Data Protection

Data Pro­tec­tion State­ment in accord­ance with the Gen­er­al Data Pro­tec­tion Reg­u­la­tion (GDPR)

I. Name and address of respons­ible party
The respons­ible party in the sense of the Gen­er­al Data Pro­tec­tion Reg­u­la­tion and oth­er nation­al data pro­tec­tion laws by mem­ber states as well as oth­er leg­al data pro­tec­tion pro­vi­sions is:

Prof. Thome Group

c/o IBIS Prof. Thome AG
Tele­phone: +49 931 73046 500
Fax: +49 931 73046 99 500
Email: info@prof-thome-gruppe.de
web site: www.prof-thome-gruppe.de

 

II. Name and address of data pro­tec­tion officer
The respons­ible party’s data pro­tec­tion officer is:

Attor­ney
Kon­stantin Mala­kas
Stein­bachtal 2b
97072 Würzburg
Tele­phone. +49 931 29 98 08 – 0
Fax: +49 931 29 98 08 – 8
Email: dsb@prof-thome-gruppe.de
Web sites: www.malakas.de; www.weblawyer.de

 

III. Gen­er­al inform­a­tion regard­ing data pro­cessing

1. Scope of pro­cessing of per­son­al inform­a­tion
In prin­ciple, we col­lect and use our users’ per­son­al inform­a­tion only to the extent neces­sary to provide a func­tion­al web site and our con­tents and ser­vices. The col­lec­tion and use of our users’ per­son­al inform­a­tion takes place on a peri­od­ic­al basis only after the user’s con­sent has been obtained. An excep­tion is made in cases where it is impossible to obtain pri­or per­mis­sion due to prac­tic­al reas­ons and the pro­cessing of the data is allow­able under leg­al pro­vi­sions.

2. Leg­al basis for the pro­cessing of per­son­al inform­a­tion
Whenev­er we obtain the con­sent of the per­son con­cerned for the pro­cessing of per­son­al inform­a­tion, this is car­ried out with­in the leg­al frame­work of Art. 6 Par. 1 lett. a EU Gen­er­al Data Pro­tec­tion Reg­u­la­tion (GDPR).
In the pro­cessing of per­son­al inform­a­tion neces­sary to ful­fill a con­tract to which the per­son con­cerned is a con­trac­tu­al party, Art. 6 Par. 1 lett. b GDPR provides the leg­al frame­work. This also applies to pro­cessing required to carry out pre-con­trac­tu­al meas­ures.
Where pro­cessing of per­son­al inform­a­tion is required to ful­fill a leg­al oblig­a­tion to which our com­pany is sub­ject, this is done with­in the leg­al frame­work of Art. 6 Par. 1 lett. c GDPR.
In the event that vital interests of the per­son con­cerned or anoth­er nat­ur­al per­son require pro­cessing of per­son­al inform­a­tion, Art. 6 Par. 1 lett. d GDPR provides the leg­al frame­work.
Where pro­cessing is required to safe­guard a jus­ti­fied interest of our com­pany or a third party and these are not out­weighed by the interests, fun­da­ment­al rights or fun­da­ment­al freedoms of the per­son con­cerned, Art. 6 Par. 1 lett. f GDPR provides the leg­al frame­work.

3. Dele­tion of data and dur­a­tion of data reten­tion
The per­son­al inform­a­tion of the per­son con­cerned will be deleted or blocked as soon as the pur­pose of retain­ing such inform­a­tion has lapsed. Reten­tion can also occur when it is stip­u­lated under European or nation­al law in reg­u­la­tions, laws or oth­er pro­vi­sions which are leg­ally val­id in the EU and to which the respons­ible parties are sub­ject. Block­ing or dele­tion of data also occurs upon the lapse of a pre­scribed reten­tion peri­od under the stand­ards men­tioned above unless fur­ther reten­tion of the data is required for the con­clu­sion or ful­fill­ment of a con­tract.

 

IV. Pro­vi­sion of the web site and cre­ation of log files

1. Descrip­tion and scope of data pro­cessing

Each time our Inter­net site is accessed, our sys­tem auto­mat­ic­ally col­lects data and inform­a­tion from the access­ing computer’s sys­tem.
The fol­low­ing data are col­lec­ted in this pro­cess:
(1) inform­a­tion regard­ing the browser type and the ver­sion being used
(2) the user’s oper­at­ing sys­tem
(3) the user’s Inter­net ser­vice pro­vider
(4) the user’s IP address
(5) date and time of access
(6) web sites from which the user’s sys­tem accessed our Inter­net page
(7) web sites accessed from the user’s sys­tem via our web site
These data are also retained in our system’s log files. These data are not retained togeth­er with oth­er per­son­al inform­a­tion of the user.

