Privacy Policy

This is how we use your data

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to as “data”) that we process, for what purposes and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and, in particular, on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as “online services”).

The terms used are not gender-specific.

Controller

Phone: +49 69 677 07 102
Email: contact@greenbanana.group

Overview of processing activities

The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects.

Types of data processed

• Contact details
• Content data
• Usage data
• Metadata, communication data and process data

Categories of data subjects

• Communication partners
• Users

Purposes of processing

• Contact requests and communication
• Security measures
• Managing and responding to inquiries
• Feedback
• Provision of our online services and user-friendliness
• Information technology infrastructure
• Reach measurement and improvement of our online services (only with consent)

Relevant legal bases

Below you will find an overview of the GDPR legal bases on which we process personal data. Please note that in addition to the GDPR, national data protection laws may apply in your or our country of residence or establishment. Should more specific legal bases apply in individual cases, we will inform you of these in this privacy policy.

• Consent (Art. 6 (1) (a) GDPR): The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Performance of a contract and pre-contractual inquiries (Art. 6 (1) (b) GDPR): The processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract.
• Legitimate interests (Art. 6 (1) (f) GDPR): Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

Security measures

In accordance with legal requirements, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the varying likelihood and severity of the threat to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

These measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access to the data, as well as access to, input of, transfer of and ensuring the availability and separation of the data. We have also established procedures that guarantee the exercise of data subject rights, the deletion of data and responses to data breaches. We consider the protection of personal data during the development and selection of hardware, software and processes, in accordance with the principles of data protection by design and by default.

TLS encryption (https): To protect the data you transmit via our online services, we use TLS encryption. You can recognize such encrypted connections by the https:// prefix in your browser’s address bar.

Transfer of personal data

As part of our processing of personal data, it may be necessary to transfer or disclose data to other entities, companies, legally independent organizational units or individuals. Recipients of this data may include, for example, IT service providers or providers of services and content integrated into a website. In such cases, we comply with legal requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data to protect your data.

Data processing in third countries

If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)), or if the processing takes place in the context of using third-party services or disclosing or transferring data to other persons, bodies or companies, this will only be done in accordance with legal requirements.

Subject to explicit consent or where a transfer is required by contract or law, we only process or have data processed in third countries with a recognized level of data protection, on the basis of contractual obligations through the standard contractual clauses of the EU Commission, or in the presence of certifications or binding internal data protection rules (Art. 44 to 49 GDPR; information page of the EU Commission).

Deletion of data

The data we process will be deleted in accordance with legal requirements as soon as consent to process it is withdrawn or other legal grounds for processing cease to apply (e.g., if the purpose for processing this data no longer exists or it is no longer necessary for that purpose). If the data is not deleted because it is required for other legally permissible purposes, its processing will be restricted to those purposes. This means the data will be blocked and not processed for any other purpose. This applies, for example, to data that must be retained for commercial or tax law reasons or whose storage is necessary for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person.

Our privacy policy may also contain further information on the storage and deletion of data, which takes precedence for the respective processing activities.

Use of cookies

Cookies are small text files or other storage markers that store information on and read information from end devices — for example, to save login status, shopping cart contents, accessed content or used functions of an online service. Cookies can also be used to improve the functionality, security and user-friendliness of online services and to analyze visitor traffic.

Information on consent: We use cookies in accordance with legal regulations. We therefore obtain users’ prior consent unless it is not legally required. In particular, consent is not necessary if storing and reading information, including cookies, is absolutely necessary to provide a digital service (i.e., our online service) that users have expressly requested. Revocable consent is clearly communicated to users and includes information on the respective cookie usage.

Legal basis: The legal basis on which we process users’ personal data using cookies depends on whether we ask for consent. If users consent, the legal basis is their consent. Otherwise, data processed using cookies is processed on the basis of our legitimate interests (e.g., in the efficient operation of our online services and improving their usability) or, where the use of cookies is necessary to fulfil our contractual obligations, on that basis.

Storage duration: With regard to storage duration, the following types of cookies are distinguished:

• Temporary cookies (session cookies): deleted at the latest after a user leaves an online service and closes their device (e.g., browser or mobile application).
• Persistent cookies: remain stored even after the device is closed — for example, to save login status or to show preferred content directly when the user revisits a website. Unless we provide explicit information about the type and storage duration of cookies (e.g., when obtaining consent), users should assume that cookies are persistent and can be stored for up to two years.

Revocation and objection (opt-out): Users can revoke their consent at any time and object to processing in accordance with Art. 21 GDPR. Users can also declare their objection via their browser settings, e.g., by deactivating the use of cookies (which may restrict the functionality of our online services). An objection to the use of cookies for online marketing purposes can also be declared via optout.aboutads.info and youronlinechoices.com. You can change your choice for this website at any time under Cookie settings.

