Data privacy Information

Information on data processing for the use of the websites www.assc-ship.com and www.assc-group.com, our LinkedIn company profile, and for the processing of customer and prospective customer data.

1. Controller

The controller within the meaning of Art. 4 No. 7 GDPR is:

The Asian Spirit Steamship Company GmbH & Cie. KG
Alsterufer 26
20354 Hamburg
Germany
Tel.: +49 (40) 808 172 300
E-Mail: contact@assc-group.com

We have appointed a Data Protection Officer. You can contact her by e-mail at kerstin.schaefer@kaschae.de or by mail:

Kerstin Ann-Susann Schäfer, PhD (UCT)
Kaschae Datenschutz & Compliance GmbH
An der Alster 62
20099 Hamburg
Germany

2. Subject of data protection and protection of terminal equipment

The subject of data protection is personal data. Pursuant to Art. 4 No. 1 GDPR, personal data means any information relating to an identified or identifiable natural person. This includes, for example, information such as name, postal address, e-mail address, telephone number, IP address and usage data generated when visiting our website or social media profile.

In addition, the use of cookies and comparable technologies may involve the storage of information on your terminal equipment or access to information already stored on your terminal equipment. This is governed by the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG), in particular Section 25 TDDDG. Further information can be found in Section 7.

3. Scope and purpose of data processing

In the following, we explain which personal data we process when you use our website, contact us as a customer or prospective customer, or visit our social media profile, particularly our LinkedIn company profile. We also explain the purposes and legal bases of the respective processing activities.

In addition, we provide information on the use of cookies and comparable technologies on our website, including the storage of information on your terminal equipment or access to information already stored on your terminal equipment within the meaning of Section 25 TDDDG.

4. Data processing when using our website

4.1 Access data and server log files

You can generally use our website without actively providing personal data. However, when you access our website, technical access data are automatically transmitted to our web server. This is necessary to display the website, ensure its technical stability and security, and prevent misuse.

The following data and information may be processed in server log files:

– IP address of the accessing device
– date and time of the request
– time zone difference to Greenwich Mean Time (GMT)
– content of the request, in particular the specific page accessed
– access status / HTTP status code
– amount of data transmitted
– website from which the request originates
– browser type and browser version
– operating system
– host name of the accessing device, where applicable

The processing of this data is necessary to display the website and to ensure the security and stability of our IT systems. The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the secure, stable and functional provision of our website.

Insofar as the processing is necessary to provide information requested by you via the website, the legal basis may also be Art. 6 para. 1 lit. b GDPR.

The websites are hosted by a hosting service provider acting on our behalf. Further information on recipients, hosting and service providers can be found in Section 5.

4.2 Storage period for server log files

In the event of incorrect page views, the data are stored in error files and deleted after seven days.

In all other cases, the IP address is anonymized in the log files. For this purpose, the last part of the IP address is removed, for example 127.0.0.1 becomes 127.0.0.*. IPv6 addresses are also anonymized. It is therefore no longer possible to assign the log data to the accessing device. The anonymized log data is deleted after 60 days.

5. Hosting, recipients and service providers

Our websites are hosted by Mittwald CM Service GmbH & Co. KG as our hosting service provider. In this context, Mittwald may process access data and server log files on our behalf to the extent necessary for the provision, operation and maintenance of the websites.

We have concluded a data processing agreement with Mittwald pursuant to Art. 28 GDPR. The hosting takes place on servers located in Germany / within the European Union. No transfer of websites access data to a third country takes place in connection with the hosting, unless expressly stated otherwise in this privacy information.

In addition, IT service providers may receive personal data where this is necessary for the provision, operation, maintenance or security of our IT systems and communication channels. Where such service providers process personal data on our behalf, we have concluded data processing agreements with them pursuant to Art. 28 GDPR.

