Privacy

We are pleased that you are visiting our website and thank you for your interest in our company. We attribute considerable importance to the protection of your privacy when you use our website. When using your personal data, we therefore act in strict accordance with the applicable data protection provisions. In the following, we therefore wish to inform you about the collection and use of personal data when you use our website.

What are personal data? The term personal data is defined in the German Federal Data Protection Act (BDSG / BDSG [new]) and the European General Data Protection Regulation (GDPR). Accordingly, personal data are specific information regarding the personal or material circumstances of a specific or identifiable natural person. This includes, for example, your name, your address, your telephone number, your email address or your date of birth.

You can visit our website without providing any information about your person. In this case, we will not store any personal data. To improve our offering, we only evaluate statistical data which do not allow any conclusions to be drawn about your person. Insofar as our website collects personal data (such as name, address or email addresses), this always takes place on a voluntary basis. Such data will not be forwarded to third parties without your express consent.

On the following pages, we wish to inform you about the processing of your personal data and the claims and rights to which you are entitled according to the data protection regulations.

I. Name and Address of the Data Controller

The controller in terms of the General Data Protection Regulation (GDPR) and other data protection legislation of the member states as well as further data protection provisions is:

STEINCONNECTOR GmbH

Frohntaler Str. 30

42929 Wermelskirchen

Deutschland

Tel.: +49 (2196) 73406-50

eMail: infosteinconnector.com

Website: www.steinconnector.de

II. Name and Address of the Data Protection Officer

The data protection officer of the controller is:

Sven Giesler

desegna Business IT Solutions

Eickhoffstr. 6

57234 Wilnsdorf

Germany

Tel.: +49 (2737) 9409-866

Email: datenschutzdesegna.de

Website: www.desegna.de

III. General Information on Data Processing

1. Scope of the Processing of Personal Data

We only collect and use the personal data of our users insofar as this is required to maintain a functional website and present our content and services. As a general rule, the collection and use of the personal data of our users only takes place with their consent. An exception may be made in those cases in which it is not possible to obtain such consent for de-facto reasons and the processing of the data is permitted on the basis of statutory regulations.

2. Legal Basis for the Processing of Personal Data

Insofar as we obtain the consent of the data subject for the processing sequences of personal data, point (a) of Art. 6(1) of the EU General Data Protection Regulation (GDPR) provides the legal basis for the processing of personal data. When processing personal data which is necessary for the fulfilment of a contract, the contracting party of which is the data subject, point (b) of Art. 6(1) GDPR is the legal basis. This also applies to processing sequences that are required for the completion of precontractual measures. Point (c) of Art. 6(1) GDPR provides the legal basis for the processing of personal data that are required to comply with a legal obligation to which our company is subject. Where the vital interests of the data subject or another natural person make the processing of personal data necessary, point (d) of Art. 6(1) GDPR serves as the legal basis. Point (f) of Art. 6(1) GDPR provides the legal basis where the processing of personal data is necessary in order to safeguard the legitimate interests of our company or any third party, and the interests, fundamental rights or freedoms of a data subject do not override the interests of the former.

3. Erasure of Data and Duration of Storage

The personal data of data subjects are erased or blocked as soon as the purpose for which they were stored no longer applies. Personal data may then be stored for longer periods if provision for such storage has been provided by European or national legislatures in European Union regulations, laws or other regulatory requirements to which the controller is subject. Personal data are also blocked or erased if a corresponding period of retention stipulated by such regulations, laws or legal requirements expires, unless such data are required for the entry into or fulfilment of a contract.

IV. Provision of the Website and Creation of Logfiles

1. Description and Scope of Data Processing

Each time our internet site is accessed, our system collects data and information automatically from the computer system of the accessing end device.

In this respect, the following data are collected:

• Information concerning the browser type and version used
• The operating system of the user
• Host name of the computer accessing the website
• Date and time of access
• Websites, from which the user's system accesses our website. The data are also stored in the log files of our system. This does not affect the IP addresses of the user or other data that allow the data to be assigned to the user. A storage of such data together with other personal data of the user does not take place.

2. Legal Basis for the Data Processing

The legal basis for the temporary storage of data is point (f) of Art. 6(1) GDPR. 

