Privacy

Data protection information pursuant to the General Data Protection Regulation (GDPR)

Privacy policy
Your trust is important to us. Timberland Securities Investment plc takes the protection of your personal data very seriously. Personal data are only collected, processed or used if the data subject has consented, if they are necessary for the fulfilment of a contract or if a law permits or prescribes the collection, processing or use. With this Privacy Policy we would like to give you details of the data collection and data processing and of the rights you have in this context.

1. Name and address of the data controller

The data controller within the meaning of the General Data Protection Regulation, other data protection laws in force in the Member States of the European Union and other data protection provisions is:

Timberland Securities Investment plc
Address: 171, Old Bakery Street, Valletta VLT 1455, Malta
Phone: +356-20908145
Email.: info@timberland-investment.com

You can contact our data protection officer at any time at the above-mentioned business address with regard to data protection issues.

dataprotection@timberland-investment.com

2. Basic remarks on the processing of personal data

Personal data means any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”). A natural person is considered to be identifiable if they can – directly or indirectly, in particular by being associated with an identifier such as a name – be mapped to an identification number, to location data, to an online identifier or to one or more particular attributes that reflect the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.

Timberland Securities Investment plc will only process personal data with the user’s consent or if the processing of the data is permitted by law. The legal basis is art. 6 para. 1 of the EU General Data Protection Regulation (GDPR). According to this regulation, the processing of personal data is only permitted if the data subject consents (art. 6 para. 1 lit. a GDPR) or processing is required for one of the following purposes:

• for the performance of a contract with the data subject or for the implementation of pre-contractual measures upon request of the data subject (art. 6 para. 1 lit. b (GDPR);
• for compliance with a legal obligation of our company (art. 6 para.1 lit. c (GDPR);
• for the protection of the vital interests of the data subject or another natural person (art. 6 para.1 lit. d GDPR);
• For the performance of a task which is carried out in the public interest or which our company has been entrusted with by official authorities (art. 6 para. 1 lit. e GDPR).
• for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data (art. 6 Abs.1 lit. f (GDPR).

3. Duration of storage and erasure of data

The personal data of the data subject will be erased or blocked as soon as the purpose of the storage ceases to apply. The data may be stored further if this has been provided for by law. The data will also be blocked or erased when a storage period prescribed by the aforementioned regulations expires, unless there is a need for further storage of the data for the conclusion or fulfilment of a contract. Prescribed storage periods in this context are e.g. retention periods under fiscal or commercial law.

4. Recording of access data (creation of log files)

Every time the website of Timberland Securities Investment plc is accessed, it automatically collects general data and information from the computer system of the accessing computer, which is stored in the log files of the server. The following information and data are collected:

• Type of browser, including the version used
  • Operating system of the computer calling up the site
  • Date and time of access
  • IP address of user
  • Internet service provider of user
  • The website from which our internet site is accessed
  • Websites and sub-websites accessed from our internet site
  • Other similar data and information serving to protect against attacks on our system

The data is stored anonymously in our system’s log files. It is not linked to other personal data on the user; Timberland Securities Investment plc does not draw any conclusions about the data subject.

The data is processed on the legal basis of art. 6 para. 1 lit f GDPR. The storage is necessary to ensure the functionality of our website and the correct presentation of the contents. Furthermore, the data serve our statistics and the constant optimisation of our contents. Lastly, it is stored in order to provide law enforcement authorities with the information necessary for prosecution in the event of a cyber attack.

The data will not be passed on to third parties unless the law requires it to be disclosed.

Since the collection and storage of data in the log files is absolutely necessary for trouble-free operation of the website, there is no possibility for the user to object.

The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. Insofar as the data was collected for the proper functioning of the website, this will take place at the end of the internet session.

5. Cookies

We use cookies on our website. Cookies are text files which our server deposits on your computer to store certain data. As a rule, cookies contain a characteristic sequence of symbols enabling a definite identification of the internet browser when the user accesses the website again. In this way, the accessing browser can be recognised and identified.

