You can request confirmation from the responsible body as to whether personal data which concerns you is being processed by us.
Should such processing be present, you can request the following information from the responsible body:
(1) the purposes for which the personal data is processed;
(2) the categories of personal data which are processed;
(3) the recipients or categories of recipients to whom the relevant personal data is disclosed or will be disclosed;
(4) the planned duration of the saving of the personal data relating to you or, should concrete information not be available in this respect, the criteria for determining the length of time of the saving;
(5) the existence of a right of correction or deletion of the personal data relating to you, a right of restriction of the processing by the responsible body or the right to raise an objection to this processing;
(6) the existence of the right to complain to a supervisory authority;
(7) all available information concerning the origin of the data, should the personal data no be gathered from the affected person;
(8) the existence of automated decision making, including profiling in accordance with Article 22 Paragraphs 1 and 4 GDPR and, at least in these case, detailed information concerning the involved logic and the breadth and intended effects of such processing for the affected person.
You have the right to request information as to whether the personal data relating to you is transferred to a third country or an international organisation. In such a case, you can request that you be informed of suitable guarantees in accordance with Article 46 GDPR in connection with the transfer.
2. Right of correction
You have the right of correction and/or completion in relation to the responsible body, should the processed personal data which relates to you be incorrect or incomplete. The responsible body must carry out the correction immediately.
3. Right to have the processing restricted
Under the conditions below, you can request that the processing of the personal data relating to you be restricted:
(1) should you dispute the correctness of the personal data relating to you for such a length of time which enables the responsible body to check the correctness of the personal data;
(2) the processing is unlawful and you reject the deletion of the personal data and instead request that the use of the personal data be restricted;
(3) the responsible body no longer requires the personal data for the purposes of the processing, however you require this in order to assert, exercise or defend legal claims or
(4) you have raised an objection to the processing in accordance with Article 21 Paragraph 1 GDPR and it is not yet clear whether the legitimate reasons of the responsible body outweigh your reasons.
Should the processing of the personal data relating to you be restricted, then regardless of its saving, this data may only be processed with you consent or in order to assert, exercise or defend legal claim, in order to protect the rights of another natural or legal person or the reasons connected to an important public interest of the EU or a Member State.
Should the restriction of the processing be limited in accordance with the reasons above, you will be informed by the responsible body before the restriction is lifted.
4. Right of deletion
a) Deletion obligation
You can request that the responsible body immediately deletes the personal data relating to you and the responsible body is obliged to immediately delete this data, should one of the following reasons be present:
(1) The personal data relating to you is no longer necessary for the purposes for which it was gathered or otherwise processed.
(2) You revoke your consent on which the processing in accordance with Article 6 Paragraph 1 Letter a) or Article 9 Paragraph 2 Letter a) GDPR was based and no other legal basis for the processing is present.
(3) You raise an objection to the processing in accordance with Article 21 Paragraph 1 GDPR and there are no legitimate reasons for the processing present which take priority or you raise an objection to the processing in accordance with Article 21 Paragraph 2 GDPR.
(4) The personal data relating to you has been processed unlawfully.
(5) The deletion of the personal data relating to you is necessary in order to fulfil a legal obligation under EU or the laws of the Member States to which the responsible body is subject.
(6) The personal data relating to you was gathered in relation to services provided by the information company in accordance with Article 8 Paragraph 1 GDPR.
b) Provision of information to third parties
Should the responsible body have made the personal data relating to you public and should it be obliged to delete this in accordance with Article 17 Paragraph1 1 GDPR, then taking the available technology and implementation costs into account, it will take reasonable measures, also of a technical nature, in order to inform the responsible body which is processing the personal data that you as the affected person have requested the deletion of all links to this personal data or the deletion of copies or reproductions of this personal data.
