Data protection at Pilz

I. Definitions

Our data pri­vacy state­ment makes use of terms defined in the EU Gen­eral Data Pro­tec­tion Reg­u­la­tions (GDPR). We have explained these terms below in order to ensure leg­i­bility and com­pre­hen­sion of our data pri­vacy state­ment:

1. Personal data

According to the GDPR, per­sonal data is all infor­ma­tion refer­ring to an iden­ti­fied or iden­ti­fi­able nat­ural person. This refers to infor­ma­tion such as your name, your date of birth, your address, your E‑Mail address, your IP address or your tele­phone number, as well as your user behav­iour. On the other hand, infor­ma­tion not directly related to your real iden­tity – such as web­sites gen­er­ally pre­ferred by all users or a website’s number of users – is not regarded as per­sonal data.

2. Data subject

The data sub­ject is any iden­ti­fied or iden­ti­fi­able nat­ural person whose per­sonal data is used by the con­troller respon­sible for pro­cessing.

3. Processing

Pro­cessing means any oper­a­tion or set of oper­a­tions which is per­formed on per­sonal data or on sets of per­sonal data, whether or not by auto­mated means, such as col­lec­tion, recording, organ­i­sa­tion, struc­turing, storage, adap­ta­tion or alter­ation, retrieval, con­sul­ta­tion, use, dis­clo­sure by trans­mis­sion, dis­sem­i­na­tion or oth­er­wise making avail­able, align­ment or com­bi­na­tion, restric­tion, era­sure or destruc­tion.

4. Restriction of processing

Restric­tion of pro­cessing means the marking of stored per­sonal data with the aim of lim­iting its pro­cessing in the future..

5. Controller or controller responsible for processing

The con­troller or con­troller respon­sible for pro­cessing is the nat­ural or legal person, public authority, agency or other body which, alone or jointly with others, deter­mines the pur­poses and means of the pro­cessing of per­sonal data. Where the pur­poses and means of such pro­cessing are deter­mined by Union or member state law, the con­troller or the spe­cific cri­teria for its nom­i­na­tion may be pro­vided for by Union or member state law.

6. Processor

The processor is a nat­ural or legal person, public authority, agency or other body which processes per­sonal data on behalf of the con­troller.

7. Recipient

The recip­ient is a nat­ural or legal person, public authority, agency or other body to which the per­sonal data is dis­closed, whether a third party or not. Public author­i­ties which may receive per­sonal data in the frame­work of a par­tic­ular inquiry in accor­dance with Union or member state law shall not be regarded as recip­i­ents.

8. Third party

A third party is a nat­ural or legal person, public authority, agency or body other than the data sub­ject, con­troller, processor and per­sons who, under the direct authority of the con­troller or processor, are autho­rised to process per­sonal data.

9. Consent

Con­sent is any freely given, spe­cific, informed and unam­biguous indi­ca­tion of the data sub­ject’s wishes by which they, by a state­ment or by a clear affir­ma­tive action, sig­ni­fies agree­ment to the pro­cessing of per­sonal data con­cerning them.

II. Name and address of the controller [Art. 4, Para. 7 of the GDPR]

The con­troller under the terms of the Gen­eral Data Pro­tec­tion Reg­u­la­tion, other national data pro­tec­tion leg­is­la­tion of the member states and other pro­vi­sions under data pro­tec­tion leg­is­la­tion is:

Pilz GmbH & Co. KG
Felix-Wankel-Straße 2
73760 Ost­fildern
Ger­many

Tel.: +49 711 3409–0
E‑Mail: info@pilz.de
Web­site: www.pilz.com

III. Data protection officer

You can reach our data pro­tec­tion officer at: dataprotection@pilz.com

IV. General information on data processing

1. Extent of personal data processing

As a basic prin­ciple, we col­lect and process our users’ per­sonal data only to the extent required for pro­viding a func­tional web­site and sup­plying our con­tent and ser­vices. We process our users’ per­sonal data reg­u­larly only if the respec­tive users have given their con­sent. An excep­tion applies in those cases where it is not actu­ally pos­sible to obtain prior con­sent and where data pro­cessing is per­mitted by law.

