Data protection declaration in accordance with the GDPR

Name and address of the responsible party

Ernst Grünberger und Claus Six
Ruberting 30
94535 Eging am See

The responsible party within the meaning of the General Data Protection Regulation and other national data protection laws of the EU Member States, as well as other data protection regulations, is:

PC Westernstadt GmbH & Co. KG
Ruberting 30
94535 Eging am See
Tel.: +49 8544 9749-0
E-mail: info@pullmancity.de
Website: www.pullmancity.de

 

Data protection officer contact details

The data protection officer of the responsible party can be reached at:

PC Westernstadt GmbH & Co. KG
Data protection officer
Ruberting 30 94535
Eging am See
Tel.: +49 8544 9749-0
E-mail: dsb@pullmancity.de

 

Data protection officer contact details

Scope of personal data processing
We collect and utilise our users' personal data only insofar as this is necessary for provision of an operational site and of our content and services. Collection and utilisation of our users' personal data is only undertaken periodically with the user's consent. An exception applies in those cases where prior consent cannot be obtained for legal or circumstantial reasons and the processing of the data is permitted by law.

Legal basis for the processing of personal data
Where we obtain the consent of the data subject for processing personal data, Art. 6 para.1 a) of the EU General Data Protection Regulation (GDPR) serves as legal basis. In processing personal data necessary for fulfilment of a contract to which the data subject is a party, Art. 6 para.1 lit. b GDPR applies as the legal basis. This also applies to processing necessary for pre-contractual proceedings. Where the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 para.1 c) of the GDPR applies as the legal basis. In the event that vital interests of the data subject or another natural person require processing of personal data, Art. 6 para.1 d) GDPR applies as the legal basis. If processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 para.1 (f) of the GDPR is applicable as legal basis for processing.

Data deletion and storage duration
The personal data of a relevant person will be deleted or blocked as soon as the purpose of storage ceases to exist. Furthermore, data may be stored if this has been provided by the European or national legislation in EU regulations, laws or other provisions to which the data controller is subject. Blocking or erasure of data will be carried out even if a storage deadline prescribed by the above-mentioned standards expires, unless data storage is a necessity for concluding or performing a contract.

Provision of the website and creation of log files

Description and scope of data processing
Every time you visit our website, our system automatically collects data and information from the computer system of the accessing computer. The following data is collected:

  1. Information regarding the used browser type and version
  2. The user’s operating system
  3. The user's IP address (anonymous)
  4. Date and time of access
  5. Referrer URL
  6. Host name of the accessing computer

The data is also stored in the log files of our system. This data is not stored together with other personal data of the user.

Legal basis for data processing
The legal basis for temporary storage of data and log files is Art. 6 para.1 lit. f, GDPR.

Purpose of the data processing
Temporary storage of IP address by the system is necessary to enable delivery of the website to the user's computer. To this end, the user's IP address must remain stored for the duration of the session. The data is stored in log files to ensure the website's functionality. The data is also used to optimise the website and to ensure the security of our information technology systems. No evaluation of the data for marketing purposes is undertaken in connection with this. We also have a legitimate interest in these purposes to process data in accordance with Art. 6 para.1 lit. f, GDPR.

Duration of retention
The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. In the case of data collection for provision of the website, this will be undertaken once the respective session has ended. Should any data be stored in log files, these will be deleted after seven days at the latest. Data may be stored for longer than this. In this case, the user's IP addresses will be deleted or distorted so that it is no longer possible to identify the accessing client.

Objection and cancellation options
Collection of data for provision of the website and storage of data in log files is absolutely necessary for operation of the website. Consequently, there is no option to object on the part of the user.

