The data controller as defined by the General Data Protection Regulation (DSGVO) is:

Kreissparkasse Stade
Große Schmiedestraße 12
21682
Stade
Germany
E-Mail: info@ksk-stade.de
Telephone: 04141 109-0
Fax: 04141 109-99101

(hereinafter also referred to as "Sparkasse", "we", "our" or "us")

If you have any questions regarding this privacy policy or about how we protect your personal data, please contact Sparkasse's data protection officer.

Florian Demmer
Beauftragter für Datenschutz und Informationssicherheit
Große Schmiedestraße 12
21682
Stade
Germany
datenschutz@ksk-stade.de

Any action that your Sparkasse performs on personal data, such as collecting, storing, sharing, erasing or using it in another form, is referred to as data processing. Personal data is any information that relates to an individual visiting this website to find out about Sparkasse products and services.

If you are already a Sparkasse customer, then your personal data will also be processed as part of your business relationship with Sparkasse. For more information on this, please refer to your Sparkasse's privacy policy. This privacy policy also covers other services and products that can be accessed through this website (such on the data processed as part of online banking).

The following details which data your Sparkasse processes for what purposes when visiting this website. If you would like to find out about the data we process on social media, please read the privacy policy for social media.

1. Data that is necessary to display this website and ensure its stability and security
 

When visiting this website solely for the purpose of obtaining information, we process the following technically necessary data:

• IP address of the end device you are using
  
• Name of the retrieved file
  
• Date and time of retrieval
  
• Amount of data transferred
  
• Retrieval status (successful / not successful)
  
• Browser type, version and operating system
  
• URLs of the pages previously viewed (i.e. referrer URLS)
  

This data is processed for the purpose of taking steps prior to performing a contract or for performing a contract in accordance with Art. 6(1) S.1(b) DSGVO. We may also process this data for the purpose of protecting your Sparkasse’s legitimate interests based on a balancing of interest in accordance with Art. 6(1) S.1(f) DSGVO. In the event this website is used for unlawful purposes, this data will also be used to identify potential violations.

Your Sparkasse also analyses this data for statistical purposes and for improving this website without creating any personality or user profiles.

2. Use of cookies

This website uses cookies. Cookies are text files with small pieces of data that are stored on your end device. They are intended to make it easier to navigate through a website and make it possible to use certain features, and in particular features that depend on information, being retained. In addition to these technical and functional cookies, cookies can also be used for other purposes, such as targeted advertising. Please refer to the sections below for more detailed information.

If you don't want cookies to be stored on your end device, you can prevent this by changing your browser settings accordingly. This is also where you can delete cookies that are already stored on your end device. However, it will no longer be possible to use all of the features provided on this website if you deactivate technical and functional cookies.

Strictly necessary cookies:

Your Sparkasse uses cookies that are necessary for running this website and for performing functions designed to make it secure and user-friendly. These cookies are essential for users to be able to navigate the website and use all its modules and features. Without them, it may no longer be possible to use this website or all of this features. Some of the website’s features only work if it can still identify your browser after you have opened a new page.

We do not use the data collected through necessary cookies to create user profiles. Necessary cookies store and transmit the following data:

• Current session ID
  
• Items inside the basket or product applications
  
• Use of specific website content, such as frequency or scope of use
  
• Data on accessing specific website content, such as product information
  
• Settings pertaining to your local Sparkasse
  
• Settings pertaining to the website’s search function
  

Since websites don’t have a memory, cookies are needed to notify the server of the pages that need to be displayed to a user. This means that users do not have to try to remember everything or have to navigate through the entire website again. Cookies can, for example, store order information, which is necessary for shopping baskets to work and frees users from having to remember all of the items they placed in their basket when they are ready to pay.

Nearly all of the technical and functional cookies used are session cookies. All of the data stored in session cookies is automatically deleted when you leave the website. This includes the cookies required, for example, to use online banking:

• JSESSIONID
• IF6CONTEXT
• IFCLONE

Cookie names that are prefixed with “TS” and then contain a variable number of random characters and digits are strictly necessary cookies. These cookies are used for load balancing which ensures that the load of the requests is evenly distributed over several web servers. With some processes, such as taking out a contract, making a transfer etc. it is important that, once an end customer has started inputting information, the process is continued on the same web server.