3. Purpose of the Data Processing

The temporary storage of IP addresses by the system is required to allow for the delivery of the website to the computer of the user. For this purpose, the user’s IP address must be stored for the duration of the session. For such purposes, we have a legitimate interest in the data processing according to point (f) of Art. 6(1) GDPR.

4. Duration of Storage

The aforementioned data are erased as soon as they are no longer required for achieving the purpose of their collection. In the case of data that are collected for the provision of our website, this occurs when the respective session has ended. Logfiles are erased after 6 months. At the end of a session, the cookies are erased, with the exception of the

- Language and time zone

- Consent to the storage of the cookies

5. Possibility of Objection and Removal

The collection of data for the provision of our website and the storage of the data in logfiles is considered a fundamental necessity for the operation of the internet site. As a result of this, the user has no possibility of objection.

V. Use of cookies

1. Description and Scope of Data Processing

Our website uses cookies. Cookies are text files that are stored in the internet browser and/or by the internet browser on the computer system of the user. Therefore, when a user visits a website, a cookie can be stored on the operating system of the user. This cookie contains a unique string of random letters that enable a clear identification of the browser when the user accesses the website again.

In this respect, the following data are stored and transferred:

• Language settings
• Login information

We also use cookies on our website that enable an analysis of the surfing behaviour of the user.

On this basis, the following data can be transferred:

• Entered search terms
• Frequency at which pages are accessed
• Use of website functions

The user data collected in this way are pseudonymised with the use of technical precautions. Therefore, the assignment of the data to the accessing user is no longer possible. The data will not be stored together with other personal data of the user.

On accessing our website, the user is notified about the use of cookies for analytical purposes, and the consent of the user is obtained regarding the processing of the personal data used in this context. In this respect, reference is also made to this privacy policy.

2. Legal Basis for the Data Processing

The legal basis for the processing of personal data with the use of cookies that are required for technical reasons is point (f) of Art. 6(1) GDPR. The legal basis for the processing of personal data with the use of cookies for analytical purposes is, with the provision of the respective consent of the user, point (a) of Art. 6(1) GDPR.

3. Purpose of the Data Processing

The purpose of using cookies is to simplify the use of websites for users. Certain functions of our internet site cannot be used without the use of cookies. In the case of these functions, it is necessary to be able to recognise the browser again when changing to a different page.

We require cookies for the following applications:

• Acceptance of language settings
• Memorising of login data

The user data collected by such cookies that are required for technical reasons are not used in order to create user profiles. Analytics cookies are used in order to improve the quality of our website and its content. Through the use of analysis cookies, we find out how our website is used and can therefore optimise our offering on a continuous basis. For this purpose, we use analysis cookies from Google Analytics. 

We have concluded an agreement on the processing of contractual data with the provider of the analysis cookies.

• Google Analytics Cookies

Google Analytics is a service provided by Google, Inc. (“Google”). Google Analytics uses cookies that allow an analysis of the use of our website. The information generated by the cookie concerning your use of this website is usually transmitted to a Google server in the US and is stored there. Through the IP anonymisation used on this website, your IP address will be shortened beforehand by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to analyse your use of the website, to compile reports on website activities and to provide other services relating to the use of the website and the internet to the website operator. The IP address transmitted by your browser in connection with Google Analytics will not be merged with any other Google data. You can prevent the storage of such cookies by changing the settings of your browser software accordingly; however, please note that, in this case, you may not be able to make full use of all the functions of this website. In addition, you can prevent the collection of the data created by the cookie and relating to your use of the website (incl. your IP address) as well as the processing of such data by Google by downloading and installing the browser plug-in available at the following link: tools.google.com/dlpage/gaoptout.

You can prevent Google Analytics from collecting data by clicking on the link below. An opt-out cookie will be set which will prevent any future collection of your data when you visit this website: Deactivate now

Further information on conditions of use and data protection is available at http://www.google.com/analytics/terms/de.html and/or under https://www.google.de/intl/de/policies/. We wish to point out that on this page, Google has been extended with the code “anonymizeIp” to ensure an anonymised collection of IP addresses (known as IP masking).

For such purposes, we have a legitimate interest in the processing of personal data according to point (f) of Art. 6(1) GDPR.

