Privacy Policy of Tellja GmbH (business division Tellja)
Version of 12/28/2020

This website is operated by Tellja GmbH (hereinafter “Tellja” or “we/us”). Below, we inform you about the collection of personal data when using this website. Personal data are all data that can be related to your person, e.g., name, address, e-mail addresses, user behavior.

Your data will be collected, processed, and used in accordance with the provisions of the German Telemedia act (Telemediengesetzes, TMG) and data protection legislation, particularly the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) and the General Data Protection Regulation (GDPR). With this privacy policy, we inform data subjects about the collection of personal data on and through our website as well as through our widget on websites of advertisers pursuant to Art. 13 GDPR.

The following points apply for the Tellja Internet website (TI) and/or Tellja Widget (TW).

1. Collection of personal data with informational use (TI)

(1) (1) In the event that our website is solely used for informational purposes, i.e. if you do not log in, register, or transmit data to us in any other way to use the website, we shall not collect any personal data, with the exception of the data transmitted by your browser. The purpose of this data collection is to allow your visit to our website in the first place and safeguard website functioning. Furthermore, these data are used by us to optimize the website and uphold the security of our IT systems. These data are:

• IP address
• Date and time of the request
• Time zone difference relative to Greenwich Mean Time (GMT)
• Content of the request (specific webpage)
• Access status/HTTP status code
• Relevant transmitted data quantity
• Website from which the request is made
• Browser
• Operating system and its interface
• Browser software language and version

(2) Furthermore, cookies are stored on your computer when using the website. Cookies are small text files that are stored on your hard drive with an assignment to the browser you use and that transmit certain information to the party setting the cookies (in this case, us). We use cookies to make our website user-friendly and effective overall. Some elements of our website require identification of the accessing browser, even after a page change. Detailed information on the cookies we use and the duration of their storage can be accessed at https://www.tellja.eu/en/cookie-policy.html.

(3) With cookies that are necessary to ensure that the website and recommendation system function as expected, cookie data are sometimes linked to your other data, if such data were transmitted in the first place.

2. Collection of personal data with personalized use (TI/TW)

(1) Besides the purely informational use of our website, we offer various services that you can use if you are interested. Generally, you have to provide additional personal data, which we then use to perform the service in question. Such mandatory disclosures are marked accordingly. Additional voluntary disclosures might also be possible. We only collect, process, and use those personal data that are required for you to use our website and/or for the performance of an agreement concluded with us, above all handling of recommendations and related disbursement of bonuses, as well as those data personally specified by you. These generally concern the following inventory data and usage data, some of which might be transmitted through forms on our website:

• Name (consisting of the salutation, first name, and family name)
• Address
• E-mail address
• User registration and login data
• User bank details
• Possibly user customer number with the advertiser

(2) Inventory data and usage or tracking data are used by us, where necessary, to substantiate a contractual relationship with you, design it accordingly, modify it, or terminate it, to fulfil our contractual obligations, for the user website login, to contact you if desired by you, or whenever either required or legally permissible within the framework of the contractual relationship.

(3) In addition to the information specified above, under certain circumstances we process the following data voluntarily transmitted to us to process support cases.

• Customer number (if not already transmitted as a mandatory disclosure)
• Contract/reference number
• Dates

We store these data for said purpose until the inquiry in question has been conclusively processed. If the inquiry is related to a transaction, we store your data until expiry of the statutory retention periods.

(4) With the exception of data collected by the third parties listed below, personal data are stored and processed within the European Union.

(5) As an alternative to the website login using a Tellja user name/password, users can also connect their existing Facebook account with their Tellja account, so they can log into Tellja with their Facebook account from then on (“Facebook Connect”). Facebook Connect is provided by the social network “Facebook”, which is operated by Facebook, Inc. headquartered at 1601 S. California Ave, Palo Alto, CA 94304, USA (hereinafter “Facebook”). The use of Facebook Connect is subject to the Facebook Privacy Policy and Terms of Service, which can be accessed at https://www.facebook.com/privacy. When using Facebook Connect, we receive access to the e-mail address stored with Facebook together with other information held by Facebook that is publicly available and generally accessible on your Facebook profile.