The cookies used to retain information about items placed in shopping baskets expire after 10 days.

The cookie used to recognise trusted devices and browsers is used on the basis of constituting a technically necessary cookie. This cookie is is called “DeviceID” and expires after 180 days. The purpose for which this cookie is used is detailed under device recognition.

The SPK_COOKIE cookie, which transfers Sparkassen customers from the main sparkasse.de website to their local Sparkassen website and “remembers” the sort code in order to do so, expires after 6 months.

Data protection notice on the use of Dynatrace on the online banking portal:

Dynatrace, which is a performance management software for programmes used on the Sparkasse website, also sets cookies on users end devices. Dynatrace manages software application’s availability and performance and enables your Sparkasse to ensure that its online banking portal is always available and works without any problems. To do so, Dynatrace places the following cookies on users end devices:

• dtCookie
• dtLatC
• dtPC
• dtSa
• DtValidationCookie
• rxVisitor
• rxvt

Your Sparkasse only uses Dynatrace in conjunction with IP masking. This means that parts of users’ IP addresses are masked when the cookies are set, which anonymises all of the data collected with the aid of these cookies. Dynatrace cookies are automatically deleted at the latest when you leave our site. These are anonymised data for ensuring the application's availability and reliability. The use of Dynatrace is necessary to ensure that the website is fast, reliable and secure. The cookies used as part of this are absolutely essential to the application's performance.

The processing of data by means of necessary technical and functional cookies is based on Art. 25(2) of the Federal Act on the Regulation of Data Protection and Privacy in Telecommunications and Telemedia (TDDDG). Where technically and functionally necessary cookies make it possible to identify users, they are processed on the basis of Art. 6(1) S.1(f) DSGVO.

• Google Analytics
  Google Analytics is a web analytics service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), who acts as our data processor in this respect (Art. 28 DSGVO).
  
  If you have agreed to the use of marketing cookies, Google Analytics will track activity with Javascript universal_analytics.js. As part of this, the following cookies will be placed on end users’ devices: _ga, _gat, _gid, _gat_g, _gat_l, _gcl_au, _ga_, universal_analytics_linkid, Universal_analytics_cid.
  
  Google Analytics uses these cookies only for statistical purposes that allow us to analyse your use of our website. This includes your use of those parts of the website (online banking) for which you are required to log in. Google Analytics cookies track visitor behaviour and conversions (pages visited, links clicked, applications, browser settings). These cookies do not collect any information on the data you provide on forms or other specific contents (e.g. those of a transfer). Google Analytics uses this information on behalf of your Sparkasse to compile reports about the use of this website for the purpose of reach measurement and to create personalised ads.
  
  If you have a Google account and activated “Personalised advertising”, Google Analytics will enrich these aggregated reports with your demographic data (e.g. age group and gender) and interests (e.g. technology enthusiasts, sport fans, foodies, product affinities) that Google has collected independently (e.g. on other websites). Google processes information from e.g. your Google account, your searches and ad clicks for its “Personalised advertising”.
  
  If you have a Google account and have activated “Personalised advertising”, we will also analyse your use of this website with Google Analytics across all of your devices (cross-device tracking). This will allow us to identify you even if the device from which you are making e.g. a purchase on our website is different from the one you might have initially used to click on the advert that initiated the purchase. The reports created for Sparkasse (including cross-device) only contain aggregated data and do not contain data on individual users.
  
  You can deactivate “Personalised advertising” any time in your Google account.
  
  If you have a Google account and activated “Web and app activities” on it, you can also view aggregated data on your use of this website and hence manage your data yourself.
  
  The data generated from your use of this website may also be transferred to and saved on a Google server in the USA. However, part of your IP address will be masked before transmission to Google through the IP Anonymization feature enabled for this website. This means that the transferred data cannot be used to identify you as an individual based on your IP address.
  
  The Subprocessor Google LLC of our service provider Google Ireland Ltd. is certified under the EU-US Data Privacy Framework (https://ec.europa.eu/commission/presscorner/detail/de/ip_23_3721), which ensures that data processed in the USA is subject to EU-equivalent safeguards.
  
  The data that is processed through Google Analytics and is linked to cookies is automatically deleted after a maximum of 26 months.
  
