It is legal to collect, process and use personal data only if one of the requirements of legality described in what will be established below is met. One of the legality requirements must also be met if the purpose of the collection, processing and use of personal data is to be changed in relation to the original purpose.
5.1. Data processing for a contractual relationship
The personal data of the party concerned, the client and/or user of the website can be treated for the preparation, performance or cancellation of a contract or request. This also includes the contractual user/client service, as long as it is related to the object of the contract.
Before the formalisation of a contract - that is, in the prior phase - personal data may be processed to prepare offers, to prepare requests for products or services, or to fulfil other wishes of the party concerned in order to reach the conclusion of the business relationship. Potential clients or users may be contacted, depending on circumstances, during the pre- information phase, using the data that they have communicated or to be able to offer similar products or services or that may be of interest due to the profile of potential client/user. If applicable, the restrictions mentioned by the party concerned (data holder) should be taken into account.
5.2. Data processing for advertising purposes
If the party concerned addresses an Alares company requesting information (for example, request to send informative material on a product, act or service), their data may be processed to allow this desire to be fulfilled.
Client/user advertising and loyalty measures require compliance with other legal requirements. The processing of personal data for advertising or market research and opinion purposes is permitted if this processing is compatible with the purpose for which they were collected or express consent has been obtained. The affected parties will be informed about the use of their data (see “Basic Information” block, purpose of use). If data is collected exclusively for advertising measures, their communication by the affected party will always be voluntary.
If the party concerned rejects the use of their data for advertising purposes, their data should not continue to be used for this purpose and will be blocked accordingly (use of "Robinson list").
5.3. Consent to the processing of data
It is possible to process data if the party concerned has given their consent. Before requesting their consent, the party concerned will be informed in accordance with section 4.3 of this block on the data protection and processing guidelines. For reasons of plausibility, the declaration of consent must always be collected in writing or electronically (acceptance ofconditions on the form). Under certain conditions, such as telephone counselling, verbal consent may be granted. The granted consent will be documented.
5.4. Data processing due to legal permission
The processing of personal data is also legal if there are legal provisions that require, presuppose or authorise this processing. The type and extent of data processing must be necessary for the processing authorised by legislation, and must be carried out in accordance with these provisions.
5.5. Data processing due to a legitimate interest
Personal data may also be processed if necessary, to safeguard a legitimate interest of Alares. In general, legitimate interests can be of a legal nature (for example, making pending titles) or economic (for example, avoiding contract disturbances). The processing of personal data by reason of a legitimate interest is not permitted if in some particular cases there are signs that the protection of the legitimate interests of the party concerned predominates over the interest of the responsible body in the processing of the data. The legitimacy of these interests will be examined before each data processing.
5.6. Processing of data subject to special protection
Personal data subject to special protection can only be treated if it is mandatory by law, or if the party concerned has given their express consent.
Otherwise, these data may also be processed if this is necessary for the responsible party to be able to exercise their rights, claim them or defend them against the party concerned. If there is an intention to process data subject to special protection, the Alares Data Protection Officer will be informed in advance.
5.7. User data and the Internet
Whenever personal data is collected, used or processed on the website or on integrated platforms, the parties concerned will be informed about this aspect in notices on data protection and, where appropriate, on cookies. The notices about the protection and processing of data on cookies must be integrated so that they are available continuously, and the party concerned can recognise them easily and access them immediately.
If the possibility of accessing personal data is offered in a restricted area (subject to registration) of web pages or Apps, the identification and authentication of the party concerned will be configured in such a way that an adequate level of protection of this access is achieved.