Our privacy statement uses terms that are defined in the EU General Data Protection Regulation (GDPR). To make the privacy statement readable and understandable, we have defined these terms as follows:

(1) PERSONAL DATA:

According to the GDPR, personal data covers all information that refers to an identified or identifiable natural person. This means information such as your name, date of birth, address, e-mail address, IP address, telephone number and your user behaviour. In contrast, information that cannot be directly connected to your true identity – such as generally preferred websites by all users or the number of users on a page – is not considered personal data.

(2) PERSON CONCERNED

The person concerned is each identified or identifiable natural person whose personal data will be processed by the party responsible for processing data.

(3) PROCESSING

Processing is any procedure executed with or without the assistance of automated processes or any series of procedures performed in conjunction with personal data, such as collecting, recording, organising, filing, saving, adapting or changing, exporting, querying, using, disclosing personal data by transmitting, distributing or any other form of provision, comparing or linking, restricting, deleting or destroying said data.

(4) RESTRICTING THE PROCESSING OF DATA

Restricting the processing of data means highlighting stored personal data with the goal of restricting its processing in the future.

(5) RESPONSIBLE PARTY

The responsible party is the natural person or legal entity, authority, institution or other office that, alone or together with others, makes decisions regarding the purposes and means of processing personal data. If the purposes and means of processing said data are specified by Union law or the rights of the Member States, the responsible party(ies) can stipulate the specific criteria for his/her appointment according to Union law or the rights of the Member States.

(6) PROCESSOR

A processor is a natural person or legal entity, authority, institution or other office that processes personal data on behalf of the responsible party.

(7) RECIPIENT

The recipient is a natural person or legal entity, authority, institution or other office to whom the personal data is disclosed, regardless of whether it is a third party or not. However, authorities that may receive personal data as part of a specific investigative order in accordance with Union law or the rights of Members States shall not be considered as recipients.

(8) THIRD PARTY

A third party is a natural person or legal entity, authority, institution or other office, not including the person concerned, the responsible party, the processor and persons under the direct supervision of the person in charge or the processor, who is authorized to process the personal data.

(9) CONSENT

Consent is any declaration of intention in the form of a declaration or other clear confirmation of treatment voluntarily issued by the person concerned in an informed and unmistakable manner for the specific situation in which the person concerned makes clear that he/she consents to have his/her relevant personal data processed.

(1) THE RESPONSIBLE PARTY [ART. 4 CLAUSE 7 GDPR]

MERIDA & CENTURION GERMANY GmbH
Blumenstraße 49-51
D-71106 Magstadt
Phone +49 (0) 7159 9459-600
Telefax +49 (0)7159 9459-500
E-Mail: dataprotection@merida-centurion.com
www.merida-bikes.com
Referred to hereinafter as “responsible party” or “we” or “us.”

(2) DATA PROTECTION OFFICER:

Mr. Reiner Braun 
E-Mail: dataprotection@merida-centurion.com

(1) SCOPE OF PROCESSING PERSONAL DATA

In principle, we collect and use the personal data of our users only as much as is necessary to provide a functional website as well as our content and services. The collection and use of your personal data is usually done only with your consent. However, one exception applies in such cases in which prior receipt of consent is not possible for actual reasons and processing the data is nevertheless permitted by legal regulations.

(2) LEGAL BASIS FOR PROCESSING PERSONAL DATA

The data transmitted by you or collected are collected, used, processed and saved exclusively under the data protection laws (GDPR, Federal Data Protection Act and the Telemedia Act) in effect and, if applicable forwarded to third parties – to the extent legally specified, contractually necessary or permitted as part of the legal bases presented below.