 

Use of cookies

a) Description and scope of data processing
Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user's computer system. If a user visits a website, a cookie may be stored on the user's operating system. This cookie contains a distinctive character string that enables unique identification of the browser when the website is accessed again. We use cookies to make our website more user-friendly. Some elements of our website require that the browser's accessing can be identified even after changing the page. The following data is stored and transmitted in cookies:

  1. Data in the chat area (Userlike)
  2. Data that is part of the overnight booking process (Vioma)

We also use cookies on our website to analyse user behaviour. The user data collected in this way is pseudonymised with technical means. It is therefore no longer possible to assign the data to the accessing user. The data is not stored together with users' other personal data.
When accessing our website, users are informed by an information banner on the use of cookies for analytical purposes and referred to this data protection declaration. A note is also included in this context as to how the user can disable the storage of cookies in the browser settings.

b) Legal basis for data processing
The legal basis for processing personal data using cookies is Art. 6 para.1 lit. f, GDPR.

c) Purpose of data processing
The purpose of using technically necessary cookies is to simplify use of websites for users. Some features of our website are not offered without the use of cookies. In this case, it is necessary that the browser be recognised even after changing the page. The user data collected by technically necessary cookies is not used to create user profiles. The analysis cookies are used to improve the quality of our website and its content. By analysing cookies, we learn how the site is used and can constantly optimise our service. For these purposes, we also have a legitimate interest in the processing of personal data in accordance with Art. 6 para.1 lit. f, GDPR.

d) Duration of storage, objection and removal option
Cookies are stored on the user's computer and transmitted to our site. Therefore, as a user you have full control of the use of cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all of the website's features. The following links will help you configure settings to reject or accept cookies in the most commonly used browsers:

 

Newsletter

Description and scope of data processing
You can subscribe to a free newsletter on our website. The data from the contact form are transmitted to us when you subscribe to the newsletter.

Mandatory fields: first name, last name, birthday, email
Non-mandatory fields: title, street and house number, postcode, location, phone number

During the subscription process, your consent is obtained for processing data and reference is made to this privacy policy. No data is disclosed to third parties in connection with data processing for sending newsletters. The data will be used exclusively for sending the newsletter.

Legal basis for data processing
The legal basis for processing data after the user registers for the newsletter, if the user's consent to this has been obtained, is Art. 6 para.1 a) GDPR.

Purpose of data processing
The user's email address is collected in order to deliver the newsletter. Collection of other personal data as part of the subscription process is for preventing the misuse of the services or of the used email address.

Duration of storage
The data will be deleted as soon as they are no longer necessary to achieve the purpose for which they were collected. The user's email address will therefore be stored for as long as the subscription to the newsletter is active. The other personal data collected during the subscription process will generally be deleted after a period of seven days.

Objection and cancellation options
The subscription to the newsletter can be cancelled by the user at any time. A link to do this can be found in every newsletter. This also allows for withdrawal of consent to the storage of personal data collected during the subscription process.

 

Use of our webshop (buying tickets)

  1. If you would like to order from our online shop, it is necessary for the conclusion of the contract that you give us the personal data we need to complete your order. The information required for the processing the contract is marked separately; any further information is voluntary. We use the data provided by you to process your order. For this purpose we can pass on your payment data to our house bank. The legal basis for this is Art. 6 para.1 p. 1 b) GDPR. You can voluntarily create a customer account through which we can store your data for future purchases. When you create an account, the data you provide will be stored revocably. All other data, including your user account, can always be deleted in the customer area. We may also process the data you provide in order to inform you of other interesting and similar products from our portfolio or to send you emails containing technical information.
  2. We are obliged by commercial and tax law to store your address, payment, and order data for a period of ten years. However, after the specified time we limit the processing of your data, that is, your data will only be used to comply with legal obligations.
  3. To prevent unauthorised access to your personal data by third parties, especially financial data, the order process is encrypted using TLS technology.

 

Payment systems

Description and scope of data processing
You can pay for goods and services online on our website. If you do this, the data you provide from the input screen during the payment process will be transferred to the payment system service provider. Your consent will be obtained for the processing of the data as part of the payment process. The following payment systems can be used on our website:

The following data will be transferred to the service provider if you use the Sofortüberweisung process: first and last name, address, telephone number, email address, IP address, PIN, TAN and any other data required to process the payment. After logging in, your account balance will be checked automatically and the transfer will be carried out using the TAN you provide. A transaction confirmation will then be sent to us immediately. After logging in, your transactions, the limit of the overdraft facility and the presence of other accounts and their balances will be automatically checked.

