Who are we?
This website and its content are provided by SBA GmbH, a provider of online training courses in the field of construction site and traffic safety.
The data controller within the meaning of data protection legislation, in particular the EU General Data Protection Regulation (GDPR), is:
SBA GmbH
Managing Director authorised to act on behalf of the company: Iris Eling
Hinterbergstraße 19
CH-6330 Cham
eMail: info@rsa-online.net
What personal data we collect and why we collect it
When you access this website, information of a general nature is automatically collected. This information is recorded in the server log file and includes the type of web browser, the operating system used, the domain name of your internet service provider, your IP address and similar details.
This is for the following reason:
Ensuring that the website connects without any problems
Ensuring the smooth running of our website
Assessment of system security and stability, as well as
for other administrative purposes
Your data will not be used to identify you personally. Information of this kind is analysed solely for statistical purposes, in order to optimise our website and the technology behind it.
Retention period
The data will be deleted as soon as it is no longer required for the purpose for which it was collected. For data used to provide the website, this is generally the case once the relevant session has ended.
Collection, processing and use of personal data; customer account
To book an online training course, you must create a customer account with us. If you decide to set up a customer account, we will store and process the data you provide in order to process current and future bookings in accordance with Article 6(1)(b) of the GDPR. We will store this data until you delete your customer account with us and any retention periods under tax and commercial law have expired.
This will be the case after 10 years at the latest.
Your data will also be passed on to the courier company responsible for delivering your certificate, provided you complete a course. This data is passed on solely for the purpose of delivering the goods in accordance with Article 6(1)(b) of the GDPR.
We also use your email address to remind you, if necessary, to refresh your course after two years.
If you have completed a training course with us, we generate a so-called hash value from your personal details and some additional data when issuing your ID card or certificate. We can use this hash value at a later date to check whether a certificate has been forged or transferred to an unauthorised person. We store this anonymised hash value for as long as your customer account remains active with us. Please bear in mind that, should you request the deletion of your customer account, we will no longer be able to verify your certificates and credentials on your behalf.
In order to process payments, we pass on your payment details to the bank responsible for payment processing, as described below.
Disclosure for payment processing
To process payments, we pass on your payment details to companies commissioned to handle payment processing. When paying via PayPal, by credit card via PayPal, or – where offered – via PayPal’s ‘Purchase on Account’ service, we pass on your payment details to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”). PayPal reserves the right to carry out a credit check for the payment methods “credit card via PayPal” or – where offered – “purchase on account” via PayPal. PayPal uses the result of the credit check, which relates to the statistical probability of payment default, to decide whether to make the respective payment method available. The credit reference may contain probability values (so-called ‘score’ values). Where score values are included in the result of the credit reference, these are based on a scientifically recognised mathematical and statistical method. The calculation of the score values takes into account, amongst other things, address details. For further information regarding data protection, including details of the credit reference agencies used, please refer to PayPal’s Privacy Policy, which you can view via the following link: https://www.paypal.com/de/webapps/mpp/ua/privacy-full The transfer of your data to the payment service provider is carried out in accordance with Article 6(1)(b) of the GDPR.
Pay Now/SOFORT: When making a payment via Sofortüberweisung processed by SOFORT GmbH, the data required for the payment will be forwarded to SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany (“SOFORT”). SOFORT GmbH is part of the Klarna Group (Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden (“Klarna”)). You can find further information about Klarna’s privacy policy at the following web address: https://www.klarna.com/sofort/datenschutz/
Stripe
On our website, we offer, amongst other things, payment via Stripe and the associated payment methods. The provider of these payment services is Stripe Payments Europe Ltd, Block 4, Harcourt Centre, Harcourt Road, Dublin 2.
If you choose to pay via Stripe, the payment details you enter will be transmitted to Stripe.
The transfer of your data to Stripe is based on Article 6(1)(a) of the GDPR (consent) and Article 6(1)(b) of the GDPR (processing necessary for the performance of a contract). You may withdraw your consent to data processing at any time. Withdrawal of consent does not affect the lawfulness of data processing operations carried out in the past. All data required for payment processing is used exclusively for the purpose of processing payments and is transmitted via the ‘SSL’ protocol. Stripe is certified under PCI DSS. Stripe may transfer, process and store personal data outside the EU. In doing so, Stripe is subject to the Safe Harbour Agreement. Information on Stripe’s data protection policy is available here: https://stripe.com/de/privacy.
Data processing on behalf of clients: We have entered into a data processing agreement with Stripe.
Uploaded media
If you are a registered user, you will need to upload certain documents (such as your driving licence) as image files to our platform. We use the information contained in these documents to verify your details and check that you are authorised to take the course.
We retain these documents, together with all other details, for the purpose of fulfilling the contract for as long as you maintain a customer account with us; otherwise, for a maximum of 10 years or until all statutory retention periods have expired.
When contacting us by email or via the contact form
When you contact us by email or via the contact form on our website, personal data is collected and stored by us. The personal data collected when you contact us via the contact form is specified in the contact form itself. When you contact us by email, the following personal data is collected and stored by us: your email address, the text of your email, and any other data you provide voluntarily.
