the use of our website, and to generate other analyses and evaluations relating to the use of our website and the internet. Google may also combine this information with other information about you, such as your search history, your personal account, usage data from other devices and other information that Google has stored about you. Google may also pass this information on to third parties if this is required by lawor when third parties process this data on behalf of Google. Such third parties may include US authorities.

The European Commission has not adopted an adequacy decision for the US. We have therefore entered into the European Commission-approvedstandard contractual clauses with Google pursuant to Art. 46 para. 2(c) GDPR. They can be accessed at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc at any time.

Your data will be stored by Google Analytics for a period of 14 months. After this period, the data is deleted and only aggregated statistics areretained.

For more information on how Google uses your data, see Google’s Privacy Policy: https://www.google.com/policies/privacy/.

The use of this service and the associated further processing of your data are based on your consent, Art. 6 para. 1(a) GDPR. You can withdraw your consent with effect for the future at any time by making the corresponding changes to your cookie settings here.

2.9. Social Media and Marketing Services

2.9.1. Google Services

We use the services described hereinafter and offered by Google LLC, 1600 Amphitheatre Pkwy Mountain View, California 94043, USA. The European Commission has not adopted an adequacy decision for the US. We have therefore entered into the European Commission-approved standard contractual clauses with Google pursuant to Art. 46 para. 2(c) GDPR. They can be accessed at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc at any time.

You can find general information about the processing of your personal data by Google at: https://policies.google.com/privacy. 

You also have the following configuration options on Google:

• You can disable personalized advertising from Google: www.google.com/ads/preferences
• You can disable personalized advertising based on device: https://support.google.com/ads/answer/1660762?hl=en and https://support.google.com/ads/answer/2662922 
• You can disable personalized advertising in your browser: http://optout.networkadvertising.org/?c=1

2.9.1.1 Google Remarketing & Personalization of Advertising in the Google Network
If you have given your consent, we will use the remarketing services from Google. Google uses cookies to track how you use our website in order to show you interest-based cross-device advertising for our products on other pages within the Google Ad network. This includes Google Searchand other sites operated by Google and its subsidiaries as well as sites operated by Google’s advertising partners. Accordingly, the information is transmitted to Google and Google’s partners. Any further data processing will only take place if you have consented to Google linking your browsing history to your Google account and using information from your Google account to personalize ads you see on the web. In this case, if you are logged in to Google while visiting our website, Google will use your data together with Google Analytics data to create and define target group lists for cross-device remarketing. To do this, Google will temporarily link your personal data to Google Analytics data to form target groups.

The use of these services and the further processing of your data are based on your consent (Art. 6 para. 1(a) GDPR). You can withdraw your consent with effect for the future at any time by making the corresponding changes to your cookie settings here.

2.9.1.2 Google Ads and Conversion Tracking
This website uses Google Ads and, in this connection, conversion tracking (visitor action evaluation).

When you click on an ad placed by Google, a conversion tracking cookieis saved on your computer. These cookies have a limited validity period of 30 days, contain no personal data and are thus not used for personal identification purposes. If you visit certain pages of our website and the cookie has not yet expired, Google and we can recognize that you have clicked on the ad and have been forwarded to this page. Every Google Ads customer receives a different cookie. It is therefore not possible to track cookies via the websites of Ads customers.

The information collected using the conversion cookie is  used to compile conversion statistics. In these statistics we can see the total number of users who clicked on one of our ads and were forwarded to a page with a conversion tracking tag. However, we receive no information which allows users to be identified personally.

The use of this service and the associated further processing of your data are based on your consent, Art. 6 para. 1(a) GDPR. You can withdraw your consent with effect for the future at any time by making the corresponding changes to your cookie settings here.