2. Leg­al basis for data pro­cessing
The leg­al basis for the tem­por­ary reten­tion of data and log files rests on Art. 6 Par. 1 lett. f GDPR.

3. Pur­pose of data pro­cessing
Tem­por­ary reten­tion of the IP address by the sys­tem is required to allow the web site to be provided to the web site on the user’s com­puter. This pro­cess requires reten­tion of the user’s IP address for the dur­a­tion of the ses­sion.
Reten­tion in the log files takes place to ensure the web site’s func­tion­al­ity. Moreover, the data enable us to optim­ize the web site and safe­guard the secur­ity of our tech­nic­al inform­a­tion sys­tems. Review of the data for mar­ket­ing pur­poses does not occur in this regard.
For such pur­poses, our jus­ti­fied interest in the data pro­cessing is based on Art. 6 Par. 1 lett. f GDPR.

4. Dur­a­tion of reten­tion
The data will be deleted at the point where they are no longer needed to achieve the pur­pose for which they were col­lec­ted. Where data are col­lec­ted to provide access to the web site, this point is reached when the respect­ive ses­sion has been com­pleted.
Where data is retained in log files, this occurs after 14 days. Fur­ther reten­tion is a pos­sib­il­ity. Where this occurs, users’ IP addresses are pseud­onym­ized or anonym­ized to pre­vent any asso­ci­ation with the access­ing cli­ent.

5. Option for objec­tion and remov­al
The col­lec­tion of data for the access­ing of the web site and the reten­tion of the data in log files are essen­tial to the oper­a­tion of the Inter­net page. As a res­ult, the user has no option to object to this col­lec­tion.

 

V. Use of cook­ies

1. Descrip­tion and scope of data pro­cessing
In design­ing our offer to be as user-friendly as pos­sible, we employ cook­ies.
A cook­ie is a small text file sent by our web serv­er at the Prof. Thome Group (for example, the web serv­er at www.prof-thome-gruppe.de) to your browser whenev­er you vis­it a web page. This cook­ie con­tains a unique char­ac­ter string that facil­it­ates pre­cise iden­ti­fic­a­tion of the browser when the web site is accessed again. Ses­sion cook­ies expire at the end of a browser ses­sion and can only cap­ture your actions dur­ing this single browser ses­sion. In con­trast, per­man­ent cook­ies con­tin­ue to be retained on your ter­min­al even between dif­fer­ent browser ses­sions and can cap­ture your set­tings or actions on mul­tiple web pages.
In prin­ciple, cook­ies present no risk to your com­puter since they are merely text files, not execut­able pro­grams.
On one hand, the cook­ies used by the Prof. Thome Group (www.prof-thome-gruppe.de) facil­it­ate use of our web site, while on the oth­er hand they per­mit mar­ket research and advert­ising efforts as well as the com­pil­ing of usage stat­ist­ics. We also employ cook­ies in the con­text of web track­ing, using them as the basis for per­son­al­ized con­tents.
Besides ses­sion cook­ies, which are deleted when you ter­min­ate your browser ses­sion, we also store per­man­ent cook­ies on your com­puter. These cook­ies are retained until you delete them. No per­son­al inform­a­tion is retained in the cook­ies we use.
Depend­ing on your browser set­ting, cook­ie files are either retained or rejec­ted. If they are retained, our web serv­er is able to detect your ter­min­al. In later ses­sions and in mov­ing between func­tions that require you to enter a pass­word, the cook­ie assists you in avoid­ing hav­ing to re-enter cer­tain inform­a­tion. In this way, cook­ies facil­it­ate the use of our web pages that require user input. In addi­tion, cook­ies can assist us in being able to cus­tom-tail­or web offers to match your interests.
If you prefer that these actions not take place, you can deac­tiv­ate cook­ies as fol­lows:
Set your browser to reject our cook­ies if you prefer to use our web sites without cook­ie func­tion­al­ity. The steps required for you to estab­lish these set­tings can vary from one browser to the next, and we are there­fore unable to provide you with more pre­cise guid­ance here.
If your browser is already set to warn you each time it receives a cook­ie, you can then decide on a case-by-case basis wheth­er you wish to allow the cook­ie to be stored. Since it will be neces­sary for our iden­ti­fic­a­tion cook­ie to be re-sent each time you access the web site, you may soon find these mes­sages quite incon­veni­ent.
For this reas­on, we recom­mend that you set your browser to accept cook­ies from www.prof-thome-gruppe.de each time they are sent. It is pos­sible for you to estab­lish this set­ting for indi­vidu­al web pages. In this case, for example, your text inputs will be retained in form fields for future quer­ies, and you will not need to re-enter your inform­a­tion each time you vis­it our web sites. In addi­tion, we will then be able to offer you con­tents tailored to your per­son­al interests.
Some ele­ments of our Inter­net site require the access­ing browser to be iden­ti­fi­able each time a new page is accessed.
For these pur­poses, the fol­low­ing inform­a­tion is retained in the cook­ies and trans­mit­ted:

