imprint and
data privacy

Data Privacy Policy of Grossmann & Berger GmbH

(English Version of 4 June based on German version as of 28th March 2019)

Modern information and communications technologies play an ever bigger role in the activities of companies like Grossmann & Berger GmbH. For this reason, we take very seriously the protection of your privacy and the personal data which you provide to us. We observe as a matter of course the legal provisions designed to protect data privacy, in particular those contained in the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG), and the German Telemedia Act (Telemediengesetz, TMG).

1. Name and Address of the Controller

The company controlling the processing of your data (“Controller”) within the meaning of the General Data Protection Regulation, national data protection laws promulgated by the EU Member States, and any other provisions of law pertaining to the protection of data privacy is:

Grossmann & Berger GmbH

Bleichenbrücke 9 (Stadthöfe)

20354 Hamburg

Telephone: +49 (0)40 / 350 80 2 – 0

Telefax: +49 (0)40 / 350 80 2 – 36

E-Mail: info@grossmann-berger.de

Internet: www.grossmann-berger.de

1. Name and Address of the Data Protection Officer

The data protection officer appointed by the Controller is:

Thies Petersen

Data Protection Officer

Hamburger Sparkasse

P.O. Box

20454 Hamburg

E-Mail: datenschutz@haspa.de

Our Data Protection Officer is available to you, as user, to answer any questions you may have about the processing of your personal data or the protection of data privacy more generally, as well as in the event you wish to file a complaint.

III. General Considerations on the Processing of Data

1. Scope of our processing of personal data

We collect and use the personal data of our users in general only to the extent that doing so is necessary to make available to you a well-functioning website, provide you with content, or perform certain services. In most cases, we collect and use personal data only after obtaining the consent of our users. An exception applies where circumstances make obtaining the prior consent of users impossible and the processing of data is permitted pursuant to the applicable statutory provisions.

2. Legal Basis for the processing of personal data

To the extent we obtain the consent of the data subject for any step in the processing of personal data, Art. 6 Para. 1 lit. a GDPR serves as the legal basis for our processing of personal data.

In the event that the processing of personal data is necessary to fulfil an agreement to which the data subject is a party, Art. 6 Para. 1 lit. b GDPR serves as the legal basis for so doing. This also applies to steps in the processing of data which are necessary for the execution of pre-contractual measures.

To the extent the processing of personal data is necessary to perform a legal obligation to which our company is subject, Art. 6 Para. 1 lit. c GDPR serves as the legal basis for so doing.

In the event that measures performed in the public interest make it necessary to process personal data, Art. 6 Para. 1 lit. e GDPR serves as the legal basis for so doing.

Where the processing of personal data is necessary to protect the legitimate interests of our company or a third party, and the interests, fundamental rights, and fundamental freedoms of the data subject do not outweigh the legitimate interests of our company, Art. 6 Para. 1 lit. f GDPR serves as the legal basis for such processing.

3. Erasure of data and term of storage

The personal data we have stored relative to any data subject will be erased or blocked as soon as the purpose for which they were stored is no longer present. The data may, however, continue to be stored where European or national legislation, through regulation, law, or other provisions to which the Controller is subject, so requires. In such cases, the personal data will be blocked or erased once the data retention period has expired, provided there are no circumstances requiring the continued storage of such data for the purpose of concluding or fulfilling an agreement.

1. Providing access to our Website and Creation of Log Files
2. Description and scope of our processing of data

Every time someone visits our Website, our system automatically collects data and information concerning the computer system used to access the site.

The following data are collected:

(1) Information about the type and version of the browser used

(2) The user’s operating system

(3) Date and time of access

(4) Websites via which the user’s system came to our Website

(5) Websites which the user’s system accesses via our Website

(6) The user’s IP-Address

(7)  The page visited on our Website

These data are then also stored in the log files of our system. The log files store IP addresses and the date and time, so that it is possible to identify the user. These data are not stored together with other personal data relevant to the user.

2. Legal basis for the processing of data

The legal basis for our temporary storage of these data and the log files is Art. 6 Para. 1 lit. f GDPR.

3. Purpose of our processing of data

The temporary storage of the user’s IP address by our system is necessary to enable us to transmit our Website to the user’s computer. To this end, the user’s IP address must be stored for the duration of the session.

