The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is:
Opdenhoff Technologie GmbH,
Bonner Straße 20 E, 53773 Hennef, Germany
Contact us:
Phone: +49 2242 913467-0
Email: info@opdenhoff.com
Managing Director & Owner: Mr. Jürgen Opdenhoff, Dipl.-Ing.
‘Opdenhoff’ is a registered trademark. European Union Intellectual Property Office,
Certificate No. 018315922, February 17, 2021
To manage the cookies and similar technologies used (tracking pixels, web beacons, etc.) and related consents, we use the consent tool “Real Cookie Banner”. Details on how “Real Cookie Banner” works can be found at https://devowl.io/rcb/data-processing/.
The legal basis for the processing of personal data in this context are Art. 6 (1) (c) GDPR and Art. 6 (1) (f) GDPR. Our legitimate interest is the management of the cookies and similar technologies used and the related consents.
The provision of personal data is neither contractually required nor necessary for the conclusion of a contract. You are not obliged to provide the personal data. If you do not provide the personal data, we will not be able to manage your consents.
The legal basis for the processing of personal data in this context are Art. 6 (1) (c) GDPR and Art. 6 (1) (f) GDPR. Our legitimate interest is the management of the cookies and similar technologies used and the related consents.
The provision of personal data is neither contractually required nor necessary for the conclusion of a contract. You are not obliged to provide the personal data. If you do not provide the personal data, we will not be able to manage your consents.
The legal basis for the processing of personal data in this context are Art. 6 (1) (c) GDPR and Art. 6 (1) (f) GDPR. Our legitimate interest is the management of the cookies and similar technologies used and the related consents.
The provision of personal data is neither contractually required nor necessary for the conclusion of a contract. You are not obliged to provide the personal data. If you do not provide the personal data, we will not be able to manage your consents.
1. Scope of processing personal data
To manage the cookies and similar technologies used (tracking pixels, web beacons, etc.) and related consents, we use the consent tool “Real Cookie Banner”. Details on how “Real Cookie Banner” works can be found at https://devowl.io/rcb/data-processing/ .
The legal basis for the processing of personal data in this context are Art. 6 (1) (c) GDPR and Art. 6 (1) (f) GDPR. Our legitimate interest is the management of the cookies and similar technologies used and the related consents.
The provision of personal data is neither contractually required nor necessary for the conclusion of a contract. You are not obliged to provide the personal data. If you do not provide the personal data, we will not be able to manage your consents.
It goes without saying that we handle your personal data responsibly and in compliance with applicable national and European data protection regulations. As the operator of our website, we process the personal data of our users as soon as you send us an inquiry via email or the available contact forms, or place an order through our online shop. The processing of our users’ personal data generally only occurs with the user’s consent. An exception applies in cases where obtaining prior consent is not possible for practical reasons and the processing of the data is permitted by law.
2. Legal basis for the processing of personal data
Insofar as we obtain the consent of the data subject for processing operations involving personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.
When processing personal data necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary for carrying out pre-contractual measures.
Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Article 6(1)(c) GDPR serves as the legal basis.
If processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, and the interests or fundamental rights and freedoms of the data subject do not override those interests, then Article 6(1)(f) GDPR serves as the legal basis for the processing.
3. Data deletion and storage period
The personal data of the data subject will be erased or blocked as soon as the purpose of storage no longer applies. Storage may also take place if this is provided for by European or national legislation in EU regulations, laws, or other provisions to which the controller is subject. Data will also be blocked or erased when a storage period prescribed by the aforementioned regulations expires, unless further storage of the data is necessary for the conclusion or performance of a contract.
4. Server location
The servers we use are located in Europe. All data you enter on our website is transmitted to and stored there – subject to the exceptions mentioned in this statement. We have a data processing agreement with the server operators in accordance with Article 28(3) GDPR, meaning that we, as the data controller within the meaning of Article 4(7) GDPR, remain in control of the data.
1. Description and scope of data processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.
The following data is collected:
(1) Information about the browser type and version used
(2) The user’s operating system
(3) The user’s internet service provider
(4) The user’s IP address
(5) Date and time of access
(6) Websites from which the user’s system accessed our website
(7) Websites accessed by the user’s system via our website
2. Legal basis for data processing
The legal basis for the temporary storage of the data and log files is Art. 6 para. 1 lit. f GDPR.
3. Purpose of data processing
The temporary storage of the IP address by the system is necessary to enable the delivery of the website to the user’s computer. For this purpose, the user’s IP address must be stored for the duration of the session.