Legal basis for data processing
The legal basis for processing data during the payment process, if the user's consent to this has been obtained, is Art. 6 para.1 a) GDPR or for the fulfilment of a contract Art. 6 para.1 b) GDPR.

Purpose of data processing
The collection of relevant data is required to carry out the payment process. Other personal data are collected during this process to prevent any abuse of the services or of the payment system.

Duration of storage
The data subject's data are stored only for as long as needed to fulfil the contract. Applicable retention provisions under commercial and tax law will be observed.

Objection and cancellation options
The user has the option of revoking his or her consent to the processing of personal data in the future at any time.

 

Contact form and email contact

Description and scope of data processing
There is a contact form on our website that can be used for electronic contact. If a user accepts this option, the data entered in the input screen will be transmitted to us and stored. This data includes:

Mandatory fields: last name, birthday, street/house number, post code, city, country, email address Voluntary fields: title, first name, phone number

The following data is also stored at the time the message is sent:

  1. The user's IP address
  2. Date and time of registration

During the sending process, your consent is obtained for processing data and reference is made to this data protection declaration. Alternatively, you can contact us via the provided e-mail address. In this case, the user's personal data that is transmitted along with the email will be stored. The data will not be disclosed to third parties during the course of this. The data is used exclusively for the processing of the conversation.

Legal basis for data processing
The legal basis for processing the data, if the user's consent to this has been obtained, is Art. 6 para.1 a) GDPR. The legal basis for processing the data transferred in the course of sending an email is Art. 6 para.1 lit. f, GDPR. If you send us an email with the intention to enter into a contract with us, this creates an additional legal basis for its processing under Art. 6 para.1 b) GDPR.

Purpose of the data processing
The processing of personal data in the input screen is used by us only for processing the contact. In the event of contact by e-mail, this also constitutes the necessary legitimate interest in processing the data. The other personal data processed during the sending process is for preventing the misuse of the contact form and to ensure the security of our information technology systems.

Duration of retention
The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. For the personal data from the contact form input screen and the data that was sent by e-mail, this is the case when the respective conversation with the user has been completed. The conversation will have ended when it is evident from the circumstances that the matter at hand has been conclusively resolved. Personal data that was additionally collected during the sending procedure will be deleted at the latest after a period of seven days.

Objection and removal options
The user has the option of revoking his or her consent to the processing of personal data at any time. A user who has contacted us by e-mail can object at any time to the storage of his or her personal data. It will not be possible to continue the conversation in this case. Consent to storage can be revoked by contacting the responsible person in writing. In this case, all personal data stored when establishing contact with us shall be deleted.

 

Google Analytics

This website uses Google Analytics, a web analysis service provided by Google Inc. ("Google"). Google Analytics uses "cookies", text files that are stored on your computer and enable your use of the website to be analysed. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. However, if IP anonymisation is enabled on this website, your IP address will first be truncated by Google within the Member States of the European Union or other parties to the agreement on the European Economic Area. The full IP address is transmitted to a Google server in the USA and shortened there only in exceptional cases. Google will use this information on behalf of the operator of this website to evaluate your use of the website, to compile reports on website activity, and to provide other services regarding website activity and internet usage for the website operator. The IP address provided by your browser as part of Google Analytics will not be combined with other data from Google. You can prevent the use of cookies by selecting the appropriate settings on your browser; however, we should like to point out that if you do this, you may not be able to access all functions provided on this website. You can also prevent the data generated by cookies concerning your use of the website (incl. your IP address) from being passed to Google, and the processing of this data by Google, by downloading and installing the browser plugin available at the following link: tools.google.com/dlpage/gaoptout. This website uses Google Analytics with the extension "_anonymizeIp()". As a result, IP addresses are further processed in truncated form, so that reference to individuals can be ruled out. If the data collected about you is personally identifiable, it will be blocked immediately and the personal data deleted as soon as possible. We use Google Analytics to analyze and regularly improve the function of our website We can improve our offer and make it more interesting for you as a user. Google has agreed to comply with the EU-US Privacy Shield, www.privacyshield.gov/EU-US-Framework with regard to any personal data that is transferred to the USA. The legal basis for the use of Google Analytics is Art. 6 para.1 p. 1 f) GDPR. Third party provider information: Google Dublin, Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland, fax: +353 (1) 436 1001. User terms & conditions: www.google.com/analytics/terms/de.html, Overview about data privacy: www.google.com/intl/de/analytics/learn/privacy.html, and its data privacy policy: www.google.de/intl/de/policies/privacy. This website also uses Google Analytics to analyse visitor flows across all devices; this is carried out via a user ID. You can disable device cross-analysis of your use of the site in your account under "My data" or "personal data".