3. Tellja recommendation marketing (by telephone)

Whenever a new customer places an order with one of our advertisers over the phone, the advertiser in question collects the personal data of the new customer and the party recommending them as required to process the order and handle the recommendation.

To successfully complete the recommendation process over the phone and afterwards pay out the bonus to the recommending party (or, whenever a bonus can be shared, to the new customer as well), the advertiser transmits the collected data required to process the recommendation (such as the first name, family name, order ID, purchased product, and e-mail address of the recommending party, as well as the e-mail address of the new customer) to Tellja.

The e-mail address of the recommending party is required to inform them about a successful recommendation. If the recommending party is not yet registered with our Tellja platform, they will receive a registration link via e-mail. The e-mail address of the new customer is required to inform the new customer in the event of possible bonus sharing.

The purpose of this data processing is solely to successfully complete the recommendation and afterwards pay out the bonus to the recommending party and/or the new customer, as desired.

We shall delete any data accrued in this regard after storage is no longer required for the purpose specified above, unless agreed otherwise or stipulated by law.

4. Tellja Champions (TI)

We offer our “Tellja Champions” product to our business users (Champions). This product allows business users to broker products and services to potential advertisers, with commissions paid out in the event of successful brokerage.

We shall only collect, process, and use those personal data of the business users and/or possibly the advertiser that are required for you to use the product and to fulfil an agreement concluded with us pursuant to Art. 6(1)(b) GDPR, above all the processing of brokerage of products and services and the associated disbursement of commissions, such as the first name/family name/salutation/tax-relevant data/bank details/possibly phone number and e-mail address of the business customer.

The sole purpose of data processing is the successful completion of intermediation and the subsequent disbursement of the commission to the business user.

5. Deletion periods (TI/TW)

Unless specified otherwise in this Privacy Policy, we shall only store your data for as long as required to fulfil the purposes for they were collected or processed, unless longer storage is required as a result of statutory retention periods. In other words, after termination of the contractual relationship and after processing of your inquiry or processing of your recommendation and disbursement of the bonus, your personal data will be deleted, unless agreed otherwise or statutorily stipulated.

6. Anonymous statistical analysis of usage data and market research (TI/TW)

We anonymously analyze usage data to design the website in a manner in line with visitor and operator needs.

We also use data for advertising or market research purposes and also transmit these to advertisers, provided that you have expressly consented to such processing in every individual instance. You can always withdraw such a consent given to us.

7. Use of Google Analytics (TI)

(1) Google Analytics, a web analysis service from Google Inc. (“Google”), is used on this website. Google Analytics uses cookies, text files that are stored on your computer and allow for an analysis of how you use the website. The information generated by the cookies on your use of the website are generally transmitted to a Google server in the USA and stored there. If IP anonymization has been activated on this website, however, your IP address will be truncated within EU member states or other states party to the agreement within the European Economic Area (EEA) beforehand. Only in exceptional cases will your full IP address be transmitted to a Google server in the USA and truncated there. Google will use this information on behalf of the operator of this website to analyze your use of this website, to compile reports on website activities, and to perform additional services for the website operator related to the use of the website and the Internet.

(2) The IP address transmitted by your browser related to Google Analytics will not be merged with other Google data.

(3) You can prevent the setting of cookies by making relevant configurations in your browser software; we would however like to point out that, in this case, you might not be able to use all functions of this website in full.

(4) You can additionally prevent the collection of data generated by the cookie related to your use of this website (incl. your IP address) and transmission to Google by downloading and installing the browser plug-in available under the following link: https://tools.google.com/dlpage/gaoptout?hl=en .

(5) This website uses Google Analytics with the extension “_anonymizeIp()”. This means that IP addresses are processed further in truncated form to prevent them being directly linked to a particular individual.