2. Legal basis for processing personal data

The data you transfer or col­lect shall only be col­lected, used, processed, stored and if nec­es­sary for­warded to third par­ties – where this is legally pre­scribed, con­trac­tu­ally nec­es­sary or per­mitted within the frame­work of cur­rent leg­is­la­tion – within the frame­work of cur­rent data pro­tec­tion leg­is­la­tion (GDPR, the German Fed­eral Data Pro­tec­tion Act and the German Broad­cast Media Act).

Art. 6 of the GDPR is the respec­tive legal basis for pro­cessing your per­sonal data to which this data pri­vacy state­ment refers:

Insofar as we obtain the data sub­ject’s con­sent to process their per­sonal data, Art. 6, Para. 1, lit. a of the EU Gen­eral Data Pro­tec­tion Reg­u­la­tion (GDPR) shall apply as the legal basis for pro­cessing per­sonal data.

Where it is nec­es­sary to process per­sonal data for the pur­poses of ful­filling a con­tract and the data sub­ject is the con­tracting party, Art. 6, Para. 1, lit. b of the GDPR shall apply as the legal basis. This shall also apply to pro­cessing which is required to carry out pre-con­trac­tual mea­sures.

Where pro­cessing of per­sonal data is nec­es­sary for our com­pany to fulfil a legal oblig­a­tion, Art. 6, Para. 1, lit. c of the GDPR shall apply as the legal basis.

Where pro­cessing of per­sonal data is nec­es­sary for pro­tecting the vital inter­ests of the data sub­ject, or those of another nat­ural person, Art. 6, Para. 1, lit. d of the GDPR shall apply as the legal basis.

Where pro­cessing is nec­es­sary to pro­tect our com­pa­ny’s or a third par­ty’s legit­i­mate inter­ests, and such inter­ests are not over­ridden by the inter­ests, fun­da­mental rights and free­doms of the data sub­ject, Art. 6, Para. 1, lit. f of the GDPR shall apply as the legal basis for pro­cessing.

3. Erasure of data and duration of storage

The data subject’s per­sonal data shall be erased or blocked as soon as the pur­pose for which it has been stored has been ful­filled. Data may be stored beyond this period if this is spec­i­fied in Euro­pean or national leg­is­la­tion from Euro­pean Union Reg­u­la­tions, laws or other pro­vi­sions to which the con­troller is sub­ject. Data shall also be blocked or erased if a storage period spec­i­fied in the above stan­dards expires, unless con­clu­sion or ful­fil­ment of a con­tract requires the data to be stored for longer.

V. Providing the website and creating log files

The extent and manner of col­lec­tion and use of your data shall vary, depending on whether you visit our web­site only to access infor­ma­tion or whether you are making use of our offers — static links (I), com­ment func­tion (II) and the option of E‑Mail con­tact as set out in the con­tact form or by E‑Mail address (III) as well as Vimeo (IV):

1. Description and extent of data processing

Each time our web­site is accessed, our system auto­mat­i­cally col­lects data and infor­ma­tion from the accessing com­puter system.

The fol­lowing data is col­lected:

1. Infor­ma­tion on the browser type and ver­sion used
2. The user’s oper­ating system
3. The user’s IP address
4. Date and time of access
5. Web­sites from which the user’s system reaches our web­site
6. Web­sites the user’s system accesses from our web­site

The data is also stored in our sys­tem’s log files. This data is not stored together with any of the user’s other per­sonal data.

2. Legal basis for data processing

The legal basis for the tem­po­rary storage of data and log files is Art. 6, Par. 1, lit. f of the GDPR.

3. Purpose of data processing

The system needs to store the IP address tem­porarily in order to pro­vide the web­site to the user’s com­puter. The user’s IP address must remain stored for the dura­tion of the ses­sion for this pur­pose.

