D a t a P r o t e c t i o n D e c l a r a t i o n
Contents
A General information
B Definitions of terms
C Scope and supervisory authorities in charge
D Data collection and purpose (scope of usage)
E Transmission of data
F Contract data processing
G Storage of data
H Your rights as data subject affected by data processing measures
I Data Protection Officer
J Changes in this Data Protection Declaration
K Respect for special national features
The purpose of this Data Protection Declaration ("DPD") of our company,Ticketbande B.V. (also deemed to be the "controller" in the meaning of the General Data Protection Regulation, i.e. EU Regulation 2016/679 from 27 April 2016 - "GDPR"),is in particular to inform you in your capacity as data subjects affected by data processing in a transparent, simple and understandable manner inter alia about:
- what data we collect, and how and why this is done;
- how we handle your data, if applicable including with the involvement of third parties;
- what substance matters the GDPR applies to;
- what rights and possibilities of influence you have with regard to your data and its use;
- what rights we have and how these may affect your rights.
Our contact information is as follows:
Ticketbande B.V., Heerlenseweg 21, 6371 HP Landgraaf, The Netherlands, Managing Director:
Mr Frank Laurini, E-Mail: contact@ticketbande.nl, Website: www.ticketbande.de, Tel. no.: 0031 455 432 127
In data protection law as well as in applications bearing relevance to data protection law, terms are sometimes used which are not self-explanatory per se and/or have not yet become so much a part of everyday language use that everyone could be expected to readily understand what the respective terms mean. For this reason, the following Section B. (Definitions of terms) explains some of the most frequently used terms in more detail.
III. Our understanding of our role with regard to data protection
Data protection is important to us, and we take a variety of measures to ensure that your data is in good hands with us. The principles laid down in the GDPR are also at the same time the principles we adhere to when handling your data. This includes not least the imperative of purpose limitation and minimisation. In this connection, we generally only request a minimum amount of data from you (or, if applicable, from third parties) which is necessary for us to structure the business / customer relationship with you in accordance with the recognised principles of business diligence / customary usage in business and to be able to offer you an excellent service. This principle of necessity continues to be applied at the level of our employees, i.e. generally only those employees who are absolutely necessary for the performance of the activities entrusted to them have access to personal data. At the same time, we only store data for as long as is necessary for the aforementioned purposes unless longer storage obligations emanate from statutory regulations. A further component in our data protection system is technology design and organisation. Through modern data processing systems, other technical precautions and, if necessary, the involvement of external specialised companies, we guarantee a high degree of data security (e.g. through the use of data encryption technology) within the company, ensuring that the risk of unauthorised external access is ruled out to the greatest extent possible. At the same time, data is stored in such a manner so that it can be easily located and, if necessary, restored at any time. In addition to the lawfulness of acquiring data, we endeavour to only use accurate data in our data processing. As a result, we are happy to receive update notices from you.
We process data processing in particular on the basis of the GDPR as well as the German Federal Data Protection Act ("BDSG") and other relevant provisions of EU and national law in the field of law governing data protection, which may also include professional and other special legal regulations. To take one example: if you provide your effective consent, art. 6 sec. 1 a) of the GDPR may serve as the specific legal basis for collecting your data for certain purposes.
Contract processor: a natural or legal person that processes personal data on behalf of another party (namely the data controller),for example a data processing centre.
German Federal Data Protection Act (BDSG): a federal German law in the field of data protection, issued on 30 June 2017 and, like the GDPR, scheduled to enter into force on 25 May 2018.
Legitimate interest: there may be a legitimate interest both in enabling as well as avoiding data processing, depending on the perspective of the party (company) or data subject (natural person). In practice, it usually depends on which party's interests are of overriding importance in the specific situation, whereby a multitude of factors (type of data, situation surrounding its collection, intended use, etc.) must be accordingly weighed out while taking into account the fundamental rights and freedoms of the data subject concerned.
Data subject: the person whose data is the subject of a data processing procedure. To be specific, in this case: you.
Browser: a computer program for displaying websites on the World Wide Web, i.e. a kind of user interface for Internet applications. Well-known examples include Microsoft Edge, Mozilla Firefox or Google Chrome.
