close
Pullman City - Die lebende Westernstand - Eging am See/Passau

Data privacy

Ernst Grünberger und Claus Six
Ruberting 30
94535 Eging am See

The data controller within the meaning of the General Data Protection Regulation and other national data protection laws of the EU Member States, as well as other data protection regulations, is:

PC Westernstadt GmbH & Co. KG
Ruberting 30
94535 Eging am See
+49 8544 97490

www.pullmancity.de
 

Contact details of the data protection officer

The data protection officer of the data controller can be reached at:

PC Westernstadt GmbH & Co. KG
Datenschutzbeauftragter
Ruberting 30
94535 Eging am See
+49 8544 97490


General information on data processing

Scope of the processing of personal data
We collect and utilise your personal data only insofar as this is necessary to provide a functioning website, our content and our services. We regularly collect and use your personal data, but only with your consent. An exception applies in cases in which circumstances prevent us from obtaining prior consent and the processing of the data is permitted by law.

Legal basis for the processing of personal data
Where we obtain the consent of the data subject for processing personal data, Art. 6 para.1 a) of the EU General Data Protection Regulation (GDPR) serves as legal basis. When processing personal data that is necessary to fulfil a contract to which the data subject is a party, Art. 6 para.1 b) GDPR serves as the legal basis. This also applies to processing that is necessary for pre-contractual proceedings. Where the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 para.1 c) of the GDPR applies as the legal basis. In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para.1 d) GDPR serves as the legal basis. If the processing is necessary to protect a legitimate interest of our company or a third party
and the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 para.1 (f) of the GDPR serves as the legal basis for the processing.

Erasure of data and duration of storage
Your personal data will be deleted or blocked as soon as the purpose for its storage no longer applies. In addition, the data may be stored if this has been provided for by European or national legislators in EU regulations, laws, or other provisions to which the data controller is subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned regulations has elapsed, unless further storage of the data is necessary for the conclusion or fulfilment of a contract.

Provision of the website and creation of log files

Description and scope of the data processing
Every time you visit our website, our system automatically collects data and information from the computer system of the accessing computer. The following data is collected:

  1. Information regarding the used browser type and version
  2. The user’s operating system
  3. The user's IP address (anonymous)
  4. Date and time of access
  5. Referrer URL
  6. Host name of the accessing computer

The data is also stored in the log files of our system. This data is not stored together with any other personal data we may have collected about you.

Legal basis for data processing
The legal basis for temporary storage of data and log files is Art. 6 para.1 f) GDPR.

Purpose of the data processing
Temporary storage of the IP address by the system is necessary to enable the delivery of the website to the user's device. For the said purpose, the user's IP address must be stored for the duration of the session. The data are stored in log files to ensure the website's functionality. The data is also used to optimise the website and ensure the security of our information technology systems. No evaluation of the data for marketing purposes is undertaken in connection with this. These purposes also encompass our legitimate interest in processing data according to Art. 6 para.1 f) GDPR.

Duration of the storage
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case the data was collected in order to provide the website, it will be deleted once your session on our site ends. Should any data be stored in log files, these will be deleted within seven days at the latest. Data may be stored for longer than this. In this case, the user's IP addresses will be deleted or distorted so that it is no longer possible to identify the accessing client.
Objection and cancellation options
Collection of data required to make the website available and storage of the data in log files is essential for the operation of the website. Consequently, users cannot object to its collection.


Use of cookies

a) Description and scope of the data processing
Our website uses cookies. Cookies are text files stored within or by the internet browser on the computer system of the user. If you visit a website, a cookie may be stored on your operating system. This cookie contains a distinctive character string that enables unique identification of the browser when the website is accessed again. We use cookies to make our website more user-friendly. Some elements of our website require that your browser be identifiable as you move on to another page within the site. The following data is stored and transmitted in cookies:

(1) Data in the chat area (Userlike)
(2) Data that is part of the overnight booking process (Vioma)

We also use cookies on our website to analyse user behaviour. The user data collected in this way is pseudonymised using technical means. It is therefore no longer possible to assign the data to the accessing user. The data is not stored together with the user's other personal data. When accessing our website, users are informed by an information banner on the use of cookies for analytical purposes and are referred to this Privacy Policy. A note is also included in this context that outlines how the user can disable the storage of cookies in their browser settings.

