If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights
with respect to the data controller:
1. Right to information
You can request that the data controller confirm whether we process personal data that concerns you.
If such processing is taking place, you can request to be informed by the data controller regarding the following information:
(1.1) the purposes for processing the personal data;
(1.2) the categories of personal data being processed;
(1.3) the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
(1.4) the planned storage duration of personal data concerning you or, if specific information in this respect is not possible
, criteria for determining the storage period;
(1.5) the existence of a right of rectification or deletion of personal data that concerns you or of a restriction on
processing by the data controller or of a right to object to such processing;
(1.6) the existence of a right of appeal to a supervisory authority;
(1.7) any available information on the origin of the data if the personal data has not been collected from the data subject;
(1.8) the existence of automated decision-making, including profiling in accordance with Art. 22 para. 1 and 4 of the GDPR and
– at least in these cases – meaningful information on the logic involved and the scope and intended effects of such processing
for the data subject.
You have the right to request information regarding whether your personal information will be transmitted to a third-party
country or an international organization. In this respect, you can request the appropriate guarantees in accordance with Art.
46 of the GDPR in connection with the transmission.
2. Right to rectification
You have a right to correct and/or add to your personal data held by the data controller if the processed personal data that
concern you are incorrect or incomplete. The data controller shall make the correction immediately.
3) Right to limitation of processing
Under the following conditions, you may request that the processing of personal data concerning you be restricted if:
(3.1) you dispute the accuracy of the personal data concerning you for a period that enables the data controller to verify the
accuracy of the personal data;
(3.2) the processing is unlawful and you refuse to delete the personal data and instead request that the use of the personal
data be restricted;
(3.3) the data controller no longer needs the personal data for processing purposes, but you need it to establish, exercise, or
defend legal claims; or
(3.4) you object to the processing in accordance with Art. 21 para. 1 of the GDPR and it is not yet clear whether the legitimate
reasons of the data controller outweigh your reasons.
Where processing of the personal data that concerns you has been restricted, such data – apart from being stored – may be
processed only with your consent or for the purpose of asserting, exercising or defending rights or protecting the rights of
another natural or legal person or on the grounds of an important public interest of the Union or of a Member State.
If the processing restriction has been done in accordance with the above conditions, you will be informed by the data
controller before the restriction is lifted.
4. Right to deletion
a) Duty to delete
You may request that the data controller delete the personal data that concerns you immediately, and the data controller will
be obliged to delete this data immediately if one of the following reasons applies:
(4.1) the personal data that concerns you is no longer necessary for the purposes for which it was collected or otherwise
(4.2) you revoke your consent to the processing pursuant to Art. 6 para. 1 (a) or Art. 9 para. 2 (a) GDPR, and where there is no
other legal ground for the processing.
(4.3) you submit an objection to the processing pursuant to Art. 21 para. 1, GDPR, and there are no overriding legitimate
grounds for processing, or you submit an objection according to Art. 21 para. 2 GDPR to the processing;
(4.4) the personal data that concerns you has been processed unlawfully;
(4.5) the deletion of personal data is required to comply with legal obligations according to Union law or the laws of the
Member States to which the data controller is subject;
(4.6) the personal data that concerns you has been collected in connection with offered information society services pursuant
to Art. 8 para. 1 GDPR.
b) Information to third parties
If the data controller has made the personal data that concerns you public and if the data controller is obliged for its
deletion pursuant to Art. 17 para. 1 of the GDPR, the data controller shall take appropriate measures, including technical
means, while taking into account available technology and implementation costs, to inform the third parties processing your
data that you as the data subject have requested deletion of all links to such personal data or of copies or replications of
such personal data.
The right to deletion does not exist insofar as the processing is necessary
(1) to exercise the right of freedom of expression and information;
(2) for the performance of a legal obligation required for processing under the law of the Union or of the Member States to
which the data controller is subject or for the performance of a task in the public interest or in the exercise of official
authority conferred to the data controller;
(3) for reasons of public interest in the field of public health in accordance with Art. 9 para. 2 (h) and (i), as well as Ar.