Controller: a natural or legal person (including non-public) which alone or jointly with others determines the purposes and means of processing personal data; to be specific, in this case: us, i.e.:
Ticketbande B.V., Heerlenseweg 21, 6371 HP Landgraaf, The Netherlands, CEO: Frank Laurini, Data Protection Officer:Frank Laurini
Cookie: text information in a smaller file format which is sent via the web browser of an Internet site that is visited to your computer (or another terminal device used for the Internet) and stored there. If you visit the site again, this will be recognized by the cookie that has been set, which allows you to for example directly activate certain usage preferences (such as the language setting) or intermediate statuses of previous usage (such as the shopping basket of an online shop).
Data processing: the use or pooling of data in the broadest sense, whether automated or not, such as the collection, recording, organisation, arrangement, storage, adaptation or alteration, read-out, enquiry, use, disclosure by transmission, dissemination or any other form of provision, comparison or linkage, restriction, erasure or destruction of data.
GDPR: a regulation of the European Union (EU 2016/679) in the field of data protection, issued on 27 April 2016 and entering into effect on 25 May 2018 (with direct effect for Germany as well).
Last contact: by last contact with you we mean a situation in which a contractual relationship between you and us has not come about and we have not "heard" from you for more than 3 (three) months, whereby it is not the acoustic nature of the contact that matters. Any type of contact between you and us that is perceivable to us, rather (including for example via email, letter or short message),is sufficient to allow the aforementioned 3-month period to begin anew.
Personal data: any information relating to an identified or identifiable natural person; the latter is the case when a person can be identified, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier or one or more specific characteristics which express the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.
Special category of personal data: that personal data revealing a natural person's racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic or biometric data (with identification function),health data or data relating to sex life or sexual orientation.
Profiling: any type of automated processing of personal data for the purpose of evaluating certain personal aspects of a natural person, in particular to analyse or predict aspects relating to work performance, economic situation, health, personal preferences, interests, reliability, conduct, whereabouts or change in location by such person.
When in the following reference is made to data, this means personal data. The terms European Union, EU and Union are used interchangeably.
Data protection regulations usually involve the protection of natural persons and their personal data. This is also the case with the key laws and regulations bearing relevance in this context, the GDPR and the German Federal Data Protection Act ("BDSG"),to which we in our capacity as a German company (regularly referred to as "controller" or "controlling party " in law governing data protection) are automatically subject. The question as to the extent that legal persons can also claim protection under data protection law from data processing companies has not yet been fully clarified. As a precautionary measure and with the aim of having a data protection-friendly orientation and alignment, which also includes the granting of optional rights in connection with the release of information on your part, we treat legal persons like natural persons if they are affected in a personal way or where such affection at least comes close to how a natural person would be affected in a comparable situation. This is the case, for example, when natural persons behind the legal persons are involved, i.e. they also appear as natural persons in a recognisable manner in company-related actions. We must adhere to the legal data protection requirements described here (as well as other) legal requirements of a data protection nature not only towards German data subjects or nationals of EU member states, but towards all persons regardless of their nationality with regard to whom we perform (or have performed) actions bearing relevance to data processing relevant in the EU, even if the actual processing takes place outside the EU.
Our company is based in The Netherlands. The following supervisory authority is therefore primarily responsible for monitoring our compliance with data protection obligations:
Data security officer of the State of The Netherlands, Mr Aleid Wolfsen, Chairman of the “Autoriteit Persoonsgegevens”, Bezuidenhoutseweg 30, NL 2509 AJ The Hague, The Netherlands Haag, Tel. no.: +31-70-8888500, Fax: +31-70-8888501, E-Mail: info@autoriteitpersoonsgegevens.nl
Since we as a company heavily involved in online activities transact business outside the territories of The Netherlands (in which we are headquartered) as well, other authorities may also be responsible for assessing our conduct bearing relevance to data protection regulations in those countries.
Data collection is the first step and at the same time a part of data processing. It is only (legally) permissible if legal requirements (in particular those laid down in the GDPR and the BDSG) that are imposed on measures of this type are met. In our company's practice, the following four situations in particular may legitimate the collection of data (and its further processing as well):
(a) (possibly explicit) consent has been granted;
(b) the action is necessary either to execute a contract with you or, however, to perform pre-contractual measures at your request;
(c) the measure is necessary to fulfil a legal obligation incumbent on us (e.g. a legal obligation to store data);
(d) there is a legitimate interest to our benefit which overrides your interests, rights, etc., relating to data in individual cases.