The data is stored in log files to ensure the website’s functionality. We also use the data to optimize the website and to ensure the security of our IT systems. The data is not used for marketing purposes. This constitutes our legitimate interest in data processing pursuant to Article 6(1)(f) GDPR.
4. Storage duration
The data will be deleted as soon as it is no longer needed for the purpose for which it was collected. In the case of data collected for the provision of the website, this is the case when the respective session has ended.
If the data is stored in log files, this occurs after a maximum of seven days. Storage beyond this period is possible. In this case, the users’ IP addresses are deleted or anonymized so that it is no longer possible to identify the requesting client.
5. Right to object and have the matter removed
The collection of data for the provision of the website and the storage of data in log files is essential for the operation of the website. Therefore, there is no possibility for the user to object.
1. Description, scope and purpose of data processing
Our website uses cookies. Cookies are text files that are stored in or by the internet browser on the user’s computer system. When a user visits a website, a cookie can be stored on the user’s operating system. This cookie contains a characteristic string that enables the browser to be uniquely identified when the website is visited again.
The following cookies are set, which are necessary for the proper functioning of the website:
• Language
• First visit YES/NO
• Screen resolution
Our legitimate interest in processing personal data pursuant to Art. 6 para. 1 lit. f GDPR lies in the purposes stated above.
We also use cookies on our website that allow us to analyze user browsing behavior (see the section “Counting Page Views”). These analytics cookies are used to improve the quality of our website and its content. They help us understand how the website is used, allowing us to continuously optimize our offerings.
When users access our website, they are informed about the use of cookies via an information banner and referred to this privacy policy.
The storage of cookies can be prevented by adjusting your browser software settings; however, in this case, the storage of all cookies will be prevented, so that not all functions of this website can be fully used.
2.) Legal basis for data processing
If only technically necessary cookies are used, or if technically necessary and technically unnecessary cookies are used without obtaining the user’s prior consent:
The legal basis for the processing of personal data using cookies is Article 6(1)(f) GDPR.
If technically necessary and non-essential cookies are used with prior consent from the user:
The legal basis for the processing of personal data using technically necessary cookies is Article 6(1)(f) GDPR.
The legal basis for the processing of personal data using cookies for analytical purposes is Article 6(1)(f) GDPR.
3.) Duration of storage, right to object and erasure
Cookies are stored on the user’s computer and transmitted from there to our site. Therefore, as a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, some of its functions may no longer be fully available.
1. Description and scope of data processing
Our website includes a contact form that can be used to contact us electronically. If a user chooses to use this form, the data entered will be transmitted to us and stored. This data includes:
• Name, first name
• Email address
• Reason for contacting us
Alternatively, you can contact us via the provided email address. In this case, the personal data you transmit with your email will be stored. This data will be used solely for processing your inquiry.
2. Legal basis for data processing
The legal basis for processing the data is, if the user has given their consent, Article 6(1)(a) GDPR.
The legal basis for processing data transmitted via email is Article 6(1)(f) GDPR. If the email contact aims at concluding a contract, the additional legal basis for processing is Article 6(1)(b) GDPR.
3. Purpose of data processing
The processing of personal data from the input form serves solely to process your contact request. In the case of contact via email, this also constitutes the necessary legitimate interest in processing the data.
4. Storage duration
The data will be deleted as soon as it is no longer required for the purpose for which it was collected. For personal data from the contact form and data transmitted by email, this is the case when the respective conversation with the user has ended. A conversation is considered ended when it is clear from the circumstances that the matter in question has been resolved.
5. Right to object and have the matter removed
The user has the right to withdraw their consent to the processing of their personal data at any time. If the user contacts us by email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.
You can contact us at any time using the contact details provided. All personal data stored as a result of this contact will be deleted in this case.
1. Description and scope of data processing
On our website, we offer artists the opportunity to register by providing personal data and to publish their own artwork via the platform. The use of certain functions (e.g., creating personal profiles, posting personal content) is only possible after prior registration by the artist. The data is entered into an input form, transmitted to us, and stored. The data will not be shared with third parties. The following data is collected during the registration process:
• Last name, first name
• Email address
• Details about artworks
2. Legal basis for data processing
The legal basis for processing the data is, if the user has given their consent, Article 6(1)(a) GDPR.
If the registration serves the purpose of fulfilling a contract to which the user is a party or of carrying out pre-contractual measures, the additional legal basis for the processing of the data is Art. 6 para. 1 lit. b GDPR.
3. Purpose of data processing
User registration is required to use certain functions of our website (creating profiles, uploading content). Registration is also necessary for the performance of a contract with the user or for carrying out pre-contractual measures.