(6) Google Analytics is used in accordance with the requirements agreed between the German data protection authorities and Google. Information on the third-party provider: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Terms of Service: https://marketingplatform.google.com/about/analytics/terms/us/ and Privacy Policy: https://policies.google.com/privacy?hl=en&gl=en.

8. Use of ensighten Tag Manager (TW)

(1) On some of our websites, data are collected for marketing purposes using ensighten technologies (www.ensighten.com), after which they are transmitted to the tracking software used by us, Google Analytics. Cookies are set for this purpose; ensighten does not store the collected usage data.

(2) You can prevent the setting of cookies by making relevant configurations in your browser software; we would however like to point out that, in this case, you might not be able to use all functions of this website in full.

9. Facebook Page Insights – “Facebook Fanpage” (TI/TW)

(1) When visiting our Facebook Page, Facebook collects, among other things, your IP address together with other information available on your PC in the form of cookies. This information is used to provide us, the operator of the Facebook Page, with statistical information on the use of the Facebook Page. These statistical data can be accessed by us, the operator of the page, through the “Insights” of the Facebook Page. These statistics are exclusively collected and provided by Facebook. As the operator, we have no influence on their creation and presentation. We cannot deactivate this function or prevent the collection and processing of data.

Facebook provides more detailed information on “Insights” at the following page: http://en-us.facebook.com/help/pages/insights.

(2) Facebook provides us with the following data through “Insights”:

number of page views, “Like” information, page activities, reach, video views, post interactions, post reach, comments, shared content, replies, gender ratios, regional user distribution (origin related to country and city), language, views and clicks in the shop, clicks on the trip planner, and clicks on phone numbers.

(3) Operation of this Facebook page and the associated processing of personal data of the user is based on our legitimate interest in offering a current and supportive possibility to inform and interact with users of and visitors to our Facebook Page, pursuant to Art. 6(1)(f) GDPR.

(4) As the operator of the fan page, we are jointly responsible for processing together with Facebook (controllers). Therefore, within the context of a Page Insights Controller Addendum with Facebook, we have agreed which party meets which obligations under the GDPR. According to the GDPR, Facebook is primarily responsible for the processing of Insights data. Facebook consequently meets all GDPR obligations regarding the processing of Insights data (among others Art. 12 and 13 GDPR, Art. 15–22 GDPR, and Art. 32–34 GDPR). You can exercise your rights as a data subject towards us or Facebook Ireland Limited (“Facebook Ireland). If you, as a data subject, contact us regarding the processing of Insights data and the obligations assumed by Facebook Ireland under the Page Insights Controller Addendum, we are obligated to transmit all pertinent data to Facebook Ireland.

For the full Page Insights Controller Addendum, visit: https://www.facebook.com/legal/terms/page_controller_addendum.

(5) Facebook addresses and URL of the Privacy Policy:

Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA;

http://www.facebook.com/policy.php; additional information on data collection: http://www.facebook.com/help/186325668085084, http://www.facebook.com/about/privacy/your-info-on-other#applications as well as http://www.facebook.com/about/privacy/your-info#everyoneinfo. Facebook has subscribed to the EU-US Privacy Shield https://www.privacyshield.gov/EU-US-Framework.

10. E-mail newsletter (TI/TW)

(1) If you provide your separate consent, we can send you our e-mail newsletter with information on website usage, our product range, competitions, and special promotions as well as general customer information. Your consent will be logged as of the date and time of login and confirmation, and you can withdraw the content of your consent at any time. You can always withdraw the consent you have given to us, effective for the future.

(2) We use products of Cheetah Digital Germany GmbH to dispatch our e-mail newsletter and therefore transfer your data required for sending to this provider.

(3) We point out that we analyze your usage behavior when sending the e-mail newsletter. For this analysis, the sent e-mails contain web beacons or tracking pixels, which represent image files the size of a single pixel stored on our website. We link the data specified in Section 1 and the web beacons to your e-mail address and an individual ID for the analyses. Data are exclusively collected in a pseudonymized manner; IDs will not be compiled with your other personal data; they do not allow for any direct references to individuals. The information is stored for as long as you are subscribed to the newsletter. After unsubscribing, we exclusively store the data anonymously for statistical purposes only.