4. Duration of Storage, Possibility of Objection and Removal

Cookies are stored on the device of the user and transferred to our website. As the user, you therefore have complete control over the use of cookies. By changing the settings of the internet browser, the transfer of the cookies can be deactivated or restricted. Cookies that have already been placed can be disabled at any time. This process can also take place on an automated basis. If cookies are deactivated for our website, it may no longer be possible to make full use all the functions of our website.

VI. Contact Form and Email Contact 

1. Description and Scope of Data Processing

Our internet site includes an enquiry form which can be used to send us enquiries electronically. If a user makes use of this option, then the data entered on the input screen are communicated to us and stored. 

Such data are:

• Personal title
• First name
• Surname
• Email address
• Possible password when creating a customer account
• Telephone
• Street
• House number
• Address suffix (not a compulsory field)
• Postcode
• Location
• Country

The following data are also stored when the message is sent:

• The user’s IP address
• Date and time of registration

Your consent to the processing of the data is obtained and you are informed of this privacy policy during the sending process. Alternatively, you can contact us using the email address provided. In this case, the user’s personal data communicated with the email are stored. Data are not disclosed to third parties in this context. The data are only used for the processing of the conversation.

Our internet site also includes a form for requesting our catalogue. If a user makes use of this option, then the data entered on the input screen are communicated to us and stored.

The collected data are:

• Company (not a compulsory field)
• Personal title (not a compulsory field)
• First name
• Surname
• Telephone number
• Email (not a compulsory field)
• Postcode
• Location
• Street / house number
• Country

The following data are also stored when the message is sent:

• The user’s IP address
• Date and time of registration

Your consent to the processing of the data is obtained and you are informed of this privacy policy during the sending process.

Our internet site also includes a form for general contact enquiries. If a user makes use of this option, then the data entered on the input screen are communicated to us and stored.

The collected data are:

• How can we contact you?
• Personal title (not a compulsory field)
• First name
• Surname
• Telephone number
• Email
• Postcode (not a compulsory field)
• Location (not a compulsory field)
• Street / house number
• Country
• How did you find us?

The following data are also stored when the message is sent:

• The user’s IP address
• Date and time of registration

Your consent to the processing of the data is obtained and you are informed of this privacy policy during the sending process.

Additionally, our internet site includes a form for online job applications, which can be used for electronic job applications. If a user makes use of this option, then the data entered on the input screen and the attached documents are transferred to us and stored.

Such data are:

• Personal title
• First name
• Surname
• Telephone number (not a compulsory field)
• Email address
• Where did you find us?
• Street and no.
• Postcode
• Location
• Country
• Salary expectation (not a compulsory field)
• Notice period (not a compulsory field)
• File attachments

If no additional documents for the application are uploaded at this point, an automatic cookie will be placed. This will be erased again after closing the browser.

The following data are also stored when the message is sent:

• The user’s IP address
• Date and time of the application

Your consent to the processing of the data is obtained and you are informed of this privacy policy during the sending process.

2. Legal Basis for the Data Processing

The legal basis for the processing of data is, where consent of the user has been provided, point (a) of Article 6(1) GDPR. The legal basis for the processing of data that are transferred when sending an email is point (f) of Art. 6(1) GDPR. If the purpose of the email contact is to conclude a contract, the additional legal basis for the processing is point (b) of Art. 6(1) GDPR.

3. Purpose of the Data Processing

The processing of the personal data from the input screen has the sole purpose of allowing us to process the enquiry, catalogue order and/or application. In the case of contacting us by email, this also constitutes the required legitimate interest in the processing of the data.

The other personal data that are processed during the sending process serve to prevent misuse of the forms and to ensure the security of our information technology systems.

4. Duration of Storage

The aforementioned data are erased as soon as they are no longer required for achieving the purpose of their collection. For personal data from the input screen of the form and data that have been sent by email, this is the case when the relevant conversation with the user has come to an end. The conversation is also considered to have ended when it is clear from the circumstances that the relevant issue has been conclusively resolved.

Any additional personal data collected during the sending process will be erased after a period of 7 days at the most.