4. Storage duration
The data will be deleted as soon as it is no longer required for the purpose for which it was collected.
This applies to data collected during the registration process if the registration on our website is cancelled or modified. For data collected during the registration process for the performance of a contract or for carrying out pre-contractual measures, this applies when the data is no longer required for the performance of the contract. Even after the contract has been fulfilled, it may be necessary to store the contracting party’s personal data in order to comply with contractual or legal obligations.
Contractual obligations on an ongoing basis require the storage of personal data for the duration of the contract. Furthermore, warranty periods must be observed, as well as the storage of data for tax purposes. The applicable retention periods cannot be generally defined but must be determined on a case-by-case basis for each contract and contracting party.
5. Right to object and have the matter removed
As a user, you have the option to cancel your registration at any time. You can also have your stored data modified at any time by closing your customer account.
If the data is required for the fulfillment of a contract or for the implementation of pre-contractual measures, premature deletion of the data is only possible insofar as no contractual or legal obligations preclude such deletion.
1. Description and scope of data processing
We offer users the option of creating user profiles on our site. These user profiles allow users to present themselves on our website.
2. Legal basis for data processing
The legal basis for processing the data is, if the user has given their consent, Article 6(1)(a) GDPR.
If the registration serves the purpose of fulfilling a contract to which the user is a party or of carrying out pre-contractual measures, the additional legal basis for the processing of the data is Art. 6 para. 1 lit. b GDPR.
3. Purpose of processing
The purpose of the processing is to give users the opportunity to upload and publish their own content. This also constitutes our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR.
4. Storage duration
The data will be deleted as soon as it is no longer required for the purpose for which it was collected.
This applies to data collected as part of a user profile through an upload, if the profile is deleted or modified on our website.
VIII. Ordering via online shop
1. Description and scope of data processing
When you place an order via our website, the order is transmitted to us. As part of the order process, we collect the following data:
– Title, first name, last name,
– a valid email address,
– address (if applicable, different delivery address)
– ordered products
Your personal data will only be passed on by us to third parties involved in the processing of the contract, such as the company commissioned with the production of the print, the logistics company commissioned with the delivery and the credit institution commissioned with payment matters.
When paying via PayPal, credit card via PayPal, direct debit via PayPal, or “purchase on account” via PayPal, we forward your payment data to PayPal (Europe) S.à rl et Cie, SCA, 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”) for payment processing. PayPal reserves the right to conduct a credit check for the payment methods credit card via PayPal, direct debit via PayPal, and “purchase on account” via PayPal. PayPal uses the result of the credit check, specifically the statistical probability of payment default, to decide whether to offer the respective payment method. The credit check may include probability values (so-called score values). If score values are included in the result of the credit check, they are based on a scientifically recognized mathematical-statistical procedure. Address data is among the information used to calculate the score values. Further information regarding data protection can be found in the PayPal Privacy Statement: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
1. Description and scope of data processing
The newsletter is sent based on the user’s registration on the website:
You can subscribe to our free newsletter on our website. When you subscribe, the data you enter in the registration form is transmitted to us. This data includes:
– E-mail address
Your consent for the processing of your data will be obtained during the registration process, and you will be referred to this privacy policy.
If you purchase goods or services on our website and provide your email address, we may subsequently use it to send you a newsletter. In such cases, the newsletter will only contain direct advertising for our own similar goods or services.
The service provider we have commissioned to send our newsletter is based in the USA (Mailchimp, The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308). The data required for subscribing to the newsletter is processed there. We have a data processing agreement with the service provider in accordance with Article 28 Paragraph 3 GDPR, meaning that they may only use the data according to our instructions, and we remain the data controller within the meaning of Article 4 No. 7 GDPR.
The data will be used exclusively for sending the newsletter.
2. Legal basis for data processing
Newsletters are sent based on user registration on our website. Subscribing to specific users, groups, or regions also requires the user’s explicit consent.
The legal basis for processing data after registration for the newsletter or subscribing to users, groups or regions by the user is, if consent has been given, Art. 6 para. 1 lit. a GDPR.
3. Purpose of data processing
The purpose of the processing is to enable the sending of newsletters or the subscription of users, groups and regions.
4. Storage duration
The data will be deleted as soon as it is no longer needed for the purpose for which it was collected. The user’s email address will therefore be stored for as long as the newsletter subscription or the user, group, or region subscription is active.
5. Right to object and have the matter removed
Users can unsubscribe from newsletters for their group or region at any time. A corresponding link is included in every newsletter for this purpose. Subscriptions can also be deactivated via the user’s account settings.
1. Description and scope of data processing
This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses “cookies,” which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators, and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google.