6. Contact by e-mail

If you contact us by e-mail as a customer, prospective customer or other business contact, we process the personal data transmitted by you. This may include in particular:

– e-mail address
– first name and surname
– telephone number, if provided
– company name, if provided
– content of your request
– any other personal data you provide in your message

We process these data for the purpose of handling your request and communicating with you.

If your request relates to the initiation, performance or execution of a contract, the legal basis is Art. 6 para. 1 lit. b GDPR. In all other cases, the legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in receiving, responding to and properly processing your request or other communication.

We store the data processed in connection with your request for as long as this is necessary to handle your request and any subsequent communication. Where the communication relates to a contractual or business relationship, statutory retention obligations may apply, in particular under commercial and tax law. In such cases, the data may be stored for up to ten years and will be deleted after expiry of the applicable retention periods.

7. Cookies and comparable technologies / TDDDG

Our websites do not use cookies.

Comparable technologies or external services may be used where external services are integrated or where a connection to a third-party provider is established. Comparable technologies may involve the storage of information on your device or access to information already stored on your device.

The use of cookies and comparable technologies is governed by the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG), in particular Section 25 TDDDG.

Where information is stored on your device or information stored on your device is accessed and this is strictly necessary to provide our websites or a function expressly requested by you, this is carried out based on Section 25 para. 2 TDDDG. Consent is not required in these cases.

Where information is stored on your device or information stored on your device is accessed and this is not strictly necessary, we obtain your prior consent where required. In such cases, the legal basis for storing information on your device or accessing information stored on your device is Section 25 para. 1 TDDDG. The subsequent processing of personal data is carried out, depending on the purpose of the processing, based on your consent pursuant to Art. 6 para. 1 lit. a GDPR or another legal basis specified in this privacy information.

Further information on Google Maps and MyFonts / Monotype can be found in Sections 9 and 10.

8. Links to external websites and services

Our websites contain links to external websites and services, including a link to Google Maps and a link to our LinkedIn company profile. These are mere links. When you visit our websites, no connection to Google Maps or LinkedIn is established solely by displaying such links.

Only if you click on such a link will you be redirected to the respective external website or service. From that moment on, the privacy policies and terms of use of the respective provider apply. We have no influence on the data processing carried out by the respective provider after you have accessed the external website or service.

If you click on the link to Google Maps, you will be redirected to the Google Maps service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Further information on data processing by Google can be found in Google’s privacy policy: https://policies.google.com/privacy.

If you click on the link to our LinkedIn company profile, you will be redirected to LinkedIn. Further information on data processing by LinkedIn can be found in LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy.

9. Google Maps

On the website www.assc-group.com, we use Google Maps to display our location and make it easier for you to find us. Google Maps is a map service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Maps may also involve processing by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Maps is integrated by means of a two-click solution and is not loaded automatically when you access our website. Before you activate the map, no connection to Google Maps is established through the map’s integration.

Only if you actively activate the map will your browser establish a connection to Google servers. In this context, personal data, in particular your IP address as well as information about your device, browser, the page accessed and the date and time of access, may be transmitted to Google. Google may also process such data for its own purposes in accordance with Google’s privacy policy.

The activation of Google Maps and any storage of information on your terminal equipment or access to information already stored on your terminal equipment are carried out based on your consent pursuant to Section 25 para. 1 TDDDG. The subsequent processing of personal data is carried out based on your consent pursuant to Art. 6 para. 1 lit. a GDPR.

You may withdraw your consent at any time with effect for the future. Further information on data processing by Google can be found in Google’s privacy policy: https://policies.google.com/privacy.

10. MyFonts / Monotype web fonts

On the website www.assc-ship.com, we use fonts from MyFonts / Monotype. The fonts are integrated locally. In addition, a MyFonts / Monotype counter is used which establishes a connection to MyFonts / Monotype in order to track the use of the font.

The provider of MyFonts is Monotype Imaging Inc. or an affiliated Monotype company. When the web font counter is loaded, a connection to MyFonts / Monotype servers is established. In this context, personal data, in particular your IP address and technical information about the access, may be transmitted to MyFonts / Monotype. According to MyFonts, where its web font tracking code is deployed, the IP address of each visitor to the website is transferred in order to count page views for licensees and to prevent illicit use of the web font software.

