In the event that personal data from you are processed, you have the following rights in relation to us with respect to the personal data concerning you:
– Right to information, Sec. 15 German Data Protection Regulation (DSGVO):
You can demand confirmation from the responsible party as to whether personal data that concern you are being processed by them.
In the event that such processing occurs, you can demand the following information from the responsible party:
- The purposes for which the personal data are being processed;
- The categories of personal data that are being processed;
- The recipients and/or the categories of recipients to which the personal data concerning you were disclosed or will be disclosed, and that especially with recipients in third countries or in international organizations; in the latter cases, you can demand to be informed about the appropriate safeguards as per Sec. 46 German Data Protection Regulation (DSGVO) in connection with the transfer;
- The planned duration of the storage of the personal data concerning you, or, in the event that concrete details are not possible in this regard, criteria for defining the storage duration;
- The existence of a right to rectification or deletion of the personal data concerning you, a right to restriction on the processing by the responsible party or a right of objection to this processing;
- The existence of a right to complain before a supervisory authority;
- All available information about the origin of the data when the personal data was not collected from the person concerned;
- The existence of automated decision-making including profiling in accordance with Sec. 22 Paras. 1 and 4 German Data Protection Regulation (DSGVO) and – at least in these cases – meaningful information about the logic involved, as well as about the scope and the intended effects of such processing for the person concerned.
– Right to rectification, Sec. 16 German Data Protection Regulation (DSGVO):
You have a right to rectification and/or completion from the responsible party to the extent that the processed personal data concerning you are incorrect or incomplete. The responsible party has to undertake the rectification without undue delay.
– Right to deletion, Sec. 17 German Data Protection Regulation (DSGVO):
- a) Deletion obligation
You can demand from the responsible party that they delete the personal data concerning you without undue delay, and the responsible party is obligated to delete these data without undue delay, provided one of the following reasons apply:
- The personal data concerning you are no longer necessary for the purposes for which they were collected or processed in any other way.
- You revoke your consent that forms the basis for the processing as per. Sec. 6 Para. 1 Letter a or Sec. 9 Para. 2 Letter a German Data Protection Regulation (DSGVO) and there is a lack of a legal basis otherwise for the processing.
- You lodge an objection in accordance with Sec. 21 Para. 1 German Data Protection Regulation (DSGVO) to the processing and there are no overriding legitimate reasons for the processing, or you lodge an objection in accordance with Sec. 21 Para. 2 German Data Protection Regulation (DSGVO) to the processing.
- The personal data concerning you were processed unlawfully.
- The deletion of the personal data concerning you is required for the fulfilment of a legal obligation under European Union law or the law of the Member State to which the responsible party is subject.
- The personal data concerning you were collected in respect to information society services offered in accordance with Sec. 8 Para. 1 German Data Protection Regulation (DSGVO).
- b) Information to third parties
In the event that the responsible party publicly disclosed the personal data concerning you and they are obligated in accordance with Sec. 17 Para. 1 German Data Protection Regulation (DSGVO) to delete same, they are obliged to take appropriate measures, including those of a technical nature, while taking into account the available technology and the implementation costs, in order for the responsible party for the data processing, which processes the personal data, be informed that you as the person concerned demand from them the deletion of all links to this personal data or of copies or replications of this personal data.
- c) Exceptions
The right to deletion does not exist to the extent that the processing is required:
- To exercise the right to freedom of expression and to information;
- To fulfil a legal obligation required for the processing in accordance with European Union law or the law of the Member State to which the responsible party is subject, or to perform a task carried out in the public interest or which occurs in the exercising of official authority, which was transferred to the responsible party;
- For reasons of public interest in the public health area as per Sec. 9 Para. 2 Letters h and i as well as Sec. 9 Para. 3 German Data Protection Regulation (DSGVO);
- For archival purposes occurring in the public interest, as well as for scientific or historic research purposes or for statistical purposes as per Sec. 89 Para. 1 German Data Protection Regulation (DSGVO), provided that the right named under section a) will probably make the fulfilment of the aims of this processing impossible, or seriously impede same, or
- To assert, exercise or defend legal claims.
