Your data protection rights under the GDPR

The General Data Protection Regulation (GDPR) sets out various rights for data subjects to ensure that your personal data is processed transparently and securely. Here are your main rights explained in detail:

1. Right to information (Article 15 GDPR)

You have the right to request confirmation from us as to whether personal data concerning you is being processed. If this is the case, you have the right to access this personal data and the following information:

  • The purposes of processing.
  • The categories of personal data being processed.
  • The recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations.
  • Where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period.
  • The existence of a right to rectification or erasure of personal data concerning you or to restriction of processing by the controller or a right to object to such processing.
  • The existence of a right to lodge a complaint with a supervisory authority.
  • If the personal data is not collected from you: All available information about the origin of the data.
  • The existence of automated decision-making, including profiling, pursuant to Art. 22 (1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved, as well as the scope and intended effects of such processing for you.

2. Right to rectification (Article 16 GDPR)

You have the right to request the immediate rectification of inaccurate or incomplete personal data concerning you. This also includes the right to have incomplete data completed by providing a supplementary statement.

3. Right to erasure (right to be forgotten) (Art. 17 GDPR)

You have the right to request the erasure of your personal data if one of the following reasons applies:

  • The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
  • You withdraw your consent on which the processing is based according to Art. 6 Para. 1 lit. a or Art. 9 Para. 2 lit. a GDPR, and there is no other legal basis for the processing.
  • You object to the processing pursuant to Art. 21 Para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 Para. 2 GDPR.
  • The personal data were processed unlawfully.
  • The erasure of personal data is necessary to fulfill a legal obligation under Union or Member State law to which we are subject.
  • The personal data were collected in relation to information society services offered in accordance with Art. 8 (1) GDPR.

4. Right to restriction of processing (Article 18 GDPR)

You have the right to request that we restrict processing if one of the following conditions applies:

  • The accuracy of the personal data is contested by you for a period enabling us to verify the accuracy of the personal data.
  • The processing is unlawful and you oppose the erasure of the personal data and request the restriction of the use of the personal data instead.
  • We no longer need the personal data for the purposes of the processing, but you need it to assert, exercise or defend legal claims.
  • You have objected to the processing pursuant to Art. 21 Para. 1 GDPR, as long as it has not yet been determined whether our legitimate reasons outweigh yours.

5. Right to data portability (Article 20 GDPR)

You have the right to receive the personal data concerning you that you have provided to us in a structured, common and machine-readable format. In addition, you have the right to transmit this data to another controller without hindrance from us, provided that:

  • The processing is based on consent pursuant to Art. 6 Para. 1 lit. a GDPR or Art. 9 Para. 2 lit. a GDPR or on a contract pursuant to Art. 6 Para. 1 lit. b GDPR and
  • The processing is carried out using automated procedures.

In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible.

6. Right to object (Article 21 GDPR)

You have the right to object at any time to the processing of your personal data based on Art. 6 (1) (e) or (f) GDPR, for reasons related to your particular situation. This also applies to profiling based on these provisions.

Your personal data will then no longer be processed unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing serves to assert, exercise or defend legal claims.

7. Right to lodge a complaint with a supervisory authority (Article 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or place of the alleged infringement if you consider that the processing of personal data concerning you infringes the GDPR.

How you can exercise these rights

To exercise any of the above rights, you can contact us at any time using the contact details provided in our legal notice. We will review your request promptly and deal with it if this is legally required.

Your right to data protection is important to us and we strive to ensure that all requests and concerns regarding your personal data are handled in a timely manner and in accordance with the General Data Protection Regulation.