5. Possibility of Objection and Removal

The user is able to withdraw his or her consent to the processing of personal data at any time. If the user contacts us by email, s/he is able to withdraw his or her consent to the storage of his or her personal data at any time. In such a case, the conversation cannot be continued. In this case, a further conversation is only possible by post. All personal data stored in the course of contact will be erased in this case.

VIII. Newsletter

1. Description and scope of data processing

On our website there is the possibility to subscribe to a free newsletter. When subscribing to the newsletter, the following data from the input mask is transmitted to us:

• Name
• e-mail address

In addition, the following data is collected during registration:

• IP address
• Date and time of registratio

The following data is collected by the newsletter:

• Date and time of unsubscription (if done).

For the processing of data, your consent is obtained during the registration process and reference is made to this privacy policy.

There is a transfer of data in connection with the data processing for the dispatch of newsletters to the Customer Forge as well as to KLICK-TIPP Limited as a subcontractor of the Customer Forge. A corresponding contract for order processing with KundenSchmiede and KLICK-TIPP Limited exists. For the data transfer to KLICK-TIPP Limited with its registered office at 15 Cambridge Court 210, Shepherd's Bush Road, London W6 7NJ, United Kingdom, there is an adequacy decision of the EU Commission for the data transfer to a third country pursuant to Art. 45 (3) DSGVO.

2. Legal basis for data processing

The legal basis for the processing of data after subscription to the newsletter by the user is, where the consent of the user has

been provided, point (a) of Article 6(1) GDPR. The legal basis for the sending of the newsletter during the course of the sale of goods or services is Art. 7(3) UWG (Unfair Competition Act).

3. Purpose of data processing

The collection of the user's e-mail address serves to deliver the newsletter.

In order to provide you with targeted information, we also collect and process voluntary information provided during the registration process. Furthermore, personal tracking is carried out by the actual newsletter.

The collection of other personal data during the registration process serves to prevent misuse of the services or the e-mail address used.

4. Duration of storage

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. Accordingly, the e-mail address, the information provided voluntarily and other personal data of the user will be stored as long as the subscription to the newsletter is active.

5. Possibility of objection and removal

The subscription to the newsletter can be cancelled by the affected user at any time. For this purpose, a corresponding link can be found in each newsletter.

This also enables revocation of the consent to the storage of the personal data collected during the registration process.

IX. CAD Download

1. Description and Scope of Data Processing

On our internet site, we provide users with the possibility to download CAD data of our products in our web shop. To complete the download, we require personal data, and it is also possible to open a customer account with the data provided. In this respect, the data are entered in an input screen, transferred to us and stored. In connection with the data processing, a forwarding of the data to NAS Conception takes place. A contract on order processing has been agreed with NAS Conception GmbH.

The collected data are:

• Personal title
• First name
• Surname
• Email
• Password
• Company
• Department (no mandatory field)
• Street address
• Postal code
• City
• Country
• Phone number (no mandatory field)

If a customer account is to be opened, the following additional data are collected:

• Account password

The following data are also stored upon registration:

• The user’s IP address
• Date and time of registration

In the scope of the registration process, the consent of the data will be obtained for the processing of such data.

2. Legal Basis for the Data Processing

The legal basis for the processing of data is, where consent of the user has been provided, point (a) of Article 6(1) GDPR. The registration also serves the purpose of the fulfilment of an agreement where the user is the contracting party, or the completion of pre-contractual measures. The legal basis for the processing of the data is point (b) of Art. 6(1) GDPR.

3. Purpose of the Data Processing

The processing of the data of the user is necessary for the fulfilment of a contract with the user, or for the implementation of pre-contractual measures.

4. Duration of Storage

The aforementioned data are erased as soon as they are no longer required for achieving the purpose of their collection. This is the case during the registration process for the fulfilment of a contract or for the completion of pre-contractual measures if the data are no longer required for completion of the contract. Even after conclusion of the contract, it may still be necessary to store the personal data of the contractual partner in order to comply with contractual or legal obligations. Continuing obligations require the storage of personal data during the contractual period. In addition, warranty periods must be observed, as well as the storage of data for tax purposes. It is not possible to determine which storage periods are to be adhered across the board; these must be determined for each individual contract and contracting party in each case.

