Privacy Policy

The protection of information related to you, such as your name, phone number, email address, or IP address (“personal data”), is very important to us. That is why we operate this website and the services we offer on it in accordance with applicable data protection laws, in particular the EU General Data Protection Regulation (“GDPR”) and the German Federal Data Protection Act (“BDSG”).

This privacy policy applies to the following services:

Below you will find an explanation of how we handle your personal data in this context. We also inform you when we share personal data with the retailer from whom you purchased your tolino eReader (“tolino retailer”).

If you are interested in self-publishing, you will be redirected from our website to https://www.tolino-media.de/. Please note that separate privacy policies apply there.

1. Who is the data controller? Who is the data protection officer?

The entity responsible for this website is the

tolino media GmbH & Co. KG

Dr. Bernhard Mischke

14 Albrechtstraße, 80636 Munich

Phone: +49 89 / 45 22 01 8 – 66 80

Fax: +49 89 / 45 22 01 8 – 66 88

info@mytolino.com

<< If you have any questions about your tolino eReader, please use our contact form below >>

Below are the contact details for our Data Protection Officer:

PROLIANCE GmbH

www.datenschutzexperte.de

21 Leopoldstraße

80802 Munich

datenschutzbeauftragter@datenschutzexperte.de

2. What do we do with your personal data?

a. When you use our website or the contact form

Providing this website requires the processing of personal data, such as your IP address. This processing is necessary to access the content displayed on this website (including its features) and is also required for IT security measures.

You also have the option of using the contact form on our website to get in touch with the tolino retailer who sold you the tolino eReader in question. For this purpose, we process the personal data you enter in the contact form and forward it to the respective tolino retailer, based on your selection in the contact form.

(1) Legal Basis

The processing of your personal data for the purpose of providing this website and communicating through it is based on our overriding legitimate interest. To provide this website, it is technically necessary for us to process certain personal data (e.g., your IP address). To facilitate your communication with us, it is necessary for us to process your respective personal data.

(2) Balancing of Interests

As part of the necessary balancing of interests, we have weighed your interest in confidentiality against our interests in providing this website and in establishing contact. When it comes to the use of the contact form, we have also taken into account the interests of the respective tolino booksellers.

Your interest in confidentiality takes a back seat in each of these cases. Otherwise, we would not be able to provide you with this website, respond to your contact request, or forward your message to the relevant tolino retailer.

(3) Recipient Categories

We use service providers to host our website. To this end, we transfer personal data to these service providers. We have contractually obligated these service providers to exercise the same level of care in processing personal data as we do ourselves.

b. When you subscribe to our newsletter

You can sign up for our newsletter by providing the necessary consent.

For this purpose, we collect the personal data that you enter in the registration form. We also process your relevant usage data, for example, to measure the success of a newsletter.

We use Mailjet GmbH (“Mailjet”) and InnoCraft Ltd. (“Matomo”) as service providers in connection with our newsletter. We track all newsletter subscriptions and unsubscriptions through our service providers. We also use our service providers to evaluate the reach of our newsletter. By using Matomo and Mailjet, we are able to analyze your newsletter behavior. This allows us to track your opening and clicking behavior and, among other things, see how often the links in the newsletter are clicked or how many subscribers have opened the newsletter. To this end, we use conversion tracking through our service providers.

(1) Legal Basis

Your consent is the legal basis for our processing of your data.

You may revoke your consent at any time with future effect by informing us of your desire to unsubscribe, for example, through the contact options described above. You can also unsubscribe using the opt-out feature at the end of each newsletter. If you unsubscribe, we will remove your email address from our newsletter distribution list.

(2) Recipient Categories

The newsletter is sent as part of a data processing arrangement by our service providers Mailjet GmbH, Alt-Moabit 2, 10557 Berlin, and Matomo, InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand, as part of a data processing arrangement, to whom we disclose your email address for this purpose. We have contractually obligated these service providers to exercise the same level of care in handling personal data as we do ourselves.

