• 1. Introduction – What is the purpose of this Policy?
• 2. Controller and Data Protection Officer of this Federal Office
• 3. Legal basis for the processing of personal data
• 4. Protection of minors
• 5. Data processing in connection with the visit of this website
• 6. Processing of personal data from applicants and other parties
• 7. Storage period / Necessity of data processing / Miscellaneous
• 8. Your rights

1. Introduction – What is the purpose of this Policy?

Below you will find information on the different kinds of collecting and processing your personal data by the Federal Office of Consumer Protection and Food Safety (BVL) that will occur when you access the web site of the Federal Office of Consumer Protection and Food Safety or contact us in any other manner.

The term “personal data” covers any piece of information that refers to an identified or identifiable natural person (“data subject”). An individual or natural person is considered to be identifiable when it can be identified directly or indirectly – in particular, by matching an identifier such as a name, with an ID number, geographical data, or online ID. This includes all details that refer to you as a person, i.e., name, address, email address, user behavior, phone number and the like.

We want you to know when we collect which kind of data and how we process it. We have installed technical and organizational safeguards to ensure that the data protection rules and regulations are complied with both by us and by our third-party service providers.

At the Federal Office of Consumer Protection and Food Safety, personal data will be processed in compliance with the applicable data protection law, including, but not limited to the European General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).

We are obligated to provide this information pursuant to Art. 13 and 14 of the European General Data Protection Regulation (GDPR).

2. Controller and Data Protection Officer of this Federal Office

The Controller for personal data processed by this federal office is

Bundesamt für Verbraucherschutz und Lebensmittelsicherheit
Bundesallee 51
38116 Braunschweig
Telephone: 030 18444-99999
Telefax: 030 18444-99099
Email: poststelle@bvl.bund.de

Postal Address

Bundesamt für Verbraucherschutz und Lebensmittelsicherheit
Official seat: Braunschweig
P.O. Box 15 64
38005 Braunschweig

In all data protection matters (e.g., questions, notices, and complaints) you may contact the data protection officer of the Federal Office of Consumer Protection and Food Safety any time:

Bundesamt für Verbraucherschutz und Lebensmittelsicherheit
Behördliche Datenschutzbeauftragte
Bundesallee 51
38116 Braunschweig
Telephone: 03018 444-95750
Email: datenschutz@bvl.bund.de

3. Legal basis for the processing of personal data

The Federal Office of Consumer Protection and Food Safety processes personal data in the fulfilment of the tasks assigned to it that are in the public interest.

To the extent that the Federal Office of Consumer Protection and Food Safety processes personal data for carrying out its tasks that are in the public interest, these activities are based on Art. 6, par. 1, lit. e of the GDPR and section 3 of the Federal Data Protection Act (BDSG) in conjunction with the corresponding statutory provisions for the corresponding task (if applicable, in conjunction with ministerial decrees).

The public tasks of the Federal Office of Consumer Protection and Food Safety include the provision of information to the public on findings and work results that the Federal Office of Consumer Protection and Food Safety obtained in the course of its work. This information will be provided by making information available to the public through this website, but also by other service offers such as events, press mailing lists, and a call center.

To the extent that the processing of personal data should be required in an individual case for meeting a statutory obligation, this will be based on Art. 6, par. 1, lit. c of the GDPR in conjunction with the applicable statutory provision from which this legal obligation arises.

To the extent that we obtain the consent from the data subject for the processing of personal data, data processing will be based on Art. 6, par. 1, lit. a of the GDPR, with regard to special categories of personal data within the meaning of Art. 9 of the GDPR (“sensitive data”) this will be based on Art. 9, par. 1 lit. a of the GDPR.

If the processing of personal data is necessary for performing an agreement to which the data subject is a party, individual cases may also be governed by Art. 6, par. 1, lit. b of the GDPR. This shall also apply to processing steps that are required to carry out tasks prior to the conclusion of an agreement. The Federal Office of Consumer Protection and Food Safety will be acting as a contract party under civil law, for instance, in the field of procurement.