The right of deletion does not apply, should the processing be necessary:
(1) in order to exercise the right of freedom of opinion and information;
(2) in order to fulfil a legal obligation which requires the processing in accordance with EU law or the law of the Member States to which the responsible body is subject or in order to carry out a task which is in the public interests or which takes place in the exercising of public power which has been assigned to the responsible body;
(3) for reasons in the public interest in the area of public health in accordance with Article 9 Paragraph 2 Letter h) and Article 9 Paragraph 3 GDPR;
(4) for archiving purposes, scientific or historical research purposes or statistical purposes in accordance with Article 89 Paragraph 1 GDPR which are in the public interest, should the right named under section a) be expected to make the attainment of the objectives of this agreement impossible or should it be expected to significantly impair these or
(5) in order to assert, exercise or defend legal claims.
5. Right of notification
Should you have claimed the right of correction, deletion or restriction of the processing in relation to the responsible body, it is obliged to provide notification of this correction or deletion of the data or restriction of the processing to all recipients to whom the personal data concerned was disclosed, unless this is shown to be impossible or would take place at disproportionately high expense.
In relation to the responsible body, you have the right to be informed of these recipients.
6. Right of data portability
You have the right to receive the personal data relating to you which you have provided to the responsible body in a structured, current and machine readable format. In addition, you have the right to transfer this data to another responsible body without hindrance by the responsible to whom the personal data was provided, should:
(1) the processing be based on consent in accordance with Article 6 Paragraph 1 Letter a) GDPR or Article 9 Paragraph 2 Letter a) GDPR or on a contract in accordance with Article 6 Paragraph 1 Letter b) GDPR and (2) the processing take place with the assistance of automated procedures.
In addition, when exercising this right, you are entitled to ensure that the personal data relating to you is transferred directly to another responsible body by a responsible body, should this be technically possible. Freedoms and rights of other persons must not be impaired as a result.
The right of data portability does not apply to processing of personal data which is necessary to carry out a task which is in the public interest or which takes place by means of the exercising of public power which has been assigned to the responsible body.
7. Right of objection
You have the right to raise an objection to the processing of your personal data which takes place under Article 6 Paragraph 1 Letter e) or Letter f) GDPR at any time for reasons connected to your specific situation. This also applies to any profiling which is based on these provisions.
The responsible body will no longer process the personal data relating to you, unless it can provide proof of mandatory protectable reasons for the processing which take precedence over your rights and freedoms or the processing is necessary in order to assert, exercise or defend legal claims.
Should the personal data relating to you be processed in order to carry out direct advertising, you have the right at any time to raise an objection to the processing of the personal data relating to you for the purposes of such advertising; this also applies to the profiling, should this be connected to such direct advertising.
Should you object to the processing for the purposes of the direct advertising, the personal data relating to you will no longer be processed for these purposes.
Regardless of Directive 2002/58/EC, you have the right to exercise your right of objection by means of automated procedures where technical specifications are used in connection with the use of services of the information company.
8. Right to revoke the declaration of consent under data protection laws
You have the right to revoke your declaration of consent under data protection laws at any time. By means of the revocation of the consent, the lawfulness of the processing which took place under the declaration of consent prior to the revocation will not be affected.
9. Automated decision making in individual cases, including profiling
You have the right not to be subjected to a decision based exclusively on automated processing, including profiling, which has legal effect in relation to you or otherwise causes you significant impairment. This does not apply if the decision:
(1) is necessary in order to conclude or fulfil a contract between yourself and the responsible body,
(2) is lawful under legal regulations of the EU or Member States to which the responsible body is subject and these legal regulations contain reasonable measures to safeguard your rights and freedoms and legitimate interests or
(3) takes place with your express consent.
However, these decisions may not be based on special categories of personal data under Article 9 Paragraph 1 GDPR, unless Article 9 Paragraph 2 Letter a) or Letter g) GDPR applies and reasonable measures have been taken to protect the rights and freedoms, as well as your legitimate interests. In respect of the cases named in (1) and (3), the responsible body will take reasonable measures in order to safeguard the rights and freedoms, as well as your legitimate interests, whereas as a minimum the right to have a person on the part of the responsible body intervene, to set out one's own opinion and to contest the decision are included here.
10. Right to complain to a supervisory authority