2.9.2. Other Services

2.9.2.1 Facebook Pixel
If you have given your consent, we will use the Facebook pixel remarketing function on our website. Facebook pixel is a snippet of JavaScript code. The Facebook pixel captures when you perform certain actions on our website or visit certain areas of our website. The Facebook pixel also collects usage data (such as URL, referrer URL, IP address, device and browser properties and timestamps). The Facebook pixel generates a checksum (hash value) from this information and transfers this hash value to Facebook. Where available, the Facebook cookie is also queried and your Facebook ID is transmitted. If you have a Facebook profile and log in there, the data transmitted by the pixel can be used to present targeted, personalized advertising on Facebook. Data from users who do not have a Facebook profile will be discarded, unused, by Facebook. You can find further information on the collection and use of data by Facebook as well as your rights in this connection and options for protecting your privacy in the Facebook Privacy Policy at https://www.facebook.com/about/privacy/.

The operator of Facebook for users outside the US and Canada is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For users in the US and Canada, the operator is Facebook Inc., 1601 South California Avenue, Palo Alto, CA 94304, USA.

Facebook may share your information within the Facebook group of companies or with other third parties. This may lead to a transfer of personal data to the US and to other third countries not covered by an EU adequacy decision. According to Facebook's own statements, Facebook uses EU standard contractual clauses approved by the European Commission to ensure an adequate level of data protection when transferring data to the US and to other third countries not covered by an EU adequacy decision.

The use of this function and the associated further processing of your data are based on your consent, Art. 6  para. 1(a) GDPR. You can withdraw your consent with effect for the future at any time by makingthe corresponding changes to your cookie settings here.

2.9.2.2 LinkedIn Insight Tag
This website uses the “Insight Tag” function by LinkedIn Ireland Unlimited, Wilton Plaza, Wilton Pl, Dublin, 2, Ireland (“LinkedIn”). The Insight Tag is a small JavaScript code section that is added to this website in order to enable detailed reports on advertising campaigns and obtain valuable information about you as a visitor to this website. We use the Insight Tag in order to track conversions, retarget website visitors and gain furtherinformation about you as a LinkedIn member when you view one of our ads. The Insight Tag enables LinkedIn to collect data such as the URL,referrer URL, IP address, device and browser properties, time stamp and page views during a visit to this website. LinkedIn encrypts this data,anonymizes it within seven days and deletes the anonymized data within 90 days. LinkedIn does not share any personal data with us, but rather only offers summarized reports on the target group for the websites andthe performance of ads. With the Insight Tag, LinkedIn also offers us the possibility of retargeting so that we can use the collected data to displaytargeted ads outside this website without you being identified.

Please note that LinkedIn also transfers personal data to third countries outside the European Economic Area that are not covered by an EU adequacy decision. Where such a transfer occurs, LinkedIn uses the standard contractual clauses approved by the European Commission. You can find relevant information at https://www.linkedin.com/help/linkedin/answer/62533?trk=microsites-frontend_legal_privacy-policy&lang=en.

As a member of LinkedIn, you can manage the use of your personal data for advertising purposes in your LinkedIn account settings.

Further information on the collection and use of data by LinkedIn as wellas your rights in this connection and options for protecting your privacy can be found in the LinkedIn Privacy Policy at https://www.linkedin.com/legal/privacy-policy?trk=uno-reg-guest-home-privacy-policy.

The use of this function and the associated further processing of your data are based on your consent, Art. 6  para. 1(a) GDPR. You can withdraw your consent with effect for the future at any time by makingthe corresponding changes to your cookie settings here.

2.9.2.3 Outbrain Pixel
This website uses the Outbrain Pixel from our partner, Outbrain UK Ltd,5th Floor, The Place, 175 High Holborn, London, WC1V 7AA, UnitedKingdom (Outbrain”), a technology of Outbrain Inc., 39 W 13th Street New York, NY 10011, USA. When you click on an ad and are taken to our website, we can track your behavior on our website using the Outbrain Pixel. In addition, the Outbrain Pixel allows us to send you targeted advertising if you have already shown an interest in certain products on our website. The Outbrain Pixel uses a unique identifier so that it can recognize and track you on our website. The information required for this purpose and information about your visit to our website, your browser and your device are stored in cookies on your device and sent to Outbrain. In addition, Outbrain uses the IP address, minus the last octet,to get your approximate location. This produces pseudonymous profiles that Outbrain stores for 13 months. We use the Outbrain Pixel to evaluate the effectiveness of our ads for statistical and market research purposes and to optimize future advertising campaigns. You can find further information on data processing by Outbrain at https://www.outbrain.com/legal/privacy#privacy-policy.