You can read the details of Mailjet GmbH’s privacy policy here:

https://www.mailjet.de/privacy-policy/

You can read more about InnoCraft Ltd’s privacy policy here:

https://matomo.org/privacy-policy/

c. If you give us your consent to receive promotional materials

If you give us your consent to receive marketing communications, we will process your personal data—in particular, your email address—for our own marketing purposes.

Your declaration of consent serves as the legal basis for our processing of your personal data in this regard. You may revoke your consent at any time, effective for the future.

d. If you have not objected to the use of your email address for our own promotional purposes

If we receive your email address in connection with the provision of our services, we will process it to send you advertisements for our own similar goods or services, provided you have not objected to this use.

You have the right to object to this use at any time without incurring any costs other than the transmission costs charged at standard rates. Please send your objection to the contact information listed above. You can also use the opt-out link in one of our promotional emails.

(1) Legal Basis

The legal basis is our legitimate interest in conjunction with a statutory provision (Section 7(3) of the German Unfair Competition Act (UWG)).

(2) Recipient Categories

We use third-party service providers for our email marketing. We transfer personal data to these service providers for this purpose. We have contractually obligated these service providers to exercise the same level of care in handling personal data as we do ourselves.

e. If you participate in one of our events

You can register for our events, such as the “Tolino Story Days.” For this purpose, we collect the personal data that you provide to us in connection with each event.

(1) Legal Basis

We process your personal data for the purpose of initiating, executing, and fulfilling the relevant contract regarding your participation in the event.

We process your personal data to provide you with information about future events. You have the right to object to this use at any time without incurring any costs other than the standard transmission fees. Please send your objection to the contact information listed above. You can also use the opt-out link in one of our promotional emails.

(2) Recipient Categories

We collaborate with third parties in connection with events. To this end, we transfer personal data to the respective third parties.

f. If you enter a contest

You can enter our sweepstakes. For this purpose, we collect the personal data that you provide to us in connection with each sweepstake.

(1) Legal Basis

We process your personal data for the purpose of initiating, executing, and fulfilling the relevant contract regarding participation in the contest, or based on your consent. You may revoke your consent at any time, effective for the future.

(2) Recipient Categories

We collaborate with third parties in connection with sweepstakes. To this end, we transfer personal data to these third parties.

g. If you follow us on social media platforms operated by third-party service providers

You can follow us on various social media platforms provided by third-party service providers (e.g., Instagram, Twitter, YouTube, Facebook, LinkedIn, XING).

To this end, we process the personal data that you provide to us or that is provided to us by the respective platform operator regarding you, to the extent that such data is made available to us. You can manage your privacy settings yourself within the social media platform.

(1) Legal Basis

We process your personal data in connection with our social media offerings based on our overriding legitimate interest. To provide our social media services, it is technically necessary for us to process certain personal data (e.g., your IP address; personal data that you have provided to the respective platform operator or to us).

As part of the necessary balancing of interests, we have weighed your interest in confidentiality against our interest in providing our social media services. Your interest in confidentiality takes a back seat in this context. Otherwise, we would not be able to offer you our social media services.

(2) Recipient Categories

We use service providers to deliver our social media offerings. The data you provide to us through our social media offerings is also automatically transmitted to the respective social media platform operators.

h. If you apply for a job with us

You can apply for a position with us. To do so, we process the personal data you provide to us as part of your application.

We process your personal data for the purpose of initiating, executing, and fulfilling the relevant contract.

i. If we sell our company and/or a service

We reserve the right to sell our company and/or a service, in whole or in part. In doing so, we may transfer your personal data to a third party in the future, in compliance with the applicable data protection requirements. We will notify you of this at least 30 days in advance, including information about the implications for your continued use of our services.

(1) Legal Basis

The processing of your personal data in connection with such a sale is based on our overriding legitimate interest. In order to complete a corporate transaction, it may be necessary for us to transfer your personal data to a third party.

(2) Balancing of Interests

As part of the necessary balancing of interests, we have weighed your interest in confidentiality against our interests in proceeding with the sale. In each case, your interest in confidentiality takes a back seat. Otherwise, we would be unable to proceed with such a sale.

j. When we anonymize your personal data

We anonymize your personal data in order to analyze it for statistical purposes.

