Privacy policy
§ 1 Information on the collection of personal data and provider identification
(1) In the following, we provide information about the collection of personal data when using this website. Personal data is all data that can be related to you personally, e.g. name, address, e-mail addresses, user behaviour.
(2) The controller pursuant to Art. 4 No. 7 of the EU General Data Protection Regulation (GDPR) is PAN Klinik am Neumarkt Betriebsgesellschaft mbH, Zeppelinstr. 1, 50667 Cologne, Neumarkt-Galerie, info@pan-klinik.de (see our legal notice). Our data protection officer is Dr Andreas Pinheiro LL.M., Hohenstaufenring 8, 50674 Cologne, info@ap-datenschutz.de.
(3) If we use contracted service providers for individual functions of our offer or would like to use your data for advertising purposes, we will inform you in detail below about the respective processes. We will also state the specified criteria for the storage period.
§ 2 Rights, in particular to information and cancellation
(1) You have the following rights vis-à-vis us with regard to your personal data:
- Right of access,
- Right to rectification or erasure,
- Right to restriction of processing,
- Right to object to processing,
- Right to data portability.
(2) If you have given your consent to the use of data, you can revoke this at any time. If the lawfulness of the processing is based on consent, this remains valid until the revocation is exercised.
(3) Please send all requests for information, requests for information or objections to data processing by e-mail to info@pan-klinik.de or to the address stated under § 1 para. 2.
(4) You can request us to delete your data at any time. There may be statutory retention periods that allow us to retain your data until the expiry of the period.
(5) If your data is incorrect, you have the right to ask us to correct it. We will comply with this request without delay.
(6) You have the right to receive the personal data you have provided to us in a readable format, where technically feasible, in order to make it available to another company (right to data portability).
(7) You have the right to lodge a complaint with the supervisory authority responsible for you. A list of data protection officers and their contact details can be found at the following link: www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.
§ 3 Data security
(1) We maintain up-to-date technical measures to ensure data security, in particular to protect your personal data from risks during data transmission and from third parties gaining knowledge of it. These are adapted to the current state of the art.
§ 4 Collection of personal data for informational use and contacting us
(1) If you only use the website for informational purposes, i.e. if you do not register or otherwise provide us with information, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure its stability and security (legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR):
- IP address
- Date and time of the request
- Time zone difference to Greenwich Mean Time (GMT)
- Content of the request (specific website)
- access status/HTTP status code
- Amount of data transferred in each case
- Website from which the request originates
- Browser
- Operating system and its interface
- Language and version of the browser software
(2) When you contact us by e-mail or via the contact form, we will store your e-mail address, your name and, if you specify this, your telephone number. The purpose of this storage is solely to contact you in order to answer your questions.
(3) The legal basis for the collection of data when contacting us is the consent you have given by sending the contact form (Art. 6 para. 1 sentence 1 lit. a GDPR).
(4) We will only use your data for advertising purposes to the extent permitted by law. In particular, we will only use your email address for direct advertising for our own similar goods or services. You can object to the use of your data for advertising purposes at any time in writing or in text form (e-mail to info@pan-klinik.de). In doing so, we rely on your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR.
(5) In addition to the aforementioned data, cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive, assigned to the browser you are using, and through which certain information flows to the body that sets the cookie (in this case us). Cookies cannot execute programmes or transfer viruses to your computer. They are used to make the website more user-friendly and effective overall.
§ 5 Cookies
(1) We use cookies on our website. Such cookies are necessary so that you can move freely on the website and use its features; this also includes access to secure areas of the website. Cookies allow us to track who has visited the website(s) and to deduce how often certain web pages are visited and which parts of the site are particularly popular. Session cookies store information about your activities on our website.
