Privacy Policy
Data protection declaration of Variatel GmbH for the use of websites
We warmly welcome you to the German website of Variatel GmbH (hereinafter “Variatel GmbH,” “Variatel,” or “we”). Our website is accessible at variatel.de (hereinafter “Website”).
The processing of your personal data on our websites is carried out in accordance with the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), and the Telemedia Act (TMG). In this privacy policy, we inform you in accordance with Article 13 GDPR about the collection of your personal data on our websites.
The terms used in this privacy policy have the meaning set out in Article 4 GDPR.
1) Name and contact details of the person responsible
- Variatel GmbH
- Gutenbergstrasse 118
- 70197 Stuttgart
- Germany
- 0180666555444
- Email: customer.service@variatel.de
- Website: variatel.de
2) Contact details of the data protection officer
- Variatel GmbH
- Gutenbergstrasse 118
- 70197 Stuttgart
- Germany
- Email: dpo@variatel.de
3) Purposes and legal bases for the processing of personal data
When you visit our website, Variatel collects, processes and uses your personal data for the following purposes:
a) Collection and processing of personal data when visiting the website
We only collect and process the information and personal data that your internet browser automatically transmits when you visit our website. This includes:
- Date and time of page access
- Browser type and browser settings
- Operating system used
- Last visited page
- Amount of data transferred and access status
- IP address
This information and personal data is required to correctly display and optimize the content of our website, to improve advertising, to ensure network and information security, and to protect the website from attacks, disruptions, and damage.
The collected data is statistically evaluated by Variatel to improve data protection and data security and to ensure an appropriate level of protection for the personal data we process. Personal data, in particular the user’s IP address, will be deleted no later than 14 days after collection, unless an attack or threat by the user has been detected.
The legal basis for the collection and processing of personal data when you visit our website, including your IP address, pursuant to Art. 6 (1) (f) GDPR, is our legitimate interest. We thereby pursue the goal of improving data protection and data security, ensuring an appropriate level of protection for personal data, safeguarding network and information security, and optimizing our website and protecting it from attacks, disruptions, and damage.
b) Registration on and orders, payments and contact via the website
If you wish to register on our website, place orders, make payments, or contact Variatel, you will be asked to provide personal information. The required information is provided via the appropriate form on the website for registration, ordering, payment, or contacting us. The personal information you provide will be collected and stored for the purpose of registration, ordering, payment processing, or processing your request.
The legal basis for the processing of this personal data pursuant to Art. 6 (1) (b) GDPR is the performance of a contract between Variatel and the data subject or the implementation of pre-contractual measures at the request of the data subject.
c) Registration of SIM cards
If you wish to register a Variatel SIM card via our website using an ID verification process, you must provide the customer data (name, address, date of birth) and identity document information required under Section 111 of the Telecommunications Act. You must also submit a copy of your identity document and complete the ID verification process, which involves transferring data to Variatel or a processor commissioned by Variatel for this purpose.
The legal basis for processing this personal data pursuant to Art. 6 (1) (b) and (c) GDPR is the performance of a contract between Variatel and the data subject or the implementation of pre-contractual measures at the request of the data subject. Furthermore, pursuant to Section 111 of the Telecommunications Act, there is a legal obligation to collect this data.
d) Direct advertising, product information and newsletters from Variatel
We offer you the opportunity to receive direct mail, product information, and newsletters from Variatel via email, SMS, messenger, and/or phone call. For this, we require your email address and/or mobile phone number.
Unless you have withdrawn your consent, we may use your email address and Variatel mobile phone number, which we received in connection with a telecommunications service contract, for direct advertising for similar goods or services from Variatel via email and/or SMS. The legal basis for this use pursuant to Art. 6 (1) (f) GDPR is our legitimate interest in advertising products and services to our customers. You have the right to object to this use at any time in accordance with Art. 21 GDPR. You can object to receiving direct advertising by contacting our customer service. You can reach our customer service at 0180666555444 (€0.20 connection charge for calls from all German networks). Only the connection costs according to the basic tariffs will apply.
In addition, we process your email address and mobile phone number for the purpose of sending direct mail, product information, and newsletters from Variatel via email and/or SMS, as well as for advertising calls from Variatel, provided you have given your consent. Your provided contact details may be stored and used for this purpose. You can revoke your consent at any time with future effect. You can revoke your consent in writing by mail to Variatel GmbH, c/o Variatel GmbH, Gutenbergstraße 118, 70197 Stuttgart.
