Data Protection Statement for Facebook Fanpages

1 Introduction

We are happy about your interest in our Facebook Fanpage ‏(„Fanpage“) and our company. The protection of your personal data is of great importance to us. We respect the statutory provisions on data protection and data security.

Therefore, we have to comply with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG) and the German Telemedia Act (Telemediengesetz – TMG). 

Below you will find information concerning which personal data we collect when providing this service and how we handle such data.

2 Responsible party / Contact details of the data protection officer

The Henkel AG & Co. KGaA, Henkelstraße 67, 40589 Düsseldorf ‏(„we“, „us“ or „Henkel“) is the responsible party for the data processing required to provide the service and as described in this data protection statement. This excludes the data processing concerning the so called “Site-Insights”, for which we share the responsibility with Facebook Ireland Limited ‏(“Facebook”).

Please keep in mind that the use of our Fanpage, leads to further processing of your personal data by Facebook, not limited to the “Site-Insights”-option. Insofar (in particular with regard to the technical possibility to use this Fanpage) we refer to the data protection statement by Facebook under  https://www.facebook.com/privacy/explanation.

Should our Fanpage be linked to other websites or online-contents, the data protection statements of those services respectively apply. 

You can contact our data protection officer Mr. Frank Liebich at the Henkel AG & Co. KGaA, Henkelstrasse 67, D 40191 Düsseldorf, or under Datenschutz@henkel.com.

3 General processing of data

3.1 Communication with us / Community Management

We regularly receive private messages with content directly addressing us. If you contact us, for instance to ask a question about a product that we presented on our Fanpage by private message, we will use your name, eventually your user name and further data provided by you to answer your query.

The processing is based on statutory provisions, which allow us to process personal data, as far as it is necessary to answer your query ‏(e.g. Art. 6 para. 1 b) GDPR) or because of our legitimate interest to provide you with the desired information ‏(Art. 6 para. 1 f) GDPR).

After answering your query, we delete your query and all information within one year from the end of the calendar year in which your query was answered.

Additionally, comments and other content that are publicized on Henkel’s Fanpage and in other public spaces of Facebook, which directly address us or relate to us in another way ‏(e.g. by content naming a product of Henkel’s), are collected by us in order to be able to react to the respective content. We may react accordingly, depending on the kind of content. For instance, we may approach the author in order to help with the usage of our products or consider feedback and reviews when improving on our products. We also create reports regarding the performance of a certain content, including its likes and engagement actions with it in order to learn and improve our public relations work. 

The processing of this data is based on statutory provisions which allow us to process personal data because it constitutes a legitimate interest of ours to react appropriately to public communication which relates to us ‏(Art. 6 para 1 f) GDPR).

Content you have posted on our Fanpage or in other public spaces of Facebook can be deleted by you in the same way as any of your contributions on the platform. We also reserve deleting older comments from our Fanpage from time to time. If you wish to delete content from our Fanpage at any time, please send us an e-mail to the address noted above.

3.2 Community-Features

You can choose from different features which we offer on our Fanpage to interact with other users, such as posting a comment on our wall, leaving a comment, and liking or sharing a post.

We would like to point out, that this part is public and therefore all information you post or provide for registration, can be seen by others. We cannot control how other Fanpage users process this information. We especially cannot prevent others from sending you messages.

All data you provide for the community-features we process to ensure the correct functioning of these features. Without this data we are not able, to offer you the community-features. The processing of this data is based on statutory provisions which allow us to process personal data, as far as it is necessary for the use of our services or the performance of a contract ‏(e.g. Sec. 15 para. 1 TMG; Art. 6 para. 1 b) GDPR), or because it constitutes a legitimate interest, to make the use of our features as easy and efficient as possible ‏(Art. 6 para 1 f) GDPR).

3.3 Sector Observation

We observe publications with connection to the business sectors we are active in ‏(namely Beauty Care, Adhesive Technologies, and Laundry and Home Care). To do so, we collect content published in the public spaces of Social Media platforms with connection to these busi-ness sectors ‏(e.g. content in which a cosmetic product or washing agent is being discussed or showcased). 

