Privacy

ulmatec

I. Name and address of the data controller

The data controller according to the General Data Protection Regulation and other national data protection laws of the EU Member States, as well as other data protection regulations, is:

ULMATEC GmbH
Ostermahdweg 6
89079 Ulm
Germany
Tel.: +49 7308 811077-0
E-mail: info@ulmatec.de
Website: www.ulmatec.de

II. Name and address of the Data Protection Officer

The Data Protection Officer of the data controller is: Erwin Feroudj
DATA-S
Mendelstraße 13
89091 Ulm
Germany
Tel.: +49 7345 2359272
E-mail: datenschutz@ulmatec.de

III. General information on data processing

1.Scope of personal data processing

We collect and utilize our users' personal data only insofar as this is necessary for provision of an operational website and of our content and services. Collection and utilization of our users' personal data is only undertaken periodically with the user's consent. An exception applies in those cases where prior consent cannot be obtained for legal or factual reasons and the processing of the data is permitted by law.

2. Legal basis for processing personal data

Insofar as we obtain consent from the data subject for the processing operations of personal data, Art. 6 para. 1 lit. a of the EU General Data Protection Regulation (GDPR) applies as the legal basis.In processing personal data necessary for fulfilment of a contract to which the data subject is a party, Art. 6 para. 1 lit. b GDPR applies as the legal basis. This also applies to processing operations that are necessary for carrying out pre-contractual measures.Insofar as the processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 para. 1 lit. c GDPR applies as the legal basis.In the event that the vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 lit. d GDPR applies as the legal basis.If processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 para. 1 lit. f applies as the legal basis.

3. Data deletion and storage duration

A data subject's personal data will be deleted or blocked as soon as the purpose of storage ceases to exist. Furthermore, data may be stored if this has been provided by the European or national legislation in EU regulations, laws or other provisions to which the data controller is subject. Blocking or erasure of data will be carried out even if a storage deadline prescribed by the above-mentioned standards expires, unless data storage is a necessity for concluding or performing a contract.

IV. Provision of the website and creation of log files

1. Description and scope of data processing

Every time you visit our website, our system automatically collects data and information from the computer system of the accessing computer.

In doing so, the following data is collected:
(1 Information about the browser type and version used
(2) The user's operating system
(3) The user's Internet service provider
(4) The IP address of the user
(5) Host name of the accessing computer
(6) Date and time of access
(7) Websites from which the user's system reaches our website
(8) Websites that are accessed by the user's system through our website

The data is also stored in the log files of our system. This data is not stored together with other personal data of the user.

2. Legal basis for data processing

The legal basis for temporary storage of data and log files is Art. 6 para. 1 lit. f GDPR.

3. Purpose of data processing

Temporary storage of the IP address by the system is necessary to enable the delivery of the website to the user's computer. To this end, the user's IP address must remain stored for the duration of the session. The data is stored in log files to ensure the website's functionality. The data is also used to optimize the website and to ensure the security of our information technology systems. No evaluation of the data for marketing purposes is undertaken in this context. These purposes also encompass our legitimate interest in data processing in accordance with Art. 6 1 lit. f GDPR.

4. Duration of storage

All data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of data collection for provision of the website, this will be undertaken once the respective session has ended. Should any data be stored in log files, this is the case after seven days at the latest. Further storage is possible. In this case, the user's IP addresses will be deleted or distorted so that assignment to the accessing client is no longer possible.

5. Objection and deletion options

Collection of data for provision of the website and storage of data in log files is absolutely necessary for operation of the website. Consequently, there is no option to object on the part of the user.

V.  Use of cookies

1. Description and scope of data processing

Our website uses cookies.Cookies are text files that are stored in the Internet browser or by the Internet browser on the user's computer system. If a user visits a website, a cookie may be stored on the user's operating system. This cookie contains a distinctive character string that enables unique identification of the browser when the website is accessed again.

We use cookies to make our website more user-friendly. Some elements of our website require that the requesting browser be identifiable even after changing pages.

