Data Protection Statement website www.myticket-jahrhunderthalle.de/ 

I. Introduction and terms

1. General
TERMS In operating our website with the URL www.myticket-jahrhunderthalle.de (hereinafter referred to as “website”), we process personal data. We treat such data as confidential and process it in accordance with the applicable laws, in particular the General Data Protection Regulation  (GDPR), the Federal Data Protection Law (BDSG) and the Telecommunications-Digital-Services-Data Protection Law (TDDDG). The purpose of this data protection statement is to inform you about the personal data we collect from you, the purposes for which it is collected, the legal basis on which we use it and, where applicable, to whom we disclose it. We will also explain your rights in respect of assertion of your data protection.

2. Terms
Our data protection statement contains technical terms that are used in the GDPR and the BDSG. We will clarify these terms in everyday language first to give a clearer understanding of them:

2.1 Personal Data 
“Personal data” is any information relating to an identified or identifiable person (Art. 4.1 GDPR). Details of an identified person might be, e.g., the name or e-mail address. Personal data is also data where the identity  is not immediately visible but the person concerned can be determined in combination with existing or external information. A person becomes identifiable by e.g., the details of their address or bank account details, date of birth or username, their IP addresses and/or location data. Any information that can be linked in any way to a person is relevant here.

2.2 Processing
4.2 GDPR defines as “processing” any procedure undertaken in connection with personal data. This particularly applies to collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.

II. Responsible Person and Data Protection Officer 

3. RESPONSIBLE PERSON
Data processing is the responsibility of:
Company: Kultur- und Kongresszentrum Jahrhunderthalle GmbH ("we/us")
Legal Representative: Arndt Moritz Jaeschke
Address: Pfaffenwiese 301
Telephone: +49 69 3601-236
Fax: +49 69 3601-222
e-mail: info@jahrhunderthalle.com 

4. DATA PROTECTION OFFICER 
Name: Reinher Karl
Address: HABEWI GmbH & Co. KG, Palmaille 96, 22767 Hamburg
Telephone: +49 40 460089-66
Fax: +49 40 460089-77
e-mail: datenschutz@habewi.de 

III. Processing Context

5. PROCESSING CONTEXT: WEBSITE
We process your personal data, as listed in detail in section IV below, when you use our website. We only process data that you actively enter on the web site (e.g., by filling in forms) or that you automatically provide when using our services.

Your data is processed solely by us and is never sold, lent or otherwise transferred to third parties. Insofar as we use the assistance of external service providers to process your personal data, this is done in the context of so-called contract processing where we as the client are authorised to instruct our contractors. In the operation of our website, we use external service providers for hosting, servicing and further development. Our website is hosted by the external provider (ALL-INKL.COM – Neue Medien Münnich, owner: René Münnich, Hauptstrasse 68, 02742 Friedersdorf, Germany) at the data centre in Dresden, Germany. If other external service providers are engaged for specific processing activities as listed in Section IV, they are named there.

We do not transfer any data to third countries, nor do we have any plans to do so. We will provide information on exceptions to this principle in the processing operations described below. Any data transfer to third countries would then be on the basis of the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov/) or the EU standard contract clauses.

IV. Processing in detail 
 

6. PROVISION OF THE WEBSITE AND SERVER-LOGFILES
6.1 Description of the processing 
Every time you access our website, we automatically collect information that your browser transmits to our server. This concerns the following data:

• IP-address
• Browser software used, along with the version and language
• Operating system
• Sub-pages of the website accessed
• Date and time of the access to the website

These are also stored in the so-called log files of our system. Temporary storage of your IP address by the system is necessary in order to be able to deliver our website to the user's end device. For this purpose, the user's IP address must remain stored for the duration of the session. The IP address is only recorded in the log files after the last three digits have been truncated.

6.2 Purpose
Processing is carried out to enable the website to be accessed and to ensure its stability and security. In addition, the processing serves to analyse statistics and improve our online offering.

6.3 Legal Basis
Processing is necessary to safeguard the overriding legitimate interests of the controller (Art. 6 Section 1f GDPR). Our legitimate interest lies in the purpose stated in section 6.2.

6.4 Storage Duration
The data is erased as soon as it is no longer required to fulfil the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the session concerned has ended. The log files are erased after 7 days.