(1) Lan­guage set­tings

User data cap­tured in this way are anonym­ized through tech­nic­al means. This pre­vents the inform­a­tion from being asso­ci­ated with the access­ing user. The data are not stored togeth­er with oth­er per­son­al inform­a­tion per­tain­ing to the user.
When users access our web site, an inform­a­tion lay­er provides inform­a­tion regard­ing the use of cook­ies for ana­lyt­ic­al pur­poses and refers users to this Data Pro­tec­tion State­ment. Inform­a­tion is also provided here on how to set the browser to pre­vent the stor­age of cook­ies.
You can find fur­ther inform­a­tion on using or deac­tiv­at­ing cook­ies at www.meine-cookies.org or www.youronlinechoices.com.
For secur­ity pur­poses, regard­less wheth­er cook­ies are stored, you will need to log in again each time you access areas of our web site that require you to register.

a) Third-party cook­ies
The Prof. Thome Gruppe also incor­por­ates third-party con­tents at the Prof. Thome Group’s web site. These third parties can store cook­ies on your com­puter when you access our web pages and in this way determ­ine that you have accessed our web pages via www.prof-thome-gruppe.de. We invite you to access the third-party web sites to obtain fur­ther inform­a­tion on their use of cook­ies. If you have made the decision not to per­mit shar­ing of cook­ies or to object to such actions (deac­tiv­ate the cook­ies), you will only have access to func­tions we can provide at our web site without these cook­ies.
b) Social media (Face­book, Google+ and You­Tube, Twit­ter)
You can also find our company’s ser­vices on-line through social net­works provided on the Inter­net by oth­er com­pan­ies (Face­book, Google and You­Tube, Twit­ter).
You can use these ser­vices only by regis­ter­ing and log­ging into each social net­work. You should there­fore be aware that each social network’s terms of use and data pro­tec­tion apply when using its respect­ive ser­vices.
Our web site uses social plug-ins from the fol­low­ing social net­works:
• Face­book Ire­land Lim­ited, Han­over Reach, 5 – 7 Han­over Quay, Dub­lin 2 Ire­land, iden­ti­fi­able through the Face­book logo (white “f” on a blue back­ground)
• Google+, oper­ated by Google Inc., 1600 Amphi­theatre Park­way, Moun­tain View, CA 94043, United States, iden­ti­fi­able through the Google+ logo (red “G” fol­lowed by “+1”)
• Twit­ter, a micro-blog­ging ser­vice of the U.S. Com­pany Twit­ter Inc., 795 Fol­som St., Suite 600, San Fran­cisco, CA 94107, United States, iden­ti­fi­able through the Twit­ter logo (a blue bird)
• You­Tube: You­Tube, LLC, 901 Cherry Ave., San Bruno, CA 94066, United States. You­Tube, LLC is a sub­si­di­ary of Google Inc., 1600 Amphi­theatre Pkwy, Moun­tain View, CA 94043 – 1351, United States.
Whenev­er you access one of our web pages con­tain­ing a You­Tube com­pon­ent, your browser estab­lishes a dir­ect con­nec­tion to the You­Tube serv­ers. The con­tents of the com­pon­ents are trans­mit­ted dir­ectly to your browser by You­Tube, which incor­por­ates them into the web site.
By incor­por­at­ing these com­pon­ents, You­Tube and Google receive the inform­a­tion that you have accessed our company’s cor­res­pond­ing web site. If you are logged into You­Tube, You­Tube and Google can con­nect the ses­sion to your You­Tube account.
If you prefer that your inform­a­tion not be trans­mit­ted to You­Tube and Google in this way, you can pre­vent the trans­mis­sion by log­ging off your You­Tube account pri­or to access­ing our web pages.