In our practice, types of data collection are used that are described in more detail below:
As a rule, we generally collect data relevant for the purposes of our company directly from you, which can be done in various ways:
- You contact us by using the contact form on our website, with which certain basic data is to be provided;
- You contact us in another way, e.g. by enquiring about a product, and would like more detailed information, which we are supposed to send to your address;
- You provide us with data on your own initiative - by whatever means of communication this may be - for example in order to receive an individual offer from us or to apply with us for a contract;
- We contact you (for instance at an informational event) within the scope of what is permissible under competition law, which results in a business transaction for which we ask you to provide us with certain data in order to complete such / perform additional actions.
As a rule, we regard the aforementioned processes as those in which either your (at least tacit) consent has been provided or, however, the data processing results from a request from you involving data. Your consent must not be provided in any particular form. However, since we have an obligation to submit proof that you have indeed provided your consent with regard to the processing of data on a consensual basis, but this cannot be documented directly in every communication situation (for example: telephone conversations),we may contact you again in the follow-up to such an event and ask for formal confirmation of your consent.
Regularly, we (also) collect personal data relating to your person from third parties, essentially for the sake of assessing business-related risks which may ensue from an intended transaction, whereby if you have not provided your consent to such this is only permissible if there is a justified interest on our part or if there is a statutory constellation constituting an exception. Such an interest (to our benefit) may be deemed to be the case, for example, if we are involved in a transaction with you in which we are/would be subject to an extensive obligation to render advance performance, and we would consult an appropriate provider (such as Creditreform) to assess your creditworthiness in order to analyse the risk associated with such. If necessary, we would also inform ourselves by using public registers and generally accessible (public) sources (e.g. www.Bundesanzeiger.de),which would also lie in the domain of information collection from third parties and the requirements associated with this if such is to be deemed lawful. Data obtained in this way never involves automated decision-making in our company, however, and is instead merely intended to broaden the basis for our own decision-making process. If we collect data on you from third parties, we shall subsequently inform you of the nature and extent of this in accordance with legal requirements no later than within one month of obtaining the data collected in this manner. Our aforementioned information obligation may be waived in certain exceptional cases, e.g. if the fulfilment of this obligation would be associated with undue effort.
Every time you access the contents of our website, data is temporarily stored which may allow identification. The following data are saved every time a page is called up at www.ticketbande.de: date and time of the call-up, name of the Internet service accessed, the resource called up and the action/enquiry used by the client, amount of data transmitted, message as to whether the call-up was successful, IP address of the accessing computer. The stored data is collected for the purpose of statistical evaluation of the use of the website and summarised anonymously. Furthermore, it is used to defend against or analyse attacks on the website. If necessary, cookies may also be used in connection with your use of our website, in which case we shall keep a corresponding notice ready for you directly on the website and request your consent, which you are (of course) completely free to grant. You can also set your browser (see its "help" menu for more details) to block all cookies (and hence automatically those from our website as well) or alternatively to notify you before such a cookie is set. In this case, however, you may no longer be able to use our website to its full extent and/or only with considerable delay, and user-specific default settings for the purpose of more convenient use (e.g. correct language setting) may no longer be available. Once cookies have been set, you can delete them yourself at any time with the help of your browser.
Tracking and analysis tools also use cookies. We use such cookies as well. In particular, we use ff. tracking and analysis tools:
Google Analytics
Web analysis service of Google Inc. (https://www.google.de/ intl/en/about/) (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; hereinafter "Google"). Pseudonymised user profiles are created and cookies used in this context. The information generated by the cookie about your use of this website such as browser type/version, operating system used, referrer URL (the previously visited page),host name of the accessing computer (IP address) and time of the server request are transmitted to a Google server in the USA and stored there. This data is assessed to determine how the website is used. The assessment is issued in the form of reports on activities that then form the basis for market research. This data is then passed on to third parties to the extent that this is permissible or necessary. Your IP address will remain anonymous, however, and will not be merged with other Google data. You may furthermore refuse to allow cookies to be used by selecting the appropriate settings on your browser. Please note, however, that if you do this you may not be able to use the full functionality of this website. Finally, you can prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) and the processing of this data by Google by downloading and installing a browser add-on (https://tools.google.com/dlpage/gaoptout?hl=en). As an alternative to the browser add-on, especially for browsers on mobile devices, you can also prevent Google Analytics from collecting data by clicking on this link. An opt-out cookie will then be set to prevent future collection of your data when you visit this website. The opt-out cookie is only valid in this browser and only for our website and is stored on your device. If you delete the cookies in this browser, you must set the opt-out cookie once again. For more information on privacy in connection with Google Analytics, please visit Google Analytics Help (https://support.google.com/analytics/answer/ 6004245?hl=en).
