Privacy

If personal data about you is processed, you are a data subject within the meaning of the GDPR and have the following rights vis-à-vis the controller:

1. Right of access

You can request confirmation from the controller as to whether personal data concerning you is being processed by us.
If such processing exists, you can request information from the controller on the following:

1. The purposes for which your personal data is processed;
2. The categories of personal data processed;
3. The recipients or categories of recipients to whom your personal data has been or will be disclosed;
4. The planned duration of storage of your personal data, or, if specific information is not possible, the criteria for determining the retention period;
5. The existence of a right to rectification or erasure of your personal data, a right to restriction of processing by the controller, or a right to object to such processing;
6. The existence of a right to lodge a complaint with a supervisory authority;
7. All available information on the source of the data if the personal data was not collected from the data subject;
8. The existence of automated decision-making, including profiling, according to Art. 22 para. 1 and 4 GDPR, and – at least in these cases – meaningful information about the logic involved as well as the scope and intended effects of such processing for the data subject.

You also have the right to request information on whether your personal data is transferred to a third country or to an international organization. In this context, you may request information on the appropriate safeguards according to Art. 46 GDPR in connection with the transfer.

2. Right to rectification

You have the right to have inaccurate personal data concerning you corrected or completed by the controller without undue delay.

3. Right to restriction of processing

You may request the restriction of processing of your personal data under the following conditions:

1. When you contest the accuracy of your personal data for a period that allows the controller to verify its accuracy;
2. When the processing is unlawful and you oppose the erasure of the personal data and instead request the restriction of their use;
3. When the controller no longer needs the personal data for the purposes of processing, but you require them for the establishment, exercise, or defense of legal claims;
4. When you have objected to the processing pursuant to Art. 21 para. 1 GDPR and it has not yet been determined whether the controller’s legitimate grounds override yours.

Once processing is restricted, the data may only be processed – aside from storage – with your consent, for the establishment, exercise, or defense of legal claims, to protect the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State. You will be informed by the controller before the restriction is lifted.

4. Right to erasure

a) Obligation to erase

You may request that the controller immediately erase personal data concerning you, and the controller is obliged to do so if one of the following grounds applies:

1. The personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
2. You withdraw your consent on which the processing is based (Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR) and there is no other legal basis for the processing;
3. You object to processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds, or you object pursuant to Art. 21 para. 2 GDPR;
4. The personal data have been unlawfully processed;
5. The erasure of personal data is necessary to fulfill a legal obligation under Union or Member State law;
6. The personal data have been collected in relation to information society services offered to a child (Art. 8 para. 1 GDPR).

b) Information to third parties

If the controller has made personal data public and is obliged to erase them, they shall take reasonable measures, considering technology and implementation costs, to inform other controllers processing the data about your request for erasure of all links, copies, or replications of your personal data.

c) Exceptions

The right to erasure does not apply to the extent that processing is necessary:

1. For exercising the right of freedom of expression and information;
2. For compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority;
3. For reasons of public interest in the area of public health (Art. 9 para. 2 lit. h and i, and Art. 9 para. 3 GDPR);
4. For archiving purposes in the public interest, scientific or historical research, or statistical purposes (Art. 89 para. 1 GDPR) insofar as this would likely make the achievement of the processing purposes impossible or seriously impair them;
5. For the establishment, exercise, or defense of legal claims.

5. Right to be informed

If you have exercised your rights to rectification, erasure, or restriction of processing, the controller is obliged to inform all recipients to whom your personal data has been disclosed, unless this proves impossible or involves disproportionate effort.

You have the right to be informed about these recipients.

6. Right to data portability

You have the right to receive personal data concerning you, which you have provided to the controller, in a structured, commonly used, and machine-readable format. You also have the right to transmit these data to another controller without hindrance, provided:

1. Processing is based on consent (Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR) or on a contract (Art. 6 para. 1 lit. b GDPR);
2. Processing is carried out by automated means.

You also have the right to request that the data be transmitted directly from one controller to another, where technically feasible. The rights and freedoms of others must not be affected. This right does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

7. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6 para. 1 lit. e or f GDPR, including profiling. The controller will no longer process your personal data unless they can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to establish, exercise, or defend legal claims.

If your personal data is processed for direct marketing purposes, you have the right to object at any time, including profiling related to such marketing. Upon objection, your personal data will no longer be processed for these purposes. You may exercise your objection in connection with information society services using automated means, regardless of Directive 2002/58/EC.

8. Right to withdraw consent

You have the right to withdraw your data protection consent at any time.
Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

9. Automated decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless:

1. The decision is necessary for entering into or performing a contract between you and the controller;
2. It is authorized by Union or Member State law and contains safeguards for your rights, freedoms, and legitimate interests;
3. It is based on your explicit consent.

Decisions must not be based on special categories of personal data unless Art. 9 para. 2 lit. a or g applies and appropriate safeguards are in place.

In cases (1) and (3), the controller ensures the protection of your rights and freedoms, including the right to obtain human intervention, to express your point of view, and to contest the decision.

⸻

Legal basis according to GDPR:

Access to stored data (Art. 15 GDPR)
Rectification of inaccurate data (Art. 16 GDPR)
Erasure of your data (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Right to object to processing (Art. 21 GDPR)