The data are stored in the log files in order to ensure the functionality of the Website. In addition, these data help us optimize the Website and ensure the security of our information technology systems – in particular to help defend the system against attacks from hackers. No evaluation of the data for marketing purposes is conducted in this connection.

These purposes also constitute our legitimate interest in the processing of user data pursuant to Art. 6 Para. 1 lit. f GDPR.

4. Term of storage

The data will be erased as soon as they are no longer needed to achieve the purpose for which they were stored. With respect to data collected in order to transmit our website to a user, this will be the case at the conclusion of the internet session.

With respect to data stored in log files, this will be the case after a period of no longer than seven days.

5. Objection or Erasure

The collection of data used for transmission of the Website and the storage of data in log files is absolutely necessary for operation of the Website. As a result, users have no way of objecting to such procedures.

1. Use of Cookies
2. Description and scope of our processing of data

Our Website uses cookies. Cookies are text data, which are stored in the internet browser or stored by the internet browser on the user’s computer system. Whenever a user calls up a web page, a cookie may be saved onto the user’s operating system. This cookie contains a characteristic series of signs, which makes it possible to identify the browser unambiguously when the Website is called up again.

We use cookies to make our Website more user-friendly. Certain elements of our Website require that we be able to identify the browser used even after it has changed pages. The following data are stored and transmitted in the cookies in this connection:

(1) Marked objects (watch list)

(2) Sortation of your real estate search (listing date, price)

Our Website also uses cookies which make it possible to analyze the user’s surfing behavior. In this way, the following data may be transmitted:

(1) Search terms entered

(2) Frequency with which pages are visited

(3) Use of certain Website functions

(4) Frequency with which pages are visited (in particular drop rates, length of visit)

(5) Storage of selected events (e.g., contact requests, registration for our Newsletter)

(6) Source page from which you accessed our Website and external links you followed

(7) Search terms on our Website

The user data collected in this way are pseudonymized by technical processes. As a result, it is no longer possible to relate the data to the user who visited our Website. These data are not stored together with other personal data of the user.

Whenever a user visits our Website, a banner informs him about our use of cookies for analytical purposes and refers him to this Data Privacy Policy. In connection herewith, we also explain how the user can block the storage of cookies in his browser settings.

2. Legal basis for the processing of data

The legal basis for our processing of personal data using cookies is Art. 6 Para. 1 lit. f GDPR.

3. Purpose of our processing of data

The purpose for using technically required cookies is to simplify the use of Websites for the user and shorten URLs. Certain functions of our Website cannot be offered without the use of cookies. For these functions, it is necessary that the browser be recognized even after it has switched pages within the Website and during the same session.

We need cookies for the following applications:

(1) Marking sortation parameters in the list of real estate search results (such as sortation according to listing date or price)

(2) Marking selected properties for your watch list

The user data collected by technically required cookies are not used to create user profiles.

We use analysis cookies for the purpose of improving the quality of our Website and enhancing its content. Through the analysis of cookies, we learn how our Website is being used so that we can constantly optimize our offerings.

These purposes also constitute our legitimate interest in the processing of user data pursuant to Art. 6 Para. 1 lit. f GDPR.

4. Term of storage, objection and deletion

Cookies are stored on the computer of the user and are transmitted from there to our Website. Thus, you as user have full control over the use of cookies. By changing the settings on your internet browser, you can deactivate or restrict the use of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our Website, it is possible that some of the functions of our Website can no longer be used in full.

The cookies are stored in part only until the end of the session (so-called session cookies) and in part long-term, but never for longer than 26 months after your last visit to our Website.

5. Google Analytics

This Website uses Google Analytics, an internet analysis service offered by Google Inc. („Google“). Google Analytics uses so-called “cookies,” or text data, which are stored on your computer and make it possible to analyze your use of our Website. The information concerning your use of this Website generated by the cookie (including your anonymized IP address) is transmitted to Google’s server in the USA and saved there. Google will use this information to evaluate the use of our Website, to generate reports on Website activities for the Website operator, and provide other services connected with the use of our Website and the internet. Google, too, may in turn pass this information on to third parties, to the extent this is provided for by law or third parties process this information on behalf of Google. Google will in no event connect your anonymized IP address with other data that may be stored by Google. You can prevent the installation of these cookies by making a corresponding change to the settings on your browser software; we point out, however, that in this case you may not be able to make full use of all the functions offered by this Website. You can, moreover, block Google’s storage and processing of the data generated by the cookie and relating to your use of the Website (including your IP address) by downloading and installing the browser-plugin available through the following link: Google Opt out. As an alternative to the Browser-Add-On, or when using a browser on a mobile device, you can click on the following link:

Google Analytics deactivate

This will install an opt-out-cookie on your device which prevents the future collection of your data by Google Analytics when you visit this Website. The opt-out functions only in the Browser and only for this domain. If you delete the cookies in your browser, you must click on this link again.

