8. Rights of data subjects
According to Art. 15 in conjunction with Art. 34 Federal Data Protection Act (BDSG), you have the unrestricted right to free information about your data stored by us and according to Art. 35 Federal Data Protection Act (BDSG) the right to erasure or blockage of prohibited data or the right to rectification of incorrect data.
Upon request, we are pleased to inform you in writing whether and which personal data we have stored about you. Wherever possible, we will take appropriate measures on short notice to update or correct your data stored by us. All information requests, queries or objections to data processing should please be directed by e-mail directly to our data protection officer, stating your complete mailing address.
If your personal data are processed, you are the data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:
Right to information:
You can request confirmation from the controller as to whether personal data relating to you will be processed by us.
In the event of such processing, you may request the following information from the data controller:
• the purposes for which the personal data are processed;
• the categories of personal data processed;
• the recipients or categories of recipients to whom your personal data have been or will be disclosed;
• the planned duration of the storage of the personal data concerning you, or if it is not possible to provide specific information in this regard, criteria for determining the duration of the storage;
• the existence of the right to request from the controller the rectification or erasure of your personal data, a right to restriction of processing by the controller or a right to object to this processing;
• the existing of the right to lodge a complaint with a supervisory authority;
• all available information on concerning the origin of the data, if the personal data are not collected from the data subject;
• the existence of automated decision-making, including profiling, referred to in Art. 22 Section 1 and 4 GDPR and – at least in these cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
• You have the right to request information as to whether the personal data concerning you will be transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate guarantees pursuant to Art. 46 GDPR in connection with the transfer.
Right to rectification:
You have the right to rectification and/or completion by the data controller if the personal data processed and relating to you are inaccurate or incomplete. The controller is to carry out the correction immediately.
Right to restriction of processing:
Under the following conditions, you may request that the processing of your personal data be restricted:
• if you dispute the accuracy of the personal data relating to you for a period of time allowing the controller to verify the accuracy of the personal data;
• the processing is unlawful and you oppose the erasure of the personal data and instead request the restriction of their use;
• the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the asserting, exercising or defending against legal claims, or
• if the you have objected to processing according to Art. 21 Section 1 GDPR and it has not yet been determined whether the legitimate grounds of the controller override yours.
Where processing has been restricted, these data – with the exception of storage – are only allowed to be processed with your consent or for the assertion, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of vital public interest of the EU or of a Member State.
Where the restriction limits the processing according to the above-mentioned pre-requisites, you will be notified by the controller before the restriction of processing is lifted.
Right to erasure:
You may request from the controller the immediate erasure of personal data concerning you, and the controller is obliged to erase these data immediately, to the extent one of the following reasons applies:
• Your personal data are no longer necessary in terms of the purposes for which they were collected or otherwise processed;
• You withdraw your consent on which processing is based according to Art. 6 Section 1 lit. a or Art. 9 Section 2 lit. a GDPR, and where there is no other legal ground for the processing.
• You object to the processing pursuant to Art. 21 Section 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to processing according to Art. 21 Section 2 GDPR.
• The personal data concerning you have been unlawfully processed.
• The erasure of the personal data on you is required for compliance with a legal obligation according to EU law or the laws of Member States to which the controller is subject.
• The personal data relating to you have been collected in relation to the offer of information society services referred to in Art.8 Section 1 GDPR.
If the controller has made public the personal data concerning you and if he is obliged to erase it according to Art. 17 Section 1 GDPR, taking into account the available technology and the cost of implementation, including technical measures, the controller shall take reasonable steps to inform controllers processing the personal data that you as a data subject have requested that they erase all links to, copies or replication of, these personal data.
The right to erasure does not exist to the extent processing is required:
• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation which requires processing by the EU or by Member States, to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• for reasons of public interest in the area of public health in accordance with Art. 9 Section 2 lit. h and i as well as Art. 9 Section 3 GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 Section 1 GDPR, to the extent that the right referred to under Section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
• for the establishment, exercise or defense of legal claims.
If you have exercised your right to rectification, erasure or restriction of processing vis-à-vis the controller, he is obliged to inform all persons to whom data concerning you has been disclosed of this rectification, erasure or restriction of processing, unless this proves impossible or involves disproportionate effort.
You have the right vis-à-vis the controller to be informed of such recipients.
You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, standard and machine-readable format. Furthermore, you have the right to transmit these data to another controller without hindrance by the controller to which the personal data have been provided, to the extent that
• the processing is based on a statement of consent according to Art. 6 Sect. 1 lit. a GDPR or Art. 9 Sect. 2 lit. a GDPR or on an agreement according to Art. 6 Section 1 lit. b GDPR and
• the processing is carried out with the help of automated procedures.
In exercising this right, you furthermore have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. Freedoms and rights of other persons are not allowed to be infringed by this.
The right to data portability shall not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Right to objection and revocation:
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you, which occurs based on Art. 6 Section 1 lit. e or f GDPR; this also includes profiling based on these provisions.
The controller shall no longer process the personal data relating to you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.
Where personal data concerning you are processed for direct marketing purposes, you have the right at any time to object to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Where you object to processing for direct marketing purposes, your personal data shall no longer be processed for such purposes.
You have the option within the context of the use of information society services – notwithstanding Directive 2002/58/EC – to exercise your right to object by automated means where technical specifications are used.
You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Right of objection and removal.
If you contact us by e-mail, you can object to the storage of your personal data at any time. In such a case, the conversation cannot be continued.
In this case, all personal data stored in the course of establishing contact will be deleted.
The collection of data for the provision of the website and the storage of data in log files is mandatory for the operation of the website. Consequently, as an exception, there is no possibility of objection in this respect.
Right to lodge a complaint with a supervisory authority:
Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you are of the view that the processing of personal data relating to you infringes the GDPR.
The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 GDPR.