Storage in log files is car­ried out to guar­antee the func­tion­ality of the web­site. We also use the data to opti­mise the web­site and to ensure the secu­rity of our IT sys­tems. No data is eval­u­ated for mar­keting pur­poses in this con­text.

The above pur­poses also con­sti­tute our legit­i­mate interest in data pro­cessing under Art. 6, Para. 1, lit. f of the GDPR.

4. Duration of storage

The data shall be erased as soon as it is no longer required to achieve the pur­pose for which it was col­lected. When data is col­lected in order to pro­vide the web­site, this is the case when the respec­tive ses­sion is ended.

When data is stored in log files, this is the case after 7 days at the latest. Extended storage is pos­sible. In this case, users’ IP addresses are erased or mod­i­fied so that they can no longer be allo­cated to the accessing user.

5. Option to object and remove

It is absolutely essen­tial to col­lect data in order to pro­vide the web­site; it is nec­es­sary to store data in log files in order to operate the web­site. As a result, the user has no option to object.

I. Static links to Face­book, Twitter, YouTube and LinkedIn

Our web­site makes use of static links to the social net­work Face­book, the microblog­ging ser­vice Twitter and the social plat­form LinkedIn. These ser­vices are offered by the com­pa­nies Meta Plat­forms Inc., Twitter Inc. and LinkedIn Corp. (“ser­vice providers”). Please inform your­self about the data pri­vacy reg­u­la­tions on the respec­tive plat­form.

Sharing con­tent

You have the option to rec­om­mend con­tent on our web­site via the but­tons placed on the article. We pro­vide infor­ma­tion — and no per­sonal data — to the social net­works for the sole pur­pose of dis­playing con­tent. When you use the but­tons, we merely link to the page of the respec­tive social media provider. We do not process any per­sonal data.

II. Com­ment func­tion

1. Descrip­tion and extent of data pro­cessing

On our web­site we offer the option to leave com­ments about indi­vidual arti­cles. Should a data sub­ject leave a com­ment on an article, details about the time the com­ment was made, as well as the user name (pseu­donym) chosen by the data sub­ject are stored and pub­lished along­side the com­ments left by the data sub­ject. The E‑Mail address entered by the data sub­ject is also stored – but not pub­lished. Fur­ther­more, the IP address assigned by the data subject’s Internet ser­vice provider (ISP) is also recorded.

2. Legal basis for data pro­cessing

The legal basis for data pro­cessing, pro­vided that the user has given their con­sent to this effect, is Art. 6, Para. 1, lit. a of the GDPR. The legal basis for pro­cessing data trans­ferred in the course of sending an E‑Mail is Art. 6, Para. 1, lit. f of the GDPR. If you have con­tacted us by E‑Mail with the aim of con­cluding a con­tract, Art. 6, Para. 1, lit. b of the GDPR forms an addi­tional legal basis.

3. Pur­pose of data pro­cessing

Pro­cessing of per­sonal data from the input screen serves only to process the com­ment. If the user makes con­tact by E‑Mail, there is also a required legit­i­mate interest in data pro­cessing.

The IP address is stored for secu­rity rea­sons and in case the data sub­ject should leave a com­ment that vio­lates third-party rights or posts unlawful con­tent. There­fore, this per­sonal data is stored in the inter­ests of the con­troller, so that they can excul­pate them­selves, if nec­es­sary, in case the law is infringed. The per­sonal data col­lected in this way shall not be for­warded to third par­ties unless it is required by law or serves as the legal defence for the con­troller.

4. Dura­tion of storage

The data shall be erased as soon as it is no longer required to achieve the pur­pose for which it was col­lected. For the E‑Mail address from the com­ment function’s input screen, this is the case when E‑Mail com­mu­ni­ca­tion is not required beyond replying to the com­ment, or the respec­tive con­ver­sa­tion with the user via E‑Mail com­mu­ni­ca­tion has ended. The con­ver­sa­tion is ended when the cir­cum­stances indi­cate that the sit­u­a­tion con­cerned has been con­clu­sively clar­i­fied. The article, including the com­ments pub­lished under the user name (pseu­donym) chosen by the data sub­ject shall auto­mat­i­cally be deleted three years after the article’s pub­li­ca­tion date.