(2) This website uses the following types of cookies, the scope and function of which are explained below:
Transient cookies (temporary use)
Persistent cookies (temporary use)
Third party cookies
(3) Transient cookies are automatically deleted when you close the browser. These include session cookies in particular. These store a so-called session ID, with which various requests from your browser can be assigned to the joint session. This allows your computer to be recognised when you return to the website. The session cookies are deleted when you log out or close the browser.
(4) Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can delete the cookies in the security settings of your browser at any time.
(5) You can configure your browser settings according to your wishes and, for example, refuse to accept third-party cookies or all cookies. We would like to point out that you may not be able to use all functions of this website.
(6) The cookies used are described by us in the cookie banner.
§ 6 Data transfer for the maintenance of the website
(1) We will not pass on your personal data to third parties unless we inform you of such a transfer.
(2 ) Our IT service providers have access to our stored data in order to rectify errors and to enable us to implement the required technical and organisational measures. In doing so, we rely on our legitimate interest in securing our IT in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR or on the fulfilment of legal obligations in accordance with Art. 6 para. 1 sentence 1 lit. c GDPR.
(3) The IT service provider(s) have been carefully selected by us and commissioned in writing. They are bound by our instructions and are regularly monitored by us. The service providers will not pass this data on to third parties.
§ 7 Social media
(1) We provide links to various social media on our website. However, these are merely links to external websites of third-party social media providers and not plugins. Consequently, no links are created or personal data transmitted to the third-party providers when you visit our website. By clicking on the respective button labelled with the provider's symbol, you will be redirected to the website of this provider. You will then leave our website. If you have any questions about the collection of data by third-party providers, please read the data protection declarations provided by the third-party providers. We refer to the following social media:
(2) Facebook
Our website links via the "f" button to the social network facebook.com, whose operator for users outside the USA and Canada is Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland. You can find information on data protection here: de-de.facebook.com/about/privacy/
The Facebook service processes your data outside the European Union and the European Economic Area to its parent company Meta Platforms, Inc. The transfer of personal data to a so-called third country requires that the provisions of Sections 44 et seq. GDPR are complied with in order to guarantee the level of protection guaranteed in the EU. The transfer of personal data to the USA takes place on the basis of an adequacy decision of the EU Commission (Adequacy decision for the EU-US Data Privacy Framework of 10 July 2023) pursuant to Art. 45 para. 1 GDPR, the so-called EU-US Data Privacy Framework (DPF). Meta Platforms, Inc. can only base the processing of personal data on Art. 45 para. 1 GDPR if it is registered in the list of participating organisations in accordance with Article 1 DPF (list available at: www.dataprivacyframework.gov/). Meta Platforms, Inc. is registered in the list of participating organisations. The registration does not include personal data of employees (HR category). This data processing can therefore be based on Art. 45.
§ 8 Web tracking - Google Analytics
(1) If you have given your consent, this website uses Google Analytics, a web analytics service provided by Google Ireland Limited ("Google"). Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyse how users use the site. The information generated by the cookies about your use of this website is usually transferred to a Google LLC server in the USA and stored there. However, if IP anonymisation is activated on this website, your IP address will be shortened by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area beforehand. Only in exceptional cases will the full IP address be transmitted to a Google LLC server in the USA and truncated there. Google will use this information on behalf of the operator of this website to analyse your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website activity and internet usage.
(2) The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.
(3) You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You can also prevent Google from collecting the data generated by the cookies and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available at the following link: tools.google.com/dlpage/gaoptout.
(4) This website uses Google Analytics with the extension "_anonymiseIp()". This means that IP addresses are further processed in abbreviated form so that they cannot be linked to a specific person. If the data collected about you is personally identifiable, it is immediately excluded and the personal data is deleted immediately.
(5) We use Google Analytics to analyse the use of our website and thus regularly improve it. We can use the statistics obtained to improve our offer and make it more interesting for you as a user.
(6) The Google service processes your data outside the European Union and the European Economic Area to its parent company Google LLC. The transfer of personal data to a so-called third country requires that the provisions of Sections 44 et seq. GDPR are complied with in order to guarantee the level of protection guaranteed in the EU.