7. COOKIES AND OTHER TRACKING TECHNOLOGIES, such as PixeGIES

7.1 Description of the processing
Our website uses cookies. Cookies are small text files that are stored on the user's device when the user visits a website. Cookies contain information that enables recognition of a terminal device and possibly certain functions of a website. We differentiate between our own cookies and external, so-called third-party cookies. So-called ‘session cookies’ and ‘persistent cookies’ are used on our website. ‘Session cookies’ are automatically deleted when you end your internet session and close the browser. Persistent cookies remain on your end device for a longer period. Together with cookies, we also use other tracking technologies, such as Pixel or Fingerprinting. If cookies are technically necessary for the operation of our website, your consent is not required. All other cookies and tracking technologies that are not technically necessary are only set once you have actively consented to the use of cookies/tracking technologies via our consent tool. To obtain and document consent, we use the ‘Consentmanager’ service, which is operated by consentmanager AB, Håltegelvägen 1b, 72348 Västerås, Sweden. The consent tool stores your selection itself in a cookie on your end device. This means that you do not have to decide about cookies again the next time you visit our website.

7.2 Purpose
We use cookies/tracking technologies, to make our website more user-friendly and offer the functions described in section 7.1.

7.3 Legal Basis
The processing is necessary in respect of technically required cookies and the use of the consent tool to safeguard the overriding legitimate interests of the controller (Art. 6 para. 1f GDPR in conjunction with Section 25 para. 2 TDDDG). Our legitimate interest lies in the purpose stated in Section 7.2. For processing in respect of all other cookies/tracking technologies - i.e. cookies that are not technically necessary - the legal basis is consent (Art. 6 para. 1a GDPR in conjunction with Section 25 para. 1 TDDDG). This consent is voluntary.

7.4 Duration of storage, Withdrawal of consent 
Cookies are automatically deleted at the end of a session or on the expiry of the stated storage duration. As cookies are stored on your end device, you, as user have full control over the use of cookies. You can disable or restrict the transfer of cookies by changing the settings on your internet browser. Cookies that have already been stored can be deleted. This can happen automatically. If cookies/tracking technologies for our website are disable, deleted or restricted, it is possible that individual functions of our website cannot be used, or can only be used in a restricted way. You can withdraw any consent you may have given for the use of cookies at any time in the consent tools settings at www.myticket-jahrhunderthalle.de with effect for the future.

7.5 Recipient
Where cookies/tracking technologies are used, data may be transmitted to the appropriate providers of these third-party services. Under some circumstances, data may also be transferred to third countries outside the European Union or the European Economic Area. We provide information about the recipients of data and transfer to third countries in the settings of the consent tool or in the corresponding section on the third-party service in this privacy policy. If necessary, personal data will be transmitted to the service provider of the consent tool ‘Consentmanager,’ consentmanager AB.

8. CONTACT BY E-MAIL

8.1 Description of the processing
You can also contact us via the email addresses provided on our website. In this case, the personal data transmitted with the e-mail will be processed by us.

8.2 Purpose
The data transmitted with and in your e-mail will be used exclusively for the purpose of processing and responding to your request.

8.3 Legal basis
The processing is necessary to safeguard the overriding legitimate interests of the controller (Art. 6 para. 1 f GDPR). Our legitimate interest lies in the purpose stated in section 8.2. If the purpose of the e-mail contact is the conclusion or fulfilment of a contract, the data processing is carried out for the fulfilment of the contract (Art. 6 para. 1 b GDPR).

8.4 Duration of storage
We will delete the data as soon as it is no longer required to fulfil the purpose for which it was collected. This is normally the case when the relevant communication with you has ended. Communication is ended when it is clear from the circumstances that your request has been conclusively dealt with. If statutory retention periods prevent erasure, the data will be erased immediately after expiry of the statutory retention period.

9. NEWSLETTER

9.1 Description of the processing
We send out a newsletter at irregular intervals. The newsletter informs you about programme tips, competitions and news about the Jahrhunderthalle. You will only receive our newsletter if you actively subscribe to our mailing list. You can subscribe by filling in and submitting a newsletter registration form on our website.

Only your e-mail address is required to subscribe to the newsletter. All other details (such as your first name and surname) are voluntary and are used solely to personalise the emails. We use the double opt-in procedure to carry out and verify newsletter subscriptions. Registration takes place in several steps. Firstly, you register for the newsletter on our website. You will then receive an e-mail from us at the e-mail address you have provided. In this e-mail, we ask you to confirm that you really have subscribed to the newsletter and wish to receive it. Confirmation is provided by clicking on a confirmation link. Only after successful confirmation will we add you to our newsletter mailing list and send you future e-mails. As part of the double opt-in procedure, we store the date, time and your IP address at both the registration and confirmation stages.