11. Use of social media plugins (TI/TW)

(1) We are currently using the following social media plugins: Facebook, Google+, Twitter, Instagram, LinkedIn, and Xing. We use the 2-click solution. Generally, your personal data are initially not transmitted to the provider of this plugin when you visit our website. You can identify the plugin provider by the first letter on the marking on the greyed-out box. Only after clicking a plugin will your personal data be transmitted: Through activation of the plugin, data are transmitted automatically to the provider in question and stored there (with providers from the USA, this is in the USA). We have no influence over either the collected data and data processing operations, nor are we aware of the full scope of data collection, the purposes, and the storage durations. Since the provider collects data in particular via cookies, we recommend deleting all cookies through the security settings of your browser before clicking the greyed-out box.

(2) If you activate a plugin, the provider of the plugin receives the information that you have accessed the relevant subpage of our website. Furthermore, the data specified under 1 (1) of this Privacy Policy are transmitted, whereby only an anonymized IP will be collected in the case of Facebook and Xing, according to the information provided by the respective provider in Germany. Data are collected regardless of whether you have an account with this provider or are logged in. If you are logged in with this provider, your data are assigned directly to your account. If you click the activated button and, for example, link the page, the provider also stores this information in your user account and publicly shares it with your contacts. If you object to assignment to your profile with the provider, you have to log out before clicking the button.

(3) The provider stores these data as a usage profile and utilizes them for advertising or market research purposes and/or the design of their website as needed. Such analysis is particularly carried out, including for users that are not logged in, to present needs-based advertisements and inform other social network users about your activities on our website. You have the right to object to the establishment of these user profiles, whereby you have to contact the provider in question to exercise this right.

(4) More detailed information on the purpose and scope of data collection and relevant processing by the provider in question can be found in the privacy policies of the providers, listed below. Here, you can also find additional information on your relevant rights and configuration options to protect your privacy.

(5) Addresses of the relevant providers and URL to their privacy policies:
a) Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA;
https://www.facebook.com/policy.php.
b) Google Inc., 1600 Amphitheater Parkway, Mountainview, California 94043, USA;
https://www.google.com/policies/privacy/partners/?hl=de.
c) Twitter, Inc., 1355 Market St, Suite 900, San Francisco, California 94103, USA;
https://twitter.com/privacy.
d) Instagram LLC., 1601 Willow Road, Menlo Park, CA 94025, USA;
https://help.instagram.com/155833707900388/.
e) LinkedIn Corporation, 2029 Stierlin Court, Mountain View, California 94043, USA;
https://www.linkedin.com/legal/privacy-policy.
f) Xing SE, Dammtorstraße 30, 20354 Hamburg, DE;
http://www.xing.com/privacy.

12. Google reCAPTCHA (TW)

(1) We use “Google reCAPTCHA” (hereinafter “reCAPTCHA”) on our websites. The service is provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).

(2) reCAPTCHA helps check whether data entries on our websites (e.g., a contact form) are made by humans or automated programs. For this purpose, your input is transmitted to Google for further use. The query includes transmission of the IP address to Google, together with any other data required for the reCAPTCHA service. Google will use this information to analyze our use of this service. Data processing takes place on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in protecting its web offers from abusive automated spying activities and spam.

(3) More information on Google reCAPTCHA and the Google Privacy Policy can be found at the following links:
https://www.google.com/intl/de/policies/privacy/ and
https://www.google.com/recaptcha/intro/android.html. For the exceptional cases in which personal data is transferred to the USA, Google has subscribed to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

13. Integration of third-party services (TI)

(1.) We make use of the services of the following third parties:

(a) We have integrated YouTube videos into our website. These videos are stored at https://www.youtube.com and can be played back directly from our website. The videos are integrated with “Privacy Enhanced Mode”, i.e. no data on you as a user are transmitted to YouTube if you do not play back the videos. Only when playing back videos will the data specified in Paragraph 4 be transmitted. We have no influence over these data transmissions. YouTube is a service from YouTube LLC.

