PRIVACY POLICY

I. NAME AND ADDRESS OF THE RESPONSIBLE PERSON

The responsible party within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is:

My Way Betty Ford Klinik GmbH
Managing Director: Sigurd Gawinski, Sven Marquardt
Heinrich-von-Bibra Str. 35
97769 Bad Brückenau

E-Mail: info[at]MyWayBettyFord.de
Internet: www.MyWayBettyFord.de

Tel.: +49 180 / 55 747 55

Name and address of the data protection officer

The data protection officer of the data controller is:

Data Protection Office
Bernd Kircher
Telegraphengasse 1
36037 Fulda

Tel.: +49 661 / 960906-36
E-mail: KIRCHER@DATENSCHUTZ-KANZLEI.COM

General information on data processing

1. Scope of the processing of personal data

We process personal data of our users only insofar as this is necessary for the provision of a functional website and our content and services. The processing of personal data of our users is regularly only carried out with the consent of the user. An exception applies in those cases where obtaining prior consent is not possible for actual reasons and the processing of the data is permitted by legal regulations.

2. Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for processing operations involving personal data, Art. 6 para. 1 lit. a of the EU General Data Protection Regulation (GDPR) serves as the legal basis. When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary for the implementation of pre-contractual measures.

Insofar as the processing of personal data is necessary for the fulfillment of a legal obligation to which our company is subject, Art. 6 para. 1 lit. c GDPR serves as the legal basis. In the event that vital interests of the data subject or another natural person make processing of personal data necessary, Art. 6 para. 1 lit. d GDPR serves as the legal basis.

If the processing is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not override the first-mentioned interest, Art. 6 para. 1 lit. f GDPR serves as the legal basis for the processing.

3. Data deletion and retention period

The personal data of the data subject shall be deleted or blocked as soon as the purpose of the storage no longer applies. Storage may also take place due to European or national regulations, laws or other provisions to which the controller is subject. Data will also be blocked or deleted if a retention period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or performance of a contract.

II. PROVISION OF THE WEBSITE AND CREATION OF LOG FILES

1. Description and scope of data processing

Each time our website is called up, our system automatically collects data and information from the computer system of the calling computer. The following data is collected in this context:

(1) Information about the browser type and version used
(2) The user’s operating system.
(3) The user’s Internet service provider
(4) The IP address of the user
(5) Date and time of access
(6) Websites from which the user’s system accesses our website
(7) Websites that are accessed by the user’s system via our website

2. Legal basis for the data processing

The legal basis for the temporary storage of the data and the log files is Art. 6 para. 1 lit. f GDPR.

3. Purpose of the data processing

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user’s computer. For this purpose, the IP address of the user must remain stored for the duration of the session.

The storage in log files is made to ensure the functionality of the website. In addition, we use the data to optimize the website and to ensure the security of our information technology systems.

These purposes are also our legitimate interest in data processing according to Art. 6 para. 1 lit. f GDPR.

4. Retention period

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.

5. Possibility of objection and elimination

The collection of data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the website. Consequently, there is no possibility of objection on the part of the user.

III. Use of Cookies

1. a) Description and scope of data processing

Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user’s computer system. When a user accesses a website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again.

We use cookies to make our website more user-friendly. Some elements of our website require that the calling browser can be identified even after a page change.
The following data is stored and transmitted in the cookies:

(1) Language settings

(2) Log-in information

We also use cookies on our website that enable an analysis of the user’s surfing behavior.
In this way, the following data can be transmitted:

(1) Search terms entered
(2) Frequency of page views
(3) Use of website functions

The user data collected in this way is pseudonymized by technical precautions. Therefore, an assignment of the data to the calling user is no longer possible. The data is not stored together with other personal userdata.

When calling up our website, users are informed by an information banner (cookie banner) about the use of cookies for analysis purposes and are referred to this data protection declaration. In this context, there is also an indication of how the storage of cookies can be prevented in the browser settings.

1. b) Legal basis for data processing

The legal basis for the processing of personal data using technically necessary cookies is Art. 6 para. 1 lit. f GDPR. The legal basis for the processing of personal data using cookies for analysis purposes is Art. 6 para. 1 lit. a GDPR if the user has given his consent in this regard.

1. c) Purpose of the data processing

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognized even after a page change.

We require cookies for the following applications:

(1) Adoption of language settings
(2) Listing of search terms

The user data collected through technically necessary cookies are not used to create user profiles.
The use of the analysis cookies is for the purpose of improving the quality of our website and its content. Through the analysis cookies, we learn how the website is used and can thus constantly optimize our offer.