The content of the consent form is:
“I agree that Variatel may inform me about Variatel products and services for advertising purposes and contact me for market research purposes, via electronic messages (eg, email, messenger, and SMS) and telephone. I also agree that Variatel may create a user profile in order to design and offer me needs-based Variatel products and services based on my inventory and traffic data. I may revoke this marketing consent, in whole or in part, at any time with future effect.”
You can revoke this marketing consent at any time. You can find out how we process your personal data and how you can revoke your consent in our privacy policy.
You can find out how your personal data is processed and how you can revoke your consent in our privacy policy [ https://variatel.de/datenschutz/ ].
The legal basis for the processing of this personal data is your consent, Art. 6 (1) (a) GDPR.
e) Advertising from Variatel’s cooperation partners
At your request, we will transmit your personal data (name, address, email address, and mobile phone number) for the purpose of sending advertising and product information from Variatel’s trusted cooperation partners via email, SMS, and/or messenger, provided you have given your consent. Variatel may store, use, and transmit the data you provide—name, address, email address, and Variatel mobile phone number—to cooperation partners. These cooperation partners may use this data to send you advertising and product information. Your consent will be logged, and you have the right to access the content of your consent and this notice at any time. You can revoke your consent at any time with future effect. You can revoke your consent in writing by post to Variatel GmbH, c/o Variatel GmbH, Gutenbergstraße 118, 70197 Stuttgart. You also have the option of unsubscribing from email advertising and the email newsletter by clicking on the unsubscribe link at the end of the email.
The content of the consent form is:
“I agree that Variatel’s trusted partners may contact me about their products and services for advertising and market research purposes, via electronic messages (eg, email, messenger, and SMS) and telephone.”
Further information on the processing of your personal data and on the withdrawal of consent can be found in Variatel’s privacy policy on the website [ https://variatel.de/datenschutz/ ].
The legal basis for the processing of this personal data is your voluntary consent in accordance with Art. 6 (1) (a) GDPR.
f) Use of cookies
Cookies are used when you use the website. Cookies are designed to personalize the website for your visit and make it easier to use. Cookies are small text files that are transferred from the website to the cookie folder of the internet browser on your device. They are stored there for later retrieval so that the website can, among other things, remember your preferences. A cookie typically contains the name of the domain from which it originated, the lifespan of the cookie, and a unique identifier. The following types of cookies are used on the Variatel website:
Session cookies: These are temporary cookies that remain in your browser’s cookie file until you leave the website. They are primarily required to enable you to use the website, place orders, and register your SIM card. Session cookies are deleted when you end your browser session. The legal basis for the processing of personal data by session cookies is Art. 6 (1) (b) GDPR, as processing is necessary to fulfill a contract between Variatel and the data subject or to take steps at the request of the data subject prior to entering into a contract.
Persistent cookies: Persistent cookies are stored in your browser’s cookie file for an extended period of time. The exact lifespan of a specific cookie may vary and depends on the cookie settings or until manually deleted.
Variatel’s persistent cookies are used to remember your choices and preferences. Examples include your registration data, the language you select, or your regional settings. This information is processed in accordance with Art. 6 (1) (b) GDPR, as it is necessary to fulfill a contract between Variatel and you as the data subject or to implement pre-contractual measures taken at your request. This enables Variatel to provide you with certain website functions.
In addition, persistent cookies are used by third parties, as further described above. These cookies are used to show you relevant and interesting ads. They are also used to determine the frequency of ad serving and to evaluate the effectiveness of advertising campaigns. Such persistent cookies are typically used by advertising networks unless you have opted out of the use of cookies. These cookies store information about your website visits and then share it with other companies within the advertising network, such as advertisers.
It’s important to note that you can refuse or object to the use of third-party cookies by selecting the appropriate settings on your internet browser or by using the respective third-party provider’s opt-out procedure. This may result in you seeing less personalized advertising.
Web beacons, also known as “clear GIFs” or “web bugs,” are electronic identifiers that allow us to count the number of users who have visited the website. The use of web beacons is based on Variatel’s legitimate interests in accordance with Art. 6 (1) (f) GDPR. Variatel’s legitimate interests in using web beacons lie in market research and analysis to optimize the user-friendliness of Variatel’s website.
The use of web beacons allows us to collect statistical data about website usage, such as the number of visitors or the frequency of certain actions on the website. This information is used to understand user behavior and to adapt and improve the website accordingly.
It’s important to note that web beacons are typically used in conjunction with cookies. They are used to collect information about user behavior on the website. The legal basis for the use of cookies has already been explained above.