5. Option to object and remove

Users shall have the option to with­draw their con­sent to the pro­cessing of their per­sonal data at any time. If users con­tacts us by E‑Mail, they can object to the storage of their per­sonal data at any time. The con­ver­sa­tion cannot be con­tinued in a case such as this. All per­sonal data stored during the course of con­tact is erased in this case.

III. Con­tact form and E‑Mail con­tact

1. Descrip­tion and extent of data pro­cessing

On our web­site there is a con­tact form which can be used to con­tact us elec­tron­i­cally. If a user uses this option, the data entered in the input screen shall be trans­ferred to us and stored. Manda­tory data is:

Title

Sur­name

First name

Com­pany

Street, house number

Post­code, town

Country

E‑Mail

Vol­un­tary data is:

Depart­ment

PO box

State/County

Tele­phone

Telefax

Industry

Cus­tomer number

At the time of sending the mes­sage, the fol­lowing data is also stored:

- The user’s IP address

Your con­sent to data pro­cessing is obtained during the sending process, with ref­er­ence to this data pri­vacy state­ment.

Alter­na­tively, you can also con­tact us on the E‑Mail address pro­vided. In this case, the user’s per­sonal data that is trans­ferred with the E‑Mail is stored.

Your data shall not be dis­closed to third par­ties in this regard. Data is only used for pro­cessing the con­ver­sa­tion.

2. Legal basis for data pro­cessing

The legal basis for data pro­cessing, pro­vided that the user has given their con­sent to this effect, is Art. 6, Par. 1, lit. a of the GDPR. The legal basis for pro­cessing data trans­ferred in the course of sending an E‑Mail is Art. 6, Para. 1, lit. f of the GDPR. If you have con­tacted us by E‑Mail with the aim of con­cluding a con­tract, Art. 6, Para. 1, lit. b of the GDPR forms an addi­tional legal basis.

3. Pur­pose of data pro­cessing

Pro­cessing of per­sonal data from the input screen serves only to allow us to process the con­tact request. If the user makes con­tact by E‑Mail, there is also a required legit­i­mate interest in data pro­cessing.

The other per­sonal data processed during the sending process is used to pre­vent misuse of the con­tact form and to ensure the secu­rity of our IT sys­tems.

4. Dura­tion of storage

The data shall be erased as soon as it is no longer required to achieve the pur­pose for which it was col­lected. For the per­sonal data from the con­tact form’s input screen and the data sent by E‑Mail, this is the case when the respec­tive con­ver­sa­tion with the user has ended. The con­ver­sa­tion is ended when the cir­cum­stances indi­cate that the sit­u­a­tion con­cerned has been con­clu­sively clar­i­fied.

The per­sonal data also col­lected during the sending process is erased after a period of seven days at the latest.

5. Option to object and remove

Users have the option to with­draw their con­sent to the pro­cessing of their per­sonal data at any time

If users con­tact us by E‑Mail, they can object to the storage of their per­sonal data at any time. The con­ver­sa­tion cannot be con­tinued in a case such as this.

All per­sonal data stored during the course of con­tact is erased in this case.

6. LinkedIn — Gen­er­ating leads through a form

By means of ads we place forms via LinkedIn; these give you the oppor­tu­nity to receive fur­ther infor­ma­tion or take advan­tage of addi­tional offers. We use this form to ask for your per­sonal data (first name and sur­name, com­pany, E‑Mail address, tele­phone number) and, depending on the type of ad, other per­sonal data pro­vided by LinkedIn in the form.

You send the data you enter in the form by pressing the “Send” button. This is sent to LinkedIn first, then LinkedIn makes this data avail­able to us via an inter­face.