You will find more information on the terms of use and data protection at Terms of Use – Analytics or at https://policies.google.com/?hl=en.

We point out that, on this Website, Google Analytics was enhanced by the Code “anonymizelp,” in order to ensure that IP addresses are stored anonymously (so-called IP-masking).

6. Google Tag Manager

We use Google Tag Manager on our website. Google Tag Manager is a tag management system that allows to quickly and easily update tracking codes and related code fragments collectively known as tags on a website or mobile app.  Google Tag Manager doesn’t use cookies to generate information but manages tags that send information to third-parties on our website.  These third-parties generate information, which is considered in this privacy policy. Google Tag Manager doesn’t use this data.

By opting out of cookies, there will be no tracking by the tags that are managed by Google Tag Manager. The Google Tag Manager does not change cookie-settings.

You can find further information in Google’s terms of service and privacy policy.

7. Google Maps

This website uses the map services „Google Maps“ via an API. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
In order to use the functions of Google Maps it is necessary to store your IP address. The information generated by cookies about your use of this website (including your anonymous IP-address and location data) will be transmitted to and stored by Google on servers in the USA.

Further information regarding the terms of use and data protection can be found at: https://www.google.com/intl/de_de/help/terms_maps/ or at https://policies.google.com/privacy.

8. Hotjar

We use Hotjar in order to better understand our user´s needs and to optimize this service and experience. Hotjar is a technology service that helps us better understand our users experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don´t like, etc.) and this enables us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on our user´s behaviour and their devices (in particular device´s IP adress (captured and stored only in anonymized form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), preferred language used to display our webiste). Hotjar stores this information in a pseudonymized user profile. Neither Hotjar nor we will ever use this information to identify individual users or to match it with further data on individual user. For further details, please see Hotjar´s privacy policy by clicking on this link.

You can opt-out the creation of a user profile, Hotjar´s storing of data about your usage of our site and Hotjar´s use of tracking cookies on other websites by following this opt-out link.

9. Facebook Custom Audiences (Facebook Pixel)

We use the Conversion Tracking Pixel service „Custome Audiences“ of Facebook Inc. („Facebook“). Tihs feature is used to show interest-based advertisement (Facebook Ads) to visitors of this website. Therefore the „Facebook Pixel“ is implemented in this website. The collected data remain anonymous for us. This means that we cannot see the personal data of any individual user.
Through this pixel a direct connection to Facebook servers is made during visting the website. Facebook can assign the visit to your account if you are registered at Facebook. Even if you are not registered or logged in, it is possible the provider stores your IP adress and other identifying features. The collected data remain anonymous. This means that we cannot see the personal data of any individual user.

You can find further information in Facebook’s privacy policy.

You can deactivate the remarketing feature „Custom Audiences“ through the following link: https://www.facebook.com/settings/?tab=ads#_=_
You need to be logged in to deactivate the remarketing feature.

10. YouTube

Our website uses plug-ins of the YouTube platform, which is operated by Google. The website operator is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. If you visit a page on our website into which a YouTube plug-in has been integrated, a connection with YouTube’s servers will be established. As a result, the YouTube server will be notified, which of our pages you have visited.
Furthermore, YouTube will be able to place various cookies on your device. With the assistance of these cookies, YouTube will be able to obtain information about our website visitor. Among other things, this information will be used to generate video statistics with the aim of improving the user friendliness of the site and to prevent attempts to commit fraud. These cookies will stay on your device until you delete them. If you are logged into your YouTube account while you visit our site, you enable YouTube to directly allocate your browsing patterns to your personal profile. You have the option to prevent this by logging out of your YouTube account. The use of YouTube is based on our interest in presenting our online content in an appealing manner. Pursuant to Art. 6 Sect. 1 lit. f GDPR, this is a legitimate interest.