In these purposes also lies our legitimate interest in the processing of personal data according to Art. 6 para. 1 lit. f GDPR.

1. d) Retention period, possibility of objection and removal

Cookies are stored on the user’s computer and transmitted from it to our site. Therefore, you as a user also have full control over the use of cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website in full.

IV. CONTACT FORM, APPLICATION OPTION AND E-MAIL CONTACT

1. Description and scope of data processing

On our website, a contact form or application form is available, which can be used to contact us electronically or to apply for a job. If a user takes advantage of this opportunity, the data entered in the input mask is transmitted to us and stored.

These data are set up as mandatory fields:

Name, telephone number, e-mail address

There are additional fields in which voluntary information can be entered. In the case of the application option, an upload function for files is also offered.

At the time of sending the message, the following data is also stored:

(1) The IP address of the user
(2) Date and time of registration

For the processing of the data, your consent is obtained during the sending process and reference is made to this privacy policy.

Alternatively, it is possible to contact us via the e-mail address provided. In this case, the user’s personal data transmitted with the e-mail will be stored.

In this context, the data will not be passed on to third parties. The data is used exclusively for processing the conversation.

2. Legal basis for the data processing

The legal basis for the processing of data is Art. 6 para. 1 lit. a GDPR if the user has given his consent.

The legal basis for the processing of data transmitted in the course of sending an e-mail is Art. 6 para. 1 lit. f GDPR. If the e-mail contact aims at the conclusion of a contract, the additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR.

3. Purpose of the data processing

The processing of personal data from the input mask serves us solely to process the contact. In the case of contact by e-mail, this also constitutes the necessary legitimate interest in processing the data. The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.

4. Retention period

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. For the personal data from the input mask of the contact form or the application form and those sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is ended when the circumstances indicate that the matter in question has been conclusively clarified.

The additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

5. Possibility of objection and elimination

The user has the possibility to revoke his consent to the processing of personal data at any time. If the user contacts us by e-mail, he can object to the storage of his personal data at any time. In such a case, the conversation cannot be continued.

All personal data stored in the course of contacting us will be deleted in this case.

V. WEB ANALYTICS

1. Scope of the processing of personal data

We use various tools on our website to analyze the surfing behavior of our users. The software sets a cookie on the user’s computer (for cookies, see above). If individual pages of our website are called up, the following data is stored:

(1) Two bytes of the IP address of the user’s calling system.
(2) The web page called up
(3) The website from which the user reached the accessed website (referrer)
(4) The subpages that are called up from the called-up website
(5) The length of time spent on the website
(6) The frequency with which the web page is accessed

The software runs exclusively on the servers of our website. A storage of the personal data of the users takes place only there. The data is not passed on to third parties.

The software is set so that the IP addresses are not stored in full, but 2 bytes of the IP address are masked (Ex: 192.168.xxx.xxx). In this way, an assignment of the shortened IP address to the calling computer is no longer possible.

2. Legal basis for the processing of personal data

The legal basis for the processing of users’ personal data is Art. 6  para. 1 lit. f GDPR.

3. Purpose of the data processing

The processing of the users’ personal data enables us to analyze the surfing behavior of our users. By evaluating the data obtained, we are able to compile information about the use of the individual components of our website. This helps us to continuously improve our website and its user-friendliness. In these purposes also lies our legitimate interest in processing the data in accordance with Art. 6 para. 1 lit. f GDPR. By anonymizing the IP address, the interest of users in their personal data protection is sufficiently taken into account.

4. Retention period

The data will be deleted after 30 days.

5. Possibility of objection and removal

Cookies are stored on the user’s computer and transmitted to our site by the user. Therefore, you as a user also have full control over the use of cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website in full.

We use the following tools:

Privacy Policy Google Analytics

This website uses Google Analytics, a web analytics service provided by Google, Inc (“Google”). Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyze how users use the site. The information generated by a cookie about your use of this website (including your IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will in no case associate your IP address with other data of Google. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above. If you would like to disable Google Analytics, you can find the appropriate browser add-on at: https://tools.google.com/dlpage/gaoptout?hl=de.

You can find more information on the data protection of Google Analytics at:
https://support.google.com/analytics/answer/6004245?hl=de.