5. Disclosure of Data

Personal data will only be forwarded to third parties insofar as they are service partners who are involved in the implementation of the contract, such as the logistics company which is commissioned with the delivery and the credit institute which is commissioned with the processing of payments. In cases in which your personal data are forwarded to third parties, the amount data transferred is always limited to the minimum required amount.

6. Possibility of Objection and Removal

As a user, you have the possibility of ending your registration at any time. You can request the stored data regarding your person to be changed at any time. To do so, please send an email to: datenschutzsteinco.de or contact us by post at: STEINCO Paul vom Stein GmbH, Albert-Einstein-Str. 4, 42929 Wermelskirchen, Germany.

If the data are required for the fulfilment of a contract or for the implementation of pre-contractual measures, a premature erasure of the data is only possible insofar as there are no contractual or legal obligations that otherwise prevent such an erasure.

X. Use of LinkedIn

1. Description and scope of data processing

A link to our company page on the LinkedIn social network of the LinkedIn Corporation ("LinkedIn") is integrated on our website. The operator of the pages is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. This serves to actively address potential employees in a professional environment in a timely manner. On this page, we also share information about our company and present ourselves to the outside world in this way. We provide information about our services, products and employment opportunities in our company.

We would like to point out that you use this LinkedIn company page and its functions on your own responsibility. This applies in particular to the use of the interactive functions (e.g. commenting, sharing, rating). When you visit our LinkedIn company page, LinkedIn collects, among other things, information that is present on your PC in the form of cookies. This information is used to provide us, as the operator of the LinkedIn company page, with statistical information in anonymised form about the use of the LinkedIn company page.

The following data is also stored at the time the link to our LinkedIn company page is used:

• The user's IP address
• Date and time

The data collected about you in this context is processed by LinkedIn Corporation and may be transferred to countries outside the European Union. For detailed information on the processing and use of data by the provider on their pages, as well as a contact option and your rights and setting options in this regard to protect your privacy, please refer to the data protection information of LinkedIn: https://www.linkedin.com/legal/cookie-policy.

XI.    Use of YouTube

1. Description and scope of data processing

Our website uses plugins from the YouTube site operated by Google. The operator of the pages is YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA. 
We have integrated YouTube videos into our online offer, which are stored on www.YouTube.com and can be played directly from our website. These are all integrated in "extended data protection mode", i.e. no data about you as a user is transmitted to YouTube if you do not play the videos. Only when you play the videos will data be transmitted, and a connection to the YouTube servers will be established. This tells the YouTube server which of our pages you have visited. 

The following data is stored at the time the videos are played:

•    IP address
•    Date and time
•    Time zone difference from Greenwich Mean Time (GMT)
•    Content of the request (concrete page)
•    Access Status/HTTP Status Code
•    Transmitted data volume
•    Referring domain
•    Browser type with version and language
•    Operating system

If you are logged into your Google or YouTube account, you allow YouTube to associate your surfing behaviour directly with your personal profile. You can prevent this by logging out of your Google or YouTube account.

You can find more information on the handling of user data in YouTube's privacy policy at www.google.de/intl/de/policies/privacy. There you will also find further information on your rights and setting options to protect your privacy

2. Legal Basis for Data Processing

Legal basis for data processing where the user has given his or her consent is point (a) of Art. 6(1) GDPR.

3. Data Processing Purpose

The way in which Facebook uses the data from the visit to Facebook company pages for own purposes, the extent to which activities on the Facebook company pages are associated with individual users, the period for which Facebook retains such data and whether data from a visit to the Facebook company pages will be passed on to third parties are not conclusively and clearly indicated by Facebook and is not known to us either. The primary responsibility under the GDPR for the processing of insights data is incumbent upon Facebook and Facebook meets any and all duties from the GDPR with regard to the processing of insights data whilst Facebook Ireland provides the data subjects with the essence of the insights complement of the pages.

4- Retention Period

If you, as user, are currently logged into Facebook, your terminal contains a cookie with your Facebook ID. This enables Facebook to track that you have accessed and how you have used this page. This also applies to all other Facebook pages. This data can be used to offer contents or advertising tailored to your needs.

