In the event that we process your personal data on the basis of your consent to this, the concrete data processing purposes result from the contents of the relevant declaration of consent, for example your consent to receiving e-mails containing advertisements for our products or services. In these cases, the data processing takes place on the basis of point (a) of Art. 6(1) of the GDPR. After giving your consent, you may withdraw such consent at any time without this affecting the lawfulness of the processing activities which we performed on the basis of your consent until the time of the withdrawal.
4. Recipients of personal data
We will transfer your personal data to third parties only in the case where this is required for the purpose of processing a contract, if this is admissible on the basis of the law or if we obtained your consent to this. In these cases, the transfer of your personal data is based on point (a), point (b), point (c) and/or point (f) of Art. 6(1) of the GDPR.
External data recipients may be those service providers who we commission with the rendering of services in the context of contract data processing in terms of Art. 28 of the GDPR (e.g. in the form of sub-contractors or in the fields of IT services, marketing services or document destruction). We will carefully select and regularly check such data processors who may use such personal data exclusively for the purposes which we indicated to them and in compliance with our instructions. In addition to the above, we transfer your personal data to external service providers based on a statutory obligation applicable to us or for the protection of our legitimate interests; these service providers, under their own responsibility, provide third-party specialist services to us, including, without limitation, payment service providers, tax advisers or chartered accountants.
It is also possible that compulsory statutory reasons require us to transfer your personal data to public authorities and government institutions, including, without limitation, public prosecution offices, courts, customs or financial authorities.
In the event that your personal data is to be transferred to any bodies having their registered office or their place of data processing outside a Member State of the European Union or a contracting state of the Treaty on the European Economic Area, we will make sure, prior to personal data being transferred, that the relevant data recipients, with the exception of cases provided for by the law, either provide for a reasonable level of data protection or that we obtained your consent to such transfer.
5. Retention periods and data erasure
Unless otherwise provided for under sec. 3, we process your personal data only for as long as this is required for the purpose of fulfilling the purposes for which such personal data had been collected or – in the case where you granted your consent – for as long as you do not withdraw your consent. Should another legal basis require longer retention periods, we will erase your personal data only once the relevant legal basis no longer applies. It may be necessary to (continue to) store your personal data in particular in the case where such personal data is still required to the purpose of rendering contractual services, to assess any warranty and, if applicable, guarantee claims which you asserted or to fulfil our statutory retention obligations.
Should you object to this, we will no longer process your personal data, unless its continued processing is admissible or even compulsory on the basis of the relevant legal provisions. We will erase your personal data also in the case where we are obliged to do so on the basis of statutory reasons.
6. Data subject rights
Being an individual who is affected by these data processing activities (“data subject”), you are entitled to a number of rights. In detail:
Right to object in terms of Art. 21 of the GDPR:
To the extent to which we process your personal data on the basis of legitimate interests (point (f) of Art. 6(1) of the GDPR) or for fulfilling any task carried out in the public interest (point (e) of Art. 6(1) of the GDPR), you shall have a right to object to your personal data being processed for reasons which result from the special situation. Apart from that, you have a right to object to any type of data processing for direct advertising purposes.
On the condition that the relevant statutory requirements are fulfilled, you are additionally entitled to exercise the following rights:
Withdrawal of consent: If you have given us your consent to the processing of your personal data, you can withdraw it at any time with effect for the future. A withdrawal shall not affect the lawfulness of the data up until the time of the withdrawal.
Right of access: You have the right to access the personal data which we process about you.
Right of rectification and erasure: You have the right to request us to rectify any inaccurate personal data and to also erase your personal data.
Right of restriction of processing: You have a right to request us to restrict the processing of your personal data.
Right to data portability: In the event that you provided personal data to us on the basis of a contract or your consent, you have a right to receive such personal data which you provided in a structured, commonly-used and machine-readable format or to have us transfer such personal data to any other data controller indicated by you.
Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the supervisory authority in charge in the case where you think that the processing of your personal data violates applicable law. For this purpose, you can contact the data protection authority which is competent for your registered office or the federal state relevant or the data protection authority competent for us. For a list of the data protection officers of the different federal states, including their contact data, please refer to the below link:
Should you have any questions concerning the processing of your personal data, the rights to which you are entitled as a data subject and any consents which you possibly granted, please feel free to contact us on a free-of-charge basis. To exercise the rights to which you are entitled, please contact us or our data protection officer directly (see contact data under sec. 1). When doing so, please ensure that we are able to clearly identify you.