Based on Art. 6 GDPR, there are various legal bases for processing your personal data which are referred to in this privacy statement:

1. Art. 6 Para. 1 a) GDPR is the legal basis for personal data processing procedures if the person concerned has given his/her consent.
2. Art. 6 Para. 1 b) GDPR is the legal basis for processing personal data that is necessary to comply with a contract and whose contractual party is the person concerned. This legal basis also refers to those processing procedures that are necessary to carry out pre-contractual actions.
3. If we have to process personal data to meet a legal obligation of our company, then Art. 6 Para. 1 c) GDPR is the legal basis for this.
4. Art. 6 Para. 1 d) GDPR serves as the legal basis if vital interests of the person concerned by the data processing or another natural person make it necessary to process their personal data.
5. If the processing of personal data is necessary to protect a justified interest of our company or a third party and, in the process, the interests, fundamental rights and freedoms of the person concerned do not outweigh this initial interest of our company, or the interest of a third party, then processing is carried out on the legal basis stated in Art. 6 Para. 1 f) GDPR.

(3) DELETING DATA AND STORAGE PERIOD

As soon as the purpose for storing the respective personal data of the person concerned no longer exists, these data are deleted or blocked. Nevertheless, storage can extend beyond this time frame if a legal basis for this was intended in European or national directives, laws or other provisions that we, as the responsible party for data processing, are subject to. Data are also blocked or deleted if a storage period specified by the standards mentioned expires, unless there is a need to further store such data for concluding a contract or fulfilling a contract.

How much of your personal data we collect and how we use it depends on whether you visit our website only to retrieve information or if you use our services or contact us, e.g. through the e-mail contact form or partner search:

(1) VISITING OUR WEBSITE

It is generally not necessary to enter your personal data to visit and use our website for informational purposes only. Rather, we automatically collect, use and store information sent to us by the respective browser during your visit to our website in the server log files.

(2) COLLECTED DATA THAT IS NOT NECESSARILY PERSONAL DATA

The following data is collected at this time:

1. Information about your browser: Type, language, the version you use (e.g. Mozilla Firefox, Microsoft Internet Explorer, Apple Safari, Google Chrome)
2. The operating system you use
3. The Internet service provider you use
4. Your IP address
5. Date and time of your access
6. Websites from which your system arrived at our website
7. Websites that your system accessed via our website
8. Time zone difference compared to Greenwich Mean Time (GMT)
9. Content of the request (specific page)
10. Access status/http status code
11. The respective volume of data transmitted

The data are stored in our system's log file. We do not store this data together with the user's other personal data, such as name, address, telephone number or e-mail address.

(3) LEGAL BASIS

The legal basis for this temporary storage of data and the log files is Art. 6 Para. 1 f) GDPR (see above III. (2) 5.) because our justified interests – as presented in the following – in storing this data outweigh your interests, fundamental rights and freedoms: The IP address is considered personal data. The temporary storage of the IP address by the system is necessary to enable the transmission of our website to your browser. To this end, the IP address must remain stored for the remainder of the session. Log files are stored to ensure the functionality of our website. The data are also used to optimize our website and ensure the security of our information technology systems. The data are not analysed for marketing purposes in this context.

(4) STORAGE PERIOD

The data are deleted as soon as they are no longer needed to achieve the purpose for which they were collected in the first place. If the data are collected to make our website available, this is the case if the respective session is ended. If the data were stored in the log files, this is the case no later than after 30 days. However, storage above and beyond this is also possible. In this case, however, your IP address is deleted or distorted so that it can no longer be assigned to your person.

(5) OBJECTION AND REMOVAL OPTIONS

The collection of data to access our website and store the data in the log files is absolutely necessary for operating the website. There is consequently no option to object in this case.

If you use our services on the website and want to communicate with us via the e-mail contact form, you are required to enter your personal data:

(1) DESCRIPTION AND SCOPE OF DATA PROCESSING

You can contact us using the e-mail addresses provided vertrieb@merida-centurion.com, marketing@merida-centurion.com and service@merida-centurion.com. In this case, your personal data transmitted with the e-mail will be stored in our system.

(2) LEGAL BASIS FOR DATA PROCESSING

The legal basis for processing the data is, if and as long as your consent is available, Art. 6 Para. 1 lit. a) GDPR (see above III. (2) 1.).