(1) Legal Basis

The processing of your personal data in connection with such anonymization is based on our overriding legitimate interest.

(2) IBalancing of Interests

As part of the necessary balancing of interests, we have weighed your interest in confidentiality against our interest in appropriate anonymization. Your interest in confidentiality takes a back seat in this context. Otherwise, we would not be able to achieve such anonymization. The GDPR and the BDSG do not apply to anonymous data.

(3) Recipient Categories

We use third-party service providers for the anonymization process. To this end, we transfer personal data to these service providers. We have contractually obligated these service providers to exercise the same level of care in handling personal data as we do ourselves.

k. If you allow the use of cookies and analytics tools

We use cookies and analytics tools to provide our services, such as through our websites and the tolino eReader. Some of the providers we use also process your personal data outside the EU/EEA (see the section“Data Transfer to Third Countries”below).

We use what are known as “cookies.” Cookies are data files that are stored by a web server on the user’s device (e.g., computer, smartphone, tablet, eReader). Cookies may be read by us and/or by third parties in certain cases.

For example, when you visit our website again using the same device, cookies are sent back either to our website (“first-party cookie”) or to another website to which the cookie belongs (“third-party cookie”).

Disabling cookies generally does not restrict your use of our websites or the services we offer.

Legal Basis

The legal basis for the use of technically necessary cookies/identifiers is our legitimate interest in conjunction with a statutory provision (Section 25(2)(2) TTDSG, Article 6(1)(f) GDPR). Storing information on your device or accessing information already stored on your device is absolutely necessary so that we can provide the telemedia service you, as a user, have expressly requested.

In all other cases, the legal basis is generally your consent, unless a specific legal basis is stated below (Section 25(1) TTDSG, Article 6(1)(a) GDPR). You may revoke your consent at any time, for example, by deleting cookies set via your device’s browser settings. Please note that, for technical reasons, this action applies only to the specific device you are currently using.

You can also prevent the collection and processing of your personal data by disabling the storage of third-party cookies on your device, using the “Do Not Track” feature of a browser that supports it, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser.

(1) Use of Tracking Cookies for Advertising Purposes

This website works with external performance advertising networks to display and optimize its own advertisements.

As part of the tracking services, cookies are stored on the devices of users who visit or use the websites or other online offerings of its customers for the purpose of documenting transactions. These cookies serve solely to correctly attribute the success of an advertisement and to facilitate the corresponding billing within the advertising network. No personal data is collected, processed, or used in this context. A cookie simply stores information about when a specific advertisement was clicked on from a device. The external partners used are listed below, each with a link to their privacy policy.

(2) Matomo

We use Matomo on our website, a web analytics service provided by InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand (“Matomo”).

Matomo uses cookies, which are text files stored locally in your web browser’s cache on your device and enable us to analyze your use of our website.

Pseudonymized usage profiles may be created and analyzed from this data for the same purpose. The data collected using Matomo technology (including your pseudonymized IP address) is processed exclusively on our local server and is not shared with third parties.

When you use our online services, certain information transmitted by your browser is collected and analyzed. This information is collected via a pixel embedded on each relevant web page.

The following data is stored on our server for statistical analysis of your visit to our website:

  • IP address – is anonymized immediately and deleted after processing
  • The webpage that was accessed
  • The website from which the user accessed the current webpage (referrer URL)
  • The subpages accessed from the webpage that was visited (clicks)
  • Time spent on the website
  • The frequency with which the website is visited
  • Request (filename of the requested file)
  • Information about the device and the user-agent profile (e.g., language, operating system, device model, screen resolution)
  • Enabling JavaScript
  • Java On/Off
  • Enable/Disable Cookies
  • Time of Access
  • Form content (for free-text fields, such as name and password, only “filled in” or “not filled in” is transmitted)

As part of our web analytics using Matomo, your IP address is stored only in a truncated and therefore anonymized form and is used solely for session identification, geolocation (down to the city level), and to defend against cyberattacks. The IP address is then deleted immediately.