2. Legal basis for data processing
The legal basis for the processing of users’ personal data is Article 6(1)(f) GDPR.
Regarding the Google Analytics service, we have a data processing agreement with Google in accordance with Article 28 Paragraph 3 GDPR, meaning that Google may only use the data according to our instructions, and we remain the data controller within the meaning of Article 4 No. 7 GDPR.
3. Purpose of data processing
Processing users’ personal data allows us to analyze their browsing behavior. By evaluating the data obtained, we are able to compile information about the use of individual components of our website. This helps us to continuously improve our website and its user-friendliness. Our legitimate interest in processing the data pursuant to Art. 6 para. 1 lit. f GDPR lies in these purposes. Anonymizing the IP address adequately protects users’ interest in the protection of their personal data.
4. Storage duration
The data will be deleted as soon as it is no longer needed for our record-keeping purposes.
5. Right to object and have the matter removed
Cookies are stored on the user’s computer and transmitted from there to our site. Therefore, as a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, some of its functions may no longer be fully available.
You still have the option to prevent the collection of data generated by cookies and related to your use of the website (including IP address) and the processing of this data by Google by downloading and installing the following browser plugin:
http://tools.google.com/dlpage/gaoptout?hl=de
Specifically, the cookies listed under the following link are stored when using Google Analytics:
https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage
1. Description and scope of data processing
We use Google Fonts to integrate external fonts, a service provided by Google Inc., Amphitheatre Parkway, Mountain View, CA 94043, USA. By integrating Google Fonts, a direct connection to Google’s servers is established when you visit our website. This allows Google to transmit the fonts directly to your browser, which then integrates them into the website. Using Google Fonts means your IP address is transmitted to and stored on a Google server in the USA.
2. Legal basis for data processing
The legal basis for the processing of users’ personal data is Article 6(1)(f) GDPR.
3. Purpose of data processing
By integrating Google Fonts, a direct connection to Google’s servers is established when you visit our online marketplace. This allows Google to transmit the fonts directly to your browser, which then integrates them into our website. This ensures the proper display and readability of our website in your browser. This also constitutes our legitimate interest in processing the data in accordance with Article 6(1)(f) GDPR.
4. Right to object and have the matter rectified
It is possible to block connections to fonts.googleapis.com through your operating system or a suitable browser add-on. This may limit your ability to use our platform.
For more information about the collection, processing and use of your data by Google, as well as your rights as a data subject, please see Google’s privacy policy at http://www.google.com/policies/privacy/?hl=de
1. Description and scope of data processing
We use Typekit Fonts to integrate external fonts, a service provided by Adobe Systems Software Ireland Limited: 4-6 Riverwalk, City West Business Campus, Saggart, Dublin 24, Ireland. By integrating Typekit Fonts, a direct connection to Adobe’s servers is established when you visit our website. This is the only way Adobe can transmit the fonts directly to your browser, which then integrates them into the website. Using Typekit Fonts means your IP address is transmitted to and stored on an Adobe server in the USA.
2. Legal basis for data processing
The legal basis for the processing of users’ personal data is Article 6(1)(f) GDPR.
3. Purpose of data processing
By integrating Typekit fonts, a direct connection to Typekit’s servers is established when you visit our online marketplace. This is the only way Typekit can directly transfer the fonts to your browser, which then integrates them into our website. This ensures the proper display and readability of our website in your browser. This also constitutes our legitimate interest in processing the data in accordance with Article 6(1)(f) GDPR.
4. Right to object and have the matter rectified
It is possible to block connections to Typekit through your operating system or a suitable browser add-on. In that case, your use of our platform may be limited.
Further information about Adobe Typekit Web Fonts can be found at https://typekit.com/ and in the Adobe Typekit privacy policy: https://www.adobe.com/de/privacy/policies/typekit.html.
If your personal data is being processed, you are a data subject within the meaning of the GDPR and you have the following rights against the controller:
1. Right to information
You can request confirmation from the controller as to whether personal data concerning you is being processed by us.
If such processing takes place, you can request the following information from the controller:
(1) the purposes for which the personal data are processed;
(2) the categories of personal data being processed;
(3) the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed;
(4) the planned duration for which the personal data concerning you will be stored, or, if specific information on this is not possible, the criteria used to determine that storage period;
(5) the existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the controller, or a right to object to such processing;
(6) the existence of a right to lodge a complaint with a supervisory authority;
(7) any available information as to the source of the data if the personal data are not collected from the data subject;
(8) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
You have the right to request information as to whether your personal data is being transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer.