 

Use of social media plug-ins

We currently use the following social media plug-ins: Facebook, Instagram. We use the 'two-click solution'. This means that if you visit our site, initially no personal data will be passed on to the providers of these plug-ins. You can recognize the provider of the plug-in by the marking on the box above its initial letter or the logo. We offer you the possibility to communicate directly with the provider of the plug-in via the button. Only if you click on the marked field and thereby activate it, the plug-in provider receives the information that you have accessed the corresponding website of our online offer. The data mentioned in this declaration will also be transmitted. In the case of Facebook, the IP address is anonymised immediately after collection, according to the relevant provider in Germany. By activating the plug-in, data is automatically transmitted to the respective plug-in provider and stored there (US providers in the USA). Since the plug-in provider collects data mainly via cookies, we recommend that you delete all cookies using your browser's security settings before clicking on the greyed-out box. We have no influence on the data collected and data processing processes, nor are we aware of the full extent of data collection, the purposes of processing, the storage periods. We also have no information on the deletion of the data collected by the plug-in provider. The plug-in provider stores the data collected about you as user profiles and uses these for the purposes of advertising, market research and/or demand-oriented design of its website. Such evaluation is also made for users who are not logged in, to display customised advertising and to inform other users of the social network about your activities on our website. You have a right to object to the creation of these user profiles. You must contact the respective plug-in provider to exercise this right. Through the plug-ins we offer you a way to interact with social networks and other users, so that we can improve our service and make it more interesting for you as a user. The legal basis for the use of the plug-ins is Art. 6 para.1 p. 1 f) GDPR. The data is passed on regardless of whether you have an account with the plug-in provider and are logged in there. If you are logged in with the plug-in provider, your data collected with us will be directly assigned to your existing account with the plug-in provider. When activating the activated button and link the page, for example, the plug-in provider also stores this information in your user account and communicates this to your contacts in public. We recommend that you log out regularly after using a social network, especially before activating the button, as this way you can avoid being assigned to your profile with the plug-in provider. For more information on the purpose and extent of the data collection and its processing by the plug-in provider, please refer to the privacy statements of these providers provided below. Here, you will also find further information on your rights and settings options for protecting your privacy. Addresses of the respective plug-in providers and URL with their data protection information:

  1. Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA; www.facebook.com/policy.php; further information for data collection: www.facebook.com/help/186325668085084, www.facebook.com/about/privacy/your-info-on-other sowie www.facebook.com/about/privacy/your-info. Facebook has agreed to comply with the EU-US privacy shield: https://www.privacyshield.gov/EU-US-Framework.

  2. Instagram Inc, 1601 Willow Road, Menlo Park, CA, 94025, USA; instagram.com/about/legal/privacy/.

 

Integration of YouTube videos

We have included YouTube videos in our online service, which are stored on www.youtube.com and are playable directly from our website. These are all integrated and embedded in the "Extended Privacy Mode", i.e. no data about you as user are transferred to Youtube if you do not play the videos. Only when you play the videos will the data referred to in paragraph 2 be transmitted. We have no influence on this data transfer. When you visit this website, YouTube receives the information that you have accessed the corresponding subpage of our website. The data mentioned in this declaration will also be transmitted. This takes place regardless of whether YouTube makes available a user account via which you are logged into or no user account exists. If you are logged in to Google, your information will be directly associated with your account. If you do not wish to be associated with your profile when using YouTube, you must first log out before clicking the button. YouTube stores your data as usage profiles and uses them for the purposes of advertising, market research and/or requirements-oriented design of its website. Such evaluation also takes place (even for users who are not logged in) for the purposes of providing customised advertising and to inform other social network users about activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact YouTube to exercise this right. For more information on the purpose and scope of data collection and processing by YouTube, please refer to the privacy policy. There you will also find further information on your corresponding rights and settings options for protecting your privacy: www.google.de/intl/de/policies/privacy. Google also processes your personal data in the USA and has submitted to the EU-US Privacy Shield: https://www.privacyshield.gov/EU-US-Framework.