The transfer of personal data to the USA takes place on the basis of an adequacy decision of the EU Commission (Adequacy decision for the EU-US Data Privacy Framework of 10 July 2023) pursuant to Art. 45 para. 1 GDPR, the so-called EU-US Data Privacy Framework (DPF). Google can only base the processing of personal data on Art. 45 para. 1 GDPR if it is registered in the list of participating organisations in accordance with Article 1 DPF (list available at: www.dataprivacyframework.gov/). Google LLC is registered in the list of participating organisations. The registration includes personal data of employees (category HR). This data processing can therefore be based on Art. 45.
Further information can be found at: privacy.google.com/businesses/compliance/
(7) The legal basis for the use of Google Analytics is your consent, i.e. Art. 6 para. 1 sentence 1 lit. a GDPR.
(8) Information from the third-party provider: Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland, terms of use: www.google.com/analytics/terms/de.html,
The privacy policy: policies.google.com/privacy.
(9) This website also uses Google Analytics for a cross-device analysis of visitor flows, which is carried out via a user ID. You can deactivate the cross-device analysis of your usage in your customer account under "My data", "Personal data".
§ 9 Use of Google Tag Manager:
(1) Google Tag Manager is a tool that allows marketers to manage website tags via an interface. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").
(2) The Tool Tag Manager itself (which implements the tags) is a cookie-less domain and does not collect any personal data. The tool triggers other tags, which in turn may collect data (interaction with telephone numbers or other contact data on the website). If a deactivation has been made at domain or cookie level, this remains in place for all tracking tags that are implemented with Google Tag Manager. For more information, see: www.google.de/analytics/terms/tag-manager/.
(3) The legal basis for the transfer of personal data to Google is your consent, i.e. Art. 6 para. 1 sentence 1 lit. a GDPR.
(4) The Google service processes your data outside the European Union and the European Economic Area to its parent company Google LLC. The transfer of personal data to a so-called third country requires that the provisions of Sections 44 et seq. GDPR are complied with in order to guarantee the level of protection guaranteed in the EU.
The transfer of personal data to the USA takes place on the basis of an adequacy decision of the EU Commission (Adequacy decision for the EU-US Data Privacy Framework of 10 July 2023) pursuant to Art. 45 para. 1 GDPR, the so-called EU-US Data Privacy Framework (DPF). Google LLC can only base the processing of personal data on Art. 45 para. 1 GDPR if it is registered in the list of participating organisations in accordance with Article 1 DPF (list available at: www.dataprivacyframework.gov/). Google LLC is registered in the list of participating organisations. The registration includes personal data of employees (category HR). This data processing can therefore be based on Art. 45.
Further information is available at: privacy.google.com/businesses/compliance/
§ 10 Google AdSense
(1) We use the offer of Google Ads to draw attention to our offers with the help of advertising material (so-called ads) on external websites. We can determine how successful the individual advertising measures are in relation to the data of the advertising campaigns. In this way, we pursue the interest of making our website more interesting for you, increasing the number of visitors and achieving a fair calculation of advertising costs. For this purpose, statistical information about you is collected and processed by our advertising partners.
(2) When you access our website via an ad, Google receives statistical parameters for measuring success, such as the display of adverts or clicks by users. If you access our website via a Google advert, Google Ads will store cookies on your PC or integrate tracking pixels on our website. The cookies generally lose their validity after 30 days and are not intended to identify you personally, but to recognise your Internet browser statistically. These techniques generally record the unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions) and opt-out information (marking that the user no longer wishes to be addressed) as analysis values.
(3) We ourselves do not collect and process any personal data in the aforementioned advertising measures. We only receive statistical analyses from Google. We have no influence on the data collected, nor are we aware of the full extent of the data collection and the storage period. Your data is transferred by Google to the USA and analysed there. If you are logged in with your Google account, your data can be directly assigned to it. If you do not wish your data to be associated with your Google profile, you must log out beforehand. It is possible that this data may be passed on by Google to contractual partners, other third parties and authorities.