Outbrain may share your information within the Outbrain group of companies or with other third parties. This may lead to a transfer of personal data to the US and to other third countries not covered by an EU adequacy decision. According to Outbrain's own statements, Outbrain uses EU standard contractual clauses approved by the European Commission to ensure an adequate level of data protection when transferring data to the USA and to other third countries not covered by an EU adequacy decision.

The use of this function and the associated further processing of your data are based on your consent, Art. 6  para. 1(a) GDPR. You can withdraw your consent with effect for the future at any time by makingthe corresponding changes to your cookie settings here.

2.10 Embedded Videos on Our Website

We embed videos from third-party providers on our website (“embedded videos”). When you click on an embedded video on our website, a connection to the servers of the third-party provider is established, within the scope of which we transfer your IP address to the respective third-party provider. This is a technical requirement in order to enable you to call up the selected video.

The transfer takes place on the legal basis of our legitimate interest in a needs-based design of our website and in enabling the provision of the embedded videos requested by you, as well as on the condition that your legitimate interests do not override this (Art. 6 para. 1(f) GDPR).

Third-party providers can also use cookies or similar technologies (e.g. pixel tags) for marketing purposes. Using these technologies, third-party providers can collect information on the websites you have visited, information on your browser or operating system, and further details on the use of our website and combine it with data from other sources. If you are logged in to your own account with the third-party provider, you also enable the third-party provider to assign your surfing behavior directly to your personal profile.

The legal basis for the processing is your consent as per Art. 6 para. 1(a) GDPR. You can withdraw your consent with effect for the future at any time by making the corresponding changes to your cookie settings here.

We use embedded videos from the following third-party providers:

2.10.1. Vimeo

Our website uses embedded videos from the vimeo.com site operated by Vimeo, Inc. The site is operated by Vimeo, Inc. 555 West 18th Street NewYork, New York 10011, USA. The data is processed by Vimeo in the US. The European Commission has not adopted an adequacy decision for the US. We have therefore entered into the European Commission-approvedstandard contractual clauses with Vimeo pursuant to Art. 46 para. 2(c)GDPR. They can be accessed at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc at any time.

You can find further information on the processing of data by Vimeo in the Vimeo Privacy Policy (https://vimeo.com/privacy).

2.10.2. YouTube

Our website also uses embedded videos from youtube.com.

For users habitually resident in the European Union, the EuropeanEconomic Area or Switzerland, the operator of the website is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. For users habitually resident outside the European Union, the European Economic Area and Switzerland, the operator and controller of the website is Google LLC, 1600 Amphitheatre Pkwy Mountain View, California 94043, USA.

Google may share your information with other Google companies or other third parties. This may lead to a transfer of personal data to the US and to other third countries not covered by an EU adequacy decision. According to Google’s own statements, Google in this case uses EU standard contractual clauses approved by the European Commission to ensure an adequate level of data protection when transferring data to the US and to other third countries not covered by an EU adequacy decision.

You can find further information on the processing of data by Google in the Google Privacy Policy (https://policies.google.com/privacy).

2.11 Our Social Media Presence

We operate pages or profiles on different social media platforms. In this context, personal data is processed as described below.

When you interact with us via our social media presence or our posts, we collect and process the information that you provide in this respect, which may include your user name and any profile photo. This is the case, for example, whenever you like, share or retweet a post, comment on it or provide other content. This data is regularly processed on the basis of ourlegitimate interest in making the corresponding functions available on our social media pages (Art. 6 para. 1(f) GDPR) and, if applicable, on the basis of your consent given to the operator of the social media platform (Art. 6 para. 1(a) GDPR) or your contractual relationship with the operator (Art. 6 para. 1(b) GDPR). Please also note that this content is published on our social media pages in line with your account settings and can be accessed by anyone worldwide.

We may also process the data to be able to receive and process inquiries or messages via our social media pages (Art. 6 para. 1(b) GDPR).