The following data is stored and transmitted in the cookies:

(1) Language settings
(2) IP address

We also use cookies on our website to analyze users' web surfing behavior.
The following data can be transmitted in this way:

  • Date and time of website visit
  • Duration and frequency of website visit
  • Location and language of the user
  • Browser, operating system and Internet provider of the user
  • Terminal with which the website was accessed
  • Display resolution
  • The user's demographic characteristics such as age and gender
  • User behavior (e.g. which pages within the website are visited)
  • Source from which the website was accessed
  • Search terms entered on the website

The user data collected in this way is pseudonymized via technical precautions. It is therefore no longer possible to assign the data to the accessing user. The data is not stored together with users' other personal data.


When accessing our website, users are informed by an information banner on the use of cookies for analytical purposes and referred to this privacy statement. In this context, a note is also included as to how users can disable the storage of cookies in the browser settings

2. Legal Basis for data processing

The legal basis for the processing of personal data using cookies is Art. 6 para. 1 lit. f GDPR.

3. Purpose of data processing

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some features of our website cannot be offered without the use of cookies. In this case, it is necessary that the browser be recognizable even after changing the page.

We require cookies for the following applications:
(1) Applying language settings
(2) Remembering search terms

The user data collected by technically necessary cookies shall not be used to create user profiles.

For these purposes, our legitimate interest also lies in the processing of personal data pursuant to Art. 6 para. 1 lit. f GDPR

4. Duration of storage and options for objection and removal

Cookies are stored on the user's computer and transmitted to our site. Therefore, as a user you have full control over the use of cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to fully use all of the website's features. The transmission of Flash cookies cannot be prevented via the browser settings. Rather, you must change the Flash Player settings.

VI. E-mail signature

In our e-mail signature, we use links to our website and to third parties such as YouTube. Further information on the transmitted data and the right of revocation can be found under number VIII "Web analysis tools".

VII. contact form and e-mail contact

1. Description and scope of data processing

There is a contact form on our website that can be used for electronic contact. If a user makes use of this option, the data that is entered in the input mask will be transmitted to us and stored. This data is: company (optional), name, telephone, e-mail, empty field for the individual request.

The following data is also stored at the time the message is sent:
(1) Date and time of registration
(2) IP address
(3) Host name of the computer
(4) Company name
(5) Name
(6) Phone number
(7) E-mail

During the sending process, your consent is obtained for processing data and reference is made to this privacy policy. Alternatively, you may contact us via the provided e-mail address. In this case, the user's personal data that is transmitted along with the e-mail will be stored. This data will not be disclosed to third parties in this context. The data is used exclusively for processing the conversation.

2. Legal basis for data processing

The legal basis for processing the data if the user's consent has been obtained is Art. 6 para. 1 lit. a GDPR.

The legal basis for processing the data transmitted in the course of sending an e-mail is Art. 6 para. 1 lit. f GDPR. If you send us an e-mail with the intention of entering into an agreement with us, this creates an additional legal basis for its processing as per Art. 6 para. 1 lit. b GDPR.

3. Purpose of data processing

We only use personal data provided in contact forms to process the contact request. In the event that a contact request is sent by e-mail, this also constitutes the necessary legitimate interest in processing the data. The processing of other personal data during the sending process is done for the purpose of preventing the abuse of the contact form and ensuring the security of our information technology systems.

4. Duration of storage

All data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. For the personal data that was sent by e-mail, this is the case when the respective conversation with the user has been completed. The conversation will have been completed when it is evident from the circumstances that the matter at hand has been conclusively resolved.

The personal data from the input mask will be kept, according to the consent given, for our respective legal retention period, which is usually ten years from the end of the calendar year of contact. Afterwards the personal data will be immediately deleted. Personal data that was additionally collected during the sending procedure will be deleted at the latest after a period of seven days

5. Objection and deletion options

The user has the option of revoking his or her consent to the processing of personal data, at any time. The revocation of consent shall not affect the legality of any processing undertaken on the basis of this consent before its withdrawal.