You can avoid this by logging out of Facebook or disabling the “remain logged in” function, erasing the cookies on your device and closing and restarting your browser. In this way, Facebook information allowing to directly identify you will be erased. You can thus use our Facebook page without your Facebook ID being disclosed. If you access interactive functions of the page (Like, Comment, Share, Messages etc.), you can see a Facebook login mask. Following your login, Facebook can identify you as a specific user again.

Information on how you can manage or erase information existing about you can be found on the following Facebook support pages: https://en-gb.facebook.com/about/privacy#

As information service provider, we do not make any decisions regarding the processing of insights data and all further information resulting from Art. 13 GDPR, including legal basis, controller identity and retention period of cookies on user terminals.

The personal data additionally collected during the sending process will be erased after a period of ninety days at the latest.

XII. Rights of the Data Subject

If your personal data are processed, you are the data subject within the meaning of the GDPR and you have the following rights vis-â-vis the controller:

1. Right of Access

You can request confirmation of whether personal data concerning your person is processed by us from the controller. If such processing takes place, you can request access to the following information from the controller:

1. the purposes for which the personal data are processed;

2. the categories of personal data that are processed;

3. the recipients and/or categories of recipients to whom your personal data are or have been disclosed;

4. the planned duration of storage for your personal data or, if definitive information cannot be provided, the criteria for the determination of the duration of storage;

5. the existence of a right to rectification or erasure regarding your personal data, a right to the restriction of processing by the controller or a right to object to such processing;

6. the existence of a right to lodge a complaint with a supervisory authority;

7. all available information concerning the origin of the data if the personal data are not obtained from the data subject;

8. the existence of automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR and – at least in these cases – clear information on the logic involved and the scope and intended effects of such processing as regards the data subject. You have the right to receive information on whether your personal data are transferred to a third country or an international organisation. In this context, you can require that we notify you of appropriate safeguards pursuant to Art. 46 GDPR in connection with any such transfer.

2. Right to Rectification

You have the right to require that the controller rectifies and/or completes your personal data insofar as the data that are processed are inaccurate or incomplete. The controller must make such changes without undue delay.

3. Right to the Restriction of Processing

You have the right to request the restriction of the processing of your personal data under the following conditions:

1. if you contest the accuracy of your personal data for a period sufficient to enable the controller to verify the accuracy of the respective personal data;

2. if the processing is unlawful and you oppose erasure of the personal data and request restriction of the use of the personal data instead;

3. if the controller no longer needs the personal data for the purposes of the processing, but you need the personal data to establish, exercise or defend legal claims, or

4. if you have objected to the processing pursuant to Art. 21(1) GDPR pending verification of whether the legitimate reasons of the controller override your reasons.

If the processing of the personal data in question has been restricted, this data – with the exception of its storage – may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of a significant public interest for the Union or a member state. If the restriction of processing has been restricted in accordance with the above requirements, you will be notified by the controllers before the restriction is lifted.

4. Right to Erasure

a) Duty to Erase

You have the right to require the controller to erase your personal data without undue delay, and the controller must then erase this data without undue delay insofar as one of the following reasons applies: 1. The personal data are no longer needed for the purposes for which they were originally collected or otherwise processed;

2. You have withdrawn your consent to processing pursuant to point (a) of Art. 6(1) or point (a) of Art. 9(2) GDPR, and there is no other legal basis for such processing;

3. You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate reasons for such processing or you object to the processing pursuant to Art. 21(2) GDPR;

4. Your personal data were processed unlawfully;

5. Your personal data must be erased to comply with a legal obligation under European Union or member state law to which the controller is subject.

6. Your personal data were collected in connection with the scope of services offered by an information society pursuant to Art. 8(1) GDPR;

7. Information to third parties

If the controller has disclosed personal data concerning your person and is obliged to erase such data pursuant to Art. 17(1) GDPR, taking the technology and the cost of implementation into account, the controller must take reasonable steps, including technical measures, in order to inform the controllers who are processing the personal data that as the data subject, you have requested such controllers to erase all links to such personal data, or copies or replications of such personal data.

b) Derogations

The right to erasure does not apply insofar as the processing is necessary
1. to exercise the right to freedom of expression and information;

2. to comply with a legal obligation that requires processing under European Union or member state law to which the controller is subject, or for the completion of a task which is in the public interest, or to exercise official authority that has been vested in the controller;

3. on the grounds of public interest in the area of public health according to points (h) and (i) of Art. 9(2) GDPR and Art. 9(3) GDPR;

4. further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes according to Art. 89(1) GDPR, insofar as the right referred to under section a) renders the fulfilment of the goals of such processing impossible or seriously impairs their fulfilment, or 5. in order to establish, exercise or defend legal claims.