We process the data you have provided solely for the purpose of handling your enquiry. The legal basis for this is Article 6(1), first sentence, point (b) of the GDPR, or our legitimate interest in responding to your enquiry in accordance with Article 6(1), first sentence, point (f) of the GDPR.
If storage is no longer necessary, we will delete all personal data collected in this context. Where there is a statutory obligation to retain data, processing will be limited to this purpose. The legal basis is Article 6(1)(c) of the GDPR.
Cookies
Our website uses so-called cookies in many places. Cookies are small text files that are saved on your computer and stored by your browser. They serve to make our website more user-friendly, more efficient and more secure. Furthermore, cookies enable our systems to recognise your browser and offer you relevant services. Cookies do not contain any personal data, but they do allow us to recognise your browser when you visit us again. You can configure your browser to notify you when cookies are being stored and to allow them to be stored only on a case-by-case basis, to block the acceptance of cookies in specific situations or generally, and to enable the automatic deletion of cookies when you close your browser.
If you have an account and log in to this website, we will set a temporary cookie to check whether your browser accepts cookies. This cookie does not contain any personal data and will be deleted when you close your browser.
Once you have logged in, we will set a few cookies to save your login details and display preferences. Login cookies expire after two days, and cookies relating to display preferences expire after one year. When you log out of your account, the login cookies will be deleted.
Using script libraries (Google Web Fonts)
To ensure that our content is displayed correctly and looks visually appealing in all browsers, we use the ‘Google Web Fonts’ service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; hereinafter ‘Google’) on this website to display fonts.
The privacy policy of the library operator, Google, can be found here: https://www.google.com/policies/privacy/
Use of Google Analytics
This website uses Google Analytics, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as ‘Google’). Google Analytics uses so-called ‘cookies’, which are text files stored on the user’s computer that enable the analysis of how this website is used. The information generated by the cookies regarding the use of this website is usually transmitted to a Google server in the United States and stored there. However, as the IP address anonymisation feature is enabled on this website, your IP address is first truncated by Google within the Member States of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and truncated there. On behalf of the operator of this website, Google will use this information to analyse your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website and internet usage. The IP address transmitted by your browser as part of the Google Analytics service is not combined with other data held by Google.
The purpose of data processing is to analyse website usage and to compile reports on activity on the website. Based on data relating to website and internet usage, further related services are then to be provided.
Privacy policy regarding the use of Google AdSense
This website uses Google AdSense, a service provided by Google Inc. (‘Google’) for displaying advertisements. Google AdSense uses so-called ‘cookies’, which are text files stored on the user’s computer that enable the analysis of website usage. Google AdSense also uses so-called web beacons (invisible images). These web beacons enable the analysis of information such as visitor traffic on these pages.
Information relating to the use of this website (including the user’s IP address) and the display of adverts, generated by cookies and web beacons, is transmitted to a Google server in the United States and stored there. This information may be passed on by Google to its contractual partners. However, Google will not associate your IP address with any other personal data held by the company.
You can block the storage of cookies by adjusting the relevant settings in your browser; however, please note that, in this case, your use of all the features of this website may be restricted. By using this website, you consent to the processing of data collected about you by Google in the manner described above and for the purpose set out above.
Further information on Google’s data processing can be found in Google’s privacy policy. You can also change your personal data protection settings there in the Data Protection Centre.
Google AdWords
Our website uses Google’s conversion tracking feature. Google AdWords is operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. If you have arrived at our website via an advert displayed by Google, the Google AdWords service places a cookie on your computer. The conversion tracking cookie is placed when a user clicks on an advert displayed by Google.
If a user visits specific pages on our website and the cookie has not yet expired, both we and Google can recognise that the user clicked on an advert and was redirected to that page. Each Google AdWords client is assigned a different cookie. This means it is not possible to track cookies across AdWords clients’ websites. The information collected via the conversion cookie is used to generate conversion statistics for AdWords clients who have opted in to conversion tracking. Clients are informed of the total number of users who clicked on their advert and were redirected to a page equipped with a conversion tracking tag. However, they do not receive any information that would allow them to identify individual users.
How long do we keep your data?
For users who register on our website, we store all the personal data they provide in their user profiles. All users may view, amend or delete their personal data at any time (usernames cannot be changed). Website administrators can also view and edit this information. You can send us any corrections by email.
What rights do you have in relation to your data?
If you have an account on this website or have written to us, you can request an export of your personal data from us, including all the data you have provided to us. You can obtain information, free of charge, about the data we hold about you and how it is used. Furthermore, you may request the erasure of all personal data we hold about you. This does not include data that we are required to retain for administrative, legal or security reasons.
How we protect your data
SSL encryption
To protect the security of your data during transmission, we use state-of-the-art encryption methods (e.g. SSL) via HTTPS.
Changes
We may amend this privacy policy at any time without prior notice. The current version published on our website shall apply.
Questions for the Data Protection Officer
If you have any questions regarding data protection, please send us an email or contact the data protection officer within our organisation, as listed at the start of this privacy policy.
Please contact us at info@rsa-online.net
SBA GmbH
Hinterbergstraße 19
CH-6330 Cham
Cham, 06.12.2019