(4) The legal basis for the transfer of personal data to Google is our legitimate interest in the dissemination of our website, i.e. Art. 6 para. 1 sentence 1 lit. f GDPR.
(5) You can prevent participation in this tracking process in various ways: a) by setting your browser software accordingly. In particular, the suppression of third-party cookies means that you will not receive ads from third-party providers. b) By deactivating interest-based ads on Google via the link www.google.de/ads/preferences, whereby this setting is deleted when you delete your cookies. c) By deactivating the interest-based adverts of providers that are part of the "About Ads" self-regulation campaign via the link www.aboutads.info/choices, whereby this setting is deleted when you delete your cookies. d) By permanently deactivating them in your Firefox, Internet Explorer or Google Chrome browsers via the link www.google.com/settings/ads/plugin. We would like to point out that in this case you may not be able to use all functions of this website to their full extent.
(6) The Google service processes your data outside the European Union and the European Economic Area to its parent company Google LLC. The transfer of personal data to a so-called third country requires that the provisions of Sections 44 et seq. GDPR are complied with in order to guarantee the level of protection guaranteed in the EU.
The transfer of personal data to the USA takes place on the basis of an adequacy decision of the EU Commission (Adequacy decision for the EU-US Data Privacy Framework of 10 July 2023) pursuant to Art. 45 para. 1 GDPR, the so-called EU-US Data Privacy Framework (DPF). Google LLC can only base the processing of personal data on Art. 45 para. 1 GDPR if it is registered in the list of participating organisations in accordance with Article 1 DPF (list available at: www.dataprivacyframework.gov/). Google LLC is registered in the list of participating organisations. The registration includes personal data of employees (category HR). This data processing can therefore be based on Art. 45.
Further information is available at: privacy.google.com/businesses/compliance/
(7) Further information on the purpose and scope of data collection and processing as well as further information on your rights in this regard and setting options to protect your privacy can be obtained from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
User conditions: www.google.com/analytics/terms/de.html,
The privacy policy: policies.google.com/privacy
§ 11 Google Maps
(1) We use Google Maps on this website. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). This allows us to show you interactive maps directly on the website and enables you to use the map function conveniently.
(2) When you visit the website, Google receives the information that you have accessed the corresponding subpage of our website. In addition, the data mentioned under § 4 of this declaration will be transmitted. This takes place regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be assigned directly to your account. If you do not wish your data to be associated with your Google profile, you must log out before activating the button. Google stores your data as usage profiles and uses them for the purposes of advertising, market research and/or the customised design of its website. Such an analysis is carried out in particular (even for users who are not logged in) to provide customised advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact Google to exercise this right.
(3) The legal basis for the transfer of personal data to Google is your consent, i.e. Art. 6 para. 1 sentence 1 lit. a GDPR. Further information on the purpose and scope of data collection and its processing by the plug-in provider can be found in the provider's privacy policy. There you will also find further information on your rights in this regard and setting options to protect your privacy: www.google.de/intl/de/policies/privacy.
(4) The Google service processes your data outside the European Union and the European Economic Area to its parent company Google LLC. The transfer of personal data to a so-called third country requires that the provisions of Sections 44 et seq. GDPR are complied with in order to guarantee the level of protection guaranteed in the EU.
The transfer of personal data to the USA takes place on the basis of an adequacy decision of the EU Commission (Adequacy decision for the EU-US Data Privacy Framework of 10 July 2023) pursuant to Art. 45 para. 1 GDPR, the so-called EU-US Data Privacy Framework (DPF). Google can only base the processing of personal data on Art. 45 para. 1 GDPR if it is registered in the list of participating organisations in accordance with Article 1 DPF (list available at: www.dataprivacyframework.gov/). Google LLC is registered in the list of participating organisations. The registration includes personal data of employees (category HR). This data processing can therefore be based on Art. 45.