 

Integration of Google Maps

We use Google Maps functions on this website. This allows us to display interactive maps directly on the website and enables your convenient use of the map function. When you visit this website, Google is notified that you have accessed the corresponding sub-page of our website. The data mentioned above in this declaration will also be transmitted. This takes place regardless of whether you are logged into a Google account or whether you have a Google account. If you are logged in to Google, your information will be directly associated with your account. If you do not wish to be associated to your Google profile, you must first log out before activating the button. Google stores your data as usage profiles and uses them for the purposes of advertising, market research and/or requirements-oriented design of its website. ​Such evaluation also takes place (even for users who are not logged in) for the purposes of providing customised advertising and to inform other social network users about activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact Google to exercise this right. For more information about the purpose and scope of data collection and its processing by the plug-in provider, please refer to the provider's privacy policy. You will find further information on your corresponding rights and options for protecting your privacy at: www.google.de/intl/de/policies/privacy. Google also processes your personal data in the USA and has agreed to comply with the EU-US Privacy Shield: https://www.privacyshield.gov/EU-US-Framework.

 

Integration of third-party services and content

Within our online service, on the basis of our legitimate interests (i.e. interest in the analysis, optimisation, and economic operation of our website within the meaning of art. 6 para.1 lit. f. GDPR), we use content or service offerings from third parties so that we can incorporate their content and services, such as videos or fonts (hereinafter uniformly referred to as "content"). This always requires that the third-party providers of this content can see the IP address of users, since without the IP address they would not be able to send the content to the users' browsers. We strive to only use content whose provider uses the IP address solely for the delivery of content. Third-party providers may also use "pixel tags" (invisible graphics, also known as "web beacons") for statistical or marketing purposes. "Pixel tags" can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user's device and may include technical information about the browser and operating system, referring websites, visiting time and other information about the use of our online offering. It may also be linked to such information from other sources. The following presentation offers an overview of third-party providers and their content in addition to links to their Privacy Statements, which contain further references to the processing of data and, already mentioned here in part, opportunities to object ('opt-out'):

  • Maps from the "Google Maps" service provided by Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Policy: www.google.com/policies/privacy/, Opt-Out: www.google.com/settings/ads/.
  • Videos from the "YouTube" platform of third party Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Policy: policies.google.com/privacy, Opt-Out: adssettings.google.com/authenticated.
  • Facebook Custom Audience is a marketing tool with which a company can use its Facebook account to specifically advertise only to those Facebook users that are likely to be interested in the advertisement. The data controller for persons resident in the USA or Canada is the aforementioned head office of Facebook Inc. at 1601 Willow Road, Menlo Park, CA 94025, USA. The data controller for persons resident outside the USA or Canada is Facebook Ireland Ltd, with registered offices at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Privacy policy: www.facebook.com/policy.php.
  • Rapidmail is a service that organises and analyses the distribution of newsletters. The data you provide in order to subscribe to our newsletter will be stored on Rapidmail servers in Germany. rapidmail GmbH, Augustinerplatz 2, 79098 Freiburg i.Br.; data security: www.rapidmail.de/datensicherheit
  • Regiondo is an online booking system (ticket shop) for processing ticket orders; Regiondo GmbH, Grafinger Str. 6, 81671 Munich, Germany; privacy policy: www.regiondo.de/datenschutz
  • Userlike is a chat platform for web, mobile and messaging support; Userlike UG, Probsteigasse 44-46; 50670 Cologne; privacy policy: www.userlike.com/de/terms
  • Vioma is software/a platform for booking individual hotels; vioma GmbH, Industriestraße 27, 77656 Offenburg; privacy policy: www.vioma.de/de/company/datenschutzerklaerung/
  • Google Ajax is an API to enable Google search in dynamic homepage content and to index it accordingly. Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; privacy policy: https://www.google.com/policies/privacy/