Cookies help us make it easier for you to use the website. Thanks to the recognition of the browser and the storage of previously entered data, the offers and contents of our website can be individually optimised in that data you have entered (e.g. access data, search terms) do not have to be re-entered every time you visit the website. The legal basis for this is art. 6 para. 1 lit f GDPR.

In addition, we use cookies on our website which enable an analysis of the user’s surfing behaviour. The data collected in this way is, however, pseudonymised, i.e. the personal data is replaced by other identifiers (pseudonyms), so that it is no longer possible to identify the data subject without additional information. As your consent is obtained when you call up our website, the personal data is processed using analysis cookies on the legal basis of art. 6 para. 1 lit f GDPR.

Since cookies are stored on the user’s computer, you as the user also have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your internet browser. You can delete cookies already stored at any time. However, if cookies for our website are deactivated, it is possible that it will no longer be possible to use all of the website’s functions in full.

6. Registration on our website

You have the opportunity to register as a user on our website. To do so, you enter the data in an input mask, send it to us and we save it. Which personal data is affected by this can be seen from the input mask. Furthermore, your IP address and the date and time of registration are also stored. At the end of the registration process, we once again obtain the user’s consent to the data processing. The legal basis for the processing of personal data in this case is therefore art. 6 para. 1 lit a GDPR. As far as the storage of the IP address is concerned, the legal basis is also art. 6 para. 1 lit f GDPR. The data will not be passed on to third parties unless the law requires it to be disclosed.

The registration of the data subject with the voluntary provision of personal data helps the controller to offer the data subject content or services which, by their nature, can only be offered to registered users. Other data is stored in order to prevent or detect misuse of the website and to ensure the security of our system.

As a registered user, you have the option at any time of modifying or completely deleting the personal data provided during registration. To do so, you can use the functions provided in your account or notify us of your wish to change or delete the data in writing or by e-mail.

7. Contact form and contact by email

The Timberland Securities Investment plc website has a contact form which can be used to contact our company by e-mail. The data entered into the input mask by the user is transmitted to us and stored. Furthermore, the user’s IP address and the date and time of transmission are also stored. The user’s consent to the processing of the data is obtained during the sending process. The legal basis for the processing is therefore art. 6 para. 1 lit a GDPR. As far as the storage of the IP address is concerned, the legal basis is also art. 6 para. 1 lit f GDPR.

Alternatively, you can contact us via the email address provided on our website. In this case, apart from the e-mail address, the personal data supplied by the user in the email will be transmitted. The legal basis for this is art. 6 para. 1 lit f GDPR.

The processing of the data transmitted via the contact form or by e-mail serves solely to establish the desired contact. Other data is stored in order to prevent or detect misuse of the website and to ensure the security of our system. The data will not be passed on to third parties unless the law requires it to be disclosed.

The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. As far as the data transmitted by the user in the contact form or in the e-mail is concerned, this is the case when the relevant communication has ended, unless the content of the communication still has legal significance afterwards.

The data subject has the option at any time to revoke their consent to the processing of the data or object to the use of the data. In such a case, the intended contact with the user will no longer be possible or communication already begun cannot be continued.

8. Subscription to our newsletter

On the Timberland Securities Investment plc website you have the option of subscribing to our company’s newsletter. Which personal data will be transmitted to us and stored by us when you order the newsletter can be seen from the input mask provided for this purpose. Furthermore, the user’s IP address and the date and time of transmission are also stored. The user’s consent to the processing of the data is obtained during the subscription process. The legal basis for the processing is therefore Art. 6 para. 1 lit a GDPR. As far as the storage of the IP address is concerned, the legal basis is also Art. 6 para. 1 lit f GDPR. The data will not be passed on to third parties unless the law requires it to be disclosed.

The processing of the data forwarded by the user by entering it into the registration form is required in order for us to send the newsletter. There will be no further use. The IP address is stored in order to prevent or detect misuse (especially of the email address) and to ensure the security of our system.

