Data collection and data processing
1. Creating log files when you visit our website.
If and to the extent that access to our website and retrieval of files stored there takes place, data is recorded automatically.
The registered and stored data are mainly:
- name of the retrieved file,
- date and time of the request,
- amount of transferred data,
- message about the success of gaining access or collection,
- IP address of the requesting device,
- the type of browser,
- operating system used by the visitor.
There is never a link made between this data and any other personal data of the visitor to our website, therefore we cannot draw any conclusions about your person with the provided information.
Processing purposes
The storage of your IP address is required because, without this, a transfer of the contents of our website to your computer cannot take place. Your IP address must remain saved for the duration of the session (a session is the connection between the internet browser that you use when visiting the website (so-called “client-side application”) and the server used by us for the website). The purpose of storing your data in server log files is, on the one hand, to guarantee the functionality of our website and, on the other, to optimise the website. In addition, this data helps us maintain the security of the information technology systems used here.
Retention period
We will delete the automatically saved access and retrieval data as soon as they are no longer required for the stated purpose. This will occur when the connection between the web browser you use to access our website (the so-called. “client-side application”) and the server we use to host our home page is terminated. The stored IP address and associated server log file will be deleted after a period of storage, which means no other data (name of the retrieved file, date and time of retrieval, amount of data sent, message about the success of the access or retrieval, the browser type, the operating system used by the visitor) can be assigned to the requesting device and its IP address.
2. Processing of personal data when inquiring about our service or product offer.
We collect personal information at the same time as the site user voluntarily discloses it to us in the form of questions about this service or product offering (for example, by email). The requesting person’s related data which was provided to us with the request will be saved. This data will not be passed on to third parties under any circumstances, and will only be used to process the correspondence initiated by the request.
Processing purposes
The processing of the data passed on to us in connection with goods or services or product-related questions is used for the processing of requests and the subsequent response.
Retention period
We delete the information provided to us in connection with goods or services, product-related questions, or which has been collected in this context, when it is no longer required to achieve the purpose of the storage. This is the case, if and to the extent there is a question about our services or our product offering, if the question has been answered from here and no further correspondence with the person making the request is required regarding the question.
3. Other processing.
If, due to factual circumstances, the collection and use of personal data is not possible and none of the aforementioned processing operations take place, the data processing will only take place with the consent of the data subject.
Your rights as a data subject
To the extent that we process data relating to you, you are entitled to the following rights under the GDPR:
1. Right to information
You have the right to request information from us about whether personal data relating to you is being processed. If this is the case, you can ask us for information about:
– the purposes of the processing,
– the data categories in which the processing takes place,
– the recipients and/or the categories of recipients to whom we have disclosed or will disclose the data,
– the data retention period stated here or, if it is not possible to provide specific information, our criteria for determining the data retention period,
– the existence of a right to correct personal data,
– the existence of a right to delete personal data,
– the existence of a right to restrict the processing of personal data by the controller within the meaning of the GDPR,
– the existence of a right to object to the processing of personal data,
– the existence of a right to lodge a complaint with a supervisory authority,
– available data source information,
– the existence of an automated decision-making process including profiling in accordance with Article 22 and, if so, meaningful information about the logic, scope and intended effects of such data processing for you as a victim within the meaning of the GDPR.
If you wish to submit such a request for information, send your request in text form to one of the contact options listed on our website.
2. Right to data correction and data completion
You can demand the correction of data that is stored about you at any time if it is incorrect (Article 16 of the GDPR). The same applies to entering incomplete personal data.
If you want a correction or addition of your personal data to be made, please send a request in text form to one of the contact options on our website.
3. Right to delete personal data
As a data subject within the meaning of the GDPR, you can demand the immediate deletion of your personal data in the case of one of the following requirements listed in Article 17 of the GDPR, which we must follow:
– the personal data are no longer required in relation to the purposes for which they have been collected or otherwise processed;
– the data subject withdraws consent on which the processing was based in accordance with Article 6 and Article 9 of the GDPR and there is no other legal basis for the processing;
– the data subject objects to the processing in accordance with Article 21 of the GDPR and there are no legitimate reasons for the processing;
– the personal data have been processed unlawfully;
– the deletion of personal data must comply with a legal obligation under the legislation of the European Union or the Member State to which the controller is subject;
– the personal data have been collected in connection with the services offered by the information company in accordance with Article 8 of the GDPR.
If we have disclosed the personal data relating to you and are required to delete it in accordance with Article 17 of the GDPR, we will take appropriate measures, including technical ones, for data managers; these measures will take due account of the available technology and implementation costs. The personal data will be processed and you will be informed because you, as the data subject within the meaning of the GDPR, have requested the deletion of all links to your personal data or copies of your personal data.
Exceptions to the right to delete data
According to Article 17 of the GDPR, the data subject’s rights do not exist if the data processing is used:
– to exercise the right to freedom of expression and information;
or
– to comply with a legal obligation that requires processing under the law of the European Union or of the Member States to which the controller is subject;
or
– to perform a task in the public interest or a public authority;
or
– for reasons of public interest concerning public health in accordance with Article 9 of the GDPR;
or
– for archival purposes of general interest, scientifically;
or
– for historical research purposes or for statistical purposes in accordance with Article 89 of the GDPR, in so far as the law referred to in the GDPR is likely to render the objectives of such processing impossible or seriously impaired;
or
– to institute, exercise or defend legal claims.