b) Legal basis for the data processing
The legal basis for processing personal data using cookies is Art. 6 para.1 f) GDPR.

c) Purpose of the data processing
The purpose of using such technically essential cookies is to make the website easier to use for users. Some features of our website will not be available if the use of cookies is disallowed. For these to work, it is necessary for your browser to remain recognisable as you make your way through our site. The user data collected by technically necessary cookies is not used to create user profiles. The analysis cookies are used to improve the quality of our website and its content. By analysing cookies, we learn how the site is used and can thus constantly optimise our service. These purposes also encompass our legitimate interest in processing personal data in accordance with Art. 6 para.1 f) GDPR.

d) Duration of storage and options for objection and removal

The cookies are stored on the user's computer and, from there, are transmitted to our site. For this reason, as a user, you will retain full control over the use of cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies which have already been saved may be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may no longer be possible to use all of the website's features.

The following links will help you configure your settings to reject or accept cookies in the most commonly used browsers:


Newsletter

Description and scope of the data processing
You can subscribe to a free newsletter on our website. The data from the contact form is transmitted to us when you subscribe to the newsletter.

Mandatory fields: first name, last name, birthday, email
Voluntarily provided data: salutation, phone number, street and house number, postcode, city

During the subscription process, your consent is obtained for processing data, and reference is made to this Privacy Policy. No data is disclosed to third parties in connection with data processing for sending newsletters. The data will be used exclusively for sending the newsletter.

Legal basis for the data processing
The legal basis for processing data after the user registers for the newsletter, if the user's consent to this has been obtained, is Art. 6 para.1 a) GDPR.

Purpose of the data processing
Your email address is collected in order to deliver the newsletter. The collection of other personal data as part of the subscription process ensures the prevention of misuse of the services or of the email address used.

Duration of storage
The data will be deleted as soon as it's no longer required to fulfil the purpose for which it was collected. Your email address will be stored for as long as your subscription to the newsletter is active. The other personal data collected during the subscription process will generally be deleted after a period of seven days.

Objection and cancellation options
You may cancel your subscription to the newsletter at any time. A relevant link can be found in every newsletter for this purpose. This also allows you to withdraw your consent to the storage of personal data collected during the subscription process.


Use of our webshop (buying tickets, booking overnight stays)

1. If you would like to place orders in our online shop, then, in order to conclude the contract, it is necessary for you to provide us with the personal data of yours that we need to handle your order.
The information that is required for processing the contract is marked separately; any further information is voluntary. We use the data you provide to process your order. For this purpose, we may pass on your payment data to our house bank.
The legal basis for this is Art. 6 para.1 sentence 1 b) GDPR. You can voluntarily create a customer account, by means of which we can store your data for future purchases. When you create an account, the data you provide will be stored revocably. All other data, including your user account, can be deleted at any time in the customer area. We may also process the data you provide in order to inform you of other interesting and similar products from our portfolio or to send you emails containing technical information.
2. We are obliged by commercial and tax law to store your address, payment, and order data for a period of ten years. However, after the specified time, we limit the processing of your data; that is, your data will only be used to comply with legal obligations.
3. To prevent unauthorised access to your personal data by third parties, especially financial data, the order process is encrypted using TLS technology.


Payment systems

Description and scope of the data processing
You can pay for goods and services online on our website. If you do this, the data you provide from the input screen during the payment process will be transferred to the payment system service provider. Your consent will be obtained for the processing of this data as part of the payment process. The following payment systems can be used on our website:

The following data will be transferred to the service provider if you use the Sofortüberweisung process: first and last name, address, telephone number, email address, IP address, PIN, TAN and any other data required to process the payment. After logging in, your account balance will be checked automatically and the transfer will be carried out using the TAN you provide.
A transaction confirmation will then be sent to us immediately. After logging in, your transactions, the limit of the overdraft facility and the presence of other accounts and their balances will be automatically checked.

Legal basis for the data processing
The legal basis for processing data during the payment process, if the user's consent to this has been obtained, is Art. 6 para.1 a) GDPR or for the fulfilment of a contract Art. 6 para.1 b) GDPR.

Purpose of the data processing
The collection of relevant data is required to carry out the payment process. Other personal data are collected during this process to prevent any abuse of the services or of the payment system.