The subscription to the newsletter can be cancelled by the data subject at any time and thus consent to its dispatch can be withdrawn. For this purpose, a dedicated link is included in every newsletter email sent. In this case – as in the case of any other objection against the use of the data at any time – the personal data stored by us in connection with the newsletter subscription will be deleted. The data will therefore be stored for as long as the subscription to the newsletter is active.

9. Newsletter tracking

Timberland Securities Investment plc collects statistical data when sending newsletters. This is done using a so-called tracking pixel. A tracking pixel is an invisible miniature diagram that is embedded in the newsletter email and downloaded to the user’s computer when the email is opened. The same applies when the user clicks on links included in the email. When a tracking pixel is downloaded, the time, the user’s IP address and the type of browser used are transmitted to our server and stored. The legal basis for this is Art. 6 para. 1 lit f GDPR.

The processing of the data serves optimisation of the newsletter. It enables a statistical analysis of whether and when an email was opened and which links in the email were opened. As a result, the acceptance of the newsletter can be gauged and appropriate adjustments can be made for future newsletters, both in terms of technology and content, in order to optimise their use in line with demand. The data will not be passed on to third parties.

Data subjects may object to the processing of their data at any time by cancelling their subscription to the newsletter (see Subscription to our newsletter). In this event, personal data stored by Timberland Securities Investment plc in this context will be deleted.

10. Data protection in the event of job applications

Job applications may be sent to us electronically (e.g. by e-mail or via an application form available on the website). In such a case, the personal data transmitted is collected and processed for carrying out the application procedure and thus for the potential initiation of an employment relationship. The legal basis for this is Art. 6 para. 1 lit b GDPR. If an employment contract is subsequently concluded with us, the transmitted data will be stored for the purpose of processing the employment contract in compliance with the statutory provisions. If no employment contract is concluded, deletion shall take place within two months of notification of the rejection decision, unless this conflicts with other legitimate interests of our company. Such a legitimate interest is, for example, a burden of proof in a procedure under the German General Equal Treatment Act (AGG). or to object to the use of the data. In such a case, it will no longer be possible to strike up contact as intended with the user or to continue with communications already begun.

11. Use of social plug-ins

On our website we have incorporated plug-ins from social networks. If the data subject is registered with the social network in question when accessing our website and is also logged in, the social network will know which specific subpage of our website the data subject is calling up. This information is collected by the social network owner and mapped to the account of the data subject. We have no influence on the type and volume of the data collected, stored and processed by the owner of the social network. For further information, please therefore contact the owner of the social network in question.

To prevent the owner of the respective social network from processing data about you, you need to log out of the respective network before accessing our website. Moreover, you can use special tools that block data transfer (e.g. Facebook blockers).

On our website we have included the social media plug-ins of the following companies:

Facebook Inc.
https://de-de.facebook.com/about/privacy/
Instagram
https://www.instagram.com/about/legal/privacy

12. Use of Google Analytics

On our website we use the analysis service Google Analytics. Google Analytics stores cookies on your computer and thus enables analysis of your use of the website. The information produced by the cookie, including your IP address, is as a rule transferred to a Google server in the USA and stored there. Beforehand, however, the transmitted data will be made anonymous. On our behalf, Google will analyse the transmitted information for statistical purposes in order to compile reports on website activity and provide us with further services relating to website and internet use. The IP address transmitted by your browser in connection with Google Analytics will not be pooled with other Google data.

To prevent this, you can deactivate or restrict the transmission of cookies in the settings of your internet browser. You can delete cookies already stored at any time. However, if cookies for our website are deactivated, it is possible that it will no longer be possible to use all of the website’s functions in full.