A user who has contacted us by e-mail can object at any time to the storage of his or her personal data. It will not be possible to continue the conversation in this case. All personal data stored in the course of contacting us by e-mail will be deleted as a result. The revocation can be made either by e-mail ( datenschutz@ulmatec.de) or by post.

VIII. Web analysis tools

a. Google Analytics

1. Scope of personal data processing

This website uses Google Analytics, a web analytics service. This is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, U.S.A.Google Analytics uses so-called "cookies". These are text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie about your use of the website will be transmitted to, and stored by, Google, on servers in the United States. The following data is stored and transmitted in the cookies:

  • Date and time of website visit
  • Duration of website visit
  • Location and language of the user
  • Browser, operating system and Internet provider of the user
  • Terminal with which the website was accessed
  • Display resolution
  • The user's demographic characteristics such as age and gender
  • User behavior (e.g. which pages within the website are visited)
  • Source from which the website was accessed
  • Search terms entered on the website



IP Anonymization

We have activated the IP anonymization feature on this website. Your IP address will be truncated by Google within the European Union or and the European Economic Area prior to transmission to the United States. Only in exceptional cases is the full IP address sent to a Google server in the US and shortened there. Google will use this information on behalf of the operator of this website to evaluate your use of the website, to compile reports on website activity, and to provide other services regarding website activity and Internet usage for the website operator. The IP address transmitted by your browser within Google Analytics is not merged with other Google data.

Browser plug-in

You can prevent cookies from being saved by setting your browser software accordingly; however, we would like to point out that, in such case, you may not be able to fully utilize all of the functions of this website. You can also prevent the data generated by cookies about your use of the website (incl. your IP address) from being passed to Google, as well as the processing of these data by Google, by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en-GB.

2. Legal basis for processing personal data

The legal basis for processing the personal data of users is Art. 6 para. 1 lit. f GDPR.

3. Purpose of data processing

The processing of users' personal data enables us to analyze the surfing behavior of our users. We are in a position to compile information about the use of the individual components of our website by evaluating the data obtained. This helps us to continuously improve our website and its user-friendliness. For these purposes, our legitimate interest also lies in the processing of personal data pursuant to Art. 6 para. 1 lit. f GDPR. By anonymizing the IP address, users' interest in protecting their personal data is sufficiently taken into account.

4. Duration of storage

The data will be deleted as soon as it is no longer needed for our recording purposes, this will be the case in this instance after 26 months.

5. Objection and deletion options

Cookies are stored on the user's computer and transmitted to our site. Therefore, as a user you have full control over the use of cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to fully use all of the website's features.

On our website, we offer our users the possibility of an opt-out from the analysis procedure. To do this, you must follow the link: Disable Google Analytics. Another cookie is then placed on your system, which signals to our system not to store the user's data. If the user deletes the corresponding cookie from his or her system in the meantime, the opt-out cookie must be reset again. For more information about how Google Analytics handles user data, see Google's privacy policy:  https://support.google.com/analytics/answer/6004245?hl=en

b) Google Analytics Remarketing

1. Scope of the personal data processing

Our websites use the features of Google Analytics Remarketing combined with the cross-device capabilities of Google AdWords and DoubleClick. This is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, U.S.A. This function enables the target groups created with Google Analytics Remarketing to be linked with the cross-device functions of Google AdWords and Google DoubleClick. This allows advertising to be displayed based on your personal interests, identified based on your previous usage and surfing behavior on one device (e.g. your mobile phone), on other devices (such as a tablet or computer). Once you have given your consent, Google will associate your web and app browsing history with your Google Account for this purpose. That way, any device that signs in to your Google Account can use the same personalized promotional messaging. To support this feature, Google Analytics collects Google authenticated user IDs that are temporarily linked to our Google Analytics data to define and create cross-device ad targeting.


The following data is stored and tranmitted in the cookies:

  • Date and time of website visit
  • Duration of website visit
  • Location and language of the user
  • Browser, operating system and Internet provider of the user
  • Terminal with which the website was accessed
  • Display resolution
  • The user's demographic characteristics such as age and gender
  • Browser and web history
  • User behavior (e.g. which pages within the website are visited)
  • Source from which the website was accessed
  • Search terms entered on the website

2. Legal basis for processing personal data

The legal basis for processing the personal data of users is Art. 6 para. 1 lit. f GDPR.