9 para. 3 of the GDPR;
(4) for archiving purposes in the interest of public, scientific or historical research purposes or for statistical purposes
in accordance with Art. 89 Para. 1 GDPR, to the extent that the law referred to in (a) is likely to render impossible or
seriously prejudicial the attainment of the objectives of such processing; or
(5) to assert, exercise or defend legal claims.
5) Right to information
If you have exercised your right to have the data controller correct, delete, or limit the processing, he or she is obliged to
inform all recipients to whom the personal data that concerns you has been disclosed of this correction or deletion of the
data or restriction on processing, unless this proves impossible or involves a disproportionate effort.
It is your right to have the data controller inform you about these recipients.
6. Right to data portability
You have the right to obtain your personal data, which you have provided to the data controller, in a structured, commonly
used and machine-readable format. In addition, you have the right to pass this data on to another data controller without
obstruction by the data controller to whom the personal data was provided, insofar as
(1) the processing is based on consent pursuant Art. 6 para. (1) a of the DSGVO or Art. 9 para. (2) a of the DSGVO or on a
contract pursuant to Art. 6 para. 1 (b) of the GDPR and
(2) the processing is undertaken using automated procedures.
In exercising this right, you also have the right to request that the personal data concerning you be transferred directly
from one data controller to another data controller, insofar as this is technically feasible. The freedoms and rights of other
persons must not be affected by this.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task in the
public interest or in the exercise of official authority delegated to the controller.
7. Right to object
You have the right, for reasons arising from your specific situation, to object to the processing of personal data concerning
you at any time, which is carried out in accordance with Art. 6 para. 1 (e) or (f) GDPR, including profiling based on those
The data controller will no longer process the personal data that concerns you, unless the party can prove compelling
legitimate reasons for the processing, which outweigh your interests, rights and freedoms, or the processing serves to assert,
exercise or defend legal claims.
If the personal data that concerns you is being processed for direct marketing purposes, you have the right to object at any
time to the processing of the personal data that concerns you for the purpose of such marketing; this also applies to
profiling, insofar as it is associated with such direct marketing.
If you object to processing that is for direct marketing purposes, the personal data that concerns you will no longer be
processed for these purposes.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your
right to object by automated means using technical specifications.
8) Right to revoke the data protection declaration of consent
You have the right at any time to revoke your data protection declaration of consent. The revocation of consent shall not
affect the legality of any processing undertaken on the basis of this consent before its withdrawal.
9) Automated decision on a case-by-case basis, including profiling
You have the right not to be subject to a decision based exclusively on automated processing – including profiling – that has
legal effect against you or significantly impairs you in a similar manner. This shall not apply if the decision:
(1) is necessary for the conclusion or fulfillment of a contract between you and the data controller;
(2) is permissible on the basis of legislation of the Union or the Member States, to which the data controller is subject, and
these laws contain adequate measures to safeguard your rights and freedoms, as well as your legitimate interests, or
(3) is undertaken with your express consent.
However, these decisions may not be based on special categories of personal data pursuant to Art. 9 para. 1 GDPR, unless Art.9
Para. 2 (a) or (g) and appropriate measures have been taken to protect your rights and freedom as well as your legitimate
In the cases referred to in (1) and (3), the data controller shall take reasonable measures to safeguard your rights, freedoms
and legitimate interests, including at least the right to obtain the intervention of a person on the part of the data
controller, to state his or her own position and to challenge the decision.
10) Right of appeal to a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right of appeal to a supervisory authority, in
particular in the Member State where you reside, work or where the infringement is suspected, if you believe that the
processing of personal data that concerns you is in contravention of the GDPR.
The supervisory authority with which the appeal has been filed shall inform the appellant of the status and results of the
appeal, including the possibility of a judicial remedy under Art. 78 of the GDPR.