Duration of storage
The data subject's data is stored only for as long as needed to fulfil the contract. Applicable retention provisions under commercial and tax law will be observed.

Objection and cancellation options
The user has the option of revoking his or her consent to the future processing of personal data at any time.


Online applications, contact form and email contact

Description and scope of the data processing
There is a contact form on our website which can be used for contacting us electronically. If users accept this option, the data entered in the input screen will be transmitted to us and stored. This data includes the following

(1) when making an online appllication:
Mandatory fields: first name, last name, birthday, street/house number, post code, city, country, telephone number, email address
Voluntary fields: salutation, title, mobile number, message

(2) when contacting us by email:
Mandatory fields: last name, birthday, street/house number, post code, city, country, email address
Voluntarily provided information: salutation, first name, telephone number, message

The following data is also stored at the time the message is sent:
(1) The user's IP address
(2) Date and time of registration

During the dispatch process, your consent is obtained for the processing of data and reference is made to this Privacy Policy. Alternatively, you can contact us using the email address provided. If you use this option, the personal data transmitted with the email will be stored. Such data will not be disclosed to third parties in this context. This data will be used exclusively to respond to your enquiry.

Legal basis for the data processing
The legal basis for processing the data, if the user's consent to this has been obtained, is Art. 6 para.1 a) GDPR. The legal basis for processing the data transmitted in the course of sending an email is Art. 6 para.1 f) GDPR. If you send us an email with the intention of entering into a contract with us, this creates an additional legal basis for its processing under Art. 6 para.1 b) GDPR.

Purpose of the data processing
We only process personal data provided in input forms to process the contact request. If contact is made via email, this also gives rise to a required legitimate interest in processing the data. The other personal data processed during the sending process are used to prevent misuse of the contact form and to ensure the security of our information technology systems.

Duration of storage
The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. For the personal data from the contact form input screen and the data that was sent by email, this is the case when the respective conversation with the user has been concluded. The conversation is considered to have been concluded when it is evident from the circumstances that the matter at hand has been conclusively resolved. Personal data that was additionally collected during the transmission procedure will be deleted within seven days at the latest.

Objection and cancellation options
The user has the option of revoking his or her consent to the processing of personal data at any time. If you contact us by email, you may object to the storage of your personal data at any time. It will not be possible to continue the conversation in this case. Consent to storage can be revoked by contacting the responsible office in writing. In this case, all personal data stored when contact was established with us shall be deleted.

 

Google Analytics

This website uses Google Analytics, a web analysis service provided by Google Inc. ("Google"). Google Analytics uses "cookies", which are text files that are placed on your computer in order to analyse your use of our website. The information generated by the cookie about your use of the website will typically be transmitted to and stored by Google on servers in the USA. However, if IP anonymisation is enabled on this website, your IP address will first be truncated by Google within the member states of the European Union or other parties to the agreement on the European Economic Area. Only in exceptional cases are IP addresses transferred to a Google server in the USA and truncated there. Google will use this information on behalf of the operator of this website to evaluate your use of the website, compile reports on website activity and provide other services to the website operator relating to website activity and internet usage.
The IP address provided by your browser within the framework of Google Analytics will not be combined with other data from Google.
You can prevent the use of cookies by selecting the appropriate settings on your browser; however, we would like to point out that if you do this, you may not be able to use all the features provided on this website in full. You can also prevent the data generated by cookies relating to your use of the website (incl. your IP address) from being passed on to Google, and the processing of this data by Google, by downloading and installing the browser plugin available at the following link: tools.google.com/dlpage/gaoptout.
This website uses Google Analytics with the extension "_anonymizeIp()". This means that IP addresses are processed in truncated form, meaning they cannot be linked to a specific person. If any of your data that is collected can identify you personally, it will be blocked immediately and deleted as soon as possible.
We use Google Analytics to analyse and regularly improve the function of our website. The statistics obtained enable us to improve our services and make them more relevant to you as a user. For those exceptional cases in which personal data is transferred to the USA, Google has agreed to comply with the EU-US Privacy Shield, www.privacyshield.gov/EU-US-Framework. The legal basis for the use of Google
Analytics is Art. 6 para.1 sentence 1 f) GDPR.
Third party provider information: Google Dublin, Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland, fax: +353 (1) 436 1001. User terms & conditions: www.google.com/analytics/ terms/en.html, overview on data privacy: support.google.com/analytics/answer/6004245, and privacy policy: policies.google.com/privacy .
This website also uses Google Analytics to analyse visitor flows across all devices; this is carried out via a user ID. You can disable device cross-analysis of your use of the site in your account under "My data", "Personal information".