Processing of cookie data based on consent: Where our online services use cookies or similar technologies that require consent, we obtain, manage and record your consent via a consent banner. The consent declaration is stored so that it does not have to be requested again and can be demonstrated in accordance with legal requirements. Storage can be server-side and/or in a cookie (opt-in cookie) or similar browser storage for up to two years. Legal basis: Art. 6 (1) (c) and (f) GDPR; our legitimate interest is the management of the cookies used and the associated consents.

Provision of the online service and web hosting

We process user data in order to provide our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or device.

• Types of data processed: usage data (e.g., websites visited, interest in content, access times); meta, communication and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).
• Data subjects: users (e.g., website visitors, users of online services).
• Purposes of processing: provision of our online services and user-friendliness; information technology infrastructure; security measures.
• Legal basis: legitimate interests (Art. 6 (1) (f) GDPR).

Hosting by Amazon Web Services: This website is hosted and delivered via Amazon Web Services (Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg). AWS provides the storage space, computing capacity and content delivery used to deliver this website to your browser and processes the data described in this section on our behalf. Legal basis: legitimate interests (Art. 6 (1) (f) GDPR).

Collection of access data and log files: Access to our online services is logged in the form of server log files. These may contain the address and name of the accessed web pages and files, the date and time of access, the amount of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. Server log files are used for security purposes, e.g., to prevent server overload (especially in the case of DDoS attacks), and to ensure server capacity and stability. Legal basis: legitimate interests (Art. 6 (1) (f) GDPR). Log file information is stored for a maximum of 30 days and then deleted or anonymized; data that must be retained for evidentiary purposes is exempt from deletion until the respective incident has been fully resolved.

Web analytics with Microsoft Clarity

Only if you consent, we use Microsoft Clarity, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, to understand how visitors use this website (for example page views, clicks, scrolling and mouse movements) and to improve it. Clarity is not loaded before you accept analytics in the consent banner.

• Types of data processed: usage data; meta, communication and procedural data (e.g., device and browser information, pseudonymised identifiers).
• Purposes of processing: reach measurement and improvement of our online services.
• Legal basis: consent (Art. 6 (1) (a) GDPR). You can withdraw your consent at any time with effect for the future under “Cookie settings”.
• Third-country transfer: data may be processed in the USA; Microsoft participates in the EU-U.S. Data Privacy Framework.

Contact and inquiry management

When you contact us (e.g., by post, via our demo request form, by email, telephone or via social media) and within the framework of existing user and business relationships, the information of the requesting persons is processed to the extent necessary to answer the contact request and any requested measures.

• Types of data processed: contact data (e.g., name, email addresses, telephone numbers); content data (e.g., company, shop system and your message entered in online forms); usage data; meta, communication and procedural data.
• Data subjects: communication partners.
• Purposes of processing: contact requests and communication; managing and responding to inquiries, including demo appointments; feedback; provision of our online services and user-friendliness.
• Legal basis: legitimate interests (Art. 6 (1) (f) GDPR); performance of a contract and pre-contractual inquiries (Art. 6 (1) (b) GDPR).

Demo request and contact form: When you contact us via our demo request form, email or other communication channels, we process the data you provide to us in this context to handle your request. Legal bases: performance of a contract and pre-contractual inquiries (Art. 6 (1) (b) GDPR) and legitimate interests (Art. 6 (1) (f) GDPR).

Changes and updates to this privacy policy

Please review the content of our privacy policy regularly. We will update it as soon as changes to our data processing make this necessary, and we will inform you if changes require action on your part (e.g., consent) or other individual notification.

Where we provide addresses and contact information of companies and organizations in this privacy policy, please note that these may change over time and check the information before contacting them.

Rights of data subjects

As a data subject under the GDPR, you have various rights, which arise in particular from Art. 15 to 21 GDPR:

• Right to object: You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Art. 6 (1) (e) or (f) GDPR, including profiling based on those provisions. Where personal data are processed for direct marketing purposes, you have the right to object at any time to such processing, including profiling to the extent that it is related to direct marketing.
• Right to withdraw consent: You have the right to withdraw any consent you have given at any time.
• Right of access: You have the right to request confirmation as to whether data concerning you is being processed, and to access this data as well as further information and a copy of the data in accordance with legal requirements.
• Right to rectification: You have the right to request the completion of data concerning you or the correction of inaccurate data concerning you.
• Right to erasure and restriction of processing: You have the right to request that data concerning you be erased without undue delay or, alternatively, that its processing be restricted, in accordance with legal requirements.
• Right to data portability: You have the right to receive the data concerning you that you have provided to us in a structured, commonly used and machine-readable format, or to request its transmission to another controller, in accordance with legal requirements.
• Right to lodge a complaint with a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR.

Definitions of terms

This section provides an overview of the terms used in this privacy policy. Many of the terms are taken from the law and are primarily defined in Art. 4 GDPR. The legal definitions are binding; the following explanations are intended to aid understanding.

• Personal data: “Personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., a cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• Controller: The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• Processing: Any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means. The term is broad and covers virtually any handling of data, be it collection, analysis, storage, transmission or erasure.