Because we have no influ­ence on the scope of the data these ser­vice pro­viders col­lect using their plug-ins, we are shar­ing what we know about it with you. Through its incor­por­ated plug-ins, each ser­vice pro­vider receives inform­a­tion that you have accessed the cor­res­pond­ing area of our web site. If you are logged into the respect­ive ser­vice pro­vider, that pro­vider can asso­ci­ate this access dir­ectly with your account. If you inter­act with the plug-ins — by click­ing the recom­mend but­ton, for example — the cor­res­pond­ing inform­a­tion will be dir­ectly trans­mit­ted to the ser­vice pro­vider and retained there. If you are not sub­scribed to a ser­vice pro­vider, it is assumed that the respect­ive ser­vice pro­vider has gained know­ledge of your IP address and retained it. If you are sub­scribed to a ser­vice pro­vider and prefer that it not col­lect inform­a­tion about you through our Inter­net site and asso­ci­ate this inform­a­tion with the sub­scriber data stored by that ser­vice pro­vider, you must log off that ser­vice pro­vider pri­or to click­ing on the social network’s but­ton.
To request fur­ther inform­a­tion regard­ing the pur­pose and scope of data col­lec­tion and the fur­ther pro­cessing and use of the data by Face­book as well the set­ting options avail­able to you for the pro­tec­tion of your pri­vacy, please con­sult the data pro­tec­tion guidelines of the respect­ive ser­vice pro­vider:
Face­book: https://www.facebook.com/privacy/explanation and http://www.facebook.com/full_data_use_policy
Google+ and You­Tube: http://www.google.com/intl/de/policies/privacy/
Twit­ter: http://twitter.com/privacy

2. Leg­al basis for the pro­cessing of per­son­al inform­a­tion
The leg­al basis for the pro­cessing of the data when the user has giv­en con­sent is Art. 6 Par. 1 lett. a GDPR.
The leg­al basis for the pro­cessing of data trans­mit­ted in the course of using plug-ins is Art. 6 Par. 1 lett. f GDPR.

3. Pur­pose of data pro­cessing
The pur­pose of our use of tech­nic­ally neces­sary cook­ies is to sim­pli­fy the use of web sites by the user. Some func­tions of our Inter­net site can­not be offered without employ­ing cook­ies. For these func­tions, it is neces­sary for the browser to be iden­ti­fied even after mov­ing to the next page.
The user data col­lec­ted by tech­nic­ally required cook­ies are not used to cre­ate user pro­files.
The use of ana­lyt­ic­al cook­ies occurs for the pur­pose of improv­ing the qual­ity of our web site and its con­tents. Through the use of ana­lyt­ic­al cook­ies, we learn how the web site is used and can in this way con­stantly refine our offer­ings.
Google uses cook­ies espe­cially to com­pile web stat­ist­ics.
We use cook­ies from social media pro­viders to offer users the oppor­tun­ity to inter­act with the addi­tion­al ser­vices they use.
For such pur­poses, our jus­ti­fied interest in the data pro­cessing is based on Art. 6 Par. 1 lett. f GDPR.

4. Reten­tion peri­od
Cook­ies will be stored on the user’s com­puter and sub­sequently trans­mit­ted to our site. In this way, you as the user also have com­plete con­trol over the use of cook­ies. By chan­ging the set­tings on your Inter­net browser, you can deac­tiv­ate or restrict the trans­mis­sion of cook­ies. Cook­ies that have already been retained can be deleted at any time. This can occur auto­mat­ic­ally.
With respect to the dur­a­tion of reten­tion by the respect­ive social media pro­viders and your rights and con­fig­ur­a­tion options to pro­tect your pri­vacy, we refer you each ser­vice provider’s data pro­tec­tion guidelines, access­ible via the links provided above.
Please note that when cook­ies are deleted, opt-out cook­ies may also be mis­takenly deleted in the pro­cess, pro­du­cing an unin­ten­ded effect. If you delete all the cook­ies in your browser, you will then need to reset each respect­ive opt-out cook­ie.

5. Objec­tion and remov­al option
You have the option at all times to deac­tiv­ate the cook­ie set­ting in your browser as described in Sec. V. 1. If no act­ive deac­tiv­a­tion occurs, remov­al is pos­sible only through dele­tion on your sys­tem. There is no right of objec­tion based on tech­nic­al reas­ons.
With respect to objec­tion and remov­al options provided by the respect­ive social media pro­viders and your rights and con­fig­ur­a­tion options to pro­tect your pri­vacy, we refer you each ser­vice provider’s data pro­tec­tion guidelines, access­ible via the links provided above

 

VI. Con­tact form and email con­tact

1. Descrip­tion and scope of data pro­cessing
Our Inter­net site fea­tures con­tact forms that can be used for mak­ing con­tact elec­tron­ic­ally. When a user makes use of these options, the data entered into the input mask are trans­mit­ted to us for reten­tion. This includes the fol­low­ing data:
(1) name (man­dat­ory field)
(2) email address (man­dat­ory field)
(3) your inform­a­tion (man­dat­ory field)
In the trans­mis­sion pro­cess, the fol­low­ing data are also retained:
(1) the user’s IP address
(2) date and time of con­tact and trans­mis­sion of the con­tact form
For data pro­cessing, your con­sent is obtained as part of the trans­mis­sion pro­cess and you are referred to this data pro­tec­tion state­ment.
It is also pos­sible to make con­tact using the provided email address. In this case, the user’s trans­mit­ted per­son­al inform­a­tion is stored along with the email.
When this occurs, no third parties out­side the Prof. Thome Gruppe are giv­en access to the data. The data are used exclus­ively for the pro­cessing of the cor­res­pond­ence.