 

Use of social media plug-ins

We currently use the following social media plug-ins: Facebook, Instagram. We use the "two-click solution". In other words, when you visit our site, no personal data is initially passed on to the providers of the plug-ins. You can recognise the provider of the plug-in by the marking on the box above its initial letter or the logo. We give you the opportunity to communicate directly with the provider of the plug-in via the button. Only if you click on the marked field and thereby activate it will the plug-in provider receive the information that you have accessed the corresponding webpage of our online offering. The data mentioned in this policy will also be transmitted. In the case of Facebook, the IP address is anonymised immediately after collection, according to the relevant provider in Germany. If you activate the plug-in, your personal data will be transferred to the respective plug-in provider and stored there (in the case of US providers, in the USA). Since the plug-in provider collects data mainly via cookies, we recommend that you delete all cookies using your browser's security settings before clicking on the greyed-out box.
We have no influence on the data collected and the platforms' data processing nor are we aware of the full extent of data collection, the purposes of such processing, or for how long they will store your data.
We also have no information on the deletion of the data collected by the plug-in provider.
The plug-in provider stores the data collected about you as user profiles and uses these for the purposes of advertising, market research and/or demand-oriented design of its website. This evaluation is carried out (even for non-logged-in users) in particular to provide interest-based advertising and to inform other social network users about your activities on our website. You have a right to object to the creation of these user profiles. You must contact the respective plug-in provider to exercise this right. Through the plug-ins, we offer you a way to interact with social networks and other users, so that we can improve our service and make it more interesting for you as a user. The legal basis for the use of the plug-ins is Art. 6 para.1 sentence 1 f) GDPR.
The data is passed on regardless of whether you have an account with the plug-in provider and are logged in there. If you are logged in with the plug-in provider, your data collected from us will be assigned directly to your existing account with the plug-in provider. When activating the activated button and linking the page, for example, the plug-in provider also stores this information in your user account and communicates this to your contacts in public. We recommend that you log out regularly after using a social network, especially before activating the button, as, this way, you can avoid activity being assigned to your profile with the plug-in provider.
For more information on the purpose and scope of data collection and processing by the
plug-in provider, please see the privacy policies of these providers, communicated below. There, you will also find further information about your rights as well as configuration options for protecting your privacy.
Addresses of the relevant plug-in providers and URLs of their data protection information:
(a) Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA; www.facebook.com/policy.php; weitere Informationen zur Datenerhebung: www.facebook.com/help/186325668085084, www.facebook.com/about/privacy/your-info-on-other sowie www.facebook.com/about/privacy/your-info. Facebook hat sich dem EU-US-Privacy-Shield unterworfen, www.privacyshield.gov/EU-US-Framework.
(b) Instagram Inc., 1601 Willow Road, Menlo Park, CA 94025, USA; instagram.com/about/legal/privacy/.


Integration of YouTube videos

We have included YouTube videos in our online offering, which are stored on www.YouTube.com and can be played directly on our website. These are all integrated and embedded in "Extended Privacy Mode", i.e., no data about you as a user is transferred to Youtube if you do not play the videos. Only when you play the videos will the data referred to in paragraph 2 be transmitted. We have no influence on this data transfer.
When you visit the website, YouTube receives the information that you have accessed the corresponding subpage of our website. The data mentioned in this policy will also be transmitted. This takes place regardless of whether YouTube makes a user account available, via which you are logged in, or whether no user account exists. If you are logged into Google, your information will be directly associated with your account. If you do not wish to be associated with your profile when using YouTube, you must first log out before clicking the button. YouTube stores your data as usage profiles and uses it for the purposes of advertising, market research and/or requirements-oriented design of its website. This type of evaluation is carried out (even for users who are not logged in) to provide interest-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles. You must contact YouTube if you wish to exercise this right.
For more information on the purpose and scope of data collection and processing by YouTube, please refer to its privacy policy. There, you will also find further information about your rights as well as settings options for protecting your privacy: policies.google.com/ privacy. Google also processes your personal data in the USA and has submitted to the EU-US Privacy Shield, www.privacyshield.gov/EU-US-Framework.