Google Adwords Conversion Tracking
We also use Google Conversion Tracking to statistically record the use of our website and evaluate it for the purpose of optimising it for you. Google Adwords sets a cookie on your computer if you have accessed our website via a Google advertisement. After 30 days, these cookies become invalid and are not used for personal identification. If the user visits certain pages of the Adwords customer's website and the cookie has not yet expired, Google and the customer can recognise that the user has clicked on the advertisement and has been redirected to this page. Each Adwords customer receives a different cookie. Cookies can therefore not be traced via the websites of Adwords customers. The information collected using the conversion cookie is used to generate conversion statistics for Adwords customers who have opted for conversion tracking. Adwords customers see the total number of users who have clicked on their advertisement and have been redirected to a site with a conversion tracking tag. They do not receive any information that personally identifies users, however. If you do not wish to participate in the tracking process, you can also reject the setting of a cookie required for this - for example by using a browser setting that generally deactivates the automatic setting of cookies. You can also deactivate cookies for conversion tracking by setting your browser to block cookies from the "www.googleadservices.com" domain. Google's privacy policy for conversion tracking can be found here (https://services.google.com/sitestats/de.html).
Social Media
We also use social networks to promote awareness of our law firm. Commercial aims and objectives which we pursue underlie this. Responsibility for data protection-compliant operation lies in the respective hands of providers of the corresponding service. We have integrated these services into our website using the so-called "two-click" procedure in order to protect your data.
We use the Facebook plugin on our website to personalize its use. We use the corresponding button as a service offered by Facebook. When you visit a site on our website that is equipped with such a plugin, your browser establishes a direct connection to Facebook servers.
The content of this plugin is transmitted directly through Facebook to the browser you are using and integrated into the website. This informs Facebook that your browser has called up the corresponding page of our web presence. This process takes place even if you do not have a Facebook account or if you do have one, but are not logged in. This information, including your IP address, is transmitted directly from your browser to a Facebook server in the USA and stored there. If you are logged in to Facebook, Facebook can associate your visit to our website directly with your account. If you interact with the plugins, for example by pressing the "like" or "share" button, this information will also be forwarded to Facebook servers. It will be stored there. Facebook publishes this information and it will be displayed to your Facebook friends. Facebook will use this information for the purposes of advertising, market research and demand-oriented design of Facebook sites. To this end, Facebook creates interest and relationship profiles, for example to evaluate your use of the website with regard to the advertisements you display and to suggest this information as advertising to other users whose profiles are similar. If you do not want Facebook to associate the information collected through our site with your Facebook account, you have the possibility to log out of Facebook before visiting our website. The purpose and scope of data collection and the further processing and use of data by Facebook as well as your rights and setting options to protect your privacy can be found in Facebook data protection policy information (https://www.facebook.com/about/privacy/).
We do not collect any personal data in special categories (see section B above),nor do we seek your express consent insofar (for instance to have it "on reserve” if needed at a future time).
If we collect data, this is only done for the operational purposes of our company, in particular to ensure:
- orderly receipt, such as the awarding of contracts (irrespective of the type of legal transaction),including their execution;
- the possibility of preparing cost estimates, quotations and similar;
- the ability to formulate and execute contracts together with their payment and despatch-related processing;
- adherence to statutory warranty obligations and any applicable contractual guarantees or also to assert these ourselves against third parties (e.g. suppliers);
- (possibly also judicial) traceability and enforcement / enforceability of claims against customers as well as the defence of claims asserted against us;
- the provision of a customer service at high level, which can be received by and can support customers in various ways if necessary and at the same time meet their high expectations regarding our company.
In addition, your data may be used for secondary purposes by our company, e.g. for:
- determination of the satisfaction of our customers with our products / services (incl. website);
- improvement of our products and services (incl. website);
- enabling the development of tailor-made offers for customers;
- support / (and if necessary) goodwill for our products / services above and beyond the warranty periods.
With regard to the collection / use of data for such secondary purposes (especially in the case of direct advertising),you may be entitled to extended rights compared to those for the main operational purposes, even if you have expressly consented to the collection of data. Cf. (inter alia) section H XI for details.