9.2 Purpose
The processing is carried out in order to offer the newsletter function and to enable the delivery of newsletter emails to subscribers. The collection and storage of the date, time and IP addresses when subscribing to the newsletter documents the consent given and protects against the misuse of email addresses.

9.3 Legal basis
The processing of our subscriber newsletter is based on consent in accordance with Art. 6 para. 1 a GDPR. You can access the declaration of consent on our website at any time at www.myticket-jahrhunderthalle.de/datenschutz. Your consent is voluntary. The collection and storage of the date, time and IP addresses when registering for the newsletter is necessary to safeguard the overriding legitimate interests of the controller (Art. 6 para. 1f GDPR). Our legitimate interest lies in the purpose stated in Section 9.2

9.4 Duration of storage and withdrawal of consent
If you do not confirm your subscription to our newsletter within 24 hours of receiving the corresponding registration e-mail, your data will be automatically erased. We will process your personal data for the duration of your newsletter subscription. You can cancel your subscription to our newsletter at any time by revoking your consent. A simple declaration is sufficient for this (by e-mail to info@jahrhunderthalle.com or by post to Kultur- und Kongresszentrum Jahrhunderthalle GmbH, Pfaffenwiese 301). You can also unsubscribe from the newsletter by clicking the unsubscribe link in every newsletter email or here www.myticket-jahrhunderthalle.de/datenschutz. If you withdraw your consent, we will no longer send you newsletters and your personal data will be removed from our active mailing list. We will add your e-mail address to our so-called blacklist to a limited extent in order to enforce your cancellation. This enables us to ensure that you do not receive any newsletters from us in future and prevents your email address from being misused by third parties.

9.5 Recipient and transfer to third countries
We use the services of the newsletter provider Brevo (formerly Sendinblue or Newsletter2Go) to manage our newsletter mailing list and send the emails. This takes place within the framework of contract processing. Brevo is a service provided by Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany. Further information on data protection at Brevo can be found at www.brevo.com/de/datenschutz-uebersicht/.

10. SOCIAL NETWORKS

10.1 Description of the processing
Our website does not use any social media plugins. The Facebook, Instagram, TikTok and LinkedIn logos displayed on our website are merely linked to the corresponding profiles of our company on the social networks. No data is transmitted to the social networks when the logos are displayed. If you click on one of the logos, you will only be redirected to the external website of the respective social network.

However, our profiles within the social networks represent data processing. If you are logged on to the respective social network when you visit one of these profiles, this information is assigned to your user account there. If you interact with our profile, e.g. comment on, share, like or retweet a post, this information is also stored in your user account. Generally, your interactions with our profile can also be visible to us.

On the Facebook and  Instagram social networks, we have the option of obtaining statistical data about the use of our Facebook page or our Instagram profile via the so-called ‘Insights’ function. These statistics are provided by Facebook and Instagram. The ‘Insights’ function cannot be disabled. We cannot decide to switch this function on or off. It is available to all Facebook fan page operators and all operators of an Instagram business account, regardless of whether you use the Insights function or not.

We are given the following data in respect of fans, subscribers, people reached and people interacting in anonymised form via Facebook Insights for a selectable period of time: Total number of page views, ‘Like’ information including origin, page activity, post interactions, reach, post reach (divided into organic, viral and paid interactions), comments, shared content, replies and demographic analyses, i.e. country of origin, gender and age. The Insights statistics do not allow us to identify subscribers or fans of our page, nor do they grant us access to their profiles.

Instagram Insights also provides anonymised data on the development and reach of our Instagram profile, and the posts, stories and videos we post there. Instagram Insights also provides us with statistical information on the place of origin, gender and age of the subscribers to our Instagram profile.

The social networks with which you interact store your data using pseudonyms as user profiles and use them for advertising and market research purposes. For example, you may be shown advertisements within the social network and on other third-party websites that match your presumed interests. This is generally done via cookies, which the social network stores on your end device. You have the right to object to the creation of these user profiles; to exercise this right, you must contact the social networks directly.

10.2 Purpose
We maintain profiles on the aforementioned social networks for the purposes of public relations and corporate communication with customers and interested parties. We use the ‘Insights’ function on Facebook and Instagram to analyse the reach of our posts on the social network and to make them more appealing to our visitors in the future.