Privacy Policy Google AdWords Conversion Tracking

This website uses the “Google AdWords Conversion Tracking” function of Google, Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). Google AdWords Conversion Tracking uses so-called “cookies”, text files that are stored on your computer and allow an analysis of your use of the website when you have clicked on a Google ad. The cookies are valid for a maximum of 90 days. Personal data is not stored in the process. As long as the cookie is valid, Google and we as the website operator can recognize that you have clicked on an ad and reached a specific target page (e.g. order confirmation page, newsletter subscription). These cookies cannot be tracked across multiple websites by different AdWords participants. Through the cookie, conversion statistics are created in “Google AdWords”. In these statistics, the number of users who clicked on one of our ads is recorded. In addition, it is counted how many users have reached a target page that has been tagged with a “conversion tag”. However, the statistics do not contain any data with which you can be identified.

You can prevent cookies from being stored on your hard drive by selecting “Do not accept cookies” in your browser settings (in MS Internet Explorer under “Tools > Internet Options > Privacy > Setting”; in Firefox under “Tools > Settings > Privacy > Cookies”); however, we would like to point out that in this case you may not be able to use all the functions of this website to their full extent. By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above. For more information on how Google uses conversion data and Google’s privacy policy, please visit: https://support.google.com/adwords/answer/93148?ctx=tltp, https://www.google.de/policies/privacy/.

Privacy Policy Google Remarketing

This website uses the remarketing or “similar target groups” function of Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). This allows you to be targeted with advertising by displaying personalized and interest-based ads when you visit other websites in the so-called “Google Display Network”. “Google Remarketing” or the “Similar Target Groups” function uses so-called “cookies” for this purpose, text files that are stored on your computer and enable an analysis of your use of the website. These text files are used to record your visits as well as anonymized data on the use of the website. Personal data is not stored in the process. If you visit another website in the so-called “Google Display Network”, you may be shown advertisements that are highly likely to take into account product and information areas previously called up on our website.

You can prevent the “Google Remarketing” or the “Similar target groups” function by preventing the storage of cookies through a corresponding setting in your browser software. However, we would like to point out that in this case you may not be able to use all functions of this website to their full extent. You can also prevent the collection of data generated by the cookie and related to your use of the website to Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link: https://www.google.com/settings/ads/plugin?hl=de. You can also deactivate the use of cookies by third-party providers by visiting the Network Advertising Initiative deactivation page at https://www.networkadvertising.org/choices/ and implementing the further information on opting out mentioned there. Google’s privacy policy on remarketing with further information can be found here: https://www.google.com/privacy/ads/.

Privacy policy DoubleClick

Doubleclick by Google is a service provided by Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). Doubleclick by Google uses cookies to present you with ads that are relevant to you. In the process, a pseudonymous identification number (ID) is assigned to your browser in order to check which ads were displayed in your browser and which ads were called up. The cookies do not contain any personal information. The use of DoubleClick cookies only enables Google and its partner websites to serve ads based on previous visits to our website or other websites on the Internet. The information generated by the cookies is transferred by Google to a server in the USA for analysis and stored there. A transfer of data by Google to third parties only takes place due to legal regulations or within the framework of sub processing. Under no circumstances will Google combine their data with other data collected by Google.

By using our websites, you consent to the processing of data about you by Google and the aforementioned method of data processing and the aforementioned purpose. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of our website. You can also prevent the collection of data generated by the cookies and related to your use of the websites to Google and the processing of this data by Google by downloading and installing the browser plugin available under the following link under the item DoubleClick deactivation extension.

Privacy Policy Facebook Pixel

We use the “conversion pixel” or visitor action pixel of Facebook Inc, 1601 S. California Ave, Palo Alto, CA 94304, USA (“Facebook”). By calling up this pixel from your browser, Facebook can subsequently recognize whether a Facebook advertisement was successful, e.g. led to an online purchase. We only receive statistical data from Facebook for this purpose without any reference to a specific person. This allows us to record the effectiveness of the Facebook ads for statistical and market research purposes. In particular, if you are registered with Facebook, we refer you to their data protection information at: http://www.facebook.com/about/privacy/.

Google Tag Manager Privacy Policy

Google Tag Manager is a solution that allows marketers to manage website tags through one interface. The Tag Manager tool itself (which implements the tags) is a cookie-less domain and does not collect any personal data. The tool takes care of triggering other tags, which in turn may collect data. Google Tag Manager does not access this data. If a deactivation has been made at the domain or cookie level, it remains in place for all tracking tags implemented with Google Tag Manager. As an alternative to the browser add-on or within browsers on mobile devices, please click on this link to prevent the collection by Google Analytics within this website in the future (the opt-out only works in this browser and only for this domain). This will place an opt-out cookie on your device. If you delete this cookie in the browser, you must click this link again.