 

Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights with respect to the responsible party: Right to information You can request that the responsible party confirm whether we will process personal data that concerns you. If such processing is taking place, you can request to be informed by the responsible party regarding the following information:

  1. the purposes for processing the personal data;
  2. the categories of personal data being processed;
  3. the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
  4. the planned storage duration of personal data concerning you or, if specific information in this respect is not possible, criteria for determining the storage period;
  5. the existence of a right of rectification or deletion of personal data that concerns you or of a restriction on processing by the responsible party or of a right to object to such processing;
  6. the existence of a right of appeal to a supervisory authority;
  7. any available information on the origin of the data if the personal data has not been collected from the data subject;
  8. the existence of automated decision-making, including profiling in accordance with Art. 22 para.1 and 4 of the GDPR and - at least in these cases- meaningful information on the logic involved and the scope and intended effects of such processing for the person concerned.

You have the right to request information regarding whether your personal information will be transmitted to a third-party country or an international organisation. In this respect, you can request the appropriate guarantees under Art. 46 of the GDPR in connection with the transmission.

Right to correct information
You have a right to correct and/or add to your personal data held by the data controller if it is incorrect or incomplete. The responsible party shall make the correction immediately.

The right to limitation of processing
Under the following conditions, you may request that the processing of personal data concerning you be restricted if:

  1. you dispute the accuracy of the personal data concerning you for a period that enables the responsible party to verify the accuracy of the personal data;
  2. the processing is unlawful and you refuse to delete the personal data and instead request that the use of the personal data be restricted;
  3. the responsible party does not need the personal data for longer than the purposes of processing, but you need it for the assertion, exercise or defence of legal claims, or
  4. you object to processing in accordance with Art. 21 para.1 GDPR and it is not yet clear whether the data controller's legitimate reasons for processing your data outweigh your interests.

Where processing of the personal data that concerns you has been restricted, such data – apart from being stored – may be processed only with your consent or for the purpose of asserting, exercising or defending rights or protecting the rights of another natural or legal person or on the grounds of an important public interest of the Union or of a Member State. If the processing restriction has been done in accordance with the above conditions, you will be informed by the responsible party before the restriction is lifted.

 

Right to deletion:
a) Deletion obligation

You may request that the responsible party delete the personal data that concerns you immediately, and the responsible party will be obliged to delete this data immediately if one of the following reasons applies:

  1. the personal data that concerns you is no longer necessary for the purposes for which it was collected or otherwise processed;
  2. you revoke your consent, removing the legal basis for processing under Art. 6 para.1 a) or Art. 9 para.2 a) of the GDPR and there is no other legal basis for processing.
  3. you submit an objection to processing pursuant to Art. 21 para.1 of the GDPR, and there are no overriding legitimate grounds for processing, or you submit an objection to processing in accordance with Art. 21 para.2 of the GDPR.
  4. the personal data that concerns you has been processed unlawfully;
  5. The deletion of personal data is required in order to comply with legal obligations according to Union law or the laws of the Member States to which the data controller is subject.
  6. The personal data that relates to you has been collected in connection with offered information society services pursuant to Art. 8 para.1 of the GDPR.

b) Passing information to third parties
If the data controller has made your personal data public and is required to delete it under Art. 17 para.1 GDPR, we will take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform data processors who process the personal data that the data subject has requested the deletion of all links to this personal data as well as any copies thereof.

c) Exceptions
The right to deletion does not exist insofar as the processing is necessary

  1. to exercise the right of freedom of expression and information;
  2. for the performance of a legal obligation required for processing under the law of the Union or of the Member States to which the responsible party is subject or for the performance of a task in the public interest or in the exercise of official authority conferred to the responsible party;
  3. for reasons of public interest in the field of public health in accordance with Art. 9 para.2 h) and i), as well as Art. 9 para.3 of the GDPR;
  4. for archiving purposes in the interest of public, scientific or historical research purposes or for statistical purposes in accordance with Art. 89 para.1 of the GDPR, to the extent that the right referred to in a) is likely to seriously inhibit or make achieving the purposes of such processing impossible; or
  5. to assert, exercise or defend legal claims.