The data you pro­vide is processed exclu­sively on the basis of your con­sent (Art. 6, Par. 1, lit. a of the GDPR). You can with­draw that con­sent at any time. An informal noti­fi­ca­tion via E‑Mail is enough to with­draw your con­sent. The legality of any data pro­cessing oper­a­tions car­ried out before con­sent is with­drawn shall remain unaf­fected.

We shall store the data sub­mitted to us via the form until such time as you instruct us to erase it, with­draw your con­sent to it being stored or there is no fur­ther need to store the data. Manda­tory statu­tory pro­vi­sions – in par­tic­ular reten­tion periods – shall remain unaf­fected. In accor­dance with its internal data pri­vacy poli­cies, LinkedIn stores your data inde­pen­dently for a period of 90 days and then erases it auto­mat­i­cally.

IV. Vimeo

We use “Vimeo”, an online video portal sup­plied by Vimeo.com, Inc., 330 West 34th Street, 5th Floor New York, New York 10001, USA to dis­play videos on our web­site.

a. Type of per­sonal data
On our web­site, when you call up a page con­taining a “Vimeo” video, your browser con­nects to “Vimeo’s” servers. This results in a data transfer, during which your IP address, tech­nical infor­ma­tion about your browser type, the oper­ating system, plus date and time are trans­mitted and processed by “Vimeo”.
“Vimeo” stores infor­ma­tion about the web­site through which you use the “Vimeo” ser­vice and which web activ­i­ties you carry out on our web­site. Web activ­i­ties include ses­sion dura­tion, bounce rate, or also which button you clicked on in the embedded “Vimeo” player on our web­site. “Vimeo” can track and store these actions using cookies. We ask for your per­mis­sion to store and process data each time you view a “Vimeo” video on our web­site by clicking on the video. Should you not con­sent to storage and pro­cessing, you will need to pre­vent the instal­la­tion of cookies. This can be done via the appro­priate set­tings in your browser.
If you are logged into “Vimeo” when you visit an Internet page on our web­site that has a “Vimeo” player embedded, the col­lected user data is assigned to your per­sonal user account.
You can find out more about the use of cookies at Vimeo at https://vimeo.com/cookie_policy. Infor­ma­tion on data pro­tec­tion at Vimeo is avail­able at https://vimeo.com/privacy.

b. Storage period
“Vimeo” stores your data until “Vimeo” no longer has any com­mer­cial reason for storing the data. At this point your data is deleted or anonymised.

c. Pur­pose of data pro­cessing
“Vimeo” uses the data to improve its own ser­vice, to com­mu­ni­cate with you and to imple­ment its own tar­geted adver­tising mea­sures.

d. Legal basis for pro­cessing
The legal basis is Art. 6 Para. 1 lit. a) GDPR. You give your con­sent by allowing external con­tent to be incor­po­rated.

e. Transfer of your data
We will never pass your per­sonal data to a third party — other than as out­lined above.
The user data is processed on “Vimeo’s” servers in the USA. “Vimeo” uses so-called stan­dard con­trac­tual clauses (= Art. 46 Para. 2 and 3 of the GDPR) as the basis for data pro­cessing for recip­i­ents based in third coun­tries or for trans­fer­ring data there. Through these clauses, Vimeo under­takes to comply with Euro­pean data pro­tec­tion stan­dards when pro­cessing your rel­e­vant data, even if the data is stored, processed and man­aged in the USA.

VI. Use of cookies

Our web­site uses cookies. Cookies are text files which are stored in the user’s Internet browser or on the user’s com­puter system by the Internet browser. If a user accesses a web­site, a cookie may be stored on the user’s oper­ating system. This cookie con­tains a char­ac­ter­istic char­acter string which enables unique iden­ti­fi­ca­tion of the browser the next time the web­site is called up.

I. Cookies used by third parties

Nec­es­sary (1)

Nec­es­sary cookies help make a web­site usable by enabling basic func­tions such as page nav­i­ga­tion and access to secure areas of the web­site. The web­site cannot func­tion prop­erly without these cookies.