In particular, if you are logged into Facebook, we also refer you to their privacy information at: http://www.google.de/tagmanager/use-policy.html

Privacy policy Google Fonts

Google web fonts (http://www.google.com/webfonts/) are used to improve the visual presentation of various information on this website. The web fonts are transferred to the browser’s cache when the page is called up so that they can be used for the display. If the browser does not support Google Web Fonts or prevents access, the text is displayed in a standard font.

No cookies are sent to the website visitor when the page is accessed. Data transmitted in connection with the page call is sent to resource-specific domains such as fonts.googleapis.com or fonts.gstatic.com. They are not associated with data that may be collected or used in connection with the parallel use of authenticated Google services such as Gmail.

General privacy information is available at the Google Privacy Center at:
http://www.google.com/intl/de-DE/privacy/

Privacy Policy Google Maps

This website uses Google Maps API to visually display geographical information. When using Google Maps, Google also collects, processes and uses data about visitors’ use of the map functions. You can find more information about data processing by Google in the Google privacy policy. There you can also change your personal privacy settings in the Privacy Center. Alternatively, you have the option of deactivating the Google Maps service and thus preventing the transfer of data to Google by deactivating JavaScript in your browser. However, we would like to point out that in this case you will not be able to use the map display on our site.

General information about privacy is available in the Google Privacy Center at: http://www.google.com/intl/de-DE/privacy/

Privacy policy Q division

Data processing by Q division GmbH (“Q division Processing”)

Q division GmbH, Walther-von-Cronberg-Platz 13, 60594 Frankfurt am Main, Germany, uses cookie IDs for advertising purposes as our service provider. Q division acts as an subprocessor for us. At our instruction, Q division collects transaction data and technical parameters from users who use our website in order to measure the advertising impact of campaigns. It is not possible to draw conclusions about the identity of the user. The data collected via Q division is important to us in order to make our advertising campaigns more efficient.

• All data collected for us by Q division is pseudonymized. You are not recognizable as a person.
• The legal basis for data processing is a legitimate interest.
• Objection to data processing is possible at any time under the following link:q-division.de/datenschutz/widerspruch

What data is collected and processed from me?

Q division collects transaction data on our pages as well as technical parameters on our behalf in the form of browser information, screen resolution, city, state, country, IP address, referrer, mobile device, device classes, flash version (hereinafter also referred to as “collected data”) and processes them. Q division does not collect names, addresses or similar personal characteristics for us that make the user identifiable. Conclusions about your identity are not possible. We also learn through the use of Q division processing whether or not an order or action has occurred without learning which individuals have gone through the process. Q division may measure the effectiveness of advertising campaigns by measuring sales or sub-page views.

Q division takes care within the activity for us and on our behalf to collect only a few data points that are necessary for the provision of the service (collectively also referred to as “Q division processing”). There is no obligation on the part of users to provide personal data. A contract is not concluded with the user. Non-provision has no consequences for the user.3

What identification procedures are used?

Q division and its subprocessors set small text files (cookies) for each user, which are stored by the browser. Both Q division and further subprocessors of Q division, which are necessary for the implementation of the service, assign the user an own ID, which is stored in the cookie, to which characteristics of his shopping behavior can be stored in the cookie or in the database of the service. Depending on the subprocessor, the user-related characteristics are stored for between 30 and 180 days and then deleted. If necessary, the cookie is updated on a new visit and the duration is reset. No server-side technologies are used by Q division that form a profile independently of the cookie.

How can the results of this processing be affected?

Data collected about you may be used by us via Q division to measure the success of advertising campaigns (statistical analysis) and to optimize campaigns.

Who are the recipients of the data and to which categories of recipients can data be disclosed? How does the data transfer work?

In the context of online marketing of advertising, various parties are regularly involved, some of whom act as so-called “data controllers”, others as so-called “data processors” who only provide services on the instructions of the data controller. Overall, the marketing is automated (so-called “programmatic booking”) and is based on an interaction of the various parties involved.

Q division uses the collected data on our behalf to measure and optimize the advertising impact of campaigns. A physical/actual data transfer to advertisers or agencies does not take place.

In the marketing activity carried out by us through Q division, various parties are involved (each with the role they assume):

• The operator of the offer on which data is collected as the responsible party for the offer itself.
• Q division itself as processor for us

Furthermore, service providers and partners of Q division are involved in the value chain as additional processors who act in accordance with Q division’s instructions or from whom Q division itself receives data.