If we wish to process your data for purposes other than those for which it was collected, and if we do not have your (separate) consent, we will only do so if the current purpose is still compatible with the original purpose. In determining compatibility, we comprehensively weigh out interests while taking into account inter alia: the context of the data collection at the time, the degree of connection between the purposes of collection at the time and current processing, the type (sensitivity) of the data and the consequences of further processing such for you as well as the existence of guarantees accompanying processing (e.g. encryption).
The following data(s) may in particular be considered to be data collected by us and then stored: Your name, your address, your date of birth, if applicable (especially for commercial customers) your profession or the branch in which you work, possibly also your marital status (depending e.g. on the type of contractual agreement to be concluded),your (other) data to expedite contact (e.g. e-mail and / or telephone and / or fax),if applicable your bank account, if applicable certain additional data of your company (such as the company's key data, commercial register number, tax numbers, management relationships) as well as our own findings following data collection, such as your order history with us and associated payment history, complaints, assertion of warranty or other contract related rights, etc., possible need for additional products, services etc.
No data are transmitted by us to third parties in principle unless this is necessary for:
- the fulfilment of primary and secondary purposes, whereby such forwarding is restricted to companies associated with us (parent company, subsidiaries and affiliates, i.e. companies which we either control or which control us or are under the joint control of a third party and us) or other companies if we are contractually associated with them in order to fulfil operational purposes towards you (e.g. subcontractors, freight forwarders, consignors);
- coordination with our (external) advisors in tax, business and legal matters, which as a rule involves persons who are already subject to statutory confidentiality requirements due to their professional status;
- the execution of payment transactions, regardless of whether we are the paying party or the party that is to effect payment;
- enabling assessment of the (in particular) financial risk of a contemplated or already agreed-upon, but not yet fully completed, legal transaction with regard to various characteristics of the (future) contracting partner, such as its creditworthiness, liquidity, payment history, etc.
- the fulfilment of public-law obligations, for example in response to a request by a government authority on the basis of pertinent statutory provisions
We do work together with contract processor. Guarantee contracts obligate such contractors to comply in particular with our Data Protection Guidelines as well as the GDPR itself.
In accordance with the principle of storage limitation, we only store your data for as long as is necessary for the purposes for which it is being/has been processed. For example, if a business contact with you has not been solidified following a phase of attempting to initiate a contractual relationship, and if there are no prospects that this will still happen in the foreseeable future, either, there is no longer any operative interest in the storage of data after the expiry of the time-barring period in which possible claims - regardless of which party such have accrued to - would come about due to a possible pre-contractual obligation. In some situations, such an interest in storage may even lapse in an even shorter period of time. However, due to legal regulations - over which we naturally have no control - we may be forced to retain data longer than we ourselves would consider necessary. Such storage obligations arise in particular under commercial and tax law, in some cases under professional law or other special legal regulations, according to which, for example, every commercial/business letter, whether received or sent must be kept for a period of 6 years (beginning at such date). This can, among other things, influence your claim for cancellation, postponing it for a certain period of time or downgrading it to a claim for restriction. For further details, please refer to section H VI. (below).
To promote readability, we have not explained every right to which you may or actually are entitled down to the last detail, and we have also looked at which cases may arise for our company or for you in your capacity as the data subject in practical terms through the data processing to be carried out by us. The present discussion is therefore not exhaustive with regard to the rights to which you are entitled, but is supplemented (especially in marginal areas) by the GDPR and other pertinent legislation wherever applicable. No special form or formal requirements must be met to assert your rights, i.e. this can also be done by telephone or e-mail.
If you assert rights under this section H, we will inform you without undue delay, but at the latest - subject to the following clause - within a period of one month after receipt of your application about the effects this will have in your specific case (in particular what legal consequences this may have). If your application is based on a complex issue and at the same time we are confronted with a large number of applications, we are entitled to only react within a period of 3 months, whereby we will notify you of and justify such a delay within the aforementioned one-month period. We must also respond to you within one month and state the grounds for such if we do not wish to take action at your request.
Notification of your rights, the fulfilment of other information obligations by us and measures taken to implement your rights are free of charge to you. We are only entitled to charge a reasonable fee corresponding to our time and effort or to refuse to process the request in the case of manifestly unfounded or (in particular excessive) requests.