13. Use of Google remarketing

The present website uses the remarketing function of Google Inc. This function serves to show website visitors interest-based ads within the Google advertising network. In the browser of the website visitor, a so-called “cookie” is stored, which makes it possible to recognise the visitor when he calls up websites belonging to Google’s advertising network. These websites may present advertisements to the visitor that relate to content previously accessed by the visitor on websites that use Google’s remarketing function.
Google says it does not collect any personal data during this process. If you do not, however, desire the use of Google’s remarketing function, you can generally disable it by means of the appropriate settings under http://www.google.com/settings/ads . Alternatively, you can disable the use of cookies for interest-based advertising via the Advertising Network Initiative by following the instructions provided under http://www.networkadvertising.org/managing/opt_out.asp .

14. Privacy policy for the use of Google Adsense

The present website uses Google AdSense, a service for placing advertisements belonging to Google Inc. “(“Google”). Google AdSense uses so-called “cookies”, text files which are stored on your computer and allow an analysis of your use of the website. Google AdSense also employs so-called web beacons (invisible graphics). These web beacons can evaluate information such as visitor traffic on these websites.
The information produced about the use of the present website by cookies and web beacons (including your IP address), and the delivery of advertising formats is transferred to a Google server in the USA and stored there. Google may share this information with its contract partners. Google will not, however, commingle your IP address with any other data stored about you.
You can prevent the installation of cookies by adjusting your browser software accordingly; however, please note that in this case you may not be able to fully use all the functions of the present website. By using this website, you consent to Google’s processing the data collected about you in the above manner and for the above purpose.

15. Privacy policy for the use of Google +1

Collection and forwarding of information:
The Google +1 button allows you to publish information worldwide. Via the Google +1 button, you and other users will receive personalised content from Google and our partners. Google will store both the information that you have given for a +1 content as well as information about the website that you viewed when you clicked on +1. Your +1s can appear together with your profile name and photo as notices in Google services, such as search results or your Google profile, or elsewhere on websites and in internet ads.
Google records information about your +1 activities in order to improve Google services for you and for others. To be able to use the Google +1 interface, you need a public Google profile that is visible worldwide and that must at least include the name chosen for the profile. This name is used in all Google services. In some cases, this name may also replace another name you have used when sharing content via your Google account. The identity of your Google profile may be displayed to users who know your email address or have other identifying information about you.
Use of the information recorded:
Apart from the purposes explained above, the information you provide will be used in line with the current Google privacy policy. Google may publish summarised statistics on users’ +1 activities or share them with users and partners such as publishers, advertisers or associated websites.
Source reference: Privacy policy Google +1

16. Google AdWords

Our website uses Google’s conversion tracking. If you arrived on our website via an advertisement placed by Google, Google Adwords will set a cookie on your computer. The conversion tracking cookie is set when a user clicks on an advertisement placed by Google. These cookies expire after 30 days and do not serve the purpose of personal identification. If the user visits certain pages of our website and the cookie has not yet expired, we and Google can see that the user has clicked on the advertisement and been directed to this page. Each Google AdWords customer receives a different cookie. Cookies can therefore not be traced via the websites of AdWords customers. The information collected by means of the conversion cookie is used to compile conversion statistics for AdWords customers who have opted for conversion tracking. Customers learn the total number of users who have clicked on their advertisement and were directed to a page containing a conversion tracking tag. They do not, however, receive any data with which users can be personally identified.
If you do not wish to be included in tracking, you can prevent a cookie from being placed – for example by means of browser settings that generally disable the automatic setting of cookies or by setting your browser so that cookies from the” googleleadservices.com” domain are blocked.
Please note that you must not delete the opt-out cookies as long as you do not wish measurement data to be recorded. If you delete all the cookies in your browser, you will need to re-set the relevant opt-out cookie.

17. Use of Facebook retargeting

The present website uses the retargeting function offered by Facebook Ireland Limited. This function serves to show website visitors interest-based ads within the Facebook advertising network. In the browser of the website visitor, a so-called “cookie” is stored, which makes it possible to recognise the visitor when he calls up websites belonging to Facebook’s advertising network. These websites may present advertisements to the visitor that relate to content previously accessed by the visitor on websites that use Facebook’s retargeting function.
Facebook says it does not collect any personal data during this process. If you do not, however, desire the use of Facebook’s retargeting function, you can deactivate it by means of the appropriate settings under http://www.facebook.com/settings/?tab=ads .