5. Right to Erasure

If you have asserted your right to the rectification, erasure or the restriction of processing towards the controller, the controller is required to notify all recipients to whom personal data concerning your person has been disclosed of such a rectification, erasure or restriction of processing, unless such notification proves to be impossible or would entail a disproportionate amount of effort. You have the right to be notified of such recipients by the controller.

6. Right to Data Portability

You have right to receive the personal data concerning you that you have made available to a controller in a structured, commonly used and machine-readable format. You also have the right to transfer such data to another controller without hindrance by the controller to which the personal data were provided, insofar as

1. the processing is based on consent pursuant to point (a) of Art. 6(1) GDPR or point (a) of Art. 9(2) GDPR or on a contract pursuant to point (b) of Art. 6(1) GDPR, and

2. the processing is carried out using automated processes.

In exercising this right, you also have the right to have personal data concerning your person be transferred directly from one controller to another insofar as this is feasible from a technical perspective. This may not be permitted to adversely affect the freedoms or rights of others. The right to data portability does not apply to the processing of personal data which is required for the performance of a task which is in the public interest or in the exercising of official authority vested in the controller.

7. Right to Object

On grounds relating to your particular situation, you have the right to object to the processing of your personal data that takes place on the basis of point (e) or (f) of Art. 6(1) GDPR at any time; this also applies to a case of profiling which may be based on these provisions.

The controller will then cease to process personal data concerning your person unless it is possible to demonstrate compelling legitimate reasons for such processing that outweigh your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims. If personal data concerning your person are processed for the purposes of direct marketing, you have the right to object to the processing of your data for such marketing purposes at any time; this will apply accordingly to any profiling that relates to such direct marketing. If you object to processing for the purposes of direct marketing, personal data concerning your person will no longer be processed for such purposes. In the context of the use of information society services – notwithstanding Directive 2002/58/EC – you may exercise your right to object by automated means in which technical specifications are used.

8. Right to Withdraw the Declaration of Consent under Data Protection Law

You have the right to withdraw your consent to the processing of your personal data at any time. Withdrawal of consent does not affect the legality of the processing which has been carried out on the basis of the consent before it was withdrawn.

9. Automated Individual Decision-making, Including Profiling

You have the right not to be subject to a decision based solely on automated processing – including profiling – that has a legal effect on your person, or is associated with effects of a similar nature. This does not apply if the decision

1. is necessary for the entry into or performance of a contract between you and the controller,

2. is permitted under European Union or member state legislation to which the controller is subject, and such legislation includes appropriate measures to safeguard your rights and freedoms and legitimate interests, or

3. is based on your explicit consent.

These decisions, however, may not be based on special categories of personal data according to Art. 9(1) GDPR, unless point (a) or (g) of Art. 9(2) GDPR applies, and appropriate measures have been taken to safeguard your rights and freedoms as well as your legitimate interests.

As regards the cases referred to in points (1) and (3) above, the controller is required to implement appropriate measures to safeguard your rights and freedoms as well as your legitimate interests, which at least entails the right to obtain intervention by an individual person on the part of the controller, to express your point of view, and to contest the decision.

10. Right to Lodge a Complaint with a Supervisory Authority

Regardless of any other administrative or judicial remedy, you have the right to complaint to a supervisory authority, in particular in the member state in which you are resident, the member state in which you work or in the place of the putative infringement if you are of the opinion that the processing of personal data concerning your person infringes the GDPR. The supervisory authority with which the complaint is lodged will inform the person who lodged the complaint about the progress and the outcome of the complaint, including the possibility of a judicial remedy, pursuant to Art. 78 GDPR. We reserve the right to amend this privacy policy at any time in compliance with the applicable data protection regulations.

Valid as of December 2022.