All of your rights contained in this section H – with the execption however of your right to appeal – are to be addressed towards us. Insofar, we hereby inform you again of our contact details which read as follows:
Ticketbande B.V., Heerlenseweg 21, 6371 HP Landgraaf, The Netherlands,
E-Mail: contact@ticketbande.nl, Website: www.ticketbande.de, Tel. no.: 0031 455 432 127
You have the right to obtain information from us as to whether we process personal data relating to you. If this is the case, the information also extends to inter alia:
(a) what kind of data are processed and for what purposes;
(b) to whom data may have been passed on (and which guarantees, if applicable, have been provided by the recipient with respect to handling of your data in compliance with law governing data protection, for example in the event that a third country is involved);
(c) duration - or criteria for the duration - of the (planned) storage of this data;
(d) if applicable, the origin of data (in the case of collection from third parties);
(e) if necessary, pertinent information on the (system) logic used and the scope and intended effects of data processing on you if these were the subject of an automated decision-making process (note: we do not perform such processes at our company ourselves).
You will receive a copy of this information from us, in the case of an electronic application on your part in electronic form (i.e. in a common electronic format). We may charge a reasonable fee for additional copies in accordance with the administrative expenses associated with this.
III. Right to withdraw consent that has already been given
You have the right to withdraw your consent at any time. Such withdrawal does not affect the lawfulness of consent-based data processing performed before the point in time of withdrawal, but means that beginning at such point in time we may no longer perform any activities relating to your data if the consent withdrawn in the meantime was the only legal basis for this. This is not the case, for example, if we are still obligated to store the data. The withdrawal can be notified without adhering to any formal requirements and is in any case also possible in the form in which you previously provided your consent.
You have the right to request us to correct any inaccurate personal data concerning you without undue delay. Taking into account the purposes of the processing, you furthermore have the right to request completion of incomplete personal data, including by means of a supplementary declaration. If your data has been disclosed to third parties, we will inform them of the correction unless this is impossible or would be associated with unreasonable effort and expense. If you so request, we will disclose the aforementioned third parties to you.
Subject to the exceptions set out in subsection 3. below, you may request us to erase your personal data immediately if:
(a) this/these data (in particular their further storage) is (are) no longer necessary for the purposes of the collection;
(b) you have withdrawn your consent in the case of consent-based data processing;
(c) you object to further processing;
(d) the processing of data was unlawful;
(e) the erasure is necessary in order to fulfil a legal obligation under European Union law or national law;
(f) the data have been collected from a child (under 16 years of age) relating to services of the information society, which in this context is understood as a service generally provided subject to charge, and which is performed electronically by means of distance selling (i.e. without direct physical contact between the parties involved) and by individual call-up.
In the event your data is erased, we usually assume that you consent to our including your name in our list of persons who do not (no longer) wish to be contacted by us. This minimises the chance that you will be contacted in the future, for example if your data is collected in another context. If you do not desire this, please let us know.
If we have disclosed the data to which your erasure claim relates, we will (while taking into account the technology available and implementation costs) undertake reasonable measures to ensure that the controllers responsible for such data are informed that you have requested the erasure of the data (including links to and reproductions of the data). If your data has been disclosed to third parties (in another manner),we will inform them of the erasure unless this is impossible or would involve unreasonable effort and expense. Upon your request, we will disclose the aforementioned third parties to you.
You are not entitled to an erasure claim - even only temporarily if applicable - especially if data processing is necessary:
(i) to exercise freedom of expression and information;
(ii) to fulfil a legal obligation applicable to us under European Union law or national law (this may be e.g. a legal obligation to keep records [before their expiry]);
(iii) to assert, exercise or defend legal claims,
or if
(iv) in the event of your withdrawal in the above meaning (section III),there is another legal basis for data processing;
(v) in the event of your objection in the above meaning (section V. 1. c),firstly, there are overriding legitimate grounds for data processing and, secondly, your objection is not only directed against direct advertising and any possibly related profiling (in the latter case - involving direct advertising, profiling relating to such - you are always entitled to a right of erasure).
If you (at least temporarily) have no claim to erasure, you may nevertheless have a claim to a limitation on (further) data processing by us. For more information, please refer to section VI immediately following.