The legal basis for processing the data that is transmitted as part of a sent e-mail is additionally Art. 6 Para. 1 lit. f) GDPR (see above III. (2) 5.). If the e-mail contact is already targeting the conclusion of an agreement, then Art. 6 Para. 1 lit. b) GDPR (see above III. (2) 2.) is also an additional legal basis for processing.

(3) PURPOSE OF DATA PROCESSING

Processing personal data from an e-mail sent to us is used solely to process the contact. This also covers the necessary justified interest in processing the data if they are processed based on Art. 6 Para. 1 f) GDPR.

(4) STORAGE PERIOD

The data are deleted as soon as they are no longer needed to achieve the purpose they were collected for in the first place. For personal data that was sent via e-mail, this is then the case if the respective conversation with the user is over. The conversation is over when it is understood from the circumstances that the relevant matter has been conclusively clarified.

(5) OBJECTION AND REMOVAL OPTIONS

You have the option of revoking your consent to have your personal data processed at any time. If you contact us using the e-mail contact form, you can request that your personal data no longer be stored. In such a case, however, the conversation cannot be continued. All personal data that was saved during the e-mail contact process will be deleted in this case.

(6)  SSL ENCRYPTION

In order to protect your transmitted data, we use SSL encryption. You can identify this type of encrypted connection with the prefix “https://” in the page link in your browser’s URL line. All data that you transmit to our website – for example when using our contact forms – cannot be read by third parties thanks to SSL encryption.

(1) DESCRIPTION AND SCOPE OF DATA PROCESSING

Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user's computer system. If a user accesses a website, a cookie may be saved on the user's operating system. This cookie contains a character string that enables the browser to clearly identify the browser when the website is repeatedly accessed.

(a) Technologically necessary cookies

We use technologically necessary cookies to make our website more user-friendly. Several elements from our website require that the browser accessing the site can also be identified after changing pages.
In the process, the following data are stored in the cookies and transmitted:

(1) Language settings
(2) Login information

(2)  LEGAL BASIS FOR DATA PROCESSING

The legal basis for processing personal data using cookies is Art. 6 Para. 1 lit. f GDPR.

(3) PURPOSE OF DATA PROCESSING

The purpose of using technologically necessary cookies is to simplify the use of websites for the user. Several functions of our website cannot be offered without the use of cookies. To this end, it is necessary for the browser to be identified again after changing pages.

We need cookies for the following uses:

(1) Acceptance of language settings
(2) Bookmarking search terms
(3) Storage of the contents of already visited pages for faster data transmission
The user data collected by technologically necessary cookies is not used to create user profiles.

(4)  STORAGE PERIOD, OBJECTION AND REMOVAL OPTIONS

Cookies are stored on the user's computer which transmits them to our site. That is why you, as the user, have complete control over the use of cookies. By changing the settings in your Internet browser, you can deactivate or restrict the transmission of cookies. Cookies already stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, the user may no longer have complete use of all functions on the website.

This website uses the open source web analysis service Matomo (formerly “Piwik”). Matomo uses so-called “cookies”. These are text files that are stored on your computer and enable an analysis of your use of the website. For this purpose, the information generated by the cookie about the use of this website is stored on our server. The IP address is made anonymous before it is saved. Data processing is carried out on the basis of the legal provisions of Art. 6 (1) 1. lit f (legitimate interest) of the GDPR. Our concern in the sense of the GDPR (legitimate interest) is the optimization of our online offer and our website.

The information generated by the cookie about the use of this website will not be passed on to third parties. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website.

If you do not agree to the storage and use of your data, you can deactivate the storage and use. In this case, an opt-out cookie is stored in your browser which prevents Matomo from saving usage data. If you delete your cookies, the Matomo Opt-Out cookie will also be deleted. The opt-out must be reactivated the next time you visit our site.

In order to enable the use of different services on our website, e.g. partner locator, we have to forward your data to a third party. We would like to inform you how this works as follows:

(1)  GOOGLE MAPS-SUPPORTED PARTNER SEARCH

We use the services of Google Maps on our website. This allows us to directly provide a partner search function based on postal codes and enables you to conveniently use this map function.