In addition, the operators collect and process your personal data under their own data protection responsibility when you visit our social media pages and/or interact with them or our posts. This is especially true if you are registered with or logged in to the platform. Even if you are not logged in to a platform, the operators collect certain personal data, such as unique identifiers linked to your browser or device, when you accessthe site. Please note that this data may be combined across different platforms and services if they are operated by the same operator. For example, both Facebook and Instagram are operated by Facebook Ireland Limited and Facebook Inc. You can find further information in the operators’ privacy policies, which we link to below.

Specifically, we operate the following social media presences:

2.11.1. Facebook

You can find our Facebook fan page here.

For users outside the US and Canada, Facebook is operated by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Facebook”).For users in the US and Canada, Facebook is operated by Facebook Inc., 1601 South California Avenue, Palo Alto, CA 94304, USA.

Facebook collects personal data from you when you are logged in to Facebook and visit or like our Facebook page. Facebook may collect pseudonymous usage data from you when you visit our Facebook page even if   you are not registered with Facebook. You can find furtherinformation in the Facebook Privacy Policy at https://www.facebook.com/about/privacy and at https://en-gb.facebook.com/legal/terms/information_about_page_insights_data. The privacy policy also provides information on the configuration options for your Facebook account.

Facebook may share your information within the Facebook group of companies (transmission to Facebook in the US) or with other third parties. This may lead to a transfer of personal data to the US and to other third countries not covered by an EU adequacy decision. According to Facebook's own statements, Facebook uses EU standard contractual clauses approved by the European Commission to ensure an adequate level of data protection when transmitting data to the US and to otherthird countries not covered by an EU adequacy decision.

In addition, as part of operating our Facebook page, we are jointly responsible with Facebook for the processing of Page Insights. Facebook uses Page Insights to analyze user behavior on our Facebook page and provides this information to us in a depersonalized form. For this purpose, we have entered into an agreement with Facebook Ireland regarding our joint responsibility for data protection, which you can access at the following link: https://www.facebook.com/legal/terms/page_controller_addendum. In this agreement, Facebook agrees, among other things, to assume primary responsibility pursuant to GDPR for the processing of Page Insights and to fulfill all obligations under the GDPR with respect to the processing of Page Insights. The processing serves our legitimate economic interests in the optimization and needs-based design of our Facebook fan page, Art. 6 para. 1(f) GDPR.

2.11.2. Instagram

You can find our Instagram page here.

For users outside the US and Canada, Instagram is operated by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Facebook Ireland”). For users in the US and Canada, Facebook is operated by Facebook Inc., 1601 South California Avenue, Palo Alto, CA 94304, USA. You can find the Instagram Data Policy at: https://help.instagram.com/519522125107875. It also contains information about the configuration options for your account.

Your personal data may also be shared with other Facebook or Instagram companies. This may lead to a transfer of personal data to the US and to other third countries not covered by an EU adequacy decision. In thiscase, Facebook uses the standard contractual clauses approved by the European Commission. The Instagram Data Policy contains further information on this issue, too.

Furthermore, we are jointly responsible with Facebook for the processing of Instagram Insights as part of operating our Instagram page. Facebookuses these Instagram Insights to analyze user behavior on our Instagram page and provides this information to us in a depersonalized form. For this purpose, we have entered into an agreement with Facebook regarding our joint responsibility for data protection, which you can access at the following link: https://www.facebook.com/legal/terms/page_controller_addendum. 
In this agreement, Facebook agrees, among other things, to assume primary responsibility pursuant to GDPR for the processing of Instagram Insights and to fulfill all obligations under the GDPR with respect to the processing of Instagram Insights. The processing serves our legitimate economic interests in the optimization and needs-based design of our Instagram page, Art. 6 para. 1(f) GDPR.

2.11.3. Twitter

You can find our Twitter account here.

For users outside the US, Twitter is operated by Twitter International Company, One Cumberland Place, Fenian Street Dublin 2, D02 AX07 Ireland. For users in the US, Twitter is operated by Twitter, Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA.

You can find the Twitter Privacy Policy at: https://twitter.com/en/privacy. It also provides you with information about the configuration options for your Twitter account.