3. Purpose of data processing

The processing of users' personal data enables us to analyze the surfing behavior of our users. We are in a position to compile information about the use of the individual components of our website by evaluating the data obtained. This helps us to continuously improve our website and its user-friendliness. For these purposes, our legitimate interest also lies in the processing of personal data pursuant to Art. 6 para. 1 lit. f GDPR.

4. Duration of storage

The data will be deleted as soon as it is no longer needed for our recording purposes, this will be the case in this instance after 26 months.

5. Objection and deletion options

Cookies are stored on the user's computer and transmitted to our site. Therefore, as a user you have full control over the use of cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to fully use all of the website's features.

On our website, we offer our users the possibility of an opt-out from the analysis procedure. To do this, you must follow the corresponding link: You may permanently object to cross-device remarketing/targeting by disabling personalized advertising in your Google Account by following this link: https://www.google.com/settings/ads/onweb/. Further information and the data protection regulations can be found in Google's Data Protection (Privacy) Policy at: https://www.google.com/policies/technologies/ads/.

c) Google AdWords und Google Conversion-Tracking

1. Scope of the personal data processing

This website uses Google AdWords. AdWords is an online advertising program from Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, United States ("Google"). As part of Google AdWords, we use so-called conversion tracking. When you click on an ad served by Google, a conversion tracking cookie is set. Cookies are small text files that your Internet browser stores on your computer. These cookies expire after 26 months and are not used for personal identification of the user. Should the user visit certain pages on the website and the cookie has not yet expired, Google and the website can tell that the user clicked on the ad and proceeded to that page. Each Google AdWords advertiser has a different cookie. Thus, cookies cannot be tracked using the website of an Adwords advertiser. The information obtained using the conversion cookie is used to create conversion statistics for the Adwords advertisers who have opted for conversion tracking. Customers are told the total number of users who clicked on their ad and were redirected to a conversion tracking tag page.

You can configure your browser to inform you about the use of cookies so that you can decide to accept or reject each cookie. Alternatively, your browser can automatically accept cookies under certain conditions or always reject them, and you can also tell it to automatically delete cookies when closing your browser. Disabling cookies may limit the functionality of this website.

The following data is stored and transmitted in the cookies:

  • Date and time of website visit
  • Duration of website visit
  • Location and language of the user
  • Browser, operating system and Internet provider of the user
  • Terminal with which the website was accessed
  • Display resolution
  • The user's demographic characteristics such as age and gender
  • Browser and web history
  • User behavior (e.g. which pages within the website are visited)
  • Source from which the website was accessed
  • Search terms entered on the website

2. Legal basis for processing personal data

The legal basis for processing the personal data of users is Art. 6 para. 1 lit. f GDPR.

3. Purpose of data processing

The processing of users' personal data enables us to analyze the surfing behavior of our users. We are in a position to compile information about the use of the individual components of our website by evaluating the data obtained. This helps us to continuously improve our website and its user-friendliness. For these purposes, our legitimate interest also lies in the processing of personal data pursuant to Art. 6 para. 1 lit. f GDPR.

4. Duration of storage

The data will be deleted as soon as it is no longer needed for our recording purposes, this will be the case in this instance after 26 months.

5. Objection and deletion options

Cookies are stored on the user's computer and transmitted to our site. Therefore, as a user you have full control over the use of cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to fully use all of the website's features.

If you do not want to participate in tracking, you can opt-out of this by easily disabling the Google Conversion Tracking cookie by changing your browser settings. In doing so, you will not be included in the conversion tracking statistics. Further information and the data protection regulations can be found in Google's Data Protection (Privacy) Policy at: https://www.google.com/policies/technologies/ads/.



d) YouTube

1. Scope of personal data processing

Our website uses plug-ins from YouTube, which is operated by Google. The operator of the pages is YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. If you visit one of our pages which feature a YouTube plugin, a connection is established to the YouTube servers. The YouTube server is then informed about which of our pages you have visited. If you are logged in to your YouTube account, YouTube allows you to associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your YouTube account.