If you do not consent to the pseudonymized storage and analysis of this data from your visit to our website, you can object to its storage and use at any time by clicking the button below:

In this case, a so-called opt-out cookie will be stored in your browser, which means that Matomo will not collect any session data. Please note that completely deleting your cookies will also delete the opt-out cookie, which you may need to reactivate. Please note that, for technical reasons, this procedure applies only to the specific device you are currently using.

You can find more information about Matomo’s data processing activities on the following website:

https://matomo.org/privacy-policy/

(3) Facebook Pixel

We use Facebook Pixel on our website, a web analytics service provided by Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA (“Facebook”).

Facebook Pixel enables Facebook to display our ads on Facebook (“Facebook Ads”) only to those Facebook users who have visited our websites. This allows us to show interest-based ads to users of our websites and services.

We have no knowledge of the details regarding the processing of personal data under Facebook’s responsibility. You can find information about Facebook’s processing of personal data on the following website:

https://de-de.facebook.com/about/privacy/

According to Facebook, it processes the following personal data:

  • Facebook Pixel HTTP Data
    Log data generated for technical reasons via the Hypertext Transfer Protocol (Secure) (HTTP(S)) when the Facebook Pixel used on the website is deployed: These include your IP address, the type and version of your web browser, the operating system used, the page accessed, the previously visited page (referrer URL), and the date and time of the request.
  • Facebook Pixel Device Data
    Data assigned to your device by the Facebook Pixel: This includes a unique ID used to (re)identify returning visitors.
  • Facebook Pixel Event Data
    Data that Facebook collects via the Facebook Pixel and associates with the unique visitor ID of the respective visitor contained in the Facebook Pixel device data: This includes actions that take place on the website (“Events”).
  • Facebook Pixel Analytics Data
    Data that Facebook generates based on the information collected by the Facebook Pixel, linked to the unique visitor ID of the respective visitor contained in the Facebook Pixel device data: This includes information about the effectiveness of Facebook ads and the assignment of users to target audiences for Facebook ads. Facebook may generate additional data based on the collected information for its own purposes or for the purposes of third parties. We have no knowledge of the details of the data generated by Facebook.

You can find more information about Facebook’s data processing activities on the following web pages:

https://www.facebook.com/about/privacy

http://www.facebook.com/policy.php

(4) Google Search Console

To continuously optimize our website’s Google ranking, we use Google Search Console, a web analytics service provided by Google.

Using Google Search Console, we can perform search analyses that provide insight into how often our website appears in Google search results. This allows us to monitor and manage our websites in the search index.

When using Google Search Console, no personal user data or tracking data is processed or transmitted to Google.

(5) Google Ads Remarketing

Our website uses Google Ads Remarketing features. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Provided you have given us your consent to do so, this feature allows us to link the advertising audiences created with Google Ads Remarketing to the cross-device features of Google Ads and the Google Marketing Platform. The legal basis is your consent pursuant to Art. 6(1)(a) of the GDPR and § 25(1) of the TTDSG. In this way, interest-based, personalized advertising messages—which have been tailored to you based on your previous usage and browsing behavior on one device (e.g., a cell phone)—can also be displayed on another of your devices (e.g., a tablet or PC).

If you have given your consent, Google will link your web and app browsing history to your Google Account for this purpose. This allows the same personalized ads to be displayed on any device on which you sign in with your Google Account.

To support this feature, Google Analytics collects users’ authenticated IDs, which are temporarily linked to our Google Analytics data to define and create audiences for cross-device advertising.

You can permanently opt out of cross-device remarketing/targeting by disabling personalized ads in your Google Account; to do so, follow this link: https://adssettings.google.com/

Since personal data is transferred to the United States, additional safeguards are required to ensure a level of data protection consistent with the GDPR. To ensure this, we have agreed upon Standard Data Protection Clauses with the provider in accordance with Article 46(2)(c) of the GDPR. These clauses obligate the recipient of the data in the U.S. to process the data in accordance with the level of protection in Europe. In cases where this cannot be ensured even through this contractual extension, we strive to obtain additional arrangements and commitments from the recipient in the U.S.