Content with connection to the business sectors will be stored and assessed in order to gain insight on the public discussion in regard to these business sectors. We will utilize the gained insights in order to improve our own public communication and bring it into alignment with the public discussion. The processing of this data is based on statutory provisions which allow us to process personal data because it constitutes a legitimate interest of ours to improve our public communication by aligning it with the public discussion ‏(Art. 6 para 1 f) GDPR). 

We will delete content collected in the public spaces of Social Media platforms from our systems one year after its collection. If you wish to delete content from our Fanpage at any time, please send us an e-mail to the address noted above.

3.4 Sweepstakes and other competitions

From time to time we offer sweepstakes and other competitions on our Fanpage. If you want to participate we will ask you to provide identification and contact details ‏(e.g. name, date of birth, address, e-mail-address etc.; further information may be necessary for the competition, such as the answer to a quiz, photos or the result of an online-game). We use this information to properly carry out the sweepstakes or competition, and if necessary for legal defence or to detect misuse.

You will find further details in the participation terms for each sweepstakes/competition. If you gave us your consent when participating in the sweepstakes/competition, we use your information for the purposes listed in the declaration of consent.

The processing of data is based on statutory provisions, which allow us to process personal data if it is necessary to properly carry out the sweepstakes/competition ‏(e.g. Art. 6 para. 1 b) GDPR), because you gave us your consent ‏(Art. 6 para. 1 a) GDPR) or to follow our legitimate interest to prevent fraud or to safeguard an effective legal defence ‏(Art. 6 para. 1 f) GDPR).

The duration of data storage will be included in the respective data protection statement for each sweepstakes/competition.

3.5 Invitation to events

From time to time we announce events on our Fanpage, which might require a registration. If you register for one of our events, we process the personal data supplied by you at the registration, such as your name, address, details of contact and communication ‏(phone number and e-mail-address) as well as further information necessary for the event ‏(e.g. to create the guest list, accreditation, entrance control, room planning and catering) and/or information necessary to send you your invitation and information for the specific event. Furthermore, we might use your information to detect misuse and for our legal defence.

The processing of data is based on statutory provisions, which allow us to process personal data if it is necessary for the registration and participation for an event ‏(Art. 6 para. 1 b) GDPR) or because we have a legitimate interest to prevent fraud or to safeguard an effective legal defence ‏(Art. 6 para. 1 f) GDPR).

If you register for an event, we delete your registration data within three years from the end of the calendar year in which the event took place.

3.6 Chatbot

We supply a chatbot on our Fanpage. It is possible to use the chatbot without sharing personal data. In case you enter personal information in the text box while using the chatbot, we will use your data only to answer your question. If we save your question for an internal review-process we will delete your personal data beforehand.

The processing of data is based on statutory provisions, which justify the processing of personal data that is necessary to answer your question ‏(Art. 6 para. 1 b) GDPR) or because we have a legitimate interest to prevent fraud or to safeguard an effective legal defence ‏(Art. 6 para. 1 f) GDPR).

If you did not agree to a longer storing period, e.g. within our customer relations management, we will store your data just as long as needed to fulfil the above mentioned purposes or as long as necessary to comply with legal obligation to retain the data.

3.7 Product test

You may have provided your contact data and your address while participating in product tests, which we conducted via our Fanpage. We will use your data for the purpose of conducting the product test.

We will not forward your data to any third party unless for the purpose of conducting the product test. 

The processing and use of your data is based on statutory provisions which justify those operations on the grounds that the processing is necessary for carrying out the product test you are participating in ‏(Art. 6 para 1 b) GDPR).

If you have not given consent to a longer storage duration e.g. in the course of our customer relationship management we will store the data no longer than needed in order to fulfill the aforementioned purpose or as long as required in case any statutory retention obligation applies.

3.8 Surveys

You may have provided your contact data, e.g. your email address while participating in a survey. We will use your data for the purpose of conducting the survey.

We will not forward your data to any third party unless for the purpose of conducting the survey. 

The processing and use of your data is based on statutory provisions which justify those operations on the grounds that we have an overriding legitimate interest in using your answers in the survey you participated in ‏(Art. 6 para 1 f) GDPR).

If you have not given consent to a longer storage duration e.g. in the course of our customer relationship management we will store the data no longer than needed in order to fulfill the aforementioned purpose or as long as required in case any statutory retention obligation applies.

3.9 Analysis of use / Site-Insights

In shared responsibility with Facebook we analyse, how you use our Fanpage ‏(Site-Insights).