The followign data is stored and transmitted in the cookies:

        • Date and time of website visit
        • Duration of website visit
        • Location and language of the user
        • Browser, operating system and Internet provider of the user
        • Terminal with which the website was accessed
        • Display resolution
        • The user's demographic characteristics such as age and gender
        • User behavior (e.g. which pages within the website are visited)
        • Source from which the website was accessed
        • Search terms entered on the website

2. Legal basis for processing personal data

The legal basis for processing the personal data of users is Art. 6 para. 1 lit. f GDPR.

3. Purpose of data processing

The processing of users' personal data enables us to present our online offers in an appealing manner. This helps us to continuously improve our website and its user-friendliness. For these purposes, our legitimate interest also lies in the processing of personal data pursuant to Art. 6 para. 1 lit. f GDPR.

4. Duration of storage

The data will be deleted as soon as it is no longer needed for our recording purposes, this will be the case in this instance after 26 months.

5. Objection and deletion options

Cookies are stored on the user's computer and transmitted to our site. Therefore, as a user you have full control over the use of cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to fully use all of the website's features. If you are logged in to your YouTube account, YouTube allows you to associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your YouTube account.

Further information about the handling of user data can be found in YouTube's Privacy Policy: https://policies.google.com/privacy/update?hl=en-us.

e) Google Web Fonts

1. Scope of personal data processing

For uniform representation of fonts, this page uses web fonts provided by Google. When you open a page, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly. When you call up a page of our website that contains a social plugin, your browser makes a direct connection with Google servers. Google is therefore aware that our web page was accessed via your IP address. The use of Google Web fonts is done in the interest of a uniform and appealing presentation of our website. This constitutes a justified interest pursuant to Art. 6 para. (1) lit. f GDPR. If your browser does not support web fonts, a standard font is used by your computer.

The following data is stored and transmitted in the cookies:

            • Date and time of website visit
            • Duration of website visit
            • Location and language of the user
            • Browser, operating system and Internet provider of the user
            • Terminal with which the website was accessed
            • Display resolution
            • The user's demographic characteristics such as age and gender
            • User behavior (e.g. which pages within the website are visited)
            • Source from which the website was accessed
            • Search terms entered on the website

2. Legal basis for the processing of personal data

The legal basis for processing the personal data of users is Art. 6 para. 1 lit. f GDPR.

3. The purpose of data processing

The processing of users' personal data enables us to present our online offers in a uniform and appealing manner. This helps us to improve our website and its user-friendliness. For these purposes, our legitimate interest also lies in the processing of personal data pursuant to Art. 6 para. 1 lit. f GDPR.

4. Duration of storage

The data will be deleted as soon as it is no longer needed for our recording purposes, this will be the case in this instance after 26 months.

5. Objection and deletion options

Cookies are stored on the user's computer and transmitted to our site. Therefore, as a user you have full control over the use of cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to fully use all of the website's features.

Further information about handling user data can be found at https://developers.google.com/fonts/faq and in Google's privacy policy at: https://www.google.com/policies/privacy/.  


f) Google Maps

1. Scope of personal data processing

This page uses the map service Google Maps via an API. This is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, U.S.A. To use Google Maps, it is necessary to save your IP address. This information is generally transmitted to a Google server in the USA and stored there. The provider of this site has no influence on this data transfer.

The following data is stored and transmitted in the cookies:

                • Date and time of website visit
                • Duration of website visit
                • Location and language of the user
                • Browser, operating system and Internet provider of the user
                • Terminal with which the website was accessed
                • Display resolution
                • The user's demographic characteristics such as age and gender
                • User behavior (e.g. which pages within the website are visited)
                • Source from which the website was accessed
                • Search terms entered on the website

2. Legal basis for the processing of personal data

The legal basis for processing the personal data of users is Art. 6 para. 1 lit. f GDPR.