In the event processing is necessary in order to protect the vital interests of the data subject or of another natural person, Art. 6, par. 1, lit. d of the GDPR forms the legal basis for processing your personal data.

4. Protection of minors

Individuals below the age of 16 years should not transmit any personal data to us without the consents from their parents. We will not request any personal data from individuals below the age of 16 years.

In the course of events hosted by the Federal Office of Consumer Protection and Food Safety in connection with the so-called “Boys Day” and “Girls Day”, personal data of minors that register via the websites at the domain www.boys-day.de and www.girls-day.de (not operated by the Federal Office of Consumer Protection and Food Safety) will be transmitted to the Federal Office of Consumer Protection and Food Safety. Please refer to the corresponding Privacy Policies of the operator(s) of those websites. Upon the end of the event, any data transmitted to the Federal Office of Consumer Protection and Food Safety for the purpose of hosting the event will be deleted.

5. Data processing in connection with the visit of this website

The Federal Office of Consumer Protection and Food Safety operates a website at the domain www.bvl.bund.de by which it informs the general public of its work and provides information to the public.

We will process personal data only to the extent required. Which data is required and processed for which purpose and on which basis primarily depends on the type of service(s) you require or on the purpose for which it is required, respectively.

Generally, the website of the Federal Office of Consumer Protection and Food Safety can be used without disclosing personal data. Whenever a data transmission becomes necessary during your visit of our website, we assure you that we meet safety standards in compliance with up-to-date and certified procedures.

5.1 Your personal details

If you contact us via any of the web forms (contact form, BVL user survey, press contact form) your personal data will only be stored and used for communicating with you and for processing your inquiry. If you place an order, personal data entered may be passed on to third parties (distributor, public authority), however, the purpose shall be exclusively limited to the dispatch of the requested publication. After your order has been filled, your personal data will be deleted.

You may subscribe to any of our free newsletters on our website. During the registration process you will be asked to submit your email address and to indicate your areas of interest. Together with these details, information on the IP address of the accessing computer and the date and time of registration will be collected. Your IP address will not be linked with data entered in the contact form. No data will be passed on to third parties in connection with data processing for newsletter mailings. This data will only be used for mailing the newsletter.

5.2 Browser details

When you browse our website, your web browser will transmit data to our web server. This information will be stored on the web servers of the Federal Office of Consumer Protection and Food Safety and will not be transmitted to third parties. The following user data will be recorded:

• Anonymized IP address,
• Inquiry details and target address (protocol version, HTTP method, referrer, user agent string),
• Date and time (time stamp),
• Accessed web page/ name of retrieved file (accessed URL, including query string),
• Transmitted data volume (size in bytes),
• Message whether the access/download was successful (HTTP status code).

This data will be stored in a log file. Storing this information is necessary to ensure the technical safety of our web server, including, but not limited to the defense against attacks. This data will be automatically deleted at regular intervals.

Generally, this data will be used to further develop our web services and will not be analyzed in a manner by which you could be identified. However, we reserve the right, to commission an internal or external party with the identification of personal data using individual data records if there should be severe breaches of our Terms of Use and in the event of impermissible access or attempts at accessing our servers.

5.3 Use of cookies

Cookies are small text files that are transmitted to your computer. These files will be stored on your computer and made available for subsequent retrieval.

We use cookies, in particular, to improve the usability of this website and to make navigation easier for you. In addition, cookies allow statistical evaluations of the use of our website (see also 5.5). Cookies store technical data in your browser's memory. The cookies set by the BVL will be deleted from your browser after 30 days at the latest. This data will not be passed on to third parties. A link to personal data will not be established, unless you have expressly given your consent.

You can view with any web browser when cookies are set and what they contain. Most browsers are set in such a way that they automatically accept cookies. However, the saving of cookies can be disabled at any time or the browser can be set so that cookies are only saved for the duration of the respective connection to the internet.