For more information on how YouTube handles user data, please consult the YouTube Data Privacy Policy under: https://policies.google.com/privacy?hl=en.

 

11. Usercentrics Consent Management Platform

This site uses third-party website tracking technologies to provide and continually improve our services, and to display advertisements according to users’ interests. I agree and may revoke or change my consent at any time with effect for the future.
Processing company

Usercentrics GmbH
Sendlinger Str. 7, 80331 Munich, Germany
Data Purposes

This list represents the purposes of the data collection and processing. A consent is only valid for the stated purposes. The collected data can’t be used or stored for any other purpose then the purposes listed below.

• Compliance with legal obligations
• Storage of Consent

Technologies Used

• Accept Cookies
• Local storage

Data Collected

This list represents all (personal) data that is collected by or through the use of this service.

• Device information
• Browser Information
• Anonymised IP Address
• Opt-in and opt-out data
• Date and time of visit
• Request URLs of the webpage
• Page path of the webpage
• Geographic location

Legal Basis

In the following the legal basis for the processing of personal data required by Art. 6 I 1 GDPR is listed.
Art. 6 para. 1 s. 1 lit. c GDPR

Location of Processing

European Union (Consent database is located in Belgium)
Retention Period

The retention period is the time span the collected data is saved for the processing purposes. The data needs to be deleted as soon as it is no longer needed for the stated processing purposes.

The Consent data (given consent and the consent revocation) will be kept for a period of three years. A data export takes place after termination of the contract.

Data Recipients

Data Recipients Infotext

Usercentrics GmbH
Data Protection Officer of Processing Company

Below you can find the email address of the data protection officer of the processing company.
datenschutz@usercentrics.com

Click here to read the privacy policy of the data processor https://usercentrics.com/privacypolicy/

1. Newsletter
2. Description and scope of our processing of data

On our Website, it is possible for you to subscribe to our free Newsletter. If you do so, the following data from the entry form will be transmitted to us in connection with your registration for the Newsletter:

(1) Subjects of interest

(2) Term of address

(3) Title

(4) First name

(5) Surname

(6) E-Mail address.

In addition, the following data will be collected in connection with your registration: date and time of registration.

In connection with the registration procedure, we shall request your consent to our processing of these data and refer to this Data Protection Policy.

No data are passed on to third parties in connection with our processing of data in connection with the delivery of our Newsletter. The data are used exclusively for the purpose of sending out the Newsletter.

2. Legal basis for the processing of data

The legal basis for the processing of data following the user’s registration for our Newsletter is, where the user has consented thereto, Art. 6 Para. 1 lit. a GDPR.

3. Purpose of our processing of data

Storage of the user’s e-mail address enables us to deliver the Newsletter. The storage of other personal data in connection with the registration process serves to prevent abuses of our services or of the e-mail address used.

4. Term of storage

The data will be erased as soon as they are no longer needed to achieve the purpose for which they were stored. This will be the case when you signal to us, by clicking on the unsubscribe link provided with every Newsletter, that you are no longer interested in receiving our Newsletter. The user’s e-mail address will thus be stored only so long as his subscription to the Newsletter is active. Following a successful cancellation of your Newsletter subscription, your personal data will be erased after a period of seven days.

5. Objection and Erasure

The user in question can cancel his subscription to the Newsletter at any time. To this end, a corresponding link is included in every Newsletter. In this way, we also make it possible for the user to revoke his consent to storage of the personal data collected during the process of registration.

VII. Contact Form and E-mail Contact

1. Description and scope of our processing of data

There are contact forms available on our Website, which may be used to contact us electronically. If a user takes advantage of this possibility, the data entered into our form will be transmitted to us, saved, and otherwise processed.

Depending on the contact form you use, the reason you state for contacting us, and the means of contact you select, we may ask for different data. These data may include the following:

(1) Department to be contacted;

(2) Form of address, first name, surname;

(3) Means of contact: telephone, e-mail, or post;

(4) Company, street, house number, zip code, city;

and/or

(5) Your message.

At the time you send us your message, the following additional data will be saved: date and time of your request.