The purpose of this processing is the uniform display of fonts, license management and the prevention of unauthorized use of web fonts. The legal basis for the processing of personal data is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the uniform and visually appealing display of our website and in complying with license requirements for the web fonts used.

According to the technical information available to us, the MyFonts / Monotype counter does not set cookies and does not store information in the memory of the user’s device.

Further information on data processing in connection with MyFonts / Monotype web font tracking can be found in MyFonts’ privacy policy: https://www.myfonts.com/a/font/legal/website-use-privacy-policy.

11. LinkedIn company profile

We maintain a company profile on LinkedIn:

https://www.linkedin.com/company/the-asian-spirit-steamship-company-gmbh-cie-kg/

You can access our LinkedIn company profile via a link on our websites or directly via LinkedIn. The LinkedIn service is provided in the European Economic Area and Switzerland by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

If you visit our LinkedIn company profile, LinkedIn processes personal data in accordance with LinkedIn’s own privacy policy. This may include information about your use of LinkedIn, your interactions with our company profile, your profile information, your IP address, device and browser information, and information collected by LinkedIn through cookies or comparable technologies. We have no influence on the scope and means of LinkedIn’s own data processing.

We process personal data when you interact with our LinkedIn company profile, for example when you follow our profile, like, comment on or share posts, send us messages, or otherwise communicate with us via LinkedIn. In such cases, we may process your profile name, the content of your interaction or message, and any other information you provide to us via LinkedIn.

The purpose of this process is to present our company, communicate with customers, business partners and interested parties, and respond to enquiries. The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in public relations, external communication and maintaining business contacts. If your communication with us relates to the initiation or performance of a contract, the legal basis is Art. 6 para. 1 lit. b GDPR.

LinkedIn may provide us with aggregated statistics and insights regarding the use of our LinkedIn company profile, such as information about visits, interactions and the reach of our posts. We receive these statistics only in aggregated form and generally cannot identify individual users from them. We use these insights to evaluate and improve our LinkedIn company profile and our communication.

In relation to the processing of personal data for the provision of page insights, LinkedIn and we are joint controllers within the meaning of Art. 26 GDPR. The essential information on this joint controllership is made available by LinkedIn in the LinkedIn Pages Joint Controller Addendum: https://legal.linkedin.com/pages-joint-controller-addendum. According to this arrangement, LinkedIn assumes primary responsibility for fulfilling the obligations under the GDPR with regard to the processing of data insights. Data subjects may nevertheless exercise their rights both against LinkedIn and against us.

Since LinkedIn has access to the relevant user and usage data, LinkedIn may be better able to fulfil requests relating to the processing of data on the LinkedIn platform.

Further information on data processing by LinkedIn, including information on cookies, advertising settings and data subject rights, can be found in LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy.

12. Rights of data subjects

As a data subject, you have the following rights against us as controller, provided that the respective legal requirements are met:

– right of access pursuant to Art. 15 GDPR
– right to rectification pursuant to Art. 16 GDPR
– right to erasure pursuant to Art. 17 GDPR
– right to restriction of processing pursuant to Art. 18 GDPR
– right to data portability pursuant to Art. 20 GDPR
– right to object pursuant to Art. 21 GDPR
– right to withdraw consent at any time with effect for the future pursuant to Art. 7 para. 3 GDPR
– right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR

If you have given consent to processing, you may withdraw this consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

If we process your personal data on the basis of legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR, you may object to such processing at any time on grounds relating to your particular situation pursuant to Art. 21 GDPR.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent supervisory authority for us is generally the Hamburg Commissioner for Data Protection and Freedom of Information.

If you have any questions regarding data protection, you may contact us at any time at contact@assc-group.com or contact our Data Protection Officer.

Status: July 2026