When processing data for scientific, historical or statistical research purposes:
This right to information may be restricted insofar as it is likely to make the achievement of the research or statistical purposes impossible or seriously impair it, and the restriction is necessary for the fulfillment of the research or statistical purposes.
2. Right to rectification
You have the right to rectification and/or completion from the data controller if the processed personal data concerning you is inaccurate or incomplete. The data controller must carry out the rectification without undue delay.
When processing data for scientific, historical or statistical research purposes:
Your right to rectification may be restricted insofar as it is likely to make the achievement of the research or statistical purposes impossible or seriously impair it, and the restriction is necessary for the fulfillment of those research or statistical purposes.
3. Right to restriction of processing
Under the following conditions, you can request the restriction of the processing of your personal data:
(1) if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;
(2) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
(3) the controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; or
(4) if you have objected to processing pursuant to Article 21(1) GDPR pending the verification of whether the legitimate grounds of the controller override your grounds.
If the processing of your personal data has been restricted, this data – apart from being stored – may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
If processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.
When processing data for scientific, historical or statistical research purposes:
Your right to restrict processing may be limited insofar as it is likely to render impossible or seriously impair the achievement of the research or statistical purposes and the restriction is necessary for the fulfillment of those purposes.
4. Right to erasure
a) Obligation to delete
You can request that the controller erase your personal data without undue delay, and the controller is obliged to erase such data without undue delay where one of the following grounds applies:
(1) The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.
(2) You withdraw your consent on which the processing was based pursuant to Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR, and there is no other legal basis for the processing.
(3) You object to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) GDPR.
(4) Your personal data has been processed unlawfully.
(5) The erasure of personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
(6) The personal data concerning you were collected in relation to information society services offered pursuant to Article 8(1) GDPR.
b) Information to third parties
If the controller has made the personal data concerning you public and is obliged to erase it pursuant to Article 17(1) GDPR, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you, as the data subject, have requested the erasure of all links to, or copies or replications of, that personal data.
c) Exceptions
The right to erasure does not apply insofar as the processing is necessary.
(1) to exercise the right to freedom of expression and information;
(2) for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(3) for reasons of public interest in the area of public health pursuant to Article 9(2)(h) and (i) and Article 9(3) GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Article 89(1) GDPR, insofar as the right referred to in point (a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
(5) for the establishment, exercise or defense of legal claims.
5. Right to information
If you have asserted your right to rectification, erasure or restriction of processing against the controller, the controller is obliged to communicate this rectification or erasure of data or restriction of processing to all recipients to whom the personal data concerning you have been disclosed, unless this proves impossible or involves disproportionate effort.
They have the right to be informed about these recipients by the data controller.
6. Right to data portability
You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. Furthermore, you have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that
(1) the processing is based on consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR or on a contract pursuant to Article 6(1)(b) GDPR and
(2) processing is carried out using automated procedures.
In exercising this right, you also have the right to have your personal data transmitted directly from one controller to another, where technically feasible. This must not adversely affect the rights and freedoms of others.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
7. Right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) of the GDPR, including profiling based on those provisions.
The controller will no longer process your personal data unless they can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of establishing, exercising or defending legal claims.
If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing; this also applies to profiling insofar as it is related to such direct marketing.
If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes.
You have the option, in connection with the use of information society services – notwithstanding Directive 2002/58/EC – to exercise your right to object by means of automated procedures using technical specifications.
When processing data for scientific, historical or statistical research purposes:
You also have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) GDPR.
Your right to object may be restricted insofar as it is likely to make the achievement of the research or statistical purposes impossible or seriously impair it, and the restriction is necessary for the fulfillment of the research or statistical purposes.
8. Right to withdraw consent under data protection law
You have the right to withdraw your consent to data processing at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
9. Automated decision-making in individual cases, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision
(1) is necessary for the conclusion or performance of a contract between you and the controller,
(2) is permitted under Union or Member State law to which the controller is subject and which contains appropriate measures to safeguard your rights and freedoms and legitimate interests or
(3) with your express consent.
However, these decisions must not be based on special categories of personal data pursuant to Article 9(1) GDPR, unless Article 9(2)(a) or (g) GDPR applies and appropriate measures to protect your rights and freedoms and legitimate interests have been taken.
With regard to the cases referred to in (1) and (3), the controller shall implement suitable measures to safeguard the rights and freedoms and legitimate interests of the data subject, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
10. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.
The supervisory authority with which the complaint has been lodged shall inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 GDPR.
The competent supervisory authority for data protection matters for our company is the State Data Protection Commissioner of the federal state in which our company is located. A list of data protection commissioners and their contact details can be found at the following link:
https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html