Privacy Policy

I. Name and address of the responsible persons

bonnorange AöR
Lievelingsweg 110
53119 Bonn
www.bonnorange.de

Phone: 0228 555 27 20
Fax: 0228 555 272 56 95
E-mail: customer-service(at)bonnorange.de

is the responsible party within the meaning of the EU General Data Protection Regulation (GDPR) and other national data protection laws.

II. contact data protection officer

bonnorange AöR
Lievelingsweg 110
53119 Bonn

telephone: 0228 555 27 20
E-mail: datenschutz(at)bonnorange.de

III General information on data processing

1. scope of the processing of personal data
We collect and use personal data of the users of our website only to the extent necessary to provide a functional website, our content and services.

In principle, the collection and use of personal data of our users only after their consent. An exception to this principle applies in cases where the processing of data is permitted by legal regulations or where obtaining prior consent is not possible for actual reasons.

2. legal basis for the processing of personal data
The legal bases for the processing of personal data result in principle from:

• Art. 6 (1) lit. a GDPR when obtaining the consent of the data subject.
• Art. 6 para. 1 lit. b GDPR in the case of processing operations that serve to fulfill a contract to which the data subject is a party. Included here are processing operations that are necessary for the performance of pre-contractual measures.
• Art. 6 para. 1 lit. c GDPR for processing operations that are necessary for the fulfillment of a legal obligation.
• Art. 6 para. 1 lit. d GDPR if vital interests of the data subject or another natural person make processing of personal data necessary.
• Art. 6 para. 1 lit. f GDPR, if the processing is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not override the former interest.

3. data deletion and storage period
The personal data of the users will be deleted or blocked as soon as the purpose of the storage no longer applies. Storage beyond this may take place if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which the responsible party is subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or performance of a contract.

IV. Use of our website, general information

1. description and scope of data processing
Each time our website is accessed, our system automatically collects data and information from the user's computer system. The following information is collected:

1. Information about the browser type and the version used.
2. The operating system of the user
3. The Internet service provider of the user
4. Date and time of access
5. Websites from which the user's system accesses our website
6. Websites that are accessed by the user's system via our website

The data described above - except for the user's IP address or other data that enables the data to be assigned to a user - is stored in the log files of our system. This data is not stored together with other personal data of the user.

2. purpose and legal basis for data processing
The temporary storage of the IP address by our system is necessary to enable delivery of the website to the user's computer. For this purpose, the IP address of the user must remain stored for the duration of the session.

The legal basis for the temporary storage of the data is Art. 6 para. 1 lit. f GDPR.

The collection of their personal data for the provision of our website is mandatory for the operation of the website. Therefore, there is no possibility for users to object.

3. duration of storage
Your data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. If your data is collected to ensure the provision of the website, the data will be deleted when the respective session has ended.

4. YouTube integration
We have embedded videos on our website that are technically provided by YouTube. YouTube is a service of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. We have chosen the most data-saving variant for the integration of videos on our website in order to offer our users the best possible online experience.

To embed YouTube videos, we use the provider's so-called "extended data protection mode". This means that no cookies are set to analyze user behavior and no data on user activity is collected to personalize video playback, but information is transmitted to YouTube. If you click or tap on an embedded video, this may trigger further data processing operations over which bonnorange no longer has any control. If you are redirected to another website or app, data about your user behavior may be collected there and analyzed. The responsible party in terms of data protection is then the respective provider in accordance with its own guidelines and terms of use. If you are logged into your YouTube account, YouTube can assign your surfing behavior to you personally. If you wish to prevent this transmission and storage of your data and your behavior on our website by YouTube, you must log out of YouTube before visiting our site and delete any cookies placed by YouTube. For more information on the collection and use of your data by YouTube, please refer to the terms of use there (https://youtube.com/t/terms) and the privacy policy of Google (https://policies.google.com/privacy).

V. General information on the use of cookies

We use cookies on our website. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user's computer system. When you visit a website, a cookie may be stored on your operating system. This contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again.

Cookies are used by us to make our homepage more user-friendly. Some elements of our website require that the browser can be identified even after a page change.