Right to information
If you have exercised your right to have the responsible party correct, delete, or limit the processing, this party is obliged to inform all recipients to whom the personal data that concerns you has been disclosed of this correction or deletion of the data or restriction on processing, unless this proves impossible or involves a disproportionate effort. It is your right to have the controller inform you about these recipients.

Right to data portability
You have the right to obtain your personal data, which you have provided to the controller, in a structured, commonly used and machine-readable format. In addition, you have the right to pass this data on to another responsible party without obstruction by the responsible party to whom the personal data was provided, insofar as

  1. the processing is based on consent under Art. 6 para.1 a) of the GDPR or Art. 9 para.2 a) of the GDPR or on a contract in accordance with Art. 6 para.1 b) of the GDPR and
  2. the processing is undertaken using automated procedures.

In exercising this right, you also have the right to request that the personal data concerning you be transferred directly from one responsible party to another responsible party, insofar as this is technically feasible. The freedoms and rights of other persons must not be affected by this. The right to data portability shall not apply to the processing of personal data necessary for the performance of a task in the public interest or in the exercise of official authority conferred on the responsible party.

Right to object
You have the right, for reasons arising from your specific situation, to object to the processing of personal data concerning you at any time, which is carried out in accordance with Art. 6 para.1 e) or f) of the GDPR; the same applies to profiling based on these provisions. The responsible party will no longer process the personal data that concerns you, unless the party can prove compelling legitimate reasons for the processing, which outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims. If the personal data that concerns you is being processed for direct marketing purposes, you have the right to object at any time to the processing of the personal data that concerns you for the purpose of such marketing; this also applies to profiling, insofar as it is associated with such direct marketing. If you object to processing that is for direct marketing purposes, the personal data that concerns you will no longer be processed for these purposes. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

The right to revoke the data protection declaration of consent
You have the right at any time to revoke your data protection declaration of consent. The withdrawal of consent shall not affect the lawfulness of processing taking place on the basis of this consent before its revocation.

Automated decision in individual cases, including profiling
You have the right not to be subject to a decision based exclusively on automated processing - including profiling - that has legal effect against you or significantly impairs you in a similar manner. This does not apply if the decision

  1. is necessary for the conclusion or fulfilment of a contract between you and the responsible party;
  2. is permissible on the basis of legislation of the Union or the Member States, to which the responsible party is subject, and these laws contain adequate measures to safeguard your rights and freedoms, as well as your legitimate interests, or
  3. is undertaken with your express consent.

However, these decisions may not be based on special categories of personal data pursuant to Art. 9 para.1 of the GDPR, unless Art. 9 para.2 a) or g) of the GDPR apply and appropriate measures have been taken to protect your rights and freedom as well as your legitimate interests. In the cases referred to in (1) and (3), the responsible party shall take reasonable measures to safeguard your rights, freedoms and legitimate interests, including at least the right to obtain the intervention of a person on the part of the responsible party, to state his or her own position and to challenge the decision.

The right of appeal to a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right of appeal to a supervisory authority, in particular in the Member State where you reside, work or where the infringement is suspected, if you believe that the processing of personal data that concerns you is in contravention of GDPR. The supervisory authority with which the appeal has been filed shall inform the appellant of the status and results of the appeal, including the possibility of a judicial remedy under Art. 78 GDPR.

Assertion of your rights against the responsible person
You may exercise your rights at any time in writing, by email or by telephone. Please contact the responsible person named above.

Changes to our privacy policy
In order to ensure that our data protection declaration always complies with current legal requirements, we reserve the right to make changes at any time. This also applies in the event that the data protection declaration has to be adapted due to new or revised services, for example new services. The new data protection declaration will then take effect the next time you visit our website.