Integration of Google Maps

We use Google Maps functions on this website. This allows us to show you interactive maps directly on the website and enables you to use the map function conveniently.
When you visit the website, Google is notified that you have accessed the corresponding sub-page of our website. The data mentioned above in this policy will also be transmitted. This takes place regardless of whether Google provides a user account, via which you are logged in, or whether no user account exists. If you are logged in to Google, your data will be associated directly with your account. If you do not wish to be associated with your Google profile, you must log out before activating the button.
Google stores your data as user profiles and uses them for the purposes of advertising, market research and/or requirements-oriented design of its website. This type of evaluation is carried out (even for users who are not logged in) to provide interest-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, and you must contact Google to exercise this right.
For more information about the purpose and scope of data collection and its processing by the plug-in provider, please refer to the provider's privacy policy. There, you will also find further information about your rights as well as settings options for protecting your privacy: policies.google.com/privacy. Google also processes your personal data in the USA and has submitted to the EU-US Privacy Shield, www.privacyshield.gov/EU-US-Framework.


Integration of third-party services and content

Within our online service, on the basis of our legitimate interests (i.e., interest in the analysis, optimisation, and economic operation of our website within the meaning of Art. 6 para.1 f) GDPR), we use content or service offerings from third parties so that we can incorporate their content and services, such as videos or fonts (hereinafter uniformly referred to as "content"). This always requires that the third-party providers of this content can see the IP address of users, since without the IP address they would not be able to send the content to the users' browsers. We strive to only use content whose provider uses the IP address solely for the delivery of content. Third-party providers may also use "pixel tags" (invisible graphics, also known as "web beacons") for statistical or marketing purposes. "Pixel tags" can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user's device and may include technical information about the browser and operating system, referring websites, visiting time and other information about the use of our online offering. It may also be linked to such information from other sources. The following presentation offers an overview of third-party providers and their content in addition to links to their privacy policies, which contain further references to the processing of data and, already mentioned here in part, opportunities to object ("opt out"):

- External fonts from Google, LLC., www.google.com/fonts ("Google Fonts"). Google Fonts are integrated by accessing a Google server (typically in the USA).
Privacy policy: policies.google.com/privacy, Opt out: adssettings.google.com authenticated.
- Maps from the "Google Maps" service provided by Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy : policies.google.com/ privacy, Opt out: www.google.com/settings/ads/.
- Videos from the "YouTube" platform of third party Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy: policies.google.com/privacy, Opt out: adssettings.google.com/authenticated.
- JavaScript library "jQuery". This library primarily allows a modern design for our websites. To increase the loading speed of our websites, we use the CDN (content delivery network) of jQuery to load this library. It is very likely that you have already downloaded jQuery from the jQuery CDN by visiting another website. In this case, your browser can use the copy stored in the cache. If your browser does not have a cached copy, or if,
for some other reason, you download the file from the jQuery CDN, your IP address will be transmitted to StackPath LLC, the CDN provider of jQuery.com, while connected to the jQuery server. The developer of the jQuery JavaScript library is the jQuery team of the JS Foundation: jquery.org/team/ js.foundation/contact jQuery is distributed for the JS Foundation via the StackPath CDN. The CDN is provided by StackPath LLC, 2021 McKinney Ave, Suite 1100, Dallas, TX 75201, USA. Further information on data protection at StackPath LLC can be found at: www.stackpath.com/legal/privacy-statement/
- Facebook Custom Audience is a marketing tool which a company can use to ensure its Facebook account specifically advertises only to those Facebook users that are likely to be interested in the advertisement. The data controller for persons resident in the USA or Canada is the aforementioned head office of Facebook Inc. at 1601 Willow Road, Menlo Park, CA 94025, USA. The data controller for persons resident outside the USA or Canada is Facebook Ireland Ltd, with registered offices at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Privacy policy: www.facebook.com/policy.php.
- Rapidmail  is a service that organises and analyses the distribution of newsletters. The data you provide in order to subscribe to our newsletter will be stored on Rapidmail servers in Germany.  rapidmail GmbH, Augustinerplatz 2, 79098 Freiburg i.Br.; data security: www.rapidmail.de/newsletter-marketing-dsgvo-und-datenschutz- konform
- Regiondo is an online booking system (ticket shop) for processing ticket orders; Regiondo GmbH, Grafinger Str. 6, 81671 Munich, Germany; privacy policy : pro.regiondo.com/de/datenschutz/
- Userlike is a chat platform for web, mobile and messaging support; Userlike UG, Probsteigasse 44-46; 50670 Cologne; privacy policy: www.userlike.com/de/terms
- Vioma is software/a platform for booking individual hotels; vioma GmbH, Industriestraße 27, 77656 Offenburg; privacy policy: www.vioma.de/de/company/ datenschutzerklaerung/
- Google Ajax is an API for enabling Google Search within dynamic homepage content and for indexing it accordingly. Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; privacy policy: policies.google.com/privacy