The legal basis for the processing of personal data using cookies results from Art. 6 para. 1 lit. f GDPR. The purpose of the use of technically necessary cookies is to simplify the use of our website.

Cookies are stored on the user's computer and transmitted from it to our site. As a user, you therefore have control over the use of cookies. You can restrict or deactivate the transmission of cookies by making changes in the settings of your Internet browser. Stored cookies can also be deleted there. Please note that you may no longer be able to use all the functions of our website if you deactivate cookies.

Use of cookies (more detailed)

Cookies are text files that contain data from visited websites or domains and are stored by a browser on the user's computer. A cookie is primarily used to store information about a user during or after a visit within an online offer. The stored information may include, for example, the language settings on a website, the login status, a shopping cart or the location where a video was watched. The term cookies also includes other technologies that fulfill the same functions as cookies (e.g., when user information is stored on the basis of pseudonymous online identifiers, also referred to as "user IDs").

The following cookie types and functions are distinguished:

• Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online service and closed the browser.
• Permanent cookies: Permanent cookies remain stored even after the browser is closed. For example, the login status can be saved or preferred content can be displayed directly when users visit a website again. Likewise, the interests of users, which are used for reach measurement or marketing purposes, can be stored in such a cookie.
• First-party cookies: First-party cookies are set by us.
• Third-party cookies (also: third-party cookies): Third-party cookies are mainly used by advertisers (so-called third parties) to process user information.
• Necessary (also: essential or absolutely necessary) cookies: Cookies may be absolutely necessary for the operation of a website (e.g. to store logins or other user input or for security reasons).
• Statistical, marketing and personalization cookies: Cookies are also generally used for range measurement and when the interests of users or user-specific behavior (e.g. viewing certain content, using functions, etc.) on individual websites are stored in a user profile. Such profiles are used, for example, to display content to users that corresponds to their potential interests. This procedure is also referred to as "tracking", i.e., tracking the potential interests of users. Insofar as we use cookies or tracking technologies, we will inform you separately in our privacy policy or when you obtain consent.

Notes on legal basis:
The legal basis on which we process your personal data using cookies depends on whether we ask you for consent. If this is the case and you consent to the use of cookies, the legal basis for processing your data is your declared consent. Otherwise, the data processed with the help of cookies is processed on the basis of our legitimate interests (e.g. in the business operation of our online offer and its improvement) or, if the use of cookies is necessary to fulfill our contractual obligations.

General information on revocation and objection (opt-out):
Depending on whether the processing is based on consent or legal permission, you have the option at any time to revoke any consent you have given or to object to the processing of your data by cookie technologies (collectively referred to as "opt-out"). You can initially declare your objection by means of your browser settings, e.g. by deactivating the use of cookies (whereby this may also restrict the functionality of our online offer). An objection to the use of cookies for online marketing purposes can also be declared by means of a variety of services, especially in the case of tracking, via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/. In addition, you can obtain further instructions on how to object in the context of the information on the service providers and cookies used.

Processing of cookie data on the basis of consent:
Before we process or have data processed in the context of the use of cookies, we ask users* for consent that can be revoked at any time. Before the consent has not been given, cookies are only used if they are necessary for the operation of our online offer. Their use is based on our interest and the interest of users* in the expected functionality of our online offer.

Types of data processed: Usage data (e.g. web pages visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
Data subjects: User (e.g. website visitor, user of online services).
Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR), Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

Services used and service providers:

Google Analytics:
Online marketing and web analytics; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://marketingplatform.google.com/intl/de/about/analytics/; privacy policy: https://policies.google.com/privacy; opt-out: opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of advertising: https://adssettings.google.com/authenticated. With regard to the use of Google Analytics, we have a contractual relationship with Google Ireland Limited, a company that is fully subject to European data protection regulations due to its registered office in Ireland. Nevertheless, access to or processing of your data in third countries outside the EU (e.g. USA) where there is no adequate level of data protection cannot be ruled out. To ensure an adequate level of data protection in such third country transfers, Google Ireland has integrated so-called EU standard data protection agreements into its terms of use, which you can access at the following link: https://business.safety.google/adsprocessorterms/sccs/eu-p2p-intra-group/ and which ensure an adequate level of data protection with regard to the processing of your data outside the EU.