1. Name: __cf_bm
   Provider: fonts.net
   Pur­pose: This cookie is used to dis­tin­guish between humans and bots. This is ben­e­fi­cial for the web­site to gen­erate valid reports about the usage of the web­site.
   Expi­ra­tion: 1 day
   Type: http cookie

VII. Web analysis through Matomo

1. Descrip­tion and extent of data pro­cessing

We use the open source soft­ware tool Matomo on our web­site to analyse the surfing behav­iour of our users. This is an open source web analysis tool. Matomo does not transfer any data to servers out­side of our con­trol.

We do not use cookies when using Matomo.

In using Matomo to analyse vis­i­tors to our web­site, our aim is to fur­ther improve our web­site and adapt it to users’ needs.

When calling up our web­site and its indi­vidual pages, Matomo col­lects the fol­lowing data:

(1) 2 Bytes of the IP address of the user’s calling system

(2) The called web­site

(3) The web­site from which the user accessed the called web­site (referrer)

(4) The sub-pages called up from the called web­site

(5) The time spent on the web­site, but no longer than one ses­sion

(6) The fre­quency with which the web­site is called, observed over no more than one ses­sion

The soft­ware runs exclu­sively on our website’s servers. This is the only place where the user’s anonymised per­sonal data is stored. Data is not dis­closed to third par­ties.

2. Legal basis for per­sonal data pro­cessing

The legal basis for pro­cessing the user’s per­sonal data is Art. 6, Para. 1 lit. f of the GDPR.

3. Pur­pose of data pro­cessing

Pro­cessing the user’s anonymised per­sonal data enables us to analyse our users’ surfing behav­iour. By eval­u­ating the data col­lected we are able to com­pile infor­ma­tion about the use of the indi­vidual com­po­nents of our web­site. This helps us to con­stantly improve our web­site and its user friend­li­ness. By short­ening the IP address, users’ interest in the pro­tec­tion of their per­sonal data is suf­fi­ciently taken into account.

4. Dura­tion of storage and option to object and remove

The data is deleted as soon as it is no longer required for our recording pur­poses. The gen­er­ated aggre­gated sta­tis­tics and under­lying data are not deleted.

5. Option to object and remove

We do not use cookies and only use anonymised user data for web analysis. For this reason, the option to object and remove is not nec­es­sary for users of our web­site.

VIII. Rights of the data subject

If your per­sonal data is processed, then you are the data sub­ject under the pro­vi­sions of the GDPR and you are enti­tled to the fol­lowing rights vis-à-vis the con­troller:

1. Right of access

You can request con­fir­ma­tion from the con­troller as to whether we are pro­cessing per­sonal data con­cerning you.

If such pro­cessing is taking place, you can request access to the fol­lowing infor­ma­tion from the con­troller:

The pur­poses for which the per­sonal data is being processed;

The cat­e­gories of per­sonal data that are being processed;

The recip­i­ents or cat­e­gories of recip­i­ents to whom the rel­e­vant per­sonal data has been dis­closed or is being dis­closed;

The planned dura­tion of storage of the per­sonal data con­cerning you or, if that is not pos­sible, the cri­teria used to define that period;

The exis­tence of the right to request from the con­troller rec­ti­fi­ca­tion or era­sure of per­sonal data con­cerning you, the right to restrict pro­cessing by the con­troller or the right to object to this pro­cessing;

The right to lodge a com­plaint with a super­vi­sory authority;

All avail­able infor­ma­tion about the origin of the data, if the per­sonal data is not obtained from the data sub­ject;

The exis­tence of auto­mated deci­sion-making, including pro­filing, referred to in Art. 22 Par. 1 and 4 of the GDPR and – at least in those cases – mean­ingful infor­ma­tion about the logic involved, as well as the impli­ca­tions and intended effects of such pro­ce­dures for the data sub­ject.

You have the right to request infor­ma­tion about whether the per­sonal data con­cerning you is trans­ferred to a third country or an inter­na­tional organ­i­sa­tion. In this con­text, you can request to be informed of the appro­priate safe­guards according to Art. 46 of the GDPR in con­nec­tion with such transfer.