(a) Description and scope of data processing

When you use Google Maps, Google is notified that you have accessed the corresponding sub-page of our website. Moreover, the data mentioned under IV of this privacy statement are transmitted to Google. This occurs regardless of whether Google has provided a user account that you are logged into or no user account exists.

When you are logged into Google, your data are directly allocated to your account. If you do not want them to be allocated to your Google account, you have to log off before activating the button.

(b) Legal basis for data processing

The legal basis of this data processing is Art. 6 Abs. 1 lit f) DSGVO

(c) Purpose of data processing

So that you can use Google Map services, Google Maps needs your IP address. You cannot use these services unless it is forwarded. Our interest is increasing user-friendliness on our website. If you use the service to search for a partner, the use of your IP address is also in your initial interest according to Art. 6 lit. f) GDPR (see above III. (2) 5.).

However, Google also stores your data as a user profile and uses it for advertising, market research purposes and/or the needs-based design of its website. Such an analysis is performed (even for users not logged in) to provide needs-based advertising and to inform other users of the social network regarding your activities on our website.

You have the right to object to the creation of these user profiles, although you have to assert this right with Google [see also below (e)]. We have no influence on Google’s processing of data.

(d) Storage period

We cannot make any statements regarding any deletion of data that is collected by Google.

(e) Objection and removal options

You have the right to object to the creation of user profiles mentioned above under (c), although you have to assert this right directly with Google.

(f) Further information

Information on the purpose and scope of the data collection and its processing by the plug-in supplier can be obtained from the privacy statement of the supplier. It will provide you with more information on your privacy rights and settings options to protect your privacy: http://www.google.de/intl/de/policies/privacy. Google also processes your personal data in the U.S. and is subject to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

(2) YOUTUBE

We've included YouTube videos in our online offering, which are stored on http://www.YouTube.com and are directly playable from our website.

(a) Description and scope of data processing

When you use YouTube, Google is notified that you have accessed the corresponding sub-page of our website. Moreover, the data mentioned under IV of this privacy statement are transmitted to Google. This occurs regardless of whether Google has provided a user account that you are logged into or no user account exists.

When you are logged into Google, your data are directly allocated to your account. If you do not want them to be allocated to your Google account, you have to log off before activating the button.

(b) Legal basis for data processing

The legal basis of this data processing is Art. 6 Abs. 1 lit f) DSGVO

(c) Purpose of data processing

So that you can use YouTube services, Google needs your IP address. You cannot use these services unless it is forwarded. Our interest is increasing user-friendliness on our website. If you use the service to search for a partner, the use of your IP address is also in your initial interest according to Art. 6 lit. f) GDPR (see above III. (2) 5.).

However, Google also stores your data as a user profile and uses it for advertising, market research purposes and/or the needs-based design of its website. Such an analysis is performed (even for users not logged in) to provide needs-based advertising and to inform other users of the social network regarding your activities on our website.

You have the right to object to the creation of these user profiles, although you have to assert this right with Google [see also below (e)]. We have no influence on Google’s processing of data.

(d) Storage period

We cannot make any statements regarding any deletion of data that is collected by Google.

(e) Objection and removal options

You have the right to object to the creation of user profiles mentioned above under (c), although you have to assert this right directly with Google.

(f) Further information

Information on the purpose and scope of the data collection and its processing by the plug-in supplier can be obtained from the privacy statement of the supplier. It will provide you with more information on your privacy rights and settings options to protect your privacy: http://www.google.de/intl/de/policies/privacy. Google also processes your personal data in the U.S. and is subject to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

At the moment we offer neither a user registration nor a newsletter registration on our website.

(a) Description of social media links

On our website, we have inserted links to our respective profiles on Facebook, Twitter and Xing. By clicking on the respective icon, you can navigate to our profiles on the desired social media platforms.