2. Leg­al basis for the pro­cessing of per­son­al inform­a­tion
The leg­al basis for the pro­cessing of the data, when the user has giv­en con­sent, is Art. 6 Par. 1 lett. a GDPR.
The leg­al basis for the pro­cessing of data trans­mit­ted in the course of send­ing email is Art. 6 Par. 1 lett. f GDPR. Where the email con­tact is based on the con­clu­sion of a con­tract, the addi­tion­al leg­al basis for the data pro­cessing is Art. 6 Par. 1 lett. b GDPR.

3. Pur­pose of data pro­cessing
The pro­cessing of per­son­al inform­a­tion from the input mask only allows us to pro­cess the con­tact. In the case con­tact is made via email, the required jus­ti­fied interest is based on the pro­cessing of the data.
The oth­er per­son­al inform­a­tion pro­cessed dur­ing the trans­mis­sion pro­cess serves to pre­vent any mis­use of the con­tact form and to safe­guard the secur­ity of our inform­a­tion sys­tem tech­no­logy.

4. Reten­tion peri­od
The data will be deleted at the point where they are no longer needed to achieve the pur­pose for which they were col­lec­ted. For per­son­al inform­a­tion from the input mask or sent by email, this occurs when the respect­ive cor­res­pond­ence with the user has been com­pleted. The cor­res­pond­ence is deemed com­pleted when it can be determ­ined from the cir­cum­stances that the rel­ev­ant facts have been con­clus­ively settled.
The data addi­tion­ally col­lec­ted dur­ing the trans­mis­sion pro­cess will be deleted with­in no more than 14 days.

5. Objec­tion and remov­al option
The user has the option at all times to revoke con­sent to the pro­cessing of the user’s per­son­al inform­a­tion. The user can con­test the reten­tion of per­son­al inform­a­tion at any time by con­tact­ing us via email. In such a case, the cor­res­pond­ence can­not be for­war­ded. Please send your dele­tion pref­er­ence via email to info@prof-thome-gruppe.de.
All per­son­al inform­a­tion retained in the course of the con­tact will be deleted in this case.

 

VII. Web ana­lys­is using Mat­omo

1. Scope of per­son­al inform­a­tion pro­cessing
At our web site, we use the Mat­omo (https://matomo.org/) soft­ware to ana­lyze our users’ web-surf­ing beha­vi­or. The soft­ware places a cook­ie in the user’s com­puter (see above regard­ing cook­ies). When indi­vidu­al pages of our web site are accessed, the fol­low­ing inform­a­tion is retained:

(1) three bytes of the IP address of the access­ing user’s sys­tem (xxx.xxx.xxx.???)
(2) web page being accessed
(3) web site from which the user has con­nec­ted to the accessed web site (refer­rer)
(4) sub­pages that are accessed from the accessed web site
(5) length of time spent at the web page
(6) fre­quency of access to the web page
(7) search terms entered
(8) fre­quency of page access

In this pro­cess, the eval­u­ation soft­ware runs exclus­ively on our own serv­ers. There is no reten­tion of the user’s per­son­al inform­a­tion since the IP address is anonym­ized. The soft­ware set­ting does not com­pletely retain the IP address, instead mask­ing 1 byte of the IP address (example: xxx.xxx.xxx.???). This action pre­vents the abbre­vi­ated IP address from being asso­ci­ated with the access­ing com­puter.
There is no trans­fer of data to third parties.

2. Leg­al basis for the pro­cessing of per­son­al inform­a­tion
The leg­al basis for the pro­cessing of the user’s per­son­al inform­a­tion is Art. 6 Par. 1 lett. f GDPR until the user’s IP address is anonym­ized. This occurs at the earli­est pos­sible moment (see https://matomo.org/privacy/ ).

3. Pur­pose of data pro­cessing
The pro­cessing of the user’s per­son­al inform­a­tion, which is anonym­ized at the earli­est pos­sible moment, allows us to ana­lyze our users’ web-surf­ing beha­vi­or. By ana­lyz­ing the data we col­lect, we are able to com­pile inform­a­tion regard­ing the use of the indi­vidu­al com­pon­ents of our web site. This assists us in con­tinu­ously improv­ing our web site and its user-friend­li­ness.

4. Reten­tion peri­od
Because the data are anonym­ized, they are not deleted, remain­ing per­man­ently avail­able to us for pur­poses of ana­lys­is. No asso­ci­ation with an indi­vidu­al user is pos­sible. Mat­omo has made the com­mit­ment nev­er to merge the data it col­lects with oth­er data­bases — for the pur­pose of estab­lish­ing a per­son­al rela­tion­ship, for example (see https://matomo.org/privacy/ ).