If you have concerns about the use of web beacons, you can take steps to limit or block their use, such as disabling cookies in your internet browser or using browser extensions that block web beacons. Please note, however, that doing so may impact the functionality and user experience of the website.
If you do not wish to accept cookies or web beacons on the Variatel website, you can adjust the settings in your internet browser accordingly. The exact steps may vary depending on your browser, but are generally found in the browser’s privacy or cookie settings. These settings allow you to refuse or delete cookies.
To disable or delete cookies and for further instructions on managing and deleting cookies for common browsers, you can visit the website www.meine-cookies.org, for example. There you will find detailed instructions for various browsers.
However, it is important to note that blocking or deleting cookies and/or web beacons may affect the full functionality and certain interactive features of the website. You may not be able to use certain features or view all of the website content if cookies and/or web beacons are blocked or deleted.
When setting your privacy settings, please consider both your personal preferences and the impact on your website experience.
g) Use of Google Analytics
In accordance with Variatel’s privacy policy, the website uses Google Analytics, a web analytics service provided by Google. Google Analytics uses cookies that are stored on the user’s computer to enable analysis of website usage. The information generated by the cookies about the user’s use of the website is usually transferred to a Google server in the USA and stored there. However, please note that the IP addresses of users on the Variatel website are shortened before being transmitted to Google within the member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there.
It is possible to object to the use of Google Analytics and to prevent the storage of cookies by selecting the appropriate settings in your browser. Furthermore, users can prevent the collection of data generated by the cookie and related to their use of the website, including their IP address, as well as the processing of this data by Google by downloading and installing the Google Analytics JavaScript opt-out browser add-on.
Further information about Google Analytics and Google’s applicable privacy policy can be found under the links provided. The legal basis for the use of Google Analytics on Variatel’s website is Art. 6 (1) (f) GDPR, as the use of Google Analytics is necessary to protect Variatel’s legitimate interests. By using Google Analytics, Variatel pursues the legitimate interest of improving the website and its offerings and making them more interesting for users.
h) Collection and processing of personal data of children
According to Variatel’s privacy policy, no personal data is knowingly collected or processed from children under the age of 14. Variatel’s website is not directed to children under the age of 16. However, it is possible that personal data from children may be inadvertently collected and processed. In such a case, Variatel will ensure that the processing and the data are appropriate for the age of the child concerned.
Variatel attaches great importance to protecting children’s privacy and takes legal provisions regarding the protection of children’s personal data very seriously. Should parents or guardians have concerns about the collection and processing of their child’s personal data, they should contact Variatel for further information and appropriate action.
4) Recipients of personal data/ transfer to a third country
According to Variatel’s privacy policy, personal data will be shared with specific recipients and processors. These include, among others:
a) Variatel GmbH: Variatel GmbH, based in Stuttgart, provides customer service to customers in Germany as a data processor.
b) Processors for identification procedures and verification of customer data: To carry out the identification process in accordance with the requirements of the Federal Network Agency, Variatel engages various processors. These processors collect customer data and perform identity verifications as part of the identification process on Variatel’s behalf. In addition, other processors are commissioned to verify the collected customer data, including the copy of the identity document, on Variatel’s behalf.
Variatel may have additional recipients and processors not explicitly mentioned in this privacy policy. In any case, Variatel ensures that the transfer of personal data to recipients or processors is carried out in compliance with applicable data protection regulations and that appropriate measures are taken to ensure the security and confidentiality of the data.
Please note that in some cases, personal data may be transferred to third countries outside the European Union. In such cases, Variatel ensures that the transfer is carried out in accordance with applicable data protection laws and that appropriate safeguards are in place to ensure an adequate level of data protection.
c) Payment service providers: When you purchase credit top-ups, extra call minutes or extra data volume via the Variatel website or the MyVariatel app, payment is processed via payment service providers such as PayPal and Adyen BV. If you use PayPal to pay, the payment is made to Variatel’s PayPal account in the UK.
d) Credit card companies and banks: If you pay invoices for fixed-term contracts, SIM cards, credit top-ups, packages, extra call minutes or extra data volumes with a credit card or give Variatel a direct debit mandate, the data required for credit card billing or direct debit collection will be transmitted to the credit card company and the banks, including the customer’s bank and Variatel’s bank.
e) Credit agencies: If you grant Variatel a direct debit mandate, Variatel will transmit personal data such as your name, address, date of birth and IBAN to credit agencies in order to carry out a credit check.
f) Debt collection agencies: If you have outstanding payments to Variatel, personal data such as your name, address, date of birth and outstanding claims against you by Variatel will be transmitted to debt collection agencies in order to carry out out-of-court and court-ordered collection proceedings.
g) Sales partners: Variatel’s sales partners in Germany have access to your existing data and your call revenue in order to answer your questions and recommend tariff optimizations as well as suitable Variatel products and services.