If you reject all cookies, the function of the website may be impaired and it may not be possible for the service to be provided in the desired quality.

5.4 Security

The Federal Office of Consumer Protection and Food Safety will use technical and organizational safeguards (privacy by default and by design) to protect personal data against loss or misuse. For instance, your data will be stored in a secure operating environment that is not open to the public. In certain cases, personal data will be encrypted by the so-called Secure Socket Layer Technology (SSL) while it is being transmitted. That means, the communication between your computer and our servers will be encrypted using a generally accepted encryption technology, if your web browser supports SSL.

5.5 Use analysis

This website uses Matomo (https://matomo.org/) (formerly Piwik), an open source software, for the statistical analyses of its traffic. Matomo uses - with your consent - so-called cookies, text files, that are stored on your computer and allow an analysis of the use of the website by you.

The information generated by the cookie about your use of the Internet offer is stored on a server in Germany. When individual pages of our website are retrieved, the following data are stored:

• two bytes of the IP address of the user’s retrieving system (anonymous)
• the web page accessed
• the website from which the user arrived at the the web page retrieved (referrer)
• the sub-pages retrieved from the web page retrieved
• length of time spent on the page
• how often the web page was retrieved
• the number of pages visited
• the location of the visitor (country)
• the provider
• the browser
• the operating system
• the screen resolution
• the browser plugins
• the visit times
• the entrance pages
• the exit pages
• the downloads

The IP address is anonymized before storage.

Legal basis for our analyses is article 6 paragraph 2 in conjunction with § 3 BDSG (continuous optimization in the context of informing the public).

If you do not want these data from your website visit to be stored and analysed, although they are entirely anonymous, you can opt out below with a mouse click. In this case, an opt-out cookie is saved to your browser, which means that Matomo will not collect any more session data.

5.6 Use of social media and social plug-ins

The Federal Office of Consumer Protection and Food Safety engages in social networks.
Please note our Information on the processing of personal data in connection with the use of our social media presences.

5.7 Links to websites of third-party operators

This Privacy Policy refers to the website www.bvl.bund.de and its subpages. To the extent our website contains links to third-party websites, our Privacy Policy will not extend to those pages. It is beyond our control whether third-party operators comply with data protection rules and regulations.

6. Processing of personal data from applicants and other parties

In the event that you contact the Federal Office of Consumer Protection and Food Safety as an applicant or based on any other legal obligation, data processing operations, including the processing of personal data and the contact channel or the forms to be used, respectively, will be governed by the applicable statutory provisions and/or rules and regulations in conjunction with Art. 6, par. 1, lit. e of the GDPR. In addition, any separate privacy policies that may have been defined for the corresponding procedure shall apply.
With regard to these data processing operations you are generally entitled to the claims explained in Art. 8 of this Privacy Policy, however, with the following additional exceptions and/or limitations:

The right to erasure of data is excluded in accordance with Art. 17, par. 3, lit. b of the GDPR to the extent that this data is required for fulfilling a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest, or in the exercise of official authority vested in the controller.

The right to object to processing is excluded pursuant to section 36 of the Federal Data Protection Act in the event that there is a compelling general public interest in the processing operations that overrides the interests of the data subject, or if a statutory provision requires the data processing operations.

7. Storage period / Necessity of data processing / Miscellaneous

Unless provided otherwise, your data will be stored in accordance with the File Management Rules of the Federal Office of Consumer Protection and Food Safety. The retention periods are set forth in the Disposal catalog. This provision also applies to electronically stored data.

Unless provided otherwise, the processing of personal data by the Federal Office of Consumer Protection and Food Safety is directly related to the fulfillment of its public tasks and required for this purpose.

Automatic decision-making on a case by case basis, including profiling, (Art. 22 of the GDPR) will not occur.