4. Right to restriction of the processing of your personal data
As a data subject within the meaning of the GDPR, you can request that we limit the personal data relating to you if one of the following conditions is to be met in accordance with Article 18 of the GDPR:
– the correctness of the personal data is disputed by the data subject for a period that allows the controller to verify the correctness of the personal data;- the processing is unlawful and the data subject refuses to have the personal data removed and instead asks for a restriction on the use of the personal data;- the controller no longer needs personal information for the purposes of the processing, but the personal information is nevertheless used by the controller to assert, exercise or defend legal claims;- the data subject has objected to the processing in accordance with Article 21 of the GDPR and it is not yet clear whether the legitimate reasons of the controller outweigh those of the data subject.
If the processing of your personal data is limited, the controller may only process your data with your written permission to assert, exercise or defend legal claims or protect the rights of another natural or legal person, or for important reasons in the public interest of the Union or of a Member State in accordance with Article 18 of the GDPR.
According to Article 18 of the GDPR, we are obliged to inform you, in so far as you are a data subject within the meaning of this GDPR, of a restriction of data processing; this at a time before the restriction is lifted.
5. Right to information due to the obligation to report regarding the correction or deletion of personal data or restriction of processing
If you have exercised the right to correct or delete personal data about you, or to restrict the processing of such data by us, we are obliged to correct or remove all recipients to whom the relevant data relates. Article 19 of the GDPR describes how to communicate the data or data processing restrictions. You will also be informed about this.
Exceptions to the notification obligation
The notification obligation according to Article 19 of the GDPR does not exist if the communication proves impossible or requires a disproportionate effort.
6. Right to data portability
According to Article 20 of the GDPR you have the right to receive the personal data that you provide to us in a structured, general and readable format. You also have the right to transfer this information to another person without interference from us, on the condition that:
– the processing is based on a permission according to Article 6 or 9 of the GDPR.
and
– the processing is done by using automated procedures.
Article 20 of the GDPR does not apply the right of data portability to data processing that is necessary for the performance of a task in the public interest or for the exercise of official authority entrusted to the controller.
When you exercise the right to data portability, you as a data subject have the right to transfer the obtained personal data directly from one responsible party to another party, as far as technically possible, without prejudice to the rights and freedoms of others.
7. Right to object to data processing
Pursuant to Article 21 of the GDPR, as a data subject within the meaning of the GDPR, you have the right to object to the processing of personal data pertaining to you in accordance with Article 6 of the GDPR for reasons arising from your specific situation; this also applies to profiling based on these provisions.
In the case of a permitted objection, we will no longer process your personal data unless we can demonstrate compelling legitimate reasons for processing that outweigh your interests, rights and freedoms, or the processing is intended to enforce, exercise or defend legal claims.
You, the data subject, have the right to object to the processing of personal data at any time if the personal data is processed to manage direct mail to you, such as that regarding advertisements and profiling in so far as it is related to such direct mail.
If you object to the processing for direct marketing purposes, we will no longer process your personal data for those purposes. Regardless of the ePrivacy Directive (Directive 2002/58/EC), you can and may exercise the right of opt-out in connection with the use of services with automated procedures that use technical specifications.
8. Right to withdraw your consent for data protection
To the extent that you have given us permission to process your personal data, you have the right to withdraw this declaration at any time. The legality of the data processing that applied prior to the withdrawal on the basis of the consent is not affected by the withdrawal declaration.
9. Your right to automated decisions per case, including profiling
In accordance with Article 22, as a data subject within the meaning of the GDPR, you have the right not to be subject to a decision (which has an effect on you) that is solely based on automated processing, including profiling.
Exceptions to this right under the GDPR
According to Article 22, this does not apply if the automated decision: – is required for the conclusion or execution of a contract between the data subject and the controller (i.e. between you and us)or- is permitted by the law of the European Union or the Member State to which the controller is subject, and where such legislation contains appropriate measures to protect the rights and freedoms and legitimate interests of the data subjector takes place with the express consent of the data subject.
However, the decisions described above under Article 22 of the GDPR may not be based on specific categories of personal data under Article 9 of the GDPR unless appropriate measures have been taken to protect the rights and freedoms and legitimate interests of the data subject.
In the (exceptional) cases referred to in Article 22 of the GDPR, we take appropriate measures to protect your rights and freedoms, as well as your legitimate interests, including at least the right: – to the intervention of a person in addition to the controller- to establish one’s own positionand- to being heard in a disputed decision.
10. Right to lodge a complaint with a supervisory authority
Under Article 78 of the GDPR, and to the extent that you are a data subject within the meaning of the GDPR, you have the right, without prejudice to any other administrative or judicial remedy, to lodge a complaint with a supervisory authority, in particular in the Member State where you live, your workplace, or the place of the alleged infringement if you believe that the processing of your personal data is contrary to Article 22 of the GDPR.
According to Article 22 of the GDPR, the supervisory authority to which the complaint has been submitted must inform the complainant of the status and results of the complaint, including any possibility of a remedy under Article 78.