Moreover, we will send to Google Analytics the following data:

(1) Area of your question

(2) Time your question was submitted.

In connection with the message procedure, we will request your consent to the processing of your data and refer to this Data Privacy Policy.

In the alternative, it is possible for you to contact us via the e-mail address we provide. In this case, the personal data transmitted with your e-mail message will be saved.

No data are passed on to third parties in this connection. Your data are used exclusively for the purpose of processing our conversation.

2. Legal basis for the processing of data

The legal basis for our processing of data is, where the user has consented thereto, Art. 6 Para. 1 lit. a GDPR. When the contact request is intended to initiate a broker’s agreement, Art. 6 Para. 1 lit. b GDPR provides an additional legal basis therefor.

The legal basis for our processing of data which are transmitted in connection with the sending of an e-mail is Art. 6 Para. 1 lit. f GDPR. When the contact request is intended to initiate an agreement, Art. 6 Para. 1 lit. b GDPR provides an additional legal basis therefor.

3. Purpose of our processing of data

The processing of personal data entered into the contact form serves exclusively to help us process your contact request and your real estate questions (in particular information about particular properties, requests for exposés, and requests for appointments for the purpose of a general consultation or viewing of a particular property).

In the event that you submit a request to be contacted or provided with information about a specific property by e-mail, such request also constitutes our required legitimate interest in processing your data.

When the contact request is intended to initiate the signing of an agreement or seek the referral of an agreement through the broker, our processing of your personal data also makes it possible to prove our activity as broker on your behalf.

The other personal data collected in connection with the procedure for sending your contact request serve to prevent abuse of the contact form and ensure the security of our information technology systems.

4. Term of storage

The data will be erased as soon as they are no longer needed to achieve the purpose for which they were stored. With respect to the personal data collected by means of a user’s entries into the contact form and such as are sent to us by e-mail, this will be the case when the conversation with that user has been concluded. The conversation is concluded when the circumstances indicate that the matter in question has been definitively settled.

Any additional personal data collected during the process of sending the contact form will be erased after a period of no longer than seven days.

5. Objection and Erasure

The user can revoke his consent to our processing of his personal data at any time. Where the user has contacted us by e-mail, he can object to our storage of his personal data at any time. In this case, it is not possible to carry on the conversation.

The simplest way for you to revoke your consent or submit an objection is to write an e-mail to the following address: info@grossmann-berger.de.

In that case, all personal data which were saved in the course of your contacting us will be erased.

VIII. 360° tour

The operator of the site offers you the opportunity to take a virtual 360° tour of selected properties. For this purpose, the functions of the service of begehungen.de Maaßen-Jürgensen GmbH, Tauentzienstraße 9-12, Salzufer 15/16, 10589 Berlin, are integrated.

As soon as you use this function, a connection is established to servers of begehungen.de, where information is automatically collected and stored in so-called server log files, which your browser passes on to these servers.
The server will be informed which property you are visiting. In addition, cookies, small text files, are stored on your computer as well as in your browser, which help to collect further information about your visits for statistical purposes. These are in detail the IP addresses, which are anonymized, the individual tours, number of hits, time and length of stay. Storage and processing of the recorded data takes place within the EU.

You can adjust your browser that way that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptation of cookies for specific cases or generally and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of the virtual tour may be restricted.

The broker is obliged to delete the personal data irrevocably and independently within 60-90 days after termination of the contractual relationship. Data processing is carried out on the basis of Art. 6 Para. 1 Letter f) DSGVO. The website operator has a justified interest in the technically faultless representation and an appealing presentation of the real estate offered by him.

So far as your registration, stating your first name and surname, your address, your e-mail address and your telephone number, is requested before the function is activated, data processing will be therefor carried out on the basis of your consent according to Art. 6 Para. 1 Letter a) and Art. 6 Para. 1 Letter f) DSGVO. The website operator has the right to protect the security and privacy of the real estate residents. Further information on this can be found in the data protection declaration of begehungen.de at https://www.begehungen.de/footer-menu/datenschutzerklaerung/

1. Further services and offers of the website
2. Description and scope of our processing of data

There are services and offers of third-parties available on our Website, which may be used to contact us electronically. If a user takes advantage of this possibility, the data entered into our form will be transmitted to us, saved, and otherwise processed.