5. Objec­tion and remov­al option
Mat­omo cook­ies are retained on the user’s com­puter, from where they are trans­mit­ted to our site. In this way, you as the user also have com­plete con­trol over the use of cook­ies. By chan­ging the set­tings on your Inter­net browser, you can deac­tiv­ate or restrict the trans­mis­sion of cook­ies at any time. Cook­ies that have already been retained can be deleted at any time. This can occur auto­mat­ic­ally. If cook­ies for our web site are deac­tiv­ated, all web site func­tions may no longer be fully usable.
At our web site, we offer our users the option to opt out of the ana­lys­is pro­cess. This option adds a cook­ie to your sys­tem that sig­nals that the user’s data are not to be retained. Please note that when cook­ies are deleted, opt-out cook­ies may also be mis­takenly deleted in the pro­cess, pro­du­cing an unin­ten­ded effect.

Fur­ther inform­a­tion regard­ing Mat­omo Software’s pri­vacy set­tings can be obtained at the fol­low­ing link: https://matomo.org/privacy/

 

VIII. Rights of the per­sons con­cerned
If per­son­al inform­a­tion con­cern­ing you is pro­cessed, you are a per­son con­cerned in the sense of the GDPR, and you are entitled to the fol­low­ing rights vis-a-vis the respons­ible parties:

1. Right to inform­a­tion
You can demand a state­ment from the respons­ible party indic­at­ing wheth­er per­son­al inform­a­tion con­cern­ing you is being pro­cessed by us.
If such pro­cessing is occur­ring, you can demand the fol­low­ing inform­a­tion from the respons­ible party:
(1) the pur­poses for which the per­son­al inform­a­tion is being pro­cessed;
(2) the cat­egor­ies of per­son­al inform­a­tion being pro­cessed;
(3) the receiv­ers and the cat­egor­ies of receiv­er to which the per­son­al inform­a­tion con­cern­ing you has been or is still to be dis­closed;
(4) the anti­cip­ated dur­a­tion of reten­tion of the per­son­al inform­a­tion con­cern­ing you or, should spe­cif­ic inform­a­tion regard­ing this mat­ter not be pos­sible, cri­ter­ia for determ­in­ing the reten­tion peri­od;
(5) the exist­ence of a right to cor­rect or delete the per­son­al inform­a­tion con­cern­ing you, a right to restrict the respons­ible party’s pro­cessing of the inform­a­tion, or a right to con­test this pro­cessing;
(6) the exist­ence of a right to appeal to a reg­u­lat­ory author­ity;
(7) all avail­able inform­a­tion regard­ing the data source if the per­son­al inform­a­tion is not col­lec­ted by the per­son con­cerned;
(8) the exist­ence of auto­mat­ic decision mak­ing includ­ing pro­fil­ing in accord­ance with Art. 22 Pars. 1 and 4 GDPR and – at least in these cases – mean­ing­ful inform­a­tion regard­ing the logic involved as well as the scope and inten­ded effect of such pro­cessing on the per­son con­cerned.
You have the right to demand to know wheth­er the per­son­al inform­a­tion con­cern­ing you is being trans­mit­ted to a third coun­try or an inter­na­tion­al organ­iz­a­tion. In this con­text, you can demand to be informed regard­ing the spe­cif­ic guar­an­tees under Art. 46 GDPR in con­nec­tion with the inform­a­tion trans­fer.

2. Right to rec­ti­fic­a­tion
You have a right to rec­ti­fic­a­tion and/or com­ple­tion vis-a-vis the respons­ible party to the extent that the pro­cessed per­son­al inform­a­tion con­cern­ing you is incor­rect or incom­plete. The respons­ible party must promptly carry out the rec­ti­fic­a­tion.

3. Right to restrict pro­cessing
Under the fol­low­ing con­di­tions, you can demand restric­tion of the pro­cessing of per­son­al inform­a­tion con­cern­ing you:
(1) if you dis­pute the accur­acy of the per­son­al inform­a­tion con­cern­ing you for a peri­od that allows the respons­ible party to check the accur­acy of the per­son­al inform­a­tion;
(2) if the pro­cessing is unlaw­ful and you decline dele­tion of the per­son­al inform­a­tion, demand­ing instead restric­tion of the use of the per­son­al inform­a­tion;
(3) if the respons­ible party no longer has need of the per­son­al inform­a­tion for the pur­poses of the pro­cessing but you need the inform­a­tion to assert, exer­cise or defend against a leg­al claim, or
(4) if you have filed an objec­tion to the pro­cessing in accord­ance with Art. 21 Par. 1 GDPR and it remains uncer­tain wheth­er the respons­ible party’s jus­ti­fied reas­ons out­weigh your own reas­ons.
If the pro­cessing of the per­son­al inform­a­tion con­cern­ing you has been restric­ted, such data — apart from their reten­tion — may only be pro­cessed with your con­sent or to assert, exer­cise or defend against a leg­al claim or to pro­tect the rights of anoth­er nat­ur­al per­son or leg­al entity or based on a sig­ni­fic­ant pub­lic interest on the part of the Uni­on or a mem­ber state.
If the pro­cessing restric­tion is car­ried out under the above-men­tioned con­di­tions, you will be informed by the respons­ible party pri­or to any lift­ing of the restric­tion.