  The legal basis for processing this data is your consent in accordance with Art. 6(1)(1)(a) DSGVO or Art. 25(1) TDDDG.
  
  

• Google Ads
  Google Analytics is a web analytics service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The responsible data processing body is Google.
  
  We use Google Ads to enable us to provide you with online ads that are relevant to your interests. Google uses DoubleClick cookies to measure the success of our ad campaigns by collecting data on parameters such as ad display frequency or user clicks. Google provides us with information on e.g. statistical analyses of the frequency at which different adverts with different prices are clicked. However, Google does not provide us with information on the use of ads that would allow us to identify individual users.
  
  The analyses created with Google Analytics allow us to identify target groups (e.g. for end devices that users have used to visit a specific product page) and provide information on them to Google through Google Ads. These target groups comprise a list of ad IDs (that are also e.g. stored in DoubleClick cookies) that are filtered by specific criteria within Google Analytics. Google uses target groups to make sure that the majority of the product ads shown to you are of relevance to you (because e.g. you already accessed information on those products on our website). Please refer to Google’s privacy policy and Goolgle Ads’ help section for more information on how Google processes your data for adverts.
  
  The legal basis for processing this data is your consent in accordance with Art. 6(1)(1)(a) DSGVO or Art. 25(1) TDDDG.
  

3. Sparkassen marketing campaign analyses and measurements

The Sparkassen Finanzgruppe uses analytics and measurement platforms to deliver, analyse and measure the success of national and regional digital advertising campaigns.

After obtaining your consent on a landing page  (sparkasse.de), these analyses are performed with the help of the following platforms:

• intelliAd
  If you click on a Sparkasse advertisement on a third-party website, you will be taken to a landing page with more information on the advertised product. The landing page for all Sparkassen adverts is sparkasse.de, from which users are then forwarded to their local Sparkassen website. sparkasse.de uses the web analytics service from intelliAd Media GmbH, Sendlinger Str. 7, 80331 Munich, Germany, to measure advertising campaigns’ success. You will be asked to consent to the use of the campaign measurement system before you will be able to access the contents pertaining to the advertised product on sparkasse.de. Once you have given your consent, the cookies set by intelliAd can be read out and assigned to specific interactions on sparkasse.de. This data then helps us to manage and optimise our marketing measures. This data cannot be used to identify any persons, because it is only collected on the basis of a cookie ID. The cookie ID, in turn, cannot be linked to an IP address because the IP address will have been anonymised immediately before the intelliAd cookie is set.
  
  The cookie is deleted after 100 days.
  
  The legal basis for this application is Art. 25(1) TDDDG. You can withdraw your consent at any time at http://login.intelliad.de/optout.php. In this case, the cookie “intelliadNoTrack” will be set, which will block user interactions up until the cookie expires. This cookie is deleted after one year.
  

• Adform
  If you click on a Sparkasse advertisement on a third-party website, you will be taken to a landing page with more information on the advertised product. The landing page for all Sparkassen adverts is sparkasse.de, from which users are then forwarded to their local Sparkassen website. sparkasse.de uses the web analytics service from Adform A/S Wildersgade 10B, sal. 1 DK-1408 Copenhagen, Denmark, for both advertising delivery as well as campaign measurement. You will be asked to consent to the use of the campaign measurement system before you will be able to access the contents pertaining to the advertised product on sparkasse.de. Once you have given your consent, the cookies set by Adform can be read out and assigned to specific interactions on sparkasse.de. This data then helps us to manage and optimise our marketing measures. This data cannot be used to identify any persons, because it is only collected on the basis of a cookie ID. The cookie ID, in turn, cannot be linked to an IP address because the IP address will have been anonymised immediately before the Adform cookie is set.
  
  The cookie is deleted after 60 days.
  
  The legal basis for this application is Art. 25(1) TDDDG. You can withdraw your consent at any time at  https://site.adform.com/de/privacy-center/platform/widerrufsrecht/. In this case, the opt-out cookie “C” will be set with a value of “3”, which will block user interactions up until the cookie expires. The cookie is deleted after 3650 days.
  

• Count server
  In order to establish whether an advertisement on a third-party website has led to a purchase from Sparkasse, sparkasse.de uses a so-called “count server”.
  