Twitter also transfers personal data to third countries outside the European Economic Area that are not covered by an EU adequacy decision. Where such a transfer occurs, Twitter uses the standard contractual clauses approved by the European Commission.

We also use Twitter Analytics. Through this function, Twitter International provides us with depersonalized information about the use of our account. This information allows us to analyze and optimize the effectiveness of our Twitter activities. The associated processing is based on our legitimate interest in optimizing our Twitter activities (Art. 6 para. 1(f) GDPR).

2.11.4. Pinterest

You can find our Pinterest page here.

For users outside the US, Pinterest is operated by Pinterest Europe Ltd.,Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. For users in the US, Pinterest is operated by Pinterest Inc. at 651 Brannan Street, San Francisco, CA 94107, USA. You can find the Pinterest Privacy Policy at https://policy.pinterest.com/en/privacy-policy.

Pinterest transfers your personal data to third countries outside the European Economic Area that are not covered by an EU adequacy decision. Where such a transfer occurs, Pinterest takes suitable data protection measures, e.g. by entering into the standard contractual clauses approved by the European Commission. You can obtain further information on this topic in the Pinterest Privacy Policy.

Finally, Pinterest provides us with depersonalized information and analyses regarding the use of our account. This information allows us to analyze and optimize the effectiveness of our Pinterest activities. Theassociated processing is based on our legitimate interest in optimizing our Pinterest activities (Art. 6 para. 1(f) GDPR).

2.11.5.YouTube

You can find our YouTube page here.

For users in the European Union, the European Economic Area or Switzerland, the operator of YouTube is Google Ireland Limited, GordonHouse, Barrow Street, Dublin 4, Ireland. For users outside the EuropeanUnion, the European Economic Area and Switzerland, the operator is Google LLC, 1600 Amphitheatre Pkwy Mountain View, California 94043,USA. You can find the Google Privacy Policy at https://policies.google.com/privacy. It also contains information about the configuration options for your Google account. Please note that your Google account may be used for different Google services (e.g. Gmail, YouTube, Google Search) and that Google may combine personal data about the Google services you use according to your Google account settings. Google may share your information with other Google companies or other third parties. This may lead to a transfer of personal data to the US and to other third countries not covered by an EU adequacy decision. According to Google’s own statements, Google in this case uses EU standard contractual clauses approved by the European Commission to ensure an adequate level of data protection when transferring data to the US and to other third countries not covered by an EU adequacy decision.

Finally, Google provides us with depersonalized information and analyses regarding the use of our account and regarding interactions with our videos. This information allows us to analyze and optimize the effectiveness of our YouTube activities. The processing carried out in this respect is based on our legitimate interest in optimizing our YouTube activities (Art. 6 para. 1(f) GDPR).

3 Other Forwarding of Data

Alongside the other cases mentioned in this Privacy Policy, your personal data can only be forwarded without your prior and express consent in the following cases:

3.1 Service Providers

We rely on contractually bound third-party companies and external service providers (“processors”) for the provision of services. In such cases, personal data is forwarded to these processors in order to enable further processing. We carefully select and regularly check these processors in order to ensure that your rights and freedoms are protected. The processors may only use the data for the purposes specified by us and are also contractually obligated by us to only handle the data in accordance with this Privacy Policy and the German data protection laws.

The processors we use fall into the following categories:

• IT service providers
• cloud providers
• server hosters
• software service providers

Data is forwarded to processors on the basis of Art. 28 para. 1 GDPR, alternatively on the basis of our legitimate interest in the economic and technical advantages associated with the use of specialized processors, as well as on the condition that your rights and interests relating to the protection of your personal data do not override this (Art. 6 para. 1(f) GDPR).

In the event that personal data is forwarded to a processor outside the EU or the European Economic Area and no adequacy decision of the European Commission is in place, we guarantee the proper processing of the data through measures such as those described in Art. 46 et seq. GDPR, i.e. by concluding the appropriate contracts or through certifications of the organization receiving the data; for further information, please contact the data protection officer.