• KUPONA GmbH, Frankfurter Straße 8, 36043 Fulda, which acts as a service provider for Q division and whose so-called “container tag technology” Q division uses, is an subprocessor and is bound by Q division’s instructions. KUPONA, for its part, maintains subprocessor relationships with the following system providers whose technologies KUPONA uses for Q division in order to deliver advertising campaigns on behalf of Q division.
• plista GmbH, Torstraße 33, 10119 Berlin, which acts as an subprocessor for KUPONA GmbH. With the help of this technology, we aim to increase the quality and relevance of our ads by tracking whether and which of our ads lead to success with the end customer (so-called conversion tracking) or which ads are clicked on by end customers (so-called click tracking). After clicking on one of our ads, a temporary cookie is set by plista in the browser of the respective customer, which assigns a counting point as soon as the customer has reached the target page. For more information on this and plista’s data protection, please visit https://www.plista.com/de/about/privacy/.

Additional processors (a list of all processors in the context of this processing) can be found at the following link: www.q-division.de/datenschutz/auftragsverarbeitung4

How can I object to the collection and use of data by Q division?

You can object to the collection and processing of data by Q division at any time on our website or use the following link to the Q division website to unsubscribe from the service there. www.q-division.de/datenschutz/widerspruch

Further opt-out options for involved processors:

For the opt-out option at Plista: https://www.plista.com/de/about/opt-out/

If you make use of this option, Q division will ensure that your data will not be used further. As the technical processes in cooperation between Q division and the other processors are not carried out in real time, there may be time delays in the transfer of the opt-out information. An opt-out cannot be implemented in real time according to the current state of the technical interfaces. Data processing can take up to 36 hours.

Legal basis for Q division processing

The legal basis for Q division processing is Art. 6 para. 1 lit. f GDPR (“legitimate interests”) as well as § 15 para. 3 TMG.

As the operator of this offer, we have a legitimate interest in the described Q division processing. Among other things, this serves to optimize our offers. The interests of the users as data subjects are protected by the fact that data is pseudonymized and the data subjects are not identified as individuals. Furthermore, the storage of information is limited to short periods of time and it is within the scope of user expectation that a certain amount of data collection takes place on Internet offers.

General information about your rights

You have the right to obtain information about the data stored about you at any time. If data about your person is incorrect or no longer up to date, you can demand that it be corrected. Under certain conditions, you also have the right to request the deletion or restriction of the processing of your data.

If you have given us consent, you can revoke this at any time with effect for the future, which means that this does not affect the lawfulness of the processing carried out on the basis of the consent up to the revocation. We provide for the revocation, among other things, the corresponding technical options provided by Q-Division (www.q-division.de/datenschutz/widerspruch). Furthermore, there may also be other revocation options in our offer (e.g. via a privacy center, if offered).

You have the right to request an electronic copy of your data or to have the data forwarded to another provider. You also have the right to contact a data protection authority and file a complaint there.

We will not charge you a fee for exercising your rights unless the request is manifestly unfounded or excessive.

If you are unsure about the legal basis on which Q division, or we, process your data, you can contact Q division at any time. Please note that Q division has no information about the identity of a user, but only pseudonymous cookie IDs. If you have deleted your browser cookies in the meantime, the information stored in your cookies has been deleted. Information is therefore no longer possible.

Contact Q division

Q division GmbH, Walther-von-Cronberg-Platz 13, 60594 Frankfurt am Main, represented by the managing directors Gerald Banze and Melanie Vogelbacher, Tel. 069 255 3494 65, e-mail: info@q-division.de (see also https://q-division.de/impressum/).

You can reach Q Division’s data protection officer at datenschutz@q-division.de.

More information on data protection can be found at www.q-division.de/datenschutz

Other

The data processing used by Q division does not serve automated decision making including profiling according to Art. 22 para. 1 and 4 GDPR.

Data transfer to third countries

There is no data transfer to third countries outside the EU.

VI. RIGHTS OF THE DATA SUBJECT

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

1. Right of information

You may request confirmation from the controller as to whether personal data concerning you is being processed by us. If there is such processing, you can request information from the controller about the following:

(1) the purposes for which the personal data are processed;
(2) the categories of personal data which are processed;
(3) the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed;
(4) the planned duration of the storage of the personal data concerning you or, if specific information on this is not possible, criteria for determining the storage period;
(5) the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller or a right to object to such processing;
(6) the existence of a right of appeal to a supervisory authority;
(7) any available information on the origin of the data, if the personal data are not collected from the data subject;
(8) the existence of automated decision-making, including profiling, pursuant to Art. 22 para. 1 and 4 of the GDPR and, at least in these cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.