(5) Further information is available at: privacy.google.com/businesses/compliance/
§ 12 YouTube
(1) We have integrated YouTube videos into our online offering, which are stored on www.youtube.com and can be played directly from our website. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). The videos are all integrated in "extended data protection mode", i.e. no data about you as a user is transferred to YouTube if you do not play the videos. Only when you play the videos will the data mentioned in paragraph 2 be transmitted. We have no influence on this data transfer.
(2) By visiting the website, YouTube (and therefore always Google) receives the information that you have accessed the corresponding subpage of our website. In addition, the data mentioned under § 4 of this declaration will be transmitted. This occurs regardless of whether YouTube provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be assigned directly to your account. If you do not wish your data to be associated with your YouTube profile, you must log out before activating the button. YouTube stores your data as usage profiles and uses them for the purposes of advertising, market research and/or customising its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide customised advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact YouTube to exercise this right.
(3) The legal basis for the transfer of personal data to YouTube is your consent, i.e. Art. 6 para. 1 sentence 1 lit. a GDPR.
(4) Further information on the purpose and scope of data collection and its processing by YouTube can be found in the privacy policy. There you will also find further information on your rights and setting options to protect your privacy: policies.google.com/privacy;
(5) The YouTube service processes your data outside the European Union and the European Economic Area to its parent company Google LLC. The transfer of personal data to a so-called third country requires that the provisions of Sections 44 et seq. GDPR are complied with in order to guarantee the level of protection guaranteed in the EU.
The transfer of personal data to the USA takes place on the basis of an adequacy decision of the EU Commission (Adequacy decision for the EU-US Data Privacy Framework of 10 July 2023) pursuant to Art. 45 para. 1 GDPR, the so-called EU-US Data Privacy Framework (DPF). Google can only base the processing of personal data on Art. 45 para. 1 GDPR if it is registered in the list of participating organisations in accordance with Article 1 DPF (list available at: www.dataprivacyframework.gov/). Google LLC is registered in the list of participating organisations. The registration includes personal data of employees (category HR). This data processing can therefore be based on Art. 45.
(6) Further information is available at: privacy.google.com/businesses/compliance/
§ 13 Use of jQuery
(1) Our website uses the Java script extension jQuery, which is downloaded from the website code.jquery.com. In this regard, programme libraries are called up from StackPath servers. The provider is The OpenJS Foundation, 1 Letterman Drive, Building D, Suite D4700, San Francisco, CA 94129, USA.
(2) When you access a website, your browser loads the required programme libraries into your browser cache. For this purpose, the browser you are using must establish a connection to the jQuery servers located in the USA. The use of jQuery is in the interest of an optimised and appealing presentation of our online offers. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 sentence 1 lit. f GDPR.
(3) jQuery ensures a comparable level of data protection when transferring data to the USA by concluding so-called standard data protection clauses (SDC) in accordance with Art. 46 para. 2 lit. c GDPR.
(4) Further information about jQuery can be found at www.jquery.com.
§ 14 Vimeo
(1) Our website uses plugins from the video portal Vimeo. The provider is Vimeo Inc, 555 West 18th Street, New York, New York 10011, USA.
(2) When you visit one of our websites equipped with a Vimeo plugin, a connection to the Vimeo servers is established. The Vimeo server is informed which of our websites you have visited. Vimeo also obtains your IP address. This also applies if you are not logged in to Vimeo or do not have a Vimeo account. The information collected by Vimeo is transmitted to the Vimeo server in the USA.
(3) If you are logged into your Vimeo account, you enable Vimeo to assign your surfing behaviour directly to your personal profile. You can prevent this by logging out of your Vimeo account.