When you click on these links, none of your data is transmitted to the operator of the respective social media platform. If you click on one of these links, you will be directed to the respective social network website. Depending on your browser, this happens by opening a new tab or pop-up. The operator of the respective network does not collect or process your data until the URL changes.

(b) Further information on Facebook, Twitter, YouTube and Instagram

In the privacy statement provisions of these social networks, you will find information on protecting and managing your data.

For more detailed information on Facebook, click on this link: https://www.facebook.com/about/privacy/update?ref=old_policy.

For more detailed information on Twitter, click on this link: https://twitter.com/de/privacy.

More information on the purpose and scope of data collection and processing by YouTube can be found in the privacy statement. There, you can find additional information on your rights and setting options to protect your privacy: https://www.google.de/intl/de/policies/privacy. Google also processes your personal data in the U.S. and is now subject to the EU-US Privacy Shield, see https://www.privacyshield.gov/EU-US-Framework.

For more information on Instagram, click on the following link for Instagram’s privacy statement: http://instagram.com/about/legal/privacy/.

Dealers can only login if they are already our customer. Data collection on the website for login use for registered partners occurs only within the framework already presented here.

If we process your personal data, you are the person concerned as set forth in the GDPR and you are entitled to the following rights from us as the responsible party:

(1) RIGHT TO INFORMATION

You can ask us for confirmation as to whether we process personal data that relates to you.

If we process such information, you can ask us for further information regarding the following:

1. the reason why your personal data is processed;
2. the categories of personal data that are processed;
3. the recipient or the categories of recipients to whom your personal data was disclosed or will be disclosed;
4. the scheduled storage period for your personal data or, if no concrete statements on this can be made, criteria for defining the storage period;
5. the existence of a right to correction or deletion of your personal data, a right to limit processing by the responsible party or the right to object to this processing;
6. the existence of a right to complain to a supervisory authority;
7. all available information on the origin of the data if the personal data are not collected from you as the person concerned.

You have the right to request information on whether your personal data will be transmitted to a third country or to an international organisation. In this context, you can request to be informed of such transmissions via suitable guarantees in accordance to Art. 46 GDPR.

(2) RIGHT TO CORRECTION

You have the right to demand from us – as the responsible party or, for example, from Google – correction and/or completion if the personal data that affects you and that we process is incorrect or incomplete. We must immediately perform the corrections.

(3) RIGHT TO RESTRICT PROCESSING

Under the following conditions, you can request that the processing of your personal data be restricted:

(a) If you dispute the accuracy of your personal data for the period of time it takes for the responsible party to review the accuracy of your personal data;
(b) If processing your personal data is unwarranted and you do not want your personal data to be deleted, rather you request that the use of your personal data be restricted;
(c) We no longer require the personal data for processing purposes, but you need it for asserting, exercising or defending legal claims, or
(d) if you file an objection against data processing in accordance with Art. 21 Para. 1 GDPR and it has not yet been determined whether the justified reasons that we have asserted outweigh your reasons.

If processing your personal data was restricted, then these data – aside from saving them – may only be processed with your consent or to assert, exercise or defend legal claims or to protect the rights of another natural person or legal entity or for reasons of an important public interest of the Union or a Member State.

If the processing of data according to the above conditions was restricted, you shall be informed before such restrictions are lifted.

(4) RIGHT TO DELETION

(a) Obligation to delete data

You can request that we immediately delete your personal data, which then means that we are immediately obligated to delete these data if one of the following reasons applies:

1. The personal data that affects you are no longer needed for the purpose for which said data was collected or in any other way processed.
2. You revoke your consent on which the processing is based according to Art. 6 Para. 1 lit. a) or Art. 9 Para. 2 lit. a) GDPR, and no other reason can be found to support data processing.
3. You file an objection against processing in accordance with Art. 21 Para. 1 GDPR and there are no overriding justified grounds for data processing, or you file an objection against data processing in accordance with Art. 21 Para. 2 GDPR.
4. Your personal data was unlawfully processed.
5. The deletion of your personal data is necessary to meet a legal obligation according to Union law or the law of Member States that we are subject to.
6. Your personal data was collected as part of services offered by the information company according to Art. 8 Para. 1 GDPR.