The transfer of personal data to these recipients is carried out in accordance with applicable data protection regulations and is intended to enable payment processing, credit checks, dunning procedures, and customer service. Variatel ensures that appropriate measures are taken to ensure the security and confidentiality of the transmitted data.
h) providers of telecommunications services and value-added services
We share your customer data and traffic data with other providers of telecommunications and value-added services, even if they are located outside the European Union. This includes, for example, foreign network operators you use when roaming or making international calls, to the extent necessary to provide telecommunications services, value-added services, billing, or fraud prevention.
i) Called subscribers
Where permitted and technically feasible, we will display your phone number to the called party. You can request that the network block the identification of your mobile phone connection for the purpose of using and billing for additional services besides the call, free of charge.
j) Federal Network Agency and security, law enforcement and constitutional protection authorities
Pursuant to Sections 112 and 113 of the Telecommunications Act, the Federal Network Agency (Bundesnetzagentur) as well as security, law enforcement, and constitutional protection authorities have access to your customer data and the data from your identity document, which we have collected and stored in accordance with Section 111 of the Telecommunications Act. We are obligated to transmit this data to these authorities.
k) Transfer to a third country
Your personal data will not be transferred to a third country or international organization beyond what is described in points 3 and 4. If personal data is transferred to Variatel in the UK, please note that transfers of personal data from the EU to the UK are not currently considered transfers to a third country under Article 44 of the GDPR.
5) Storage period of personal data
Variatel will only store your personal data for as long as necessary for the purposes for which it was collected or processed. Unless there are legal requirements or retention periods due to impending or ongoing legal disputes that require longer storage.
The copy of your identity document, which is sent to Variatel as part of the video identification process, will be destroyed immediately after the information required for the conclusion of the contract has been verified.
6) Your rights as a data subject
You have the following rights:
Right to information about the personal data concerned (Article 15 GDPR)
Right to rectification (Article 16 GDPR)
Right to erasure (Article 17 GDPR)
Right to restriction of processing (Article 18 GDPR)
Right to object to processing pursuant to Art. 21 GDPR, provided that the data processing is carried out on the basis of Art. 6 (1) (e) or (f) GDPR; see also the note on the right to object pursuant to Art. 21 GDPR at the end
Right to data portability (Article 20 GDPR)
Right to withdraw consent at any time without affecting the legality of processing carried out before the withdrawal, provided that the data processing is based on consent pursuant to Art. 6 (1) (a) or Art. 9 (2) (a) GDPR
Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR
7) Obligation to provide personal data and possible risk in case of non-provision
To conclude a contract for telecommunications services with Variatel, you are required to provide personal data, including customer details pursuant to Section 111 of the Telecommunications Act, as well as details and a copy of your identity document for prepaid services. If you do not provide this data, no contract can be concluded with you or certain payment methods cannot be offered to you. Furthermore, the provision of personal data is required to use the website. If you do not provide this data, the websites may not be usable at all or may only be usable with limited functionality.
8) Changes to this privacy policy
From time to time, it may be necessary to adapt and amend the content of this Privacy Policy. Variatel therefore reserves the right to amend this Privacy Policy and will post the amended Privacy Policy on the website and inform the data subjects in advance of the amended Privacy Policy if Variatel intends to further process the personal data for a different purpose.
Note on the right of objection according to Article 21 of the General Data Protection Regulation (GDPR):
Right of objection due to the special situation:
You have the right to object at any time to the processing of your personal data based on Article 6(1)(e) (public security) or (f) (balance of interests) of the GDPR, for reasons related to your particular situation. This also applies to so-called profiling based on these commissions. Variatel will no longer process your personal data unless there are compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.
Right to object to direct marketing:
If we use your personal data for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes. This also applies to profiling associated with such direct marketing. If you object to the processing of your personal data for direct marketing purposes, your data will no longer be processed for these purposes.
Exercising the right of objection:
You can exercise your right of objection informally, for example by post to Variatel GmbH, Gutenbergstraße 118, 70197 Stuttgart or by email to customer.service@variatel.de.
As of: 01.07.2023