– Right to restriction of the processing, Sec. 18 German Data Protection Regulation (DSGVO):
You can demand the restriction of the processing of the personal data concerning you under the following conditions:
- When you dispute the correctness of the personal data concerning you for a period of time that permits the responsible party to review the correctness of the personal data;
- The processing is unlawful and you reject the deletion of the personal data and instead demand the restriction on the usage of the personal data;
- The responsible party no longer requires the personal data for processing purposes, but you do require them for asserting, exercising or defending legal claims, or
- When you have lodged an objection to the processing in accordance with Sec. 21 Para. 1 German Data Protection Regulation (DSGVO) and it has not yet been established whether the legitimate interests of the responsible party outweigh your reasons.
In the event that the processing of the personal data concerning you was restricted, these data may – apart from their storage – only be processed with your consent or to assert, exercise or defend legal claims or to protect the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.
In the event that you have effected a restriction of the processing in accordance with the aforementioned conditions, you are informed by the responsible party prior to the restriction being cancelled.
– Right to information, Sec. 19 German Data Protection Regulation (DSGVO):
If you have asserted your right vis-a-vis the responsible party to the rectification, deletion or restriction of the processing, said party is obligated to inform all recipients to which the personal data concerning you were disclosed about said rectification or deletion of the data or restriction on the processing, unless this proves to be impossible or causes disproportionate effort and outlays.
You have the right vis-a-vis the responsible party to be informed about these recipients.
– Right to data portability, Sec. 20 German Data Protection Regulation (DSGVO):
You have the right to receive all of the personal data concerning you that you have provided to the responsible party in a structured, conventional and machine-readable format. Furthermore, you have the right to transfer these data to another responsible party without being hindered by the responsible party that made the personal data available, provided:
- The processing is based on consent as per Sec. 6 Para. 1 Letter a German Data Protection Regulation (DSGVO) or Sec. 9 Para. 2 Letter a German Data Protection Regulation (DSGVO) or on a contract in accordance with Sec. 6 Para. 1 Letter b DSGVO and
- The processing occurs with the help of an automated procedure.
Moreover, in exercising this right, you have the right to effect that the personal data concerning you are transferred directly from one responsible party to another responsible party, provided this is technically feasible. The freedoms and rights of other persons may not be affected by same.
Your right to deletion remains unaffected.
The right to data portability is not applicable to the processing of personal data required to fulfil a task that is in the public interest or that occurs in the exercising of official authority which was transferred to the responsible party.
– Right to objection, Sec. 21 German Data Protection Regulation (DSGVO)
You have an individual case-related right to objection, as well as a right to objection to the processing of data for advertising purposes.
– Right to revoke the data protection law declaration of consent:
You can at all times revoke the consent issued for the processing of your personal data vis-a-vis the responsible party. Please note that the revocation is first valid and applicable for the future. The lawfulness of the processing that occurs due to the consent until the revocation of said consent remains unaffected.
– Automated decision in single cases, including profiling, Sec. 22 German Data Protection Regulation (DSGVO):
You have the right to not be subject to a decision based solely on automated processing – including profiling – which would cause a legal effect in relation to you or which would significantly impair you in a similar manner. This is not applicable when the decision:
- Is required for the conclusion or fulfilment of a contract between you and the responsible party,
- Is permissible under European Union legislation or that of the Member State to which the responsible party is subject and this legislation contains suitable measures to safeguard your rights and freedoms, as well as your legitimate interests, or
- Occurs with your express consent.
In the cases of (1) and (3), the responsible party is to take appropriate measures to safeguard your rights and freedoms, as well as your legitimate interests, whereby at least the right exists to obtain the intervention of a person on the part of the responsible party, to present one’s own position and to challenge the decision.
Furthermore, decisions taken solely on the basis of automated processing may not be based on special categories of personal data in accordance with Sec. 9 Para. 1 German Data Protection Regulation (DSGVO) provided Sec. 9 Para. 2 Letter a or g German Data Protection Regulation (DSGVO) do not apply and appropriate measures were taken to safeguard your rights and freedoms, as well as your legitimate interests.
– Right to complain before a supervisory authority, Sec. 77 German Data Protection Regulation (DSGVO):
In addition, you have the right to complain before a data protection supervisory authority about the processing of your personal data. You can direct your complaint to the supervisory authority in the Member State where you reside, where your place of work is or where the location of the alleged infringement is. The supervisory authority to which you submit the complaint informs you as the complainant about the status and the findings on the complaint, including the option to have a judicial review before the courts as per Sec. 78 German Data Protection Regulation (DSGVO). A list of the data protection officers, as well as their contact details are provided in the following link: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html