 

Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights with respect to the responsible party:

Right of access
You can request that the responsible party confirm whether we process personal data that concerns you. If we do indeed process such data of yours, you can request the following information from the data controller:

  1. the purposes for which the personal data is being processed;
  2. the categories of personal data being processed;
  3. the recipients or categories of recipients to whom the personal data relating to you either has been or continues to be disclosed;
  4. the intended period for which the personal data relating to you will be stored or, where specific information pertaining to this is not available, criteria for determining the storage duration;
  5. the existence of a right to rectification or erasure of personal data concerning you, a right to restriction of its processing by the data controller, or a right to object to this processing;
  6. the existence of a right of appeal to a supervisory authority;
  7. all available information on the origin of the data, if the personal data is not collected from the data subject him/herself;
  8. the existence of any automated decision-making, including profiling, in accordance with Art. 22 1 and 4 of the GDPR and – at least in these cases – meaningful information on the logic involved and the scope and intended effects of such processing for the data subject.

You have the right to be informed as to whether your personal data will be transmitted to a third country or an international organisation. In this context, you can request the appropriate guarantees under Art. 46 of the GDPR in connection with the transmission.

Right to rectification
You have the right to rectification and/or completion by the data controller if the personal data processed concerning you is either incorrect or incomplete. The data controller is required to make the correction immediately.

Right to Restriction of Processing
Under the following conditions, you may request that the processing of your personal data be restricted:

  1. Should you dispute the accuracy of the personal data concerning you for a period of time which allows the data controller to verify the accuracy of the personal data;
  2. the processing is unlawful and you reject the deletion of the personal data and instead request the restriction of the use of your personal data;
  3. the data controller no longer requires the personal data for processing purposes, but you require it to assert, exercise, or defend legal claims; or
  4. you have objected to processing pursuant to Art. 21 para.1 GDPR and it is not yet clear whether the data controller's legitimate interests in processing your data outweigh your interests.

If the processing of personal data concerning you has been restricted, then – apart from its storage – this data may only be processed with your consent or for the purposes of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person, or for reasons of an important public interest of the Union or a Member State. If the processing has been restricted in accordance with the above conditions, you will be informed by the data controller before the restriction is lifted.

Right to deletion
a) Deletion obligation
You have the right to demand that the data controller delete your personal data, and the data controller must do so without delay if any of the following reasons applies:

  1. The personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
  2. You withdraw your consent upon which the processing was based in accordance with Art. 6 para.1 a) or Art. 9 para.2 a) GDPR, and there is no other legal basis for the processing.
  3. You object to processing in accordance with Art. 21 para.1 of the GDPR, and there are no overriding legitimate grounds for processing, or you submit an objection to processing in accordance with Art. 21 para.2 GDPR.
  4. Your personal data has been unlawfully processed.
  5. Your personal data must be erased in order to comply with a legal obligation under Union law or Member State law to which the data controller is subject.
  6. The personal data concerning you was collected in relation to services offered by information society services pursuant to Art. 8 para. 1 GDPR.

b) Transfer of personal data to third parties
If the data controller has made your personal data public and is required to delete it under Art. 17 para.1 GDPR, we will take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform data processors who process the personal data that the data subject has requested the deletion of all links to this personal data as well as any copies thereof.