VI. Your rights / rights of the data subject

According to the EU General Data Protection Regulation, you have the following rights as a data subject:

1. right to information
You have the right to obtain from us, as data controller, the information whether we process personal data concerning you. In addition, you could request information about the following:

• The purpose of the data processing;
• the categories of personal data processed;
• the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed;
• the planned duration of the storage of the personal data concerning you or, if concrete information on this is not possible, criteria for determining the storage period;
• the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller, or a right to object to such processing;
• the existence of a right of appeal to a supervisory authority;
• any available information about the origin of the data, if the personal data are not collected from the data subject;
• The existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR and, at least in these cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.

You also have the right to request information about whether your personal data is transferred to a third country or to an international organization. In this case, you can request information about the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

You could assert your right to information under: datenschutz(at)bonnorange.de

2. right to rectification
If the personal data processed by us and concerning you is incorrect or incomplete, you have a right against us to correction and/or completion. The correction will be made without delay.

3. right to restriction
The right to restrict the processing of personal data concerning you may be exercised in the following cases:

• the accuracy of the personal data is contested for a period enabling the controller to verify the accuracy of the personal data;
• the processing is unlawful and erasure of the personal data is refused, requesting instead the restriction of the use of the personal data;
• the controller no longer needs the personal data for the purposes of the processing, but the data subject needs it for the establishment, exercise or defense of legal claims; or
• the data subject has objected to the processing pursuant to Article 21(1) of the GDPR and it is not yet clear whether the legitimate grounds of the controller override the grounds of the data subject.

If the processing of personal data concerning you has been restricted, this data may - apart from being stored - only be processed with your consent or for the assertion, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the Union or a Member State.

In the event of a restriction of processing in accordance with the principles outlined, you will be informed by us before the restriction is lifted.

4. right to deletion

If the reasons outlined below apply, you may request that the personal data relating to you be deleted without delay. The responsible party is obliged to delete this data without delay. The grounds are:

• The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.
• The processing is protected on the basis of consent pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR and you revoke your consent. Another requirement is that there is no other legal basis for the processing.
• You object to the processing (Art. 21 (1) GDPR) and there are no overriding legitimate grounds for the processing. Another possibility is that you lodge an objection to the processing pursuant to Art. 21 (2) GDPR.
• The processing of the personal data concerning you is unlawful.
• The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
• The personal data concerning you has been collected in relation to information society services offered pursuant to Article 8(1) of the GDPR.

If we have made the personal data concerning you public, and we are obliged to erase it pursuant to Article 17(1) of the GDPR, we shall take reasonable measures, including technical measures, to inform data controllers processing the personal data that you, as the data subject, have requested the erasure of all links to or copies or replications of such personal data, taking into account the available technology and the cost of implementation.

We would like to point out that the right to erasure does not apply insofar as the processing is necessary

• For the exercise of the right to freedom of expression and information;
• for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) and Art. 9(3) GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Article 89(1) GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously prejudice the achievement of the purposes of such processing; or
• for the assertion, exercise or defense of legal claims.

5. right to information
If you have asserted the right to rectification, erasure or restriction of processing, we are obliged to notify all recipients to whom the personal data concerning you has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort. Furthermore, you have the right to be informed about these recipients.

6. right to data portability

According to the GDPR, you also have the right to receive the personal data concerning you that has been provided to us in a structured, common and machine-readable format. Furthermore, you have the right to transmit this data to a controller or another controller without hindrance by the controller to whom the personal data was provided, provided that

• the processing is based on consent pursuant to Art. 6 (1) a GDPR or Art. 9 (2) a GDPR or on a contract pursuant to Art. 6 (1) b GDPR and
• the processing is carried out with the help of automated procedures.

Finally, in the context of exercising the right to data portability, you have the right to obtain that the personal data concerning you be transferred directly from the controller to one or another controller, insofar as this is technically feasible and does not adversely affect the freedoms and rights of other persons.