If we have collected data unlawfully and you are therefore (actually) entitled to an erasure claim, you can demand from us that we restrict data processing instead of such erasure. The same applies to lawfully collected data in the case we have in the meantime achieved the purpose, but you need the data to assert, exercise or defend legal claims. If you have filed an objection to the data processing involving you (and we do not have to comply with this if only because it is directed against direct advertising/related profiling) or if you dispute the accuracy of data, you can request us to restrict the use of your data during the corresponding review phase (weighing of interests in the event of an objection, examination of the data for actual inaccuracy). This means that we may only process such limited data (aside from its storage and special cases of overriding public interest) with your consent or in order to assert, exercise or defend against legal claims or to protect the rights of another natural or legal person.
Even without your initiative, we will limit the use of your information to the extent described above if the last contact with you (see section B) goes back longer than a period corresponding to 3 (three) years plus the remainder of the year in which the last contact occurred. This shall not affect any rights of restriction or erasure that may have arisen at an earlier point in time.
If data restriction in the aforementioned meaning has occurred and is due to be revoked (e.g. because it could be determined that the data is not accurate),we will inform you before this step is taken. If your data has been disclosed to third parties, we will inform them of the data restriction unless this is impossible or would involve unreasonable effort and expenses. If you so request, we will name the aforementioned third parties to you.
VII. Right to transfer of data
If we process your data automatically on the basis of consent given by you or within the scope of a contractual relationship, you can require us to receive the corresponding data in a structured form in a common, machine-readable format, for example in order to be able to forward it ourselves (and without any influence whatsoever by us) to another data controller. As far as is technically feasible and such does not affect the rights of other persons, you may also request that we forward such data stocks directly to another data controller selected by you (e.g. a company with whom you wish to conclude a contract). An additional claim for erasure in your favour, if applicable, will not be affected by a data transfer request.
VIII. Right to notification in the event of data breach
If a situation occurs in which the violation of data (e.g. a so-called data breach) poses a great risk to your personal rights and freedoms, we will inform you immediately. Such notification includes inter alia the data of your contact person in this context as well as information on the impending consequences of injury and the measures already taken or planned to be taken to contain these consequences. Such notification may be waived if we have subsequently initiated such effective containment measures that no great risk in the aforementioned meaning can be assumed any longer and if the data have already been significantly secured against unauthorised access - particularly by means of technical measures (e.g. encryption) - or if the notification would involve unreasonable efforts and expenses (in which case we would arrange a public announcement or measure having a similarly broad impact).
In principle (i.e. except in exceptional cases),you have the right not to be subject to a decision based exclusively on automated processing - including profiling - if this has legal effect towards you or has a significantly negative effect on you in a similar manner. Our company does not use such decision-making structures at the present time and we would inform you separately should this change and your data be affected.
You may complain at any time about our conduct relating to the processing of data to the supervisory authority in charge (cited above in section C II). Of course, you can also file a complaint with us, and we will try to solve any problems that may arise together.
If we have processed your data to protect our legitimate interests (or to fulfil a task in the public interest),you can object to this at any time. Further processing by us is then (still) only permissible if we can demonstrate reasons for processing which are so important that they override your interests, rights and freedoms, or if such serves the purpose of asserting, exercising or defending against legal claims. If your objection is directed against the use of your data for purposes of direct advertising/related profiling, we will (no longer) use / process your data in this context. You may send your objection to us or our Data Protection Officer in any form.
Due to the (small) size of our company, there is no legal obligation to appoint a data protection officer, nor have we appointed one on a voluntary basis. However, our entire company staff will be pleased to help you with all your questions in connection with this "Information on the Declaration of Consent", the Declaration of Consent as such, other questions regarding the processing of your data and, of course, your rights under section H and the assertion of these rights.
This Data Protection Declaration may be changed from time to time, for example in order to adapt it to respective / updated decisions in case law involving data protection handed down by the courts, which were not yet known / foreseeable as of 25 May 2018. We will announce any changes on our website, with changes of a particularly serious nature being communicated in individual form (generally by e-mail) to all customers / users / suppliers / other data subjects relevantly affected whose contact data we still have at the respective point in time.
Our business activities extend to many European countries (and even beyond). If it should be the case that we owe you a higher data protection standard with regard to individual items than under the GDPR in the country in which our data protection activities have an effect, in which you are domiciled and which is also a Member State of the European Union or the EEA (except for Switzerland) under national law there, we would ask you to inform us as to the nature and scope of this without undue delay since we also want to abide by such requirements, whereby we - we mention this only by way of clarification - also perform our own research in such matters.