10.3 Legal basis
The legal basis for data processing in the context of our profiles on social networks is the protection of our overriding legitimate interests (Art. 6 para. 1f GDPR). Our legitimate interest lies in the purpose stated in section 10.2. If you are asked for consent by the respective operator of a social network, the legal basis is Art. 6 para. 1a GDPR. With regard to our presences on Facebook, Instagram, TikTok, and LinkedIn, data processing is also carried out on the basis of joint responsibility in accordance with Art. 26 GDPR. 

10.4 Recipient and transfer to third states
The respective social networks are operated by the companies listed below. Further information on data protection relating to our profile on the social networks can be found in the linked data protection provisions.

• Facebook: Meta Platforms, Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA or Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Data protection statement: www.facebook.com/policy.php; www.facebook.com/help/186325668085084, www.facebook.com/about/privacy/your-info-on-other#applications and www.facebook.com/about/privacy/your-info#everyoneinfo.
• Instagram: Meta Platforms, Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA or Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland; Data protection statement: help.instagram.com/155833707900388/.
• LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Data protection statement: www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy. You can find the data protection agreement with LinkedIn at www.linkedin.com/legal/l/dpa. The agreement on joint responsibility can be seen at legal.linkedin.com/pages-joint-controller-addendum.
• TikTok: TikTok Technology Limited, 10, Earlsfort Terrace, Dublin, D02 T380, Ireland. Can be contacted by e-mail at: reports@tiktok.com; Data protection statement: https://www.tiktok.com/legal/page/eea/privacy-policy/de 

The social networks also process your personal data in the USA.

11. GOOGLE ANALYTICS

11.1 Description of the processing
Our website uses ‘Google Analytics’, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as ‘Google’). Google Analytics uses cookies (see section 7), which enable analysis of your use of our website. We use Google Analytics in the ‘Universal Analytics’ version offered, which allows this analysis across devices by assigning the data to a pseudonymous user ID. The information generated by the cookies is usually transferred to a Google server in the USA and stored there. However, we only use Google Analytics with IP anonymisation. This means that your IP address will be truncated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. The statistics compiled by Google Analytics record specifically how many users visit our website, the country or location from which access is made, which subpages are accessed and which links or search terms visitors use to reach our website. You can find the Google Analytics user conditions at www.google.com/analytics/terms/de.html. an overview of data protection in Google Analytics can be seen at www.google.com/intl/de/analytics/learn/privacy.html. The Google data protection statement can be seen at www.google.de/intl/de/policies/privacy.

11.2 Purpose
Processing is undertaken in order to be able to analyse the use of our website. The information obtained is used to improve and customise our online presence.

11.3 Legal Basis
Processing is based on consent in accordance with Art. 6 para. 1a GDPR. We obtain this consent via the consent tool  (see section 7.1). This consent is voluntary.

11.4 Duration of storage, right to object, revocation of consent 
We stated the storage period and your control and setting options for cookies in section 7.4. You can revoke the consent you have given with regard to Google Analytics at any time in the settings of the consent tool with effect for the future. Alternatively, you can object to data processing by Google Analytics at any time by downloading and installing the browser add-on offered by Google at. tools.google.com/dlpage/gaoptout?hl=de . The analysis data processed and stored by Google Analytics will be automatically deleted by us after 14 months.

11.5 Recipient and transfer to third states 
According to the German data protection supervisory authorities (Data Protection Conference), Google Analytics is jointly responsible for data processing on our behalf. Along with that, we have also concluded the ‘Google Measurement Controller-Controller Data Protection Terms’ with Google. Google also processes your personal data in the USA.

12. GOOGLE WEBFONTS

12.1 Description of the processing
Our website uses ‘Google Web Fonts,’ a font replacement service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as ‘Google’). Google Web Fonts replaces the standard fonts on your device with fonts from Google's catalogue when displaying our website. If your browser prevents the integration of Google Web Fonts, the text on our website will be displayed in your device’s standard fonts. Google fonts are loaded directly from a Google server. In order for this to happen, your browser sends a request to a Google server. This may also transmit your IP address to Google in connection with the address of our website. However, Google Web Fonts does not store any cookies on your end device. According to Google, data processed as part of the Google Web Fonts service is transferred to resource-specific domains such as fonts.googleapis.com or fonts.gstatic.com. They are not associated with data that may be related to the use of other Google services such as the search engine of the same name or Gmail. Further information on data protection at Google Web Fonts can be found at developers.google.com/fonts/faq?hl=de-DE&csw=1. General information on data protection at Google can be found at policies.google.com/privacy?hl=de-DE.