(b) Information to third parties

If we disclosed your personal data to the public and we are obligated to delete it according to Art. 17 Para. 1 GDPR, we shall take the appropriate actions, taking into account available technology and the implementation costs, even those of a technical kind, to inform others who are responsible for data processing, who process your personal data, that you, as the person concerned, have requested the deletion of all links to your personal data or want copies or replications of this personal data.

(c) Exceptions

The right to deletion does not exist as long as processing is necessary

1. to exercise the right of one’s freedom to express an opinion and to information;
2. to meet a legal obligation that requires processing according to the law of the Union or Member States, which we are subject to, or to handle a task that is in the public interest or to exercise a public authority that was transferred to the responsible party;
3. for reasons of public interest in the field of public health in accordance to Art. 9 Para. 2 lit. h) and i) as well as Art. 9 Para. 3 GDPR;
4. for archiving purposes that are in the public interest, scientific or historic research purposes or for statistical purposes according to Art. 89 Para. 1 GDPR as long as the right to deletion mentioned under Section X (4) (a) probably makes the realization of the goals of this processing impossible or seriously impairs them, or
5. to assert, exercise or defend legal claims.

(5) RIGHT TO INFORMATION

If you have asserted the right to correction, deletion or restriction to processing with us, we are obligated to inform all recipients, to whom your personal data was disclosed, of this correction or deletion of data or restriction to processing, unless this proves to be impossible or is associated with unreasonable time and expense. You have the right to be informed about these recipients by us.

(6) RIGHT TO DATA TRANSMISSION

You have the right to receive your personal data that you provided to us in a structured, conventional and machine-readable format. In addition, you have the right to transmit these data to another responsible party without impairment by us as the responsible party to whom the personal data was supplied as long as

1. processing is based on consent in accordance to Art. 6 Para. 1 lit. a) GDPR or Art. 9 Para. 2 lit. a) GDPR or on an agreement in accordance to Art. 6 Para. 1 lit. b) GDPR and
2. processing occurs with the aid of an automated procedure.

In exercising this right, you further have the right to ensure that your personal data is transmitted directly by us as the responsible party to another responsible party, as long as this is technologically feasible. Freedoms and rights of other persons may not be impaired by this action.

The right to data transmission shall not apply to processing personal data that is necessary to perform a task, that is in the public interest or occurs as part of exercising public authority that was transferred to us as the responsible party.

(7) RIGHT OF OBJECTION

You have the right to file an objection – for reasons that result from your special situation – to the processing of your personal data, which occurs based on Art. 6 Para. 1 lit. e) or f) GDPR; this also applies to profiling based on these provisions.

We no longer process your personal data unless we can provide compelling and legitimate grounds for processing the data that outweigh your interests, rights and freedoms, or processing the data serves to assert, exercise or defend legal claims.

If your personal data are processed to operate a direct advertising campaign, you have the right to file an objection at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling as long as it is connected to such direct advertising. If you object to data processing for the purpose of direct advertising, your personal data shall no longer be processed for these purposes.

You have the option, in conjunction with the use of services from an information company – regardless of Directive 2002/58/EU – to exercise your right to object using an automated process for which technical specifications are used.

(8) RIGHT TO REVOKE DATA PRIVACY DECLARATION OF CONSENT

You have the right to revoke your data privacy declaration of consent at any time. By revoking your consent, the legality of the data processing that has occurred up to the point of your revocation shall not be affected.

(9)  RIGHT TO FILE A COMPLAINT WITH A SUPERVISORY AUTHORITY

Without prejudice to another administrative or legal remedy, you have the right to file a complaint with a supervisory authority, especially in the Member State where you reside, your workplace or the location of the alleged violation if you are of the opinion that the processing of your personal data violates the GDPR.

The supervisory authority to whom the complaint was filed shall inform you, as the claimant, regarding the status and outcome of the complaint, including the option of a legal remedy according to Art. 78 GDPR.