3.2 Miscellaneous Forwarding of Data

Alongside the other cases mentioned in this Privacy Policy, your personal data can only be forwarded without your prior and express consent in the following cases:

• If it is necessary in order to clarify unlawful or improper use of the service or for prosecution, personal data will be forwarded to the law enforcement authorities and, if necessary, to injured third parties. However, this only takes place if there are specific indications for unlawful or improper behavior. Data can also be forwarded for the purpose of implementing terms of use or other agreements. In this context, our legitimate interest in processing the data lies in ensuring the proper functioning of our website and the service and, if applicable, in executing, enforcing or defending legal claims.
• Furthermore, we are legally obliged to provide information to certain public bodies upon request. These bodies are law enforcement authorities, authorities that pursue offenses that entail fines, and the financial authorities.
• During the development of our business it is possible that the structure of our company is altered through a change of legal structure, through the foundation of subsidiaries, business units or subdivisions, or is purchased or sold. For transactions of this nature, the customer information is passed on together with the part of the company that is to be transferred. Each time that personal data is forwarded to third parties to the extent described above, we will ensure that this takes place in accordance with this Privacy Policy and the relevant data protection laws.

4 Automated Individual Decision-Making

We do not use automated processing – including profiling – to reach decisions which have a legal effect on you or significantly affect you in a similar way.

5 Rights of the Data Subject

5.1 Your Rights

When the respective prerequisites are in place, you have the following rights: 

• Right of Access: You have a right to request confirmation at any time as to whether we are processing personal data that concerns you. Furthermore, you have the right to access the personal data concerning you that is being processed by us in the scope described in Art. 15 GDPR.
• Right to Rectification: You have a right to the rectification of inaccurate personal data concerning you.
• Right to Erasure: You can also request the erasure of your personal data, e.g. when your data is no longer necessary for the purpose for which it was collected or otherwise processed.
• Right to Restriction of Processing: Furthermore, you have the right to request the restriction of processing of your personal data; in such a case, the data is blocked from any processing. This right applies in particular when the accuracy of the personal data is disputed between you and us.
• Right to Data Portability: If we process your personal data in order to fulfill a contract with you or on the basis of your consent, you also have the right to receive your personal data in a structured, commonly used and machine-readable format, if and to the extent to which you have provided us with the data.

Should you wish to access data concerning your person that is stored by Leica Camera AG, assert your other rights or if you have questions regarding data protection at our company, you can contact us either by mail (Leica Camera AG, Am Leitz-Park 5, 35578 Wetzlar) or by email at data-protection@leica-camera.com. After answering your query, we will delete your query after three years at the end of the respective calendar year.

Furthermore, you have the right to lodge a complaint with a supervisory authority at any time, in particular a supervisory authority in the member state of your place of residence, work or the place at which the suspected infringement took place if you are of the view that the processing of personal data concerning you is in violation of data protection law.

5.2 Data Processing When Exercising Your Rights

Lastly, we would like to point out that in the event that you exercise your rights as per Art. 15 to 22 GDPR, we will process the personal data provided by you for the purpose of implementing these rights and providing verification hereof. We will only process data stored for the purpose of preparing for and providing access for this purpose, as well as for the purpose of data protection monitoring, and will otherwise restrict processing in accordance with Art. 18 GDPR. This processing takes place on the legal basis of Art. 6 para. 1(c) GDPR in connection with Art. 15 to 22 GDPR and Art. 34 para. 2 of the German Federal Data Protection Act (BDSG).

6 Erasure of Data

Unless described otherwise in this Privacy Policy, we erase or anonymize your data as soon as it is no longer required for the purposes for which we collected or otherwise processed it as per the above. We generally save your personal data on the website and the associated services for the duration of the usage or contractual relationship plus a period of 30 days during which we keep backup copies following erasure. We also retain your data if we are obliged to do so for legal reasons or if the data is required for longer due to criminal proceedings or for the safeguarding, assertion or implementation of legal claims. Should it be necessary to store data for legal reasons, its processing will be blocked. The data will then no longer be available for further use.

7 Changes to This Privacy Policy

We always keep this Privacy Policy up to date. Consequently, we reserve the right to amend it occasionally and to update changes in the processing of your data. We will inform you separately before any changes enter into force. The latest version of the Privacy Policy is always available at https://store.leica-camera.jp/help/data-protection.