The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. right to revoke the declaration of consent under data protection law
You have the right to revoke your declaration of consent under data protection law at any time. We would like to point out that the revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

8. right of objection

Furthermore, you are entitled to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out on the basis of Art. 6(1)(e) or (f) GDPR. The right to object also applies to profiling based on these provisions.

The controller will no longer process the personal data concerning you unless he can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of asserting, exercising or defending legal claims.

If the personal data concerning you are processed for the purpose of, you are entitled to object at any time to the processing of personal data concerning you for the purpose of such advertising. This also applies to profiling, insofar as it is related to such direct marketing. If you object to the processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

You also have the possibility, in connection with the use of information society services (notwithstanding Directive 2002/58/EC), to exercise your right to object by means of automated procedures using technical specifications.

9. automated decision in individual cases including profiling

Under the EU General Data Protection Regulation, you continue to have the right not to be subject to a decision based solely on automated processing - including profiling - which produces legal effects concerning you or similarly significantly affects you. However, there is an exception to this principle if the decision is

1. is necessary for the conclusion or performance of a contract between you and the controller,
2. is permitted by legal provisions of the Union or the Member States to which the controller is subject and these legal provisions contain appropriate measures to protect your rights and freedoms as well as your legitimate interests, or
3. is carried out with your explicit consent.

If the processing is carried out within the framework of the cases mentioned in (1) and (3), the controller shall take appropriate measures to safeguard the rights and freedoms as well as your legitimate interests. This includes, at least, the right to obtain the intervention of a person on the part of the controller, to express his or her point of view and to contest the decision.

The decision under (1) - (3) may not be based on special categories of personal data pursuant to Article 9(1) of the GDPR, unless Article 9(2)(a) or (g) applies and appropriate measures have been taken to protect the rights and freedoms and your legitimate interests.

10. right to complain to a supervisory authority
Finally, if you believe that the processing of personal data concerning you violates the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, workplace or the place of the alleged infringement. The supervisory authority responsible for bonnorange AöR is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

VII. reminder collection dates

You can subscribe to a free collection date reminder on our homepage, with which we will remind you by email one or two days before the collection date of the respective waste type in your street, depending on your choice, and further inform you about possible date changes. This service can also be done by subscribing and using our waste planner app.

The data that you enter in the input mask during registration will be transmitted to us. We collect the following data on the basis of the consent obtained from you during the registration process: street, house number, house number suffix, e-mail address, IP address of the calling computer, date and time of registration.

Your data will not be passed on in connection with the data processing for sending the reminder. The data is used exclusively for sending the reminder.

In order to keep the mail addresses of the subscribers of the reminder mail up to date, you will receive an e-mail once a year asking you to confirm your subscription. The sender of the e-mail is noreply(at)bonnorange.info. The mail has the following content:

"Dear Sir or Madam, please confirm your subscription for Musterstraße 1, 53111 Bonn, in order to continue receiving reminders for the collection dates. To do so, please click on the following link: (Editor's note: a link that is tailored to the user will appear here).

If you do not confirm within 2 weeks, your subscription will be automatically unsubscribed.

The legal basis for the processing of the data is Art. 6 para. 1 lit. a GDPR if the user has given his consent. The collection of the user's email address serves to deliver the reminder email.

Your data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. Accordingly, your e-mail address will be stored as long as the subscription to the newsletter is active. The subscription to the garbage collection reminder e-mail can be terminated by you at any time by revoking your consent. For this purpose, you will find a corresponding link in each newsletter, or you can send us an e-mail to datenschutz(at)bonnorange.de.

We would also like to point out that you can object to the future processing of your personal data in accordance with the legal requirements pursuant to Art. 21 GDPR at any time. The objection can be made in particular against the processing for purposes of direct advertising."

VIII. Electronic contact

If you contact us, there are two contact forms available on our homepage, which you can use to contact us electronically. The data entered in the input mask will be transmitted to us and stored.

In the case of the "Waste advice" contact form, the following data is compulsorily collected: Name, e-mail address. In addition, telephone number, street, house number, postal code and city are collected voluntarily.

In the case of the contact form "Notification to city cleaning", the following data is collected: Name, e-mail address, telephone number, street, house number, postal code, city.

