14. YOUR RIGHTS
When we process your data, you are “affected” within the meaning of the GDPR. You have the following rights: right to information, right to rectification, right to limitation of processing, right to cancellation, right to information and right to data transferability. In addition, you have a right of objection and a right of revocation.
Below you will find details on the individual rights:
a. Right to information
You have the right to ask us to confirm whether your personal data is being processed.
If we process your personal data, you have the right to obtain information about the following information:
• The processing purposes
• The categories of personal data being processed;
• The recipients or categories of recipients to whom your personal data have been or are still being disclosed, in particular recipients in third countries or international organisations;
• If possible, the planned duration for which your personal data will be stored or, if this is not possible, the criteria for determining this duration;
• The existence of a right to have your personal data concerning you rectified or deleted or to have us restrict or object to such processing;
• The existence of a right of appeal to a supervisory authority;
• If the personal data was not collected directly from you, all available information about the origin of the data;
• The existence of automated decision-making, including profiling in accordance with Art. 22 (1) and (4) GDPR and – at least in these cases – meaningful information on the logic involved and the scope and intended effects of such processing for you.
If we transfer your data to an international organisation or to a third country, you also have the right to request information on whether suitable guarantees pursuant to Art. 46 GDPR exist in connection with the transfer.
b. Right of rectification
You have the right to correct and/or complete the data that we have stored about you if this data is incorrect or incomplete. We will make the correction or completion without delay.
c. Right to restrict processing
Under certain conditions, you have the right to request us to restrict the processing of your personal data. At least one of the following conditions must be fulfilled:
• You deny the accuracy of the personal data for a period of time that enables us to verify the accuracy of the personal data;
• The processing is unlawful and you refuse to delete the personal data and instead you request the restriction of the use of the personal data;
• We no longer need the personal data for the purposes of processing, but you do need it to assert, exercise or defend legal claims, or
• You have lodged an objection to the processing pursuant to Art. 21 (1) GDPR, as long as it is not yet clear whether our justified reasons outweigh your interests.
d. Right to cancellation
You have the right to ask us to delete your personal data immediately if we are obliged to do so. This is the case if one of the following conditions is fulfilled:
• Your personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
• You revoke your consent on which the processing was based pursuant to Art. 6 (1) (a) or Art. 9 (2) (a) GDPR, and there is no other legal basis for the processing.
• You object to the processing pursuant to Article 21 (1) GDPR and there are no overriding legitimate grounds for processing or you object to the processing pursuant to Article 21 (2) GDPR.
• Your personal data have been processed unlawfully.
• The deletion of personal data is necessary to fulfil a legal obligation under Union law or the law of the Member States to which we are subject.
• Your personal data have been collected in relation to information society services offered in accordance with Art. 8 (1) GDPR.
If we have made your personal data public and we are obliged to delete them in accordance with the aforementioned conditions, we will take appropriate measures, including technical measures, taking into account the technologies and implementation costs available to us, to inform other data processors who process the personal data, that you have requested us to delete all links to this personal data or copies or replications of this personal data.
However, your right to cancellation does not exist if processing is necessary for the following reasons (exceptions):
• To exercise freedom of expression and information;
• To fulfil a legal obligation required for processing under the law of the Union or of the Member States to which we are subject, or to perform a task in the public interest or in the exercise of official authority conferred on us;
• For reasons of public interest in the field of public health in accordance with Art. 9 (2) lit. h and i and Art. 9 (3) GDPR;
• For archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes pursuant to Article 89 (1) DS-GMO, where the right referred to in (1) is likely to render impossible or seriously prejudicial the attainment of the objectives of such processing, or
• To assert, exercise or defend legal claims.
e. Right to information
If you have exercised your right of rectification, deletion or restriction against us, we are obliged to inform all recipients to whom we have disclosed your personal data of the correction, deletion or restriction of the processing of your data, unless this proves impossible or involves a disproportionate effort.
f. Right to data transferability
You have the right to receive the personal data you have provided to us in a structured, common and machine-readable format and the right to have this data transferred to another person in charge, subject to the following conditions:
(1) Processing is based on consent pursuant to Art. 6 (1) lit. a or Art. 9 (2) lit. a GDPR or on a contract pursuant to Art. 6 (1) lit. b and
(2) Processing shall be carried out by means of automated methods.
You have the right to have us transfer your personal data directly to another person responsible, insofar as this is technically feasible and does not impair the freedoms and rights of other persons.
This right to data transferability shall not apply if the processing is necessary for the performance of a task in the public interest or in the exercise of official authority conferred on us.
g. Right of objection
You have the right to object at any time to the processing of your personal data based on Art. 6 (1) lit. e or lit. f GDPR for reasons arising from your particular situation. This also applies to any profiling referred to in these provisions.
After an objection, we will no longer process your personal data unless we can prove compelling grounds for processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
If we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of your personal data for the purpose of such advertising. This also applies to profiling as far as it is connected with direct advertising. If you object to the processing of your personal data for direct marketing purposes, we will no longer process it for these purposes
You have the possibility to exercise your objection in connection with the use of Information Society services by means of automated procedures using technical specifications, notwithstanding Directive 2002/58/EC (Directive on privacy and electronic communications).
h. Right of revocation
According to Art. 7 (3) GDPR you have the right to revoke your consent at any time. The revocation of consent does not render the legality of the processing retroactively ineffective.
i. Right of appeal to a supervisory authority
They shall have the right of appeal to a supervisory authority, without prejudice to any other administrative or judicial remedy. In particular, you may exercise your right of appeal in your Member State of residence, place of work or place of suspected infringement if you believe that the processing of your personal data is contrary to GDPR’s.