(b) We use external fonts from the Adobe Typekit to attractively design your visit to our website. When you visit our site, these are called up from servers of Adobe Systems Inc., San Jose, California. Adobe does not set cookies to perform this service. For more information on data protection relating to the Adobe Typekit, please visit the relevant Adobe Privacy Policy: https://www.adobe.com/privacy/policies/typekit.html

(c) We have furthermore integrated content from the following third-party provides on this website: OpenStreetMap. We use the open-source mapping tool “OpenStreetMap” to represent geo data. It does not store user data.

(2) By visiting our website, the relevant third party receives information that you have accessed the relevant subpage of our website. Furthermore, the data specified in 1.(1) of this Privacy Policy will be transmitted. Data are transmitted regardless of whether this third-party provider provides an account into which you are logged in, or of whether there is a user account in the first place. If you are logged in with this plugin provider, your data are assigned directly to your account. If you object to assignment to your profile with the third-party provider, you have to log out before clicking the button.

(3) Under certain circumstances, the respective third-party provider stores these data as a usage profile and utilizes it for advertising or market research purposes and/or the design of their website as needed. This kind of analysis is carried out in particular (including for users who are not logged in) to provide needs-based advertising. You have the right to object to the establishment of these user profiles, whereby you have to contact the third-party provider in question to exercise this right.

(4) More detailed information on the purpose and scope of data collection and relevant processing by the third-party provider in question can be found in the privacy policies of the third-party providers, listed below. Here, you can also find additional information on your relevant rights and configuration options to protect your privacy.

(5) Addresses of the relevant providers and URL to their privacy policies:

YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA;
https://policies.google.com/privacy?hl=en

Google Inc., 1600 Amphitheater Parkway, Mountainview, California 94043, USA;
https://www.google.com/policies/privacy/partners/?hl=en;

Open Street Map
https://wiki.openstreetmap.org/wiki/Legal_FAQ.

14. Subcontractors and recipients of personal data (TI/TW)

We employ subcontractors in the processing of personal data and conclude a contract with these processors in accordance with the requirements of Art. 28 GDPR.

In addition to the previously listed companies, the following companies will receive your personal data:

• The Cheetah Digital Germany GmbH company, to send the transaction e-mails as part of the recommendation system and to dispatch our newsletter, as stated in Section 7.2. As a global provider of marketing technology and services, working on our behalf, Cheetah Digital GmbH takes relevant measures to protect personal data. Among other things, contractual assurances are in place for this purpose. In the event that data flows transnationally outside of the European Economic Area, the standard contractual clauses and associated requirements under the GDPR, as adopted by the European Commission, are agreed as a suitable and adequate assurance. You have the option to request a copy of the agreement using the contact address listed below.
• In the event of non-cash bonuses, various logistics service providers and logistics companies.
• The advertiser, provided that you have given your consent over the course of your recommendation.
• The TeleMarCom European Services GmbH company, to provide call center services, particularly for customers who do not speak German.

15. Security of processing (TI/TW)

We take technical and organizational measures to protect the personal data of users, pursuant to the requirements of Art. 32 GDPR. All our employees tasked with the processing of personal data are obligated to data confidentiality. Personal data of the user are encrypted through HTTPS on transmission to the website.

16. Special situations (TW)

If there is a fault during the recommendation process, the Tellja Service Team might have to process a special situation. If this is the case, data must be processed to understand whether a new customer contract was concluded as a result of a successful recommendation. Those data transmitted to us by either the recommending party or the new customer for clarification of the issue (e.g., name, customer number, and information on the date and time) will be processed to query those data necessary to provide evidence of the successful order from the advertiser (e.g., an OrderID). The sole purpose of processing is to successfully conclude the recommendation. We shall delete any data accrued in this regard after storage is no longer required for the purpose specified above (i.e. after clarification of the situation or final processing of the recommendation), unless agreed otherwise or statutorily stipulated.