8. Your rights

Being a data subject, you may assert the following claims against the Federal Office of Consumer Protection and Food Safety (Controller within the meaning of the GDPR: Art. 2 of this Privacy Policy):

8.1 Right to withdraw the consent – Art. 7, par. 3 of the GDPR

In the event that your personal data is processed based on a consent, you have the right to withdraw this consent at any time, provided, however, that this does not affect the legitimacy of data processing based on the consent until the date of its withdrawal.

8.2 Right of access - Art. 15 of the GDPR

You have the right of access to any data processed in connection with you, its origin and recipient(s) as well as the purpose of processing and duration of storage. The exceptions from this right set forth in section 34 of the Federal Data Protection Act shall apply.

8.3 Right to rectification - Art. 16 of the GDPR

You have the right to rectification with regard to inaccurate personal data concerning yourself.

8.4 Right to erasure - Art. 17 of the GDPR

In addition, you have the right to have your personal data erased by the Controller. However, this is only possible if the personal data concerning you is no longer needed, if it is unlawfully processed, or if the corresponding consent was withdrawn.

The exceptions from this right set forth in section 35 of the Federal Data Protection Act shall apply. If your data cannot be erased or deleted due to the specific type of storage in the context of automated data processing operations, or if this would require a disproportionate amount of effort, and if your interest in the erasure is to be deemed insignificant, you may not claim and the Federal Office of Consumer Protection and Food Safety is not obligated to erase or delete your personal data. In this event, the right to erasure will be substituted by the restriction of processing.

8.5 Right to restriction of processing - Art. 18 of the GDPR

Furthermore, you have the right to restrict the processing. The right to restrict the processing will enable you to temporarily prevent the further processing of personal data relating to you. In particular, the restriction will apply during the period in which other rights exercised by you are examined.

Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with your consent, or for the establishment, exercise or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

8.6 Right to portability - Art. 20 of the GDPR

The right to portability includes your right to obtain any personal data relating to you in a commonly used, machine-readable format from the Federal Office for Consumer Protection and Food Safety, if necessary, to pass them on to another Controller or to obtain the right to have the personal data transmitted directly from one controller to another, to the extent this is technically feasible.

In accordance with Art. 20, par. 3, sentence 2 of the GDPR, you are not entitled to this claim if the data processing operations serve the fulfillment of public tasks. With respect to the Federal Office of Consumer Protection and Food Safety, this rule will only apply when data is processed for fiscal purposes.

8.7 Right to object - Art. 21 of the GDPR

Furthermore, you have the right to object to data processing. If you object to the processing of your personal data, your personal data will not be processed any longer.

Pursuant to section 36 of the Federal Data Protection Act, this right shall not apply when a public authority is required to carry out processing operations under a statutory provision. With respect to the Federal Office of Consumer Protection and Food Safety this is the case with regard to the public tasks assigned to it which it has to carry out.

8.8 Right to lodge a complaint with a supervisory authority - Art. 77 of the GDPR

In the event that you perceive an infringement on your rights regarding the processing of your personal data by the Federal Office of Consumer Protection and Food Safety, you have the right to lodge a complaint with a data protection supervisory authority.

You may contact the data protection supervisory authority responsible for the Federal Office of Consumer Protection and Food Safety as follows:

Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (The Federal Officer for Data Protection and Freedom of Information)
Graurheindorfer Straße 153
53117 Bonn

Telephone: +49 (0)228-997799-0
Telefax: +49 (0)228-997799-5550
Email: poststelle@bfdi.bund.de

This is a courtesy translation of the privacy policy of the Federal Office of Consumer Protection and Food Safety which is intended solely as a convenience to the non-German-reading public. If any questions arise related to the accuracy of the information contained in the translation, please refer to the official German version of the document. Any discrepancies or differences created in the translation are not binding and have no legal effect for compliance or enforcement purposes.

Privacy policy information for specific technical tasks of BVL is available in German language only at: https://www.bvl.bund.de/datenschutz