12.2 Purpose
Processing is undertaken to be able to make the texts on our website more legible and aesthetically more appealing.

12.3 Legal basis
Processing is necessary for the protection of the overriding legitimate interests of the responsible person (Art. 6 para. 1f GDPR). Our legitimate interests lies in the purpose named in section 12.2.

12.4 Recipient and transfer to third states
By using Google Webfonts, personal data may be transferred to Google. Google also processes your personal data in the USA.

13. YOUTUBE

13.1 Description of the processing
Our website uses the services of  “YouTube”, a video platform operated by YouTube LLC, 901 Cherry Avenue, San Bruno, CA 94066, USA (hereinafter referred to as “YouTube“). YouTube is represented by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. We use YouTube by embedding individual videos from the platform in our website so that they can be played directly on our website. The videos are integrated in the “enhanced data protection mode” offered by YouTube, i.e., none of your personal data is transmitted to Google if you do not play the videos. Data is only transferred to Google; we have no influence over this. If you play an embedded video on our website, Google is informed which sub-page you visited and which video you watched. Your IP-address may also be transmitted to Google. If you are logged in there as a YouTube or Google user, Google assigns this information to your user account. Google stores your data as a user profile and uses it for advertising purposes, market research and/or demand-oriented design of the Google‘s websites. You have the right to object to the creation of this user profile, and you have to contact Google directly in order to exercise this right. Further information on data protection at Google can be found at www.google.com/intl/de-DE/policies/privacy/.

13.2 Purpose 
Processing is carried out to enable the playing of videos on our website.

13.3 Legal Basis
Processing is undertaken on the basis of consent according to Art. 6 Para. 1a GDPR. This is collected by us via the consent tool “Consentmanager” (see section 7.1) or in the context of a content blocker at the place in our website where a YouTube video is to be shown. This consent is voluntary.

13.4 Revocation of consent 
You can withdraw your consent for playing YouTube videos on our website at any time in the settings of the consent tool www.myticket-jahrhunderthalle.de with effect for the future.

13.5 Recipient and transfer to third states
Through the integration of YouTube, personal data could be transmitted to YouTube LLC or Google. Google also processes your personal data in the USA.

14. GOOGLE ADS CONVERSION

14.1 Description of the processing
Our web site uses the advertising service “Google Ads Conversion”, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4. Ireland (hereinafter referred to as “Google“). With the aid of Google Ads Conversions, we can switch advertising to external websites, to make you aware of our offers there. Furthermore, we are able, using this service, to determine the range and success of individual advertising campaigns. Our advertisements are delivered by Google via so-called “Ad Server”. To do this, Google uses “Ad Server” cookies, through which certain parameters for measuring success, such as showing of adverts or clicks by users. If you come to our website via a Google advertisement, a cookie is stored in your end device by Google Ads (see section 7). According to Google, these cookies are not intended to identify you personally. The unique cookie-ID, number of Ad Impressions per placement (Frequency), last impression (relevant for Post-View-Conversions) and opt-out information (note that the user no longer wishes to be contacted) are generally stored as analysis values with this cookie. The cookies enable Google to recognise your internet browser again. If you visit websites of a Google-Ads customer and the cookie stored on your end device has not expired, Google and the customer can see that you have clicked on an advertisement and have been transferred on to our website. A different cookie is assigned to each Google-Ads customer. Cookies can thus not be traced via the web pages of Google-Ads customers. We do not process any personal data ourselves with our Google Adwords advertising actions. Google only provides us with statistical analyses. We can identify from these analyses which of the advertising activities used are particularly effective. We do not get any other data from the use of the advertising media, in particular, we cannot identify users from this information. If you visit our web site, a connection is made with the Google's servers. We have no influence over the scope and further use of the data collected by Google through the use of Google Ads Conversion and thus inform you according to our level of knowledge: through the integration of Google Ads Conversion, Google receives information as to what sub-pages of our web site you have opened or whether you have clicked on our advert. If you are registered for a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged on, it is possible that Google can discover and store your IP-address.

Further information on data protection at Google can be found here: policies.google.com/privacy?