(4) Further information on the handling of user data can be found in Vimeo's privacy policy at: vimeo.com/privacy.
(5) Vimeo is used in the interest of presenting our online video offerings. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 sentence 1 lit. f GDPR.
(6) Vimeo Inc. ensures a comparable level of data protection when transferring data to the USA by concluding so-called standard data protection clauses (SDC) in accordance with Art. 46 para. 2 lit. c GDPR. Further information can be found at: vimeo.com/privacy
§ Section 15 Data collection for the purpose of applications
(1) We advertise vacancies on our website. If you apply for a position, we will store your application documents received by post or e-mail until the application process has ended.
(2) If we do not decide in your favour, we will destroy your application documents no later than six months after the end of the application process. We rely here on our legitimate interest in an efficient legal defence pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR in conjunction with Section 21 para. 5 AGG. The preclusion period for such actions is 2 months.
(3) The processing of your applicant data is based on Section 26 (1) BDSG, as it is necessary to establish an employment relationship.
§ 16 Subpages of medical practices
(1) On our homepage you will find subpages on which medical practices that co-operate with us in the PAN complex or are associated with the PAN Group present themselves.
(2) The medical practices themselves are responsible for data processing when contacting one of the medical practices. If you have any questions about this, please contact the relevant medical practice directly.
§ 17 Use of Cookiebot
(1) We use functions of the provider Cookiebot on our website. The company behind Cookiebot is Cybot A/S, Havnegade 39, 1058 Copenhagen, DK. Among other things, Cookiebot offers us the opportunity to provide you with a comprehensive cookie notice (also known as a cookie banner or cookie notice). By using this function, data can be sent from you to Cybot, stored and processed.
(2) We use Cookiebot to obtain your consent to the storage of certain cookies in your browser and to document this in compliance with data protection regulations. In addition, the technology behind Cookiebot scans, monitors and analyses all cookies and tracking measures on this website.
(3) The data mentioned in § 4 is processed by Cookiebot. Furthermore, an encrypted, anonymous key is generated and stored, which stores a proof of consent (via a cookie).
(4) With regard to the use and storage of consent, we refer to Art. 6 para. 1 lit. c GDPR, as we are legally obliged to be able to prove consent (Art. 5 para. 2 GDPR). The possibility to switch off cookies is made possible by the so-called cookie banner. Obtaining consent when setting cookies is a requirement of § 15 para. 3 TMG i.V.m. Art 7 GDPR (see also ECJ "Planet 49" ECLI:EU:C:2019:801)
§ 18 Anonymised Call Pixel Tracking
(1) Call tracking is used to measure the behaviour of callers. When you call us, we store a telephone number, shortened by the last digits. Our interest here is the customised and needs-based adaptation of our offers on the website. By assigning the pixel to an offer, we can measure whether the offer is requested or not.
(2) Static call tracking is used. Static call tracking means that a specific (advertising) channel is linked to a fixed telephone number. We link the Google Ads campaign adverts to the transmitted telephone number.
(3) In the area of medical services, however, such tracking is problematic and would only be possible with your informed consent. We have therefore decided to anonymise the tracking, which makes it impossible for us to assign your personal information.
(4) The data collected in the form of call numbers (shortened by 3 digits) is initially not transmitted to us, but to LocalPerformance GmbH as a third-party provider. The data will not be forwarded to and by agreement. Only the final total of calls is transmitted to us. As we do not know the pseudonyms of the telephone numbers, we in turn have no way of assigning the data to a specific person. LocalPerformance GmbH has no access to the Google Ads data records. It is also unable to assign the telephone numbers to individuals. The use of call tracking takes place within the framework of our legitimate interest in a functioning and needs-based offer design in accordance with § 6 para. 1 lit. f GDPR, which we derive from entrepreneurial freedom (Art. 16 GrCh). As we anonymise the data by means of a fiduciary procedure, the interests of the data subject do not prevail in this case.