2. Right to rec­ti­fi­ca­tion

You have a right to obtain rec­ti­fi­ca­tion and/or com­ple­tion from the con­troller, where the processed per­sonal data con­cerning you is incor­rect or incom­plete. The con­troller shall rec­tify the data without delay.

3. Right to restrict pro­cessing

You can request that pro­cessing of the per­sonal data con­cerning you be restricted under the fol­lowing con­di­tions:

When you con­test the accu­racy of the per­sonal data con­cerning you, for a period enabling the con­troller to verify the accu­racy of the per­sonal data;

Pro­cessing is unlawful and you oppose the era­sure of the per­sonal data and request the restric­tion of its use instead;

The con­troller no longer needs the per­sonal data for the pur­poses of the pro­cessing, but you require it for the estab­lish­ment, exer­cise or defence of legal claims, or

When you have objected to pro­cessing pur­suant to Art. 21 Par. 1 of the GDPR, pending ver­i­fi­ca­tion of whether the legit­i­mate grounds of the con­troller over­ride yours.

Where pro­cessing of the per­sonal data con­cerning you is restricted, such data shall – with the excep­tion of storage – only be processed with your con­sent or for the estab­lish­ment, exer­cise or defence of legal claims or for the pro­tec­tion of rights of another nat­ural or legal person or for rea­sons of impor­tant public interest of the Union or of a member state.

If restric­tion of pro­cessing was obtained in accor­dance with the afore­men­tioned con­di­tions, you shall be informed by the con­troller before the restric­tion is lifted.

4. Right to era­sure

a) Oblig­a­tion to erase

You can make a request to the con­troller that the per­sonal data con­cerning you be erased without undue delay and the con­troller shall be obliged to erase this data without undue delay where one of the fol­lowing grounds applies:

The per­sonal data con­cerning you is no longer nec­es­sary for the pur­poses for which it was col­lected or oth­er­wise processed.

You with­draw your con­sent on which pro­cessing is based in accor­dance with Art. 6, Para. 1, lit. a or Art. 9, Para. 2, lit. a of the GDPR and there are no other legal grounds for pro­cessing.

You object to pro­cessing pur­suant to Art. 21, Para. 1 of the GDPR and there are no other over­riding legit­i­mate grounds for pro­cessing or you object to pro­cessing pur­suant to Art. 21, Para. 2 of the GDPR.

The per­sonal data con­cerning you was processed unlaw­fully.

The per­sonal data con­cerning you must be erased for com­pli­ance with a legal oblig­a­tion in Union or member state law to which the con­troller is sub­ject.

The per­sonal data con­cerning you was col­lected in rela­tion to the offer of infor­ma­tion society ser­vices referred to in Art. 8, Para. 1 of the GDPR.

b) Infor­ma­tion to third par­ties

Where the con­troller has made the per­sonal data con­cerning you public and is obliged to erase the per­sonal data pur­suant to Art. 17, Par. 1 of the GDPR, taking account of the avail­able tech­nology and the cost of imple­men­ta­tion, the con­troller shall take rea­son­able steps, including tech­nical mea­sures, to inform con­trollers pro­cessing the per­sonal data that you as the data sub­ject have requested the era­sure of any links to, or copy or repli­ca­tion of this per­sonal data.

c) Excep­tions

The right to era­sure shall not apply where pro­cessing is nec­es­sary

For exer­cising the right of freedom of expres­sion and infor­ma­tion;

For com­pli­ance with a legal oblig­a­tion which requires pro­cessing by Union or member state law to which the con­troller is sub­ject or for the per­for­mance of a task car­ried out in the public interest or in the exer­cise of offi­cial authority vested in the con­troller;

For rea­sons of public interest in the area of public health in accor­dance with points (h) and (i) of Art. 9 Par. 2 as well as Art. 9 Par. 3 of the GDPR;

 For archiving pur­poses in the public interest, sci­en­tific or his­tor­ical research pur­poses or sta­tis­tical pur­poses in accor­dance with Art. 89 Par. 1 of the GDPR, in so far as the right referred to in para­graph a) is likely to render impos­sible or seri­ously impair the achieve­ment of the objec­tives of that pro­cessing, or

For the estab­lish­ment, exer­cise or defence of legal claims.