3. The purpose of data processing

Die Verarbeitung der personenbezogenen Daten der Nutzer ermöglicht uns eine ansprechende Darstellung unserer Online-Angebote. Dies hilft uns dabei unsere Webseite und deren Nutzerfreundlichkeit stetig zu verbessern. In diesen Zwecken liegt auch unser berechtigtes Interesse in der Verarbeitung der Daten nach Art. 6 Abs. 1 lit. f DSGVO.

4.Duration of storage

The data will be deleted as soon as it is no longer needed for our recording purposes, this will be the case in this instance after 26 months.

5. Objection and deletion options

Cookies are stored on the user's computer and transmitted to our site. Therefore, as a user you have full control over the use of cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to fully use all of the website's features.

Further information about handling user data can be found in Google's privacy policy at https://www.google.de/intl/de/policies/privacy.

IX. Rights of the data subjects

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights with respect to the data controller:

1. The right to information

You can request that the data controller confirm whether we process personal data that concerns you.

If such processing is taking place, you can request to be informed by the data controller regarding the following information:

(1) the purposes for processing the personal data;
(2) the categories of personal data being processed;
(3) the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
(4) the planned storage duration of personal data concerning you or, if specific information in this respect is not possible, criteria for determining the storage period;
(5) the existence of a right of rectification or deletion of personal data that concerns you or of a restriction on processing by the data controller or of a right to object to such processing;
(6) the existence of a right of appeal to a supervisory authority;
(7) any available information on the origin of the data if the personal data has not been collected from the data subject;
(8) the existence of automated decision-making, including profiling in accordance with Art. 22 para. 1 and 4 GDPR and – at least in these cases – meaningful information on the logic involved and the scope and intended effects of such processing for the data subject.


You have the right to request information regarding whether your personal information will be transmitted to a third-party country or an international organization. In this respect, you can request the appropriate guarantees in accordance with Art. 46 GDPR in connection with the transmission.

2. Right of recification

You have a right to correct and/or add to your personal data held by the data controller if it is incorrect or incomplete. The data controller shall make the correction immediately.

3. The right to restrict processing

Under the following conditions, you may request that the processing of personal data concerning you be restricted if:

(1) you dispute the accuracy of the personal data concerning you for a period that enables the data controller to verify the accuracy of the personal data;
(2) the processing is unlawful, and you refuse to delete the personal data and instead request that the use of the personal data be restricted;
(3) the data controller no longer needs the personal data for processing purposes, but you need it to establish, exercise, or defend legal claims; or
(4) you object to the processing in accordance with Art. 21 para. 1 GDPR and it is not yet clear whether the legitimate reasons of the data controller outweigh your reasons.

Where processing of the personal data that concerns you has been restricted, such data – apart from being stored – may be processed only with your consent or for the purpose of asserting, exercising or defending rights or protecting the rights of another natural or legal person or on the grounds of an important public interest of the Union or of a Member State.

If the processing restriction has been done in accordance with the above conditions, you will be informed by the data controller before the restriction is lifted.

4. Right to deletion

a) Deletion obligation

You may request that the data controller delete the personal data that concerns you immediately, and the data controller will be obliged to delete this data immediately if one of the following reasons applies:

(1) the personal data that concerns you is no longer necessary for the purposes for which it was collected or otherwise processed;             (2) you revoke your consent to the processing pursuant to Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR, and where there is no other legal ground for the processing;
(3) you submit an objection to the processing pursuant to Art. 21 para. 1 GDPR, and there are no overriding legitimate grounds for processing, or you submit an objection to the processing according to Art. 21 para. 2 GDPR.
(4) the personal data that concerns you has been processed unlawfully;
(5) the deletion of personal data is required to comply with legal obligations according to Union law or the laws of the Member States to which the data controller is subject.
(6) the personal data that concerns you has been collected in connection with offered information society services pursuant to Art. 8 para. 1 GDPR.

b) Transfer of personal data to third parties

If the data controller has made your personal data public and is required to delete it pursuant to Art. 17 para. 1 GDPR, that data controller shall take appropriate measures, including technical means, while taking into account available technology and implementation costs, to inform the persons responsible for the data processing of the personal data, that you as the data subject have requested deletion of all links to such personal data or of copies or replications of such personal data.

