D. Information on the rights of data subjects
As a data subject, you have the following rights with regard to the processing of your personal data:
- Right of access (Article 15 of the General Data Protection Regulation)
- Right to rectification (Article 16 of the General Data Protection Regulation)
- Right to erasure ("right to be forgotten") (Article 17 of the General Data Protection Regulation)
- Right to restriction of processing (Article 18 of the General Data Protection Regulation)
- Right to data portability (Article 20 of the General Data Protection Regulation)
- Right to object (Article 21 of the General Data Protection Regulation)
- Right to withdraw consent (Article 7(3) of the General Data Protection Regulation)
- Right to lodge a complaint with a supervisory authority (Article 77 of the General Data Protection Regulation)
To exercise your rights, you can contact us using the contact information referred to in Section A
Information on any specific modalities and mechanisms that may facilitate the exercise of your rights, in particular the exercise of your rights to data portability and to object, can be found, where appropriate, in the information on the processing of personal data in Section B of this Privacy Statement.
Below, you will find detailed information on your rights with regard to the processing of your personal data:
I. Right of access by the data subject
As the data subject, you have the right of access under the conditions of Article 15 of the General Data Protection Regulation.
Specifically, this means that you have the right to request confirmation from us as to whether we process personal data. If that is the case, you also have the right to access this personal data and the information stated in Article 15(1) of the General Data Protection Regulation. This includes infor-mation on the purpose of processing, the categories of personal data being processed and the recipient or categories of recipients who have access or who will have access to the personal data (Article 15(1a, 1b, 1c) of the General Data Protection Regulation).
The full scope of your right of access can be found in Article 15 of the General Data Protection Regulation, which can be accessed via the following link: http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016R0679.
II. Right to rectification
As the data subject, you have the right to rectification under the conditions of Article 16 of the General Data Protection Regulation.
Specifically, this means that you have the right to have any incorrect personal data that concerns you rectified by us without undue delay and to have any incomplete personal data completed.
The full scope of your right of access can be found in Article 16 of the General Data Protection Regulation, which can be accessed via the following link:http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016R0679.
III. Right to erasure ("right to be forgotten")
As the data subject, you have the right to erasure ("right to be forgotten") under the conditions of Article 17 of the General Data Protection Regulation.
This means that, unless otherwise specified, you have the right to request that we erase personal data that concerns you without undue delay, and we are obliged to erase this personal data immediately, insofar as one of the reasons stated in Article 17(1) of the General Data Protection Regulation ap-plies. This may be the case, for example, if personal data is no longer necessary for the purposes for which is was collected or otherwise processed (Ar-ticle 17(1a) of the General Data Protection Regulation).
In the event that we have disclosed the personal data and are obliged to erase it, we are also obliged to take appropriate measures, including those of a technical nature and taking into account the available technology and costs of implementation, to inform other parties responsible for processing the disclosed personal data that you have requested that they erase all links to, or copies or replicas of, the personal data (Article 17(2) of the General Data Protection Regulation).
As an exception, the right to erasure ("right to be forgotten") does not apply if processing is obligatory because of one of the reasons stated in Article 17(3) of the General Data Protection Regulation. For example, this may be the case if the processing is necessary to fulfil a legal obligation or to en-force, exercise or defend legal claims (Article 17(3a) and (3e) of the General Data Protection Regulation).
The full scope of your right to erasure can be found in Article 17 of the General Data Protection Regulation, which can be accessed via the following link:http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016R0679.
IV. Right to restriction of processing
As the data subject, you have the right to restriction of processing under the conditions of Article 18 of the General Data Protection Regulation.
This means that you have the right to request that processing is restricted if one of the conditions stated in Article 18(1) of the General Data Protection Regulation is met. For example, this may be the case if you dispute the accuracy of the personal data. Processing is restricted in this case for a period of time that enables us to verify the accuracy of the personal data (Article 18(1a) of the General Data Protection Regulation).