  If you click on a Sparkasse advertisement on a third-party website, you will be taken to a landing page with more information on the advertised product. The landing page for all Sparkassen adverts is sparkasse.de, from which users are then forwarded to their local Sparkassen website. You will be asked to consent to the use of the campaign measurement system before you will be able to access the contents pertaining to the advertised product on sparkasse.de. Once you have given your consent, a “zs_aff” cookie with a random ID will be set that allows us to manage and optimise our marketing measures. This data cannot be used to identify any persons, because it is only collected on the basis of a random ID.
  
  The cookie is deleted after 30 days.
  
  The legal basis for this application is Art. 25(1) TDDDG. You can withdraw your consent for this cookie at any time under “Update cookie settings” on sparkasse.de.
  

4. Third-party applications

• YellowMap
  This website uses SmartMaps, a service provided by YellowMap AG, CAS-Weg 1-5, 76131 Karlsruhe, Germany, for displaying maps. This service makes it possible to display interactive maps directly on the website and for users to use these maps. In order to be able to provide the maps, YellowMap will be processing your IP address as well as range of other technical data. The data YellowMap collects will only be used for creating the map and deleted after 10 minutes. YellowMap does not use any cookies.
  
  For more information on the purpose and scope of the data collected and its processing by YellowMap can be found at https://www.smartmaps.net/datenschutz/.
  
  This page also contains more information on your rights concerning the above.
  
  The legal basis for processing your data is Art. 6(1) S.1(b) DSGVO.
  
  
  

• Live Chat
  The "Live Chat" feature provided on this website can be used to contact your Sparkasse. The live chat feature is a service provided by talkevent Software GmbH, Carlswerkstr. 13b, 51063 Cologne, Germany, on behalf of your Sparkasse. In order to prevent misuse, the following data is stored when using the chat assistant in addition to the information you enter:
  
      - IP address
      - Date and time
  
  The above data and the information exchanged through the chat function are not used for any other purposes.
  
  The legal basis for processing this data is Art. 6(1)(1)(b)(f) DSGVO. The chat data will be deleted after a maximum of 90 days.
  

• Text chat with chatbot “Linda”
  This website allows Sparkassen customers to communicate with a Sparkasse chatbot (virtual assistant) by text. The controller (Art. 4(7) DSGVO) responsible for the data processed when chatting by text with the chatbot is your Sparkasse.
  
  Communicating by text chat with the chatbot does not generally require the provision of personal data. However, when asking for information to do with your personal dealings with your Sparkasse, you will need to provide certain personal data (e.g. date of birth and account number) in order to verify your identity. Communicating by text chat with the chatbot “Linda” never requires the provision of special personal data (Art. 9 DSGVO). For this reason, please never enter any special personal data (Art. 9 DSGVO) such as data concerning your health, when communicating by text with “Linda”.
  
  To make sure that your enquiry can be appropriately identified and responded to, the contents of your text message will be forwarded to Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).  This is where the intent of your message will be identified (intent classification). This is the only purpose for which Google will be using the text message. If you have entered (unrequired) personal data into the text chat box, Google will be acting as your Sparkasse's data processor (Art. 28 DSGVO) in this context.
  
  The legal basis for processing this data is Art. 6(1)(b) DSGVO.
  
  Google is owned by the American company Google LLC, Mountain View, California. The text messages are not forwarded to Google LLC for the intent classification. However, it is still possible that Google LLC may access this data. If you have entered (unrequired) personal data into the text chat box, the legal basis for such a transfer of personal data to a third country is Art. 45(1) S.1 DSGVO (adequacy decision).
  
  Your Sparkasse will also process and systematically analyse the content of the chat text messages for the purpose of improving its services. In the event that chat message contain personal data that was not asked for and voluntarily provided, this data will be processed on the basis of our legitimate interests (Art. 6(1) S.1(f) DSGVO).
  
  When the chatbot is used by a Sparkasse customer, the chat logs will be stored for a period of 6 or 10 years until the end of the year because of the legal data retention requirements. The retention period depends on whether and, if so, which retention requirements apply to the data in question (e.g. §§ 257 German Commercial Code (HGB), 147 Tax Code (AO)). In this case, the legal basis for processing this data is Art. 6(1) S.1(c) DSGVO.
  