For more information and the privacy policy, please see Google’s Privacy Policy at: https://www.google.com/policies/technologies/ads/

l. When you visit one of our web pages on which a YouTube video can be played

We use YouTube to embed videos. YouTube is operated by YouTube LLC, headquartered at 901 Cherry Avenue, San Bruno, CA 94066, USA. YouTube is represented by Google (see the section“Data Transfer to Third Countries”below).

On some of our web pages, we use plugins provided by YouTube. When you visit web pages that include such a plugin, a connection is established with YouTube’s servers, and the plugin is displayed. This transmits information to YouTube’s servers about which of our web pages you have visited. If you are logged in to YouTube at that time, YouTube associates this information with your personal user account. If you interact with the plugin—for example, by clicking the play button on a video—this information is also associated with your user account. You can prevent this association by logging out of your YouTube user account, as well as any other user accounts with YouTube LLC and Google, before using our websites, and by deleting the corresponding cookies from those companies.

For more information on data processing and YouTube’s (Google) privacy policy, please visit:

https://policies.google.com/privacy?hl=de

Legal Basis

Your consent serves as the legal basis for the corresponding processing (Section 25(1) of the TTDSG, Article 6(1)(a) of the GDPR).

3. How long do we retain your personal data?

We will delete your personal data once the purpose for which it was stored no longer applies and there is no legal requirement to retain it (e.g., a retention requirement under the German Tax Code and/or the German Commercial Code). If deletion is not possible in a specific case, processing will be restricted.

4. What rights do you have as a data subject?

To exercise your rights or withdraw your consent, please contact us using the contact information provided above.

a) You have the right to request information at any time about all personal data we process about you.

b) If your personal data is inaccurate or incomplete, you have the right to have it corrected and supplemented.

c) You may request the deletion of your personal data at any time, provided that we are not legally obligated or authorized to continue processing your data.

d) If the legal requirements are met, you may request that the processing of your personal data be restricted.

e) You have the right to object to the processing of your data if it is carried out for the purposes of direct marketing or profiling. If the processing is based on a balancing of interests, you may object to the processing by providing reasons based on your particular situation.

f) If data processing is based on your consent or is carried out in connection with a contract, you have the right to receive the data you have provided, provided that this does not infringe on the rights and freedoms of others.

g) If we process your data based on a declaration of consent, you have the right at any time to revoke that consent with effect for the future. The processing carried out prior to revocation remains unaffected by the revocation.

h) You also have the right at any time to file a complaint with a data protection supervisory authority if you believe that data processing has been carried out in violation of applicable law.

The following regulatory authority generally has jurisdiction over us:

Bavarian State Office for Data Protection Supervision

Promenade 27 (Castle)

91522 Ansbach

https://www.lda.bayern.de/de/index.html

We will notify all recipients to whom we have disclosed personal data of any correction or deletion of your personal data or any restriction on the processing thereof, unless this proves impossible or involves a disproportionate effort. We will inform you of the recipients to whom your personal data has been disclosed upon your request.

5. In what context do we create automated profiles?

No automatic profiles are created.

6. Data Transfer to Third Countries

In some cases, personal data is transferred to recipients in third countries (see the relevant note in our Privacy Policy). Third countries are countries outside the EU and outside the EEA. These third countries also include the United States.

The United States does not have a level of data protection comparable to that in Europe. In particular, government agencies may access personal data without us or you being aware of it. Legal action may not be successful.

The legal basis for such a data transfer is generally your consent (Art. 49(1), first sentence, subparagraph (a) of the GDPR) or the performance of a contract (Art. 49(1), first sentence, subparagraph (b) of the GDPR).

7. Data Security

We implement appropriate technical and organizational security measures to protect the personal data we process against accidental or intentional manipulation, loss, destruction, or unauthorized access.

********

Customer Contact Form

Please note: Customer service for tolino eReaders is handled by the respective tolino retailer who sold you the device. There is no separate tolino customer service department. Accordingly, your contact requests submitted via our form will be automatically forwarded to your tolino retailer’s support team, where they will be processed. A retailer’s store is automatically preinstalled on every tolino eReader. This retailer is always your point of contact for questions about the device and related matters. As a rule, this is the retailer from whom you purchased the device. However, this does not mean that you must necessarily be registered with that retailer.

[vfb id=”2″]