You have the right to request information about whether the personal data concerning you is transferred to a third country or to an international organization. In this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

2. Right to rectification

You have a right to rectification and/or completion vis-à-vis the controller if the processed personal data concerning you are inaccurate or incomplete. The controller shall carry out the rectification without undue delay.

3. Right to restriction of processing

You may request the restriction of the processing of personal data concerning you under the following conditions:

(1) if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;
(2) the processing is unlawful and you object to the erasure of the personal data and request instead the restriction of the use of the personal data;
(3) the controller no longer needs the personal data for the purposes of the processing, but you need it for the establishment, exercise or defense of legal claims; or
(4) if you have objected to the processing pursuant to Art. 21 para. 1 GDPR and it is not yet clear whether the controller’s legitimate grounds override your grounds.

If the processing of personal data concerning you has been restricted, such data may – apart from being stored – only be processed with your consent or for the assertion, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State.

If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

4. Right to erasure
5. a) Obligation to delete

You may request the controller to erase the personal data concerning you without undue delay, and the controller is obliged to erase this data without undue delay, if one of the following reasons applies:

(1) The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.

(2) You revoke your consent on which the processing was based pursuant to Art. 6 para. 1 lit a or Art. 9 para. 2 lit. a GDPR and there is no other legal basis for the processing.

(3) You object to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 para. 2 GDPR.
(4) The personal data concerning you have been processed unlawfully.
(5) The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
(6) The personal data concerning you has been collected in relation to information society services offered pursuant to Art. 8 para. 1 GDPR.

1. b) Information to third parties

If the controller has made the personal data concerning you public and is obliged to erase it pursuant to Art. 17 para. 1 GDPR, it shall take reasonable measures, including technical measures, having regard to the available technology and the cost of implementation, to inform data controllers which process the personal data that you, as the data subject, have requested that they erase all links to or copies or replications of such personal data.

1. c) Exceptions

The right to erasure does not exist insofar as the processing is necessary for

(1) for the exercise of the right to freedom of expression and information;
(2) for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(3) for reasons of public interest in the area of public health pursuant to Art. 9 para. 2 lit. h and i and Art. 9 para. 3 GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Art. 89 para. 1 GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously prejudice the achievement of the purposes of such processing; or
(5) for the assertion, exercise or defense of legal claims.

5. Right to information

If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to inform all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.

You have the right against the controller to be informed about these recipients.

6. Right to data portability

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, common and machine-readable format. In addition, you have the right to transfer this data to another controller without hindrance from the controller to whom the personal data was provided, provided that

(1) the processing is based on consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract pursuant to Art. 6 para. 1 lit. b GDPR and

(2) the processing is carried out with the help of automated procedures.

In exercising this right, you also have the right to obtain that the personal data concerning you be transferred directly from one controller to another controller, insofar as this is technically feasible. Freedoms and rights of other persons must not be affected by this.

The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right of objection

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6 para. 1 lit. e or f GDPR; this also applies to profiling based on these provisions.

The controller shall no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of asserting, exercising or defending legal claims.

If the personal data concerning you is processed for the purpose of direct marketing, you have the right to object at any time to processing of personal data concerning you for the purpose of such marketing; this also applies to profiling, insofar as it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

You have the possibility, in connection with the use of information society services – notwithstanding Directive 2002/58/EC – to exercise your right to object by means of automated procedures using technical specifications.

8. Right to revoke the declaration of consent under data protection law.

You have the right to revoke your declaration of consent under data protection law at any time. The revocation of the consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

9. Automated decision in individual cases including profiling.

You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

(1) is necessary for the conclusion or performance of a contract between you and the controller,
(2) is permitted by legal provisions of the Union or the Member States to which the controller is subject and these legal provisions contain appropriate measures to protect your rights and freedoms as well as your legitimate interests; or
(3) is done with your express consent.

However, these decisions may not be based on special categories of personal data pursuant to Art. 9 para. 1 GDPR, unless Art. 9 para. 2 lit. a or lit. g GDPR applies and appropriate measures have been taken to protect the rights and freedoms and your legitimate interests.

With regard to the cases mentioned in (1) and (3), the controller shall take reasonable steps to safeguard the rights and freedoms as well as your legitimate interests, which include, at a minimum, the right to obtain the intervention of a person on the part of the controller, to express his or her point of view and to contest the decision.

10. Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Art. 78 GDPR.