18. Third party content and services for the use of YouTube

Our website also comprises content and services of third parties, e.g. videos from YouTube or maps from Google Maps. When you access these contents/services via our website, your IP address is as a rule transmitted to the respective third party provider. This makes it possible for these third parties to use your user IP address. Although we endeavour to involve only those third party providers which use IP addresses solely for the delivery of the content, we have no influence on how the respective third party provider uses the data received. For further information, please therefore contact the third party provider in question.

19. Your rights as a data subject

When your personal data is processed, you are a data subject as defined by the GDPR and you have the following rights vis-à-vis us as data controller:

1. a) Right of confirmation and access, art. 15 GDPR

You have the right to obtain confirmation from us at any time as to whether any personal data concerning you is processed by us. Where that is the case, you have the right to access to the data and the following information:

• the categories of personal data processed;
• the recipients or categories of recipient to whom the personal data about you have been or will be disclosed;
• the envisaged period for which the personal data about you will be stored, or, if concrete details are not possible, the criteria used to determine that period;
• the existence of the right to request rectification or erasure of personal data or restriction of processing of personal data concerning you by the controller or to object to such processing;
• the existence of the right to lodge a complaint with a supervisory authority;
• where the personal data is not collected from the data subject, any available information as to its source;
• the existence of automated decision-making, including profiling, pursuant to art. 22 paras. 1 and 4 GDPR and – at least in those cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Furthermore, you have the right to be informed whether personal data is transferred to a country which is not a member state of the EU (so-called third country) or to an international organisation. In this connection, you can demand to be informed of the appropriate safeguards pursuant to art. 46 GDPR relating to the transfer.

1. b) Right to rectification, art. 16 GDPR

You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Furthermore, you have the right – taking into account the purposes of the processing – to have incomplete personal data completed, including by means of providing a supplementary statement.

1. c) Right to erasure (“right to be forgotten), art. 17 GDPR

You have the right to demand the erasure of personal data concerning you without delay where one of the following grounds applies:

• the personal data concerning you is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
• you withdraw consent on which the processing is based according to art. 6 para. 1 lit. a or art. 9 para. 2 lit. a GDPR and where there is no other legal ground for the processing;
• you object to the processing pursuant to art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to art. 21 para. 2 GDPR;
• the personal data concerning you was unlawfully processed;
• your personal data has to be erased for compliance with a legal obligation according to Union or EU Member State law, to which the controller is subject;
• our personal data has been collected in relation to the offer of information society services according to art. 8 para. 1 GDPR.

Where Timberland Securities Investment plc has made the personal data public and is obliged pursuant to the above provisions to erase the personal data, then we are also obliged to inform other controllers, who process the data, that you as data subject have requested the erasure of any links to, or copy or replication of, those personal data.

In this regard, taking into account the available technology and the implementation costs, we take appropriate measures, including technical measures, to comply with these obligations, at least to the extent that processing is no longer necessary, i.e. that no legal provisions prescribe this and that no legitimate interests prevent deletion.

1. d) Right to restriction of processing, art. 18 GDPR

You have the right to demand that we restrict the processing of your personal data where at least one of the following applies:

• you contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data;
• the processing is unlawful and the you request, instead of erasure of the personal data, the restriction of their use;
• we no longer need the personal data for the purposes of the processing, but you need it for the enforcement of, exercise of or defence against legal claims.
• you have objected to processing pursuant to art. 21 para. 1 GDPR pending the verification whether the legitimate grounds of Timberland Securities Investment plc override your grounds.

Where processing of your personal data has been restricted, such personal data shall – with the exception of storage – only be processed with your consent or for the enforcement of, exercise of or defence against legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. In such a case you shall be informed by us before the restriction is lifted.

