Rights of the Data Subject

If your personal data is processed, you are considered a data subject within the meaning of the General Data Protection Regulation (GDPR) and have the following rights against the controller:

Right of Access (Art. 15 GDPR)

You have the right to request confirmation from us as to whether personal data concerning you is being processed. If this is the case, you have the right to obtain access to the following information:

• Processing purposes
• Categories of personal data
• Recipients or categories of recipients
• Planned storage duration or the criteria for determining this duration
• The existence of rights to rectification, deletion, restriction, or objection
• Right to lodge a complaint with the relevant supervisory authority
• If applicable, the source of the data (if collected from a third party)
• If applicable, the existence of automated decision-making, including profiling, with meaningful information about the logic involved, the scope, and expected impact
• If applicable, the transfer of personal data to a third country or international organization

Right to Rectification (Art. 16 GDPR)

If your personal data is inaccurate or incomplete, you have the right to request its immediate correction or completion.

Right to Restriction of Processing (Art. 18 GDPR)

You have the right to request a restriction of processing of your personal data if one of the following conditions applies:

• You contest the accuracy of your personal data, for a period allowing us to verify its accuracy.
• The processing is unlawful, and you oppose the deletion of your personal data and instead request restriction of its use.
• We no longer need your personal data for processing purposes, but you require it for the establishment, exercise, or defense of legal claims.
• You have objected to processing, pending the verification of whether our legitimate grounds override yours.

Right to Erasure (“Right to be Forgotten”) (Art. 17 GDPR)

You have the right to request immediate deletion of your personal data if one of the following reasons applies:

• Your data is no longer necessary for the purposes for which it was collected.
• You withdraw your consent, and there is no other legal basis for processing.
• You object to processing, and there are no overriding legitimate grounds, or you object under Art. 21(2) GDPR.
• Your personal data has been unlawfully processed.
• Deletion is required to fulfill a legal obligation under Union or Member State law.
• Your personal data was collected concerning information society services according to Art. 8(1) GDPR.

Please note that this right does not apply if processing is necessary:

• For exercising the right of freedom of expression and information.
• For fulfilling a legal obligation or performing a task in the public interest.
• For reasons of public health.
• For archiving purposes in the public interest, scientific or historical research, or statistical purposes.
• For the establishment, exercise, or defense of legal claims.

Right to Data Portability (Art. 20 GDPR)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format or to request transmission to another controller.

Right to Object to Certain Data Processing (Art. 21 GDPR)

You have the right to object at any time to the processing of your personal data on grounds relating to your particular situation if the processing is based on Art. 6(1) sentence 1 lit. e or f GDPR, including profiling.

If your personal data is processed for direct marketing purposes, you have the right to object at any time to processing for such marketing, including profiling related to direct marketing.

Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to other administrative or judicial remedies, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates the GDPR.

The supervisory authority will inform you about the progress and outcome of your complaint, including the possibility of judicial remedy under Art. 78 GDPR.

Provision of the Website and Creation of Log Files

Description and Scope of Data Processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device.

The following data is collected:

• Information about the browser type and version
• The user’s operating system
• The user’s internet service provider
• Date and time of access
• Websites from which the user’s system accesses our website
• Websites accessed by the user’s system via our website

These data are stored in our system’s log files. They are not stored together with other personal data of the user.

Purpose of Data Processing

The temporary storage of the IP address by the system is necessary to deliver the website to the user’s device. The IP address must be stored for the duration of the session.

Storage in log files is done to ensure the functionality of the website, optimize the website, and maintain the security of our IT systems. These data are not used for marketing purposes.

Legal Basis for Data Processing

The legal basis for the temporary storage of data and log files is Art. 6(1) sentence 1 lit. f GDPR (legitimate interest).

Storage Duration

The data are deleted once they are no longer necessary for their collection purpose.

• For website provision, this happens at the end of the session.
• For log file storage, data are deleted after seven days at the latest.
• Further storage is possible if IP addresses are anonymized to prevent identification of the accessing client.

Objection Possibility

The collection of data for website provision and log file storage is necessary for website operation. Users cannot opt out of this. However, in individual cases, an interest balancing assessment may be conducted to evaluate the legitimacy of objections.