5. Right to noti­fi­ca­tion

If you have asserted your right to rec­ti­fi­ca­tion, era­sure or restric­tion of pro­cessing from the con­troller, the con­troller shall be obliged to inform all the recip­i­ents to whom the per­sonal data con­cerning you has been dis­closed of this rec­ti­fi­ca­tion or era­sure of data or restric­tion of pro­cessing, unless this proves impos­sible or involves dis­pro­por­tionate effort.

You are enti­tled to receive infor­ma­tion about these recip­i­ents from the con­troller.

6. Right to data porta­bility

You have the right to receive the per­sonal data con­cerning you, which you pro­vided to the con­troller, in a struc­tured, com­monly used and machine-read­able format. You also have the right to transmit this data to another con­troller without hin­drance from the con­troller to which the per­sonal data has been pro­vided, where

Pro­cessing is based on con­sent pur­suant to Art. 6 Par. 1 lit. a or Art. 9 Par. 2 lit. a of the GDPR or on a con­tract pur­suant to Art. 6 Par. 1 lit. b of the GDPR and pro­cessing is car­ried out by auto­mated means.

In exer­cising this right, you fur­ther have the right to have the per­sonal data con­cerning you trans­mitted directly from one con­troller to another, where tech­ni­cally fea­sible. The rights and free­doms of others must not be adversely affected by the exer­cising of this right.

7. Right to object

You shall have the right, on grounds relating to your par­tic­ular sit­u­a­tion, to object at any time to pro­cessing of the per­sonal data con­cerning you based on Art. 6, Para. 1, lit. e or f of the GDPR; this shall also apply to pro­filing based on those pro­vi­sions.

The con­troller shall no longer process the per­sonal data con­cerning you unless the con­troller demon­strates com­pelling legit­i­mate grounds for pro­cessing which over­ride your inter­ests, rights and free­doms, or for the estab­lish­ment, exer­cise or defence of legal claims.

If the per­sonal data con­cerning you is processed for direct mar­keting pur­poses, you shall have the right at any time to object to pro­cessing of the per­sonal data con­cerning you for the pur­poses of such mar­keting; this shall also apply to pro­filing to the extent that it is related to such direct mar­keting.

If you object to pro­cessing for direct mar­keting pur­poses, the per­sonal data con­cerning you shall no longer be processed for such pur­poses.

In the con­text of the use of infor­ma­tion society ser­vices – notwith­standing Direc­tive 2002/58/EC – you can exer­cise your right to object by auto­mated means using tech­nical spec­i­fi­ca­tions.

8. Right to with­draw your dec­la­ra­tion of con­sent under data pri­vacy leg­is­la­tion

You have the right to with­draw your dec­la­ra­tion of con­sent under data pri­vacy leg­is­la­tion at any time. With­drawal of con­sent shall not affect the law­ful­ness of pro­cessing based on con­sent before its with­drawal.

9. Right to lodge a com­plaint with a super­vi­sory authority

Without prej­u­dice to any other admin­is­tra­tive or judi­cial remedy, you shall have the right to lodge a com­plaint with a super­vi­sory authority, in par­tic­ular in the member state of your habitual res­i­dence, place of work or place of the alleged infringe­ment, if you con­sider that the pro­cessing of per­sonal data con­cerning you infringes the GDPR.

The super­vi­sory authority with which the com­plaint has been lodged shall inform the com­plainant on the progress and the out­come of the com­plaint, including the pos­si­bility of a judi­cial remedy pur­suant to Art. 78 of the GDPR.

IX. Right of amendment

We reserve the right to amend this data pri­vacy state­ment in order to adapt it to cur­rent reg­u­la­tions; the same applies to the offer­ings on our web­site.