The information required by the GDPR pertaining to the processing of data for Site-Insight can be found on the Facebook website; at the moment you will find Facebook´s data protection statement under https://www.facebook.com/privacy/explanation.

Facebook will supply you with the relevant details about the contract between Facebook and Henkel AG & Co. KGaA regarding the processing of data as joint controllers as per Art. 26 GDPR; at the moment you will find this information by clicking this Link: https://www.facebook.com/legal/terms/page_controller_addendum.

In the context of Site-Insight we will only receive anonymized statistics – therefore we have no access to personal data which are being processed by Facebook.

4 Transfer of personal data

A disclosure of your personal data occurs in the following cases:

• Personal data will be disclosed to criminal prosecution authorities as well as, if necessary, harmed third parties if necessary to investigate illegal or abusive use of our services. However, this only occurs if there are specific indications for illegal use or misuse. A disclosure can also take place if this serves to enforce the terms and conditions for the use of our services or other agreements or if necessary, to assert, exercise or defend legal claims. Our legitimate interest for the processing is safeguarding the proper functioning of our website and to assert, exercise or defend legal claims, as the case may be. We are also required by law to provide information to certain governmental agencies.  These are the criminal prosecution authorities, public authorities that prosecute administrative misdemeanors sanctioned with fines and the tax authorities. Our legitimate interest for the processing is to prevent misuse, prosecute criminal offenses and to assert, exercise or defend legal claims, as the case may be ‏(e.g. Art. 6 para. 1 f) GDPR). 
• For the fulfilment of our services we must rely on third party companies and external service providers under contractual relationships (“processor”). Categories of such processors can be agencies, fulfilment-service provides, an IT-Service providers. 
  In such situations, information will be disclosed to these companies or individual persons, in order to enable further processing.  We carefully select these external service providers and regularly examine them in order to make sure that your privacy is safeguarded. Processors are only allowed to use the data for the purposes determined by us. They are also obligated under contracts with us to treat your data exclusively in accordance with this data protection statement as well as the European and German laws on data protection. 
  Within the framework of potential transfers described above, it might occur that the third party bound by instructions might process the data in states outside the EU (“third countries”). 
• Every disclosure of data to a party outside the EU is carried out in compliance with applicable data protection laws. To the extent the EU-Commission has not declared that a third country provides an adequate level of data protection, we will provide sufficient guarantees to establish an adequate protection of your data. For this purpose a contract with the processor might be concluded that incorporates the EU Standard Contract Clauses  (http://ec.europa.eu/justice/data-protection/international-transfers/transfer/index_en.htm).
• During the course of the further development of our business, it is possible that the structure of Henkel AG & Co. KGaA will change by changing the legal form, establishing, purchasing or selling subsidiaries, company divisions or parts of the company. In case of such transactions, the customer information is passed on together with the part of the business which is transferred. To this extent, we make sure that each disclosure of personal data to third parties is carried out in accordance with this data protection statement and applicable data protection laws. Such a transfer of personal data can be justified by a legitimate interest to adapt the structure of our company to economic and legal circumstances if required ‏(Art. 6 para. 1 f) GDPR).

5 Your right as a data subject

As a data subject you have the right to obtain information at any time about the data stored about you. Furthermore, you have the right to rectify, right to erasure, a right to restriction of processing as well as potentially the right to data portability. Additionally, you have the right to complain to a data protection supervisory authority.

IN ADDITION, YOU MAY OBJECT TO DATA PROCESSING FOR RESASONS ARISING FROM YOUR PARTICULAR SITUATION; IF THE PROCESSING OF YOUR PERSONAL DATA IS BASED ON ART. 6 PARA. 1 LIT. E OR LIT. F GDPR.

Should you have given your consent to the processing of your personal data, you can withdraw it at any time with effect for the future. 

As far as the processing of personal data by Site-Insights is concerned, Facebook acts as the joint contact point and handles all applications concerning the exercise of the above mentioned rights. 

6 Changing of this data protection statement

Status of this data protection statement is August 17, 2020.

The development of our Fanpage can have effects on the way we handle personal data. We retain the right to adapt this data protection statement in line with applicable data protection laws. Therefore, we recommend visiting our Fanpage from time to time, to stay informed about possible updates of our data protection statement.