17. Legal bases (TI/TW)

In line with the provisions of Art. 13 GDPR, we hereby inform you of the legal bases of our data processing activities.

• If we obtain consent of the data subject for the processing of personal data, the legal basis is Art. 6(1)(a) GDPR. If one of the other legal bases specified in the following applies, this legal basis will not lose its validity if consent is withdrawn.
• For personal data processing required to perform a contract concluded with the data subject, the legal basis is Art. 6(1)(b) GDPR. This also covers processing operations required for the performance of pre-contractual measures.
• If processing of personal data is required to fulfill legal obligations to which our company is subject, the legal basis is Art. 6(1)(c) GDPR.
• The legal basis for the temporary storage of data and logfiles is Art. 6(1)(f) GDPR.
• The legal basis for the processing of personal data using technical cookies necessary for use of the website is Art. 6(1)(f) GDPR. The legal basis for the processing of personal data for analysis purposes, using cookies, is Art. 6(1)(f) GDPR.
• After your registration for our newsletter, we will store your e-mail address for the purpose of delivering the newsletter. The legal basis is Art. 6(1)(1)(a) GDPR.
• If processing is required for the safeguarding of a legitimate interest of our company or a third party and if the interests, basic rights, and basic freedoms of the data subject do not outweigh the former interest, the legal basis for processing is Art. 6(1)(f) GDPR.
• The legal basis for the transmission of data in special cases is Art. 6(1)(a) and (b) GDPR.

If the processing of personal data is based on Art. 6 para. 1 lit. f GDPR, our legitimate interest is the performance of our business activities for the benefit of all our employees and shareholders.

18. No automated decision-making/profiling (TI/TW)

We do not carry out any automated decision-making and/or profiling.

19. Rights of data subjects (TI/TW)

Users and other data subjects have the following rights vis-à-vis us with regard to their personal data:

• Right of access to relevant personal data (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to object to processing, if said processing takes place on the basis of Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR); please also see the following reference to the right to object under Art. 21 GDPR
• Right to data portability (Art. 20 GDPR)
• Right to withdraw granted consent at any time, without this affecting the legality of processing on the basis of this consent before withdrawal, if data processing is based on consent pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR

You also have the right to lodge a complaint with a data supervisory authority on our processing of your personal data (Art. 77 GDPR).

21. Service providers/controller/contact details/objection/withdrawal of consent (TI/TW)

The service provider pursuant to § 13 German Telemedia Act (TMG) and the controller – within the meaning of the GDPR, other data protection legislation within the member states of the European Union, and other regulations of a data protection nature –, is:

Tellja GmbH, Solmsstr. 12, D-60486 Frankfurt am Main
Fax: +49 (0)69 8700 429 29
E-Mail: support@tellja.de

You can direct all requests for information, correction, and erasure, objections, and withdrawals of consent, assert your right to restriction of processing and your right to data portability, as well as user comments or questions relating to data protection, to the aforementioned address.

22. Data protection officer (TI/TW)

You can contact our data protection officer via e-mail at datenschutz@tellja.de or by mail at Tellja-GmbH, C/O entplexit GmbH, Data Protection Officer, Kölner Straße 12, 65760 Eschborn, Germany.

23. Data protection supervisory authority and right to lodge complaints (TI/TW)

We fall under the competence of the data protection supervisory authority of the German State of Hesse – The Hessian Commissioner for Data Protection and Freedom of Information, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

24. Updates to this Privacy Policy (TI/TW)

Every now and then, we have to update the content of this Privacy Policy. We reserve the right to make changes to the Privacy Policy at any time. We will inform registered users of any changes to the Privacy Policy already made or scheduled on their next login, with a notification published at the same location as this Privacy Policy.