Restriction means stored personal data is marked with the aim of restricting its future processing (Article 4(3) of the General Data Protection Regula-tion).
The full scope of your right to restriction of processing can be found in Article 18 of the General Data Protection Regulation, which can be accessed via the following link:http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016R0679.
V. Right to data portability
As the data subject, you have the right to data portability under the conditions of Article 20 of the General Data Protection Regulation.
This means that you have the right, unless specified otherwise, to receive the relevant personal information that you have provided to us in a struc-tured, common and machine-readable format, and you have the right to freely convey this data to another controller, provided that the processing is based on a consent in accordance with Article 6(1a) or Article 9(2a) of the General Data Protection Regulation or on a contract in accordance with Arti-cle 6(1b) of the General Data Protection Regulation and the processing is carried out by automated means (Article 20(1) of the General Data Protection Regulation).
Information as to whether processing is carried out based on consent in accordance with Article 6(1a) or Article 9(2a) of the General Data Protection Regulation or based on a contract in accordance with Article 6(1b) of the General Data Protection Regulation can be found in the information on the le-gal basis for processing in Section B of this Privacy Statement.
When exercising the right to data portability, you also have the right, unless specified otherwise, to have your personal data transferred directly by us to another controller, insofar as this is technically possible (Article 20(2) of the General Data Protection Regulation).
The full scope of your right to data portability can be found in Article 20 of the General Data Protection Regulation, which can be accessed via the fol-lowing link:http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016R0679.
VI. Right to object
As the data subject, you have the right to object under the conditions of Article 21 of the General Data Protection Regulation.
As the data subject, we will expressly draw your attention to your right to object upon our first communication with you at the latest.
Detailed information on this can be found below:
1. Right to object for reasons arising from the specific situation of the data subject
As the data subject, you have the right to object to the processing of your personal data on the basis of Article 6(1e) or (1f) of the General Data Protection Regulation for reasons arising from your specific situation at any time; this also applies to profiling based on these provisions.
Information as to whether processing is based on Article 6(1e or (1f) of the General Data Protection Regulation can be found in the information on the legal basis of processing in Section B of this Privacy Statement.
In the event of an objection based on reasons arising from your specific situation, we will no longer process your personal data unless we can prove compelling, legitimate grounds that outweigh your interests, rights and freedoms, or that the processing is necessary to enforce, exercise or defend legal claims.
The full scope of your right to object can be found in Article 21 of the General Data Protection Regulation, which can be accessed via the following link: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679.
2. Right to object to direct marketing
If personal data is processed to drive direct marketing, you have the right to object to the processing of your personal data for the purposes of this type of marketing; this also applies to profiling, insofar as it is linked to direct marketing.
Information as to whether and to what extent personal data is processed for the purposes of direct marketing can be found in the information on the purposes of processing in Section B of this Privacy Statement.
In the event of an objection to processing for the purposes of direct marketing, we will no longer process the personal data for this purpose.
The full scope of your right to object can be found in Article 21 of the General Data Protection Regulation, which can be accessed via the following link: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679.
VII. Right to withdraw consent
If the processing is based on consent pursuant to Article 6(1a) or Article 9(2a) of the General Data Protection Regulation, you as the data subject have the right to withdraw consent at any time in accordance with Article 7(3) of the General Data Protection Regulation. Withdrawing consent does not affect the lawfulness of processing before the withdrawal of consent. We will inform you of this before you give your consent.
Information as to whether processing is based on consent in accordance with Article 6(1a) or Article 9(2a) of the General Data Protection Regulation can be found in the information on the legal basis of processing in Section B of this Privacy Statement.
VIII. Right to lodge a complaint with a supervisory authority
As the data subject, you have the right to lodge a complaint with a supervisory authority under the conditions of Article 77 of the General Data Protection Regulation.
The supervisory authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht [Bavarian Data Protection Authority, BayLDA]
Promenade 18
91522 Ansbach Germany
poststelle@lda.bayern.de
+49 (0) 981 180093-0