Depending on the contact form you use, the reason you state for contacting us, and the means of contact you select, we may ask for different data. These data may include the following:

(1) Department to be contacted;

(2) Form of address, first name, surname;

(3) Means of contact: telephone, e-mail, or post;

(4) Company, street, house number, zip code, city;

and/or

(5) Your message.

At the time you send us your message, the following additional data will be saved: date and time of your request.

Moreover, we will send to Google Analytics the following data:

(1) Area of your question

(2) Time your question was submitted.

In connection with the message procedure, we will request your consent to the processing of your data and refer to this Data Privacy Policy.

In the alternative, it is possible for you to contact us via the e-mail address we provide. In this case, the personal data transmitted with your e-mail message will be saved.

No data are passed on to third parties in this connection. Your data are used exclusively for the purpose of processing our conversation.

2. Legal basis for the processing of data

The legal basis for our processing of data is, where the user has consented thereto, Art. 6 Para. 1 lit. a GDPR. When the contact request is intended to initiate a broker’s agreement, Art. 6 Para. 1 lit. b GDPR provides an additional legal basis therefor.

The legal basis for our processing of data which are transmitted in connection with the sending of an e-mail is Art. 6 Para. 1 lit. f GDPR. When the contact request is intended to initiate an agreement, Art. 6 Para. 1 lit. b GDPR provides an additional legal basis therefor.

3. Purpose of our processing of data

The processing of personal data entered into the contact form serves exclusively to help us process your contact request and your real estate questions (in particular information about particular properties, requests for exposés, and requests for appointments for the purpose of a general consultation or viewing of a particular property).

In the event that you submit a request to be contacted or provided with information about a specific property by e-mail, such request also constitutes our required legitimate interest in processing your data.

When the contact request is intended to initiate the signing of an agreement or seek the referral of an agreement through the broker, our processing of your personal data also makes it possible to prove our activity as broker on your behalf.

The other personal data collected in connection with the procedure for sending your contact request serve to prevent abuse of the contact form and ensure the security of our information technology systems.

4. Term of storage

The data will be erased as soon as they are no longer needed to achieve the purpose for which they were stored. With respect to the personal data collected by means of a user’s entries into the contact form and such as are sent to us by e-mail, this will be the case when the conversation with that user has been concluded. The conversation is concluded when the circumstances indicate that the matter in question has been definitively settled.

Any additional personal data collected during the process of sending the contact form will be erased after a period of no longer than seven days.

5. Objection and Erasure

The user can revoke his consent to our processing of his personal data at any time. Where the user has contacted us by e-mail, he can object to our storage of his personal data at any time. In this case, it is not possible to carry on the conversation.

The simplest way for you to revoke your consent or submit an objection is to write an e-mail to the following address: info@grossmann-berger.de.

In that case, all personal data which were saved in the course of your contacting us will be erased.

1. Rights of the Data subject

If personal data pertaining to you as user are processed, you constitute a data subject within the meaning of the GDPR and you are entitled to the following rights vis-à-vis us as the Controller:

1. Right of information

You are entitled to require that we confirm whether any personal data concerning you are being processed by us.

If that is the case, you are entitled to require that we disclose the following information to you:

(1) the purposes for the processing of your personal data;

(2) the categories of personal data being processed;

(3) the recipients or the categories of recipient to whom your personal data have been or will be disclosed;

(4) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

(5) the existence of the right to request from the Controller rectification or erasure of your personal data or restriction of processing of your personal data or to object to such processing;

(6) the existence of the right to lodge a complaint with a supervisory authority;

(7) where the personal data are not collected from you as data subject, any available information as to their source;

(8) the existence of automated decision-making, including profiling, referred to in Article 22 Paras. 1 and 4 GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you as data subject.

You have the right to demand information about whether your personal data have been transmitted to any foreign country or international organization; and in connection herewith, the right to be informed about the appropriate safeguards under Art. 46 GDPR relative to such transmission.

2. Right to Rectification

You have the right to insist on rectification and/or completion from us, to the extent the personal data pertaining to you which we process are false or incomplete. We are obligated to carry out the rectification without undue delay.

