When we process your data, you are a “data subject” within the meaning of the GDPR. You have the following rights: right to access the stored personal data, right to rectification, right to restriction of the processing, right to erasure, right to be informed as well as right to data portability, in addition, you have a right to object and a right to withdraw consent.

Below You will find details about the individual rights:

a. Right to access the stored personal data

You have the right to demand from us confirmation whether we process your personal data.

If we process your personal data, You have the right to disclosure of the following information:

• the processing purposes;
• the categories of personal data being processed;
• the recipients or categories of recipients to whom your personal data have been or will be disclosed, in particular to recipients in third countries or to international organisations;
• if possible, the planned duration your personal data will be stored or, if this is not possible, the criteria for determining that duration;
• the existence of a right to rectification or erasure of personal data concerning You or to restriction of our processing or a right to object to such processing;
• the existence of a right to lodge a complaint with a supervisory authority;
• if the personal data has not been collected directly from You, all available information about the source of the data;
• the existence of an automated decision-making process including profiling under Art. 22 (1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved, as well as the implications and intended effects for You of such processing.

If we transfer your data to an international organisation or to a third country, You also have the right to demand information as to whether suitable guarantees exist in connection with the transfer under Art. 46 GDPR.

b. Right to rectification

You have the right to rectification and/or completion of the data we have stored about You if such data is incorrect or incomplete. We will initiate the correction or completion immediately.

 c. Right to restriction of processing

Under certain conditions, You have the right to demand that we restrict the processing of your personal data. At least one of the following conditions must be met:

• You contest the accuracy of your personal data for a period enabling us to verify the accuracy of your personal data,
• The processing is unlawful, and You refuse erasure of the personal data and instead require the restriction of the use of the personal data;
• We no longer need your personal data for processing purposes, but You need it to assert, exercise or defend your legal rights, or
• You have objected to the processing pursuant to Art. 21 (1) GDPR if it is not yet certain whether our legitimate reasons override your interests.

d. Right to erasure

You have the right to demand from us to immediately erase your personal data if we are required to do so. This is the case if one of the following conditions is met:

• Your personal information is no longer necessary for the purposes for which it was collected or otherwise processed.
• You withdraw your consent to the processing under Art. 6 (1) (a) or Art. 9 (2) (a) GDPR and there is no other legal basis for the processing.
• In accordance with Art. 21 (1) GDPR, You object to the processing and there are no legitimate reasons for the processing, or You object to the processing under Art. 21 (2) GDPR.
• Your personal data was processed unlawfully.
• The erasure of personal data is required to fulfil a legal obligation under legislation of the European Union or national law of member states to which we are subject to.
• Your personal data has been collected in relation to offered information society services under Art. 8 (1) GDPR.

 If we have made your personal information public and we are required to erase it in accordance with the above-mentioned conditions, we shall take appropriate measures, also of a technical nature, to inform, taking into account the technologies and implementation costs available to us, the other data controllers who process the personal data that You have demanded from us the erasure of any links to such personal data or of copies or duplications of such personal data.

However, your right to erasure does not exist if processing is required for the following reasons (exceptions):

• to exercise the right to freedom of expression and information;
• to fulfil a legal obligation required by the legislation of the European Union or of the member states to which we are subject to, or to perform a task taking place in the public interest or in the exercise of official authority which has been delegated to us;
• for reasons of public interest in the field of public health under Art. 9 (2) (h) and (i) and Art. 9 (3) GDPR;
• for archival purposes in the public interest, for scientific or historical research purposes or for statistical purposes under Art. 89 (1) GDPR, to the extent that the law referred to in (1) will probably render impossible or will seriously affect achieving the objectives of that processing, or
• to assert, exercise or defend legal rights.

e. Right to be informed

If You have asserted your right towards us to rectification, erasure, or restriction, we are required to notify all recipients to whom we have disclosed your personal data, about the rectification, erasure, or restriction of the processing of your data, except when it results to be impossible or involves a disproportionate effort thereto.

f. Right to data portability

Under the following condition You have the right to receive the personal data that You have provided to us, in a structured, common and machine-readable format and the right to have this data transmitted to another data controller:

• The processing is based on consent under Art. 6 (1) (a) or Art. 9 (2) (a) GDPR or on a contract under Art. 6 (1) (b) and
• the processing takes place using automated procedures.

You have the right to obtain, that we transfer your personal data directly to another data controller, as far as this is technically feasible and the freedoms and rights of other persons are not affected by this.

This right to data portability does not apply if the processing is necessary for the performance of a task that is in the public interest or takes place in the exercise of public authority that has been delegated to us.

g. Right to object

At any time, You have the right, for reasons that arise from your particular situation, to object against the processing of your personal data, as based on Art. 6 (1) (e) or (f) GDPR. This also applies to a profiling referred to in these provisions.

In the event of an objection, we will cease to process your personal data, unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or the processing is for the purpose of asserting, exercising or defending legal rights.

When we process your personal data to perform direct marketing, You have at any time the right to object to the processing of your personal data for the purpose of such marketing. This also applies to profiling, as far as it is related to direct marketing.

If You object to the processing of your personal data for direct marketing purposes, we will no longer process them for these purposes.

You have the option, in the context of the use of information society services – regardless of Directive 2002/58/EC (Privacy and Electronic Communications Directive) – to exercise your right of objection through automated procedures that use technical specifications.

 h. Right of withdrawal

Under Art. 7 (3) GDPR You have the right to withdraw your consent at any time. The withdrawal of consent does not retroactively render the processing unlawful.

 i. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a supervisory authority, without prejudice to any other administrative or judicial remedy. In particular, in the member state of your place of residence, employment or the place of the alleged infringement, You may exercise your right of to lodge a complaint if You believe that the processing of your personal data is violating the GDPR.

An overview of the respective national data protection officers of the states as well as their contact information can be found under the following link:

https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.