1. e) Notification obligation

If you have asserted your right to rectification or erasure of personal data or restriction of processing, we shall be obliged to notify each recipient to whom your personal data has been disclosed of such rectification or erasure of personal data or restriction of processing, unless this proves impossible or involves disproportionate effort. You can therefore demand that we inform you about those recipients.

1. f) Right to data portability

You have the right to receive your personal data, which you have supplied to us, in a structured, commonly used and machine-readable format. Furthermore, you have the right to transmit this data to another controller without hindrance from the controller to which the personal data has been provided, where the processing is based on consent pursuant to art. 6 para. 1 lit. a GDPR or art. 9 para. 2 lit. a GDPR or on a contract pursuant to art. 6 para. 1 lit. b GDPR and the processing is carried out by automated means, as long as the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Moreover, when exercising your right to data portability according to art. 20 para. 1 GDPR you can demand that the personal data be transferred directly from one controller to another controller to the extent that this is technically feasible and that no rights and freedoms of others are adversely affected by this.

1. g) Right to withdraw data processing consent, art. 7 para. 3 GDPR

If you have given your consent to data processing, you have the right to withdraw this consent at any time with effect for the future. This also applies to any withdrawal of declarations of consent given to us prior to the validity of the General Data Protection Regulation, i.e. before 25 May 2018. Please note that the revocation will only be effective for the future. Processing which took place prior to the revocation shall not be affected by this.

Should you wish to exercise your right of withdrawal, please send an email to this effect addressed to datenschutzbeauftragter@timberland-finance.com or a letter to the business address Timberland Securities Investment plc, Aragon House Business Centre, Dragonara Road, St. Julian’s, STJ 3140, Malta

1. h) Automated decisions in isolated cases including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless the decision

is necessary for entering into, or performance of, a contract between you and Timberland Securities Investment plc

or

is permissible under Union or Member State law to which the controller is subject and such legislation lays down suitable measures to safeguard the rights and freedoms and legitimate interests of the data subject

or

is based on the data subject’s explicit consent.

However, these decisions must not be based on special categories of personal data pursuant to art. 9 para. 1 GDPR, unless art. 9 para. 2 lit. a or g GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.

If the decision is necessary for entering into or fulfilling a contract between the data subject and the data controller or is taken with the explicit consent of the data subject, Timberland Securities Investment plc shall implement suitable measures to safeguard the rights, freedoms and legitimate interests of the data subject, at least the right to obtain human intervention on the part of the data controller, to express their own point of view and to contest the decision.

1. i) Right to lodge a complaint with a supervisory authority, art. 77 GDPR

Without prejudice to any rights you may have against us, you also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR. The supervisory authority with which the complaint is lodged will inform you on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to art. 78 GDPR.

20. Right to object, art. 21 GDPR

**You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data which is based on art. 6 para. 1 lit. e or f GDPR. This also includes profiling based on those provisions.

Timberland Securities Investment plc shall no longer process the personal data in the event of objection unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where your personal data is processed for direct marketing purposes, you shall have the right to object at any time to the processing of your personal data for such marketing; this also includes profiling, to the extent that it is related to such direct marketing.

Where you object to processing for direct marketing purposes, the personal data concerning you shall no longer be processed for such purposes.

You have the possibility, in the context of the use of information society services – notwithstanding Directive 2002/58/EC – to exercise your right to object by automated means using technical specifications.

Should you wish to exercise your right of objection, please send it to:
Timberland Securities Investment plc
Address: 171, Old Bakery Street, Valletta VLT 1455, Malta
Phone: +356-20908145
Fax:      +356-20908150
Email.: dataprotection@timberland-investment.com

21. Regular updates of this data protection information

These data protection regulations are subject to regular amendments and adjustments.

Such amendments make it necessary to update our data protection information from time to time.

You can recognise the current version by the note “As of…” at the end of this data protection information.

As of 25.5.2018