c) Exceptions
The right to deletion does not exist insofar as processing is necessary

  1. to exercise the right to freedom of expression and information;
  2. to fulfil a legal obligation which requires the processing in accordance with the law of the Union or of the Member States to which the data controller is subject, or to perform a task that is in the public interest or carried out in the exercise of public authority which was transferred to the data controller;
  3. for reasons of public interest in the field of public health in accordance with Art. 9 para.2 h) and i), as well as Art. 9 para.3 GDPR;
  4. for the purposes of archiving, the purposes of scientific or historical research, or statistical purposes which are in the public interest in accordance with Art. 89 para.1 GDPR, to the extent that the right referred to in a) is likely to seriously inhibit or make achieving the purposes of such processing impossible; or
  5. to assert, exercise or defend legal claims.

Right to be Informed
If you have asserted the right to rectification, deletion or restriction of processing against the data controller, the data controller will be obliged to communicate this rectification or deletion of the data or restriction of processing to all recipients to whom the personal data concerning you have been disclosed, unless this proves impossible or requires a disproportionate effort. You have the right to be informed by the data controller about who these recipients are.

Right to Data Portability
You have the right to obtain a copy of the personal data you have put at disposal of the data controller in a structured, commonly used, machine-readable format. Moreover, you have the right to transmit this data to another data controller without any obstruction from the data controller to whom the personal data has been given, if

  1. the processing is based on your consent in accordance with Art. 6 para.1 a) GDPR or Art. 9 para.2 a) of the GDPR or on a contract in accordance with Art. 6 para.1 b) GDPR and
  2. the processing is carried out by using automated procedures.

In exercising this right, you also have the right to have the data controller transfer your personal data directly to another data controller if this is technically feasible. This action must not affect the freedoms and rights of other persons. The right to data portability does not apply to personal data processing that is required for the performance of a task that falls within the public interest or that occurs in the exercise of public authority that has been transferred to the data controller.

Right to object
You have the right, for reasons arising from your specific situation, to object at any time to the processing of personal data concerning you that is carried out in accordance with Art. 6 para.1 e) or f) GDPR; the same applies to profiling based on these provisions. The data controller will no longer process the personal data relating to you unless they can prove a compelling, legitimate reason for this which outweighs your interests, rights, and freedoms or the processing serves to assert, exercise, or defend legal claims. If the personal data relating to you is processed for direct marketing purposes, you have the right to object at any time to such processing; this also applies to profiling insofar as it is associated with direct marketing of this kind. If you object to your data being processed for direct marketing purposes, your personal data will no longer be processed for such purposes. You have the possibility, in connection with the use of information society services, notwithstanding Directive 2002/58/EC, to exercise your right to object by means of automated procedures in which technical specifications are used.

Right to withdraw consent under data protection law
You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent shall not affect the legality of processing carried out on the basis of that consent prior to its withdrawal.

Automated decision-making in individual cases, including profiling
You have the right not to be subject to a decision based exclusively on automated processing - including profiling - that has legal effect against you or significantly impairs you in a similar manner. This shall not apply if the decision

  1. is necessary for either the conclusion or performance of a contract between you and a data controller;
  2. is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
  3. is based on your explicit consent.

However, these decisions may not be based on special categories of personal data pursuant to Art. 9 para.1 GDPR, unless Art. 9 para.2 a) or g) GDPR apply and appropriate measures have been taken to protect your rights and freedoms as well as your legitimate interests. With regard to the cases referred to in (1) and (3), the data controller shall take appropriate measures to safeguard your rights, freedoms and legitimate interests, including aat least the rights to obtain human intervention on the part of the data controller, to state his/her own position, and to challenge the decision.

Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right of appeal to a supervisory authority, in particular in the Member State where you reside, work or where the infringement is suspected, if you believe that the processing of personal data that concerns you is in contravention of GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy under Art. 78 GDPR.

Assertion of your rights against the data controller
You may exercise your rights at any time in writing, by email or by telephone. Please contact the controller named above.

Changes to our Privacy Policy
In order to ensure that our Privacy Policy always complies with current legal requirements, we reserve the right to make changes at any time. This also applies in the event that the data protection declaration has to be adapted due to new or revised services, for example new offers. The new Privacy Policy will then take effect the next time you visit our website.