4. Right to dele­tion
a) Dele­tion respons­ib­il­ity
You can demand that the respons­ible party imme­di­ately delete the per­son­al inform­a­tion con­cern­ing you, and the respons­ible party is required to delete these data provided that one of the fol­low­ing reas­ons applies:
(1) The per­son­al inform­a­tion con­cern­ing you is no longer needed for the pur­poses for which it was col­lec­ted or oth­er­wise pro­cessed.
(2) You revoke your con­sent on which the pro­cessing is based in accord­ance with Art. 6 Par. 1 lett. a or Art. 9 Par. 2 lett. a GDPR and no oth­er leg­al basis for the pro­cessing exists .
(3) You file an objec­tion to the pro­cessing in accord­ance with Art. 21 Par. 1 GDPR and there are no over­rid­ing reas­ons for the pro­cessing, or you file an objec­tion to the pro­cessing in accord­ance with Art. 21 Par. 2 GDPR.
(4) The per­son­al inform­a­tion con­cern­ing you was unlaw­fully pro­cessed.
(5) The dele­tion of the per­son­al inform­a­tion con­cern­ing you is required for ful­fill­ment of a leg­al oblig­a­tion under Uni­on law or the law of a mem­ber state to which the respons­ible party is sub­ject.
(6) The per­son­al inform­a­tion con­cern­ing you was col­lec­ted in rela­tion to provided inform­a­tion soci­ety ser­vices in accord­ance with Art. 8 Par. 1 GDPR.
b) Dis­clos­ing inform­a­tion to third parties
If the respons­ible party has dis­closed the per­son­al inform­a­tion con­cern­ing you and if that party is required to delete the inform­a­tion in accord­ance with Art. 17 Par. 1 GDPR, the party must inform those respons­ible for pro­cessing these data that, as a per­son con­cerned, you have deman­ded the dele­tion of all links to this per­son­al inform­a­tion or from cop­ies or rep­licas of this per­son­al inform­a­tion.
c) Excep­tions
The right to dele­tion does not exist if the pro­cessing is required
(1) for exer­cise of the right of free­dom of expres­sion and inform­a­tion;
(2) to ful­fill a leg­al oblig­a­tion requir­ing the pro­cessing under the law of the Uni­on or its mem­ber states to which the respons­ible party is sub­ject, or to carry out a duty in the pub­lic interest or in the exer­cise of offi­cial author­ity gran­ted to the respons­ible party;
(3) for reas­ons of pub­lic interest in the area of pub­lic health in accord­ance with Art. 9 Par. 2 letts. h and i and Art. 9 Par. 3 GDPR;
(4) for archiv­ing pur­poses in the pub­lic interest, sci­entif­ic or his­tor­ic­al research pur­poses in accord­ance with Art. 89 Par. 1 GDPR to the extent that the right des­ig­nated under sec­tion a) is expec­ted to pre­clude or ser­i­ously affect the achieve­ment of the goals of this pro­cessing, or
(5) to assert, exer­cise or defend against leg­al claims.

5. Right to inform­a­tion
If you have asser­ted against the respons­ible party your right to rec­ti­fy or delete the data or restrict its pro­cessing, that party is oblig­ated to com­mu­nic­ate to all receiv­ers of the data this rec­ti­fic­a­tion or dele­tion of the data or restric­tion of its pro­cessing unless this proves to be impossible or involves dis­pro­por­tion­ate effort.
You have the right to be informed by the respons­ible party regard­ing these receiv­ers.