3. Right to restriction of processing

Under the following conditions, you may require that we restrict the processing of personal data pertaining to you:

(1) if you challenge the accuracy of the personal data pertaining to you for a period of time enabling us as Controller to verify the accuracy of such personal data;

(2) the processing of your personal data is unlawful, you oppose the erasure of the personal data, and request the restriction of their use instead;

(3) we as Controller no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defense of legal claims; or

(4) if you have objected to the processing of your personal data pursuant to Art. 21 Para. 1 GDPR, and it has not yet been determined whether the Controller’s legitimate interests outweigh your interests.

If the processing of your personal data has been restricted, these data may be processed – apart from the process of storing them – only with your consent or for the purpose of establishing, exercising, or defending legal claims or protecting the rights of another natural or legal person, or for reasons constituting a significant public interest of the European Union or a Member State.

If the processing of your personal data has been restricted in accordance with the conditions set forth above, we will notify you before the restriction is lifted.

4. Right to Erasure
5. a) Duty to erase

You may require that we erase the personal data pertaining to you without undue delay, and we are obligated to erase such data without undue delay where one of the following grounds applies:

(1) The personal data pertaining to you are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

(2) You revoke the consent upon which our processing of your data was based pursuant to Art. 6 Para. 1 lit. a GDPR, and there is no other basis in law for such processing;

(3) You object to the processing pursuant to Art. 21 Para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 2 Para. 2 GDPR;

(4) Your personal data have been unlawfully processed;

(5) Your personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the Controller is subject; or

(6) Your personal data have been collected in relation to the offer of information society services referred to in Art. 8 Para. 1 GDPR.

1. b) Notification of third parties

Where we as Controller have made your personal data public and are obliged pursuant to Art. 17 Para. 1 GDPR to erase the personal data, we will, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform controllers which are processing your personal data that you have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

1. c) Exceptions

The right to erasure does not apply where processing of your personal data is necessary:

(1) for exercising the right of freedom of expression and information;

(2) for compliance with a legal obligation which requires the processing under Union or Member State law to which the Controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;

(3) for reasons of public interest in the area of public health in accordance with Art. 9 Para. 2 lit. h and i as well as Art. 9 Para. 3 GDPR;

(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 Para. 1 GDPR in so far as the right to erasure referred to in Art. 17 Para. 1 GDPR is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

(5) for the establishment, exercise or defense of legal claims.

5. Right to notification

If you have exercised your right to rectification, erasure, or restriction of processing with regard to us as Controller, we are obligated to communicate this to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

We will inform you about those recipients if you request.

6. Right to data portability

You as data subject have the right to receive the personal data concerning you, which you have provided to us as Controller, in a structured, commonly used and machine-readable format. Moreover, you have the right to transmit those data to another controller without hindrance from us, as the Controller to which the personal data have been provided, where:

(1) the processing is based on consent pursuant to Art. 6 Para. 1 lit. a GDPR or Art. 9 Para. 2 lit. a GDPR or on a contract pursuant to Art. 6 Para. 1 lit. b GDPR; and

(2) the processing is carried out by automated means.

In exercising this right, you moreover have the right to have the personal data transmitted directly from us as Controller to another controller, where technically feasible.

The right to data portability shall not adversely affect the rights and freedoms of others; and this right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us as Controller.

7. Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6 Para. 1 lit. e or f GDPR, including profiling based on those provisions.

In this case, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms; or such processing serves the establishment, exercise or defense of legal claims.

Where your personal data are processed for direct marketing purposes, you shall have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Where you object to processing for direct marketing purposes, your personal data shall no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

8. Right to revoke your consent under data privacy law

You have the right to revoke, at any time, your consent under data privacy law. Such revocation of consent shall have no impact on the lawfulness of processing conducted on the basis of such consent prior to its revocation.

9. Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or with similar significance affects you.

The foregoing shall not apply if the decision

(1) is necessary for entering into, or performance of, a contract between you and us as data Controller;

(2) is authorized by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests as data subject; or

(3) is based on your explicit consent.

Such decisions, however, may not be based on special categories of personal data referred to in Article 9 Para. 1 GDPR, unless Art. 9 Para. 2 lit. a or g applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.

In the cases referred to in points (1) and (3) above, we as data Controller will implement suitable measures to safeguard your rights and freedoms and legitimate interests, including at least your right to obtain the intervention of a natural person on our part, the right to express your point of view, and the right to contest the decision.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you as data subject have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 GDPR.