  Note: If you do not want your data (which is never intended to include personal data) to be processed as set out above, please use another means to contact your Sparkasse (e.g. phone, visit a branch).
  

• Newsletter
  On this website, you can also subscribe to your Sparkasse's newsletter, through which it will provide you with information on its latest promotions and news. Your Sparkasse will only send you the newsletter with your consent or where legally permitted. The technical service provider appointed by your Sparkasse to provide this service is S-Communication Services GmbH, Friedrichstraße 50, 10117 Berlin, Germany.
  
  Subscribing to the newsletter involves a double-opt-in procedure. The first opt-in comprises your confirmation of an activation email sent to the email address you provided after registering. If you fail to confirm your activation email within the period of time set out in the email, your information will be automatically deleted. Your email address will only be saved for the purpose of sending you the newsletter if you confirm the activation email within the specified period of time.
  
  Your Sparkasse will furthermore store your IP address and the time of registration and confirmation respectively. The reason for this is to retain evidence of your registration and to be able to clarify any potential misuse of your personal data.
  
  You can opt-out of your email address being used for the distribution of the newsletter, i.e. unsubscribe at any time. The link for unsubscribing can be found at the end of every newsletter.
  
  The legal basis for processing this data is Art. 6(1)(1)(a)(b) DSGVO.
  
  Sparkasse is constantly working on improving its newsletter service. As part of this, Sparkasse measures and analyses newsletter open and click rates. Open rates provide information on the percentage of newsletter recipients who have actually opened and hence read the newsletter. Click tracking makes it possible to track which and how often the links included in the newsletter are clicked. These analyses can be used to create targeted newsletters with contents that are of actual interest to their recipients.
  
  The legal basis for processing this data is your consent in accordance with Art. 25(1) TDDDG.
  
  You can withdraw your consent at any time under the “Manage” tab in the newsletter login section on the website, or the “Edit details” link in the newsletter.
  

We only share your data with third parities if you have consented to the same or if we have a legal obligation to do so.

In this context, your personal data may, in particular, be shared with:

• Law enforcement authorities
  
• Other companies of the Savings Bank Finance Group (Sparkassen-Finanzgruppe).
  

Data may also be shared with authorised service providers if they meet your Sparkasse’s special confidentiality requirements. These service providers could, in particular, constitute IT, consulting and sales and marketing companies. In these cases, your Sparkasse will enter into corresponding data protection agreements with these service providers.

If the data described in this privacy policy is no longer needed, it will be deleted. This always applies unless the data needs to be processed - for a limited time - for other purposes.

If your Sparkasse has defined a different storage period for certain services, this period will be stated in the description of the relevant service.

Data that your Sparkasse collects when you visit this website are never transferred to any international organisations or third countries (countries outside the EEA). If your Sparkasse uses any analytics services, you will be able to find more information about them under “Cookies” at the top.

You have the following rights concerning the personal data collected by your Sparkasse:

• Right to information
  
• Right to rectification and erasure
  
• Right to restrict processing
  
• Right to data portability
  
• Right to withdraw consent
  

Information about your right to object in accordance with Art. 21 DSGVO

1. Right to object on personal grounds

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data that is based on point (e) (public interest) or (f) (legitimate interests) of Article 6(1) DSGVO, including to profiling based on those provisions in terms of Art. 4(4) DSGVO.

If you object, your Sparkasse will no longer process your personal data, unless it can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or if the data is processed for the establishment, exercise or defence of legal claims.

2. Right to object to the processing of your data by your Sparkasse for the purpose of direct advertising

In some cases, your Sparkasse will process your personal data for direct advertising purposes. You have the right to object at any time to the processing of your personal data for the purpose of such advertising; as well as to any profiling associated with such advertising.

If you object to the processing of your data for the purpose of direct advertising, your Sparkasse will stop processing your personal data for this purpose.

The objection does not have to be provided in any particular form, but should be addressed to:

Kreissparkasse Stade
Große Schmiedestraße 12
21682 Stade
Germany
info@ksk-stade.de

You also have the right to complain to the following supervisory authority, which is responsible for your Sparkasse regarding the protection of personal data, with respect to the processing of your personal data:

[Please enter the contact details of the responsible supervisory authority here.]

The data collected when visiting this website will not be used for automated decision-making in terms of Art. 22 DSGVO.