c) Exceptions

The right to deletion does not exist insofar as the processing is necessary
(1) to exercise the right of freedom of expression and information;
(2) for the performance of a legal obligation required for processing under the law of the Union or of the Member States to which the data controller is subject or for the performance of a task in the public interest or in the exercise of official authority conferred to the data controller;
(3) for reasons of public interest in the field of public health in accordance with Art. 9 para. 2 lit. h and i, as well as Art. 9 para. 3 GDPR;
(4) for archiving purposes in the interest of public, scientific or historical research purposes or for statistical purposes in accordance with Art. 89 para. 1 GDPR, to the extent that the law referred to in a) is likely to render impossible or seriously prejudicial the attainment of the objectives of such processing; or
(5) to assert, exercise or defend legal claims.

5. Right to information

If you have exercised your right to have the data controller correct, delete, or limit the processing, this party is obliged to inform all recipients to whom the personal data that concerns you has been disclosed of this correction or deletion of the data or restriction on processing, unless this proves impossible or involves a disproportionate effort. It is your right to have the data controller inform you about these recipients.

6. The right to data portability

You have the right to obtain your personal data, which you have provided to the data controller, in a structured, commonly used and machine-readable format. In addition, you have the right to pass this data on to another data controller without obstruction by the data controller to whom the personal data was provided, insofar as


(1) the processing is based on consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or a contract pursuant to Art. 6 para. 1 lit. b GDPR and
(2) the processing is undertaken using automated procedures.

In exercising this right, you also have the right to request that the personal data concerning you be transferred directly from one data controller to another data controller, insofar as this is technically feasible. The freedoms and rights of other persons must not be affected by this. The right to data portability does not apply to the processing of personal data necessary for the performance of a task in the public interest or in the exercise of official authority conferred on the data controller.

7. Right of objection

You have the right, for reasons arising from your specific situation, to object to the processing of personal data concerning you at any time, which is carried out in accordance with Art. 6 para. 1 lit. e or f GDPR; the same applies to profiling based on these provisions.


The data controller will no longer process the personal data that concerns you, unless the party can prove compelling legitimate reasons for the processing, which outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

If the personal data that concerns you is being processed for direct marketing purposes, you have the right to object at any time to the processing of the personal data that concerns you for the purpose of such marketing; this also applies to profiling, insofar as it is associated with such direct marketing.

If you object to processing that is for direct marketing purposes, the personal data that concerns you will no longer be processed for these purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

8. The right to revoke the data protection declaration of consent

You have the right at any time to revoke your data protection declaration of consent. The revocation of consent shall not affect the legality of any processing undertaken on the basis of this consent before its withdrawal.

9. Automated decision in individual cases, including profiling

You have the right not to be subject to a decision based exclusively on automated processing - including profiling - that has legal effect against you or significantly impairs you in a similar manner. This shall not apply if the decision:


(1) is necessary for the conclusion or fulfillment of a contract between you and the data controller;
(2) is permissible on the basis of legislation of the Union or the Member States, to which the data controller is subject, and these laws contain adequate measures to safeguard your rights and freedoms, as well as your legitimate interests, or
(3) is undertaken with your express consent.

However, these decisions may not be based on special categories of personal data pursuant to Art. 9 para. 1 GDPR, unless Art. 9 para. 2 lit. a or g GDPR and appropriate measures have been taken to protect your rights and freedom as well as your legitimate interests.

In the cases referred to in (1) and (3), the data controller shall take reasonable measures to safeguard your rights, freedoms and legitimate interests, including at least the right to obtain the intervention of a person on the part of the data controller, to state his or her own position and to challenge the decision.

10. The right of appeal to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right of appeal to a supervisory authority, in particular in the Member State where you reside, work or where the infringement is suspected, if you believe that the processing of personal data that concerns you is in contravention of the GDPR.

The supervisory authority with which the appeal has been filed shall inform the appellant of the status and results of the appeal, including the possibility of a judicial remedy under Art. 78 GDPR.