At the time the message is sent, the following data is also stored:

• The IP address of the user
• Date and time of the contact

Furthermore, it is possible to contact us via the e-mail address provided. In this case, the user's personal data transmitted with the e-mail will be stored.

Your data will not be passed on to third parties in this context; the data will be used exclusively for processing the communication.

The legal basis for the processing of the data is Art. 6 para. 1 lit. a GDPR if the user has given his consent. The legal basis for the processing of data transmitted in the course of sending an e-mail is Art. 6 para. 1 lit. f GDPR. If the e-mail contact aims at the conclusion of a contract, the additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR.

In this context, the processing of personal data serves solely to process the contact. In the case of contact by e-mail, this also constitutes the necessary legitimate interest in processing the data.

If further personal data is processed during the sending process, this is only used to prevent misuse of the contact form and to ensure the security of our information technology systems.

Your data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. For the personal data from the input mask of the contact form and those sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is ended when it is clear from the circumstances that the matter in question has been conclusively clarified.

The additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

You have the option to revoke your consent to the processing of personal data at any time. You can also object to the storage of your personal data at any time when contacting us by e-mail. However, we would like to point out that in such a case the conversation cannot be continued. You can send your revocation and/or objection to: datenschutz(at)bonnorange.de. All personal data stored in the course of contacting us will be deleted in this case.

IX. Online-Services

We provide various online services on our homepage to make it easier for you to place orders and contact us. These are the following individual services, whereby the personal data listed below is collected and transmitted to us:

1. Notification of defective or missing gray, green and blue waste bins: Name, telephone number, mobile number, fax, e-mail address, street, house number, personal message.
2. Ordering, changing and cancelling of grey, green and blue waste bins: owner, first name, surname, company, street, house number, zip code, city, telephone, e-mail address, date of application, file number, number of residents.
3. Application for fee reduction for own composting: Owner, title, surname, company, street, house number, zip code, town, telephone, e-mail address, application date, details of the property concerned, file number.
4. Application for 50% fee reduction if only one person lives on the property and there is a 40-litre residual waste waste bin: Owner, title, name, company, street, house number, zip code, town, telephone, e-mail address, application date, details of the property concerned and file number.
5. Bulky waste: owner*in, name, street, house number, zip code, city, telephone, e-mail address, date of application, file number and, if applicable, different address of the collection location.
6. Ordering of towed items: owner*in, title, street, house number, zip code, city, date of application, details of the property in question, file number, possible deviating address for fee notification.
7. Collection of large electrical appliances: Name, street, house number, postal code, company, e-mail, telephone number, data of the collection address.
8. Delivery bill for large electrical appliances by dealers: Name, title, address of the person delivering to the number of residents*, file number.
9. Picobello/ registration of a waste collection campaign: name, street, house number, postal code, city, e-mail address.

The following data is also stored at the time the message is sent:

1. The IP address of the user
2. Date and time of registration

Furthermore, there is the possibility of contacting us via the provided e-mail address and submitting the applications. In this case, the user's personal data transmitted with the e-mail will be stored.

Your data will not be passed on to third parties in this context; the data will be used exclusively for processing the applications.

The legal basis for the processing of the data is Art. 6 para. 1 lit. a GDPR if the user has given his consent. The legal basis for the processing of data transmitted in the course of sending an e-mail is Art. 6 (1) lit. f GDPR. If the request aims at the conclusion of a contract, the additional legal basis for the processing is Art. 6 (1) lit. b GDPR.

In this context, the processing of personal data is solely for the purpose of processing your requests. In the case of contact by e-mail, this also constitutes the necessary legitimate interest in processing the data. The personal data required for the fulfillment of the application will be stored by us for as long as is necessary for the fulfillment of the services ordered.

If further personal data is processed during the submission process, this is only used to prevent misuse of the contact form.

You have the option to revoke your consent to the processing of personal data at any time. When contacting us by e-mail, you can also object to the storage of your personal data at any time. However, we would like to point out that in such a case, the processing of your requests cannot be continued.

You can send your revocation and/or objection to:
datenschutz(at)bonnorange.de.

All personal data stored in the course of contacting us will be deleted in this case.