6. Right to data port­ab­il­ity
You have the right to receive in a struc­tured, cur­rent and machine-read­able format the per­son­al inform­a­tion con­cern­ing you that the respons­ible party has made avail­able to you . In addi­tion, you have the right to trans­fer to anoth­er respons­ible party the per­son­al inform­a­tion con­cern­ing you without inter­fer­ence from the respons­ible party to which the per­son­al inform­a­tion was made avail­able, provided that (1) the pro­cessing is based either on a con­sent in accord­ance with Art. 6 Par. 1 lett. a GDPR or Art. 9 Par. 2 lett. a GDPR or on a con­tract in accord­ance with Art. 6 Par. 1 lett. b GDPR and (2) the data are pro­cessed using auto­mated pro­ced­ures.
In the exer­cise of this right, you have a fur­ther right to have the per­son­al inform­a­tion con­cern­ing you dir­ectly trans­ferred from one respons­ible party to anoth­er respons­ible party to the extent tech­nic­ally pos­sible. The freedoms and rights of oth­er per­sons may not be affected in this pro­cess.
The right to data port­ab­il­ity does not apply to the pro­cessing of per­son­al inform­a­tion required to carry out a duty in the pub­lic interest or in the exer­cise of offi­cial author­ity gran­ted to the respons­ible party;

7. Right of objec­tion
For reas­ons arising from your par­tic­u­lar situ­ation, you have the right at any time to file an objec­tion to the pro­cessing of the per­son­al inform­a­tion con­cern­ing you that is based on Art. 6 Par. 1 lett. e or f GDPR; this also applies to any pro­fil­ing based on these pro­vi­sions.
The respons­ible party may no longer pro­cess the per­son­al inform­a­tion con­cern­ing you unless it can provide evid­ence of com­pel­ling and legit­im­ate reas­ons for the pro­cessing that out­weigh your interests, rights and freedoms or the pro­cessing is in sup­port of an asser­tion of, exer­cise of or defense against a leg­al claim.
Where the per­son­al inform­a­tion con­cern­ing you is pro­cessed in con­nec­tion with activ­it­ies involving dir­ect pro­mo­tion, you have the right at any time to file an objec­tion to the pro­cessing of the per­son­al inform­a­tion con­cern­ing you for the pur­poses of such pro­mo­tions; this also applies to pro­fil­ing to the extent that it is asso­ci­ated with such dir­ect pro­mo­tion.
If you con­test the pro­cessing for pur­poses of dir­ect pro­mo­tion, the per­son­al inform­a­tion con­cern­ing you may no longer be pro­cessed for these pur­poses.
You have the option in con­nec­tion with your use of ser­vices of the inform­a­tion soci­ety – not­with­stand­ing Dir­ect­ive 2002/58/EC – to exer­cise your right of objec­tion by means of auto­mated pro­ced­ures that util­ize tech­nic­al spe­cific­a­tions.

8. Right to revoke your declar­a­tion of con­sent under data pro­tec­tion reg­u­la­tions
You have the right at any time to revoke your declar­a­tion of con­sent under data pro­tec­tion reg­u­la­tions. Revoc­a­tion of con­sent does not affect the law­ful­ness of con­sent-based pro­cessing that took place pri­or to the revoc­a­tion.

9. Auto­mated decision mak­ing includ­ing pro­fil­ing
You have the right not to be sub­jec­ted to a decision based exclus­ively on auto­mated decision mak­ing – includ­ing pro­fil­ing – that has leg­al effect on you or sig­ni­fic­antly affects you in a sim­il­ar way. This does not apply if the decision
(1) is required for the con­clu­sion or ful­fill­ment of a con­tract between you and the respons­ible party,
(2) is allow­able accord­ing to legis­la­tion of the Uni­on or its mem­ber states to which the respons­ible party is sub­ject and this legis­la­tion con­tains appro­pri­ate meas­ures to safe­guard your rights and freedoms as well as your jus­ti­fied interests or
(3) takes place with your express con­sent.
These decisions may not be based, how­ever, on spe­cif­ic cat­egor­ies of per­son­al inform­a­tion in accord­ance with Art. 9 Par. 1 GDPR unless either Art. 9 Par. 2 letts. a or g GDPR apply and appro­pri­ate meas­ures have been taken to pro­tect your rights and freedoms as well as your jus­ti­fied interests.
With respect to the cases spe­cified in (1) and (3), the respons­ible party must take appro­pri­ate meas­ures to safe­guard rights and freedoms as well as your jus­ti­fied interests, min­im­ally includ­ing the right to a per­son­al inter­ven­tion on the part of the respons­ible party, a present­a­tion of your own pos­i­tion and an appeal against the decision.

10. Right to appeal to a reg­u­lat­ory author­ity
Without pre­ju­dice to oth­er admin­is­trat­ive sanc­tions or judi­cial rem­ed­ies, you are entitled to appeal to a reg­u­lat­ory author­ity, espe­cially one in the mem­ber coun­try of your res­id­ence, work­place or the site of the alleged viol­a­tion if you believe that the pro­cessing of the per­son­al inform­a­tion con­cern­ing you is con­trary to the GDPR.
The reg­u­lat­ory author­ity hear­ing the appeal will inform the appel­lant regard­ing the status and out­come of the appeal, includ­ing the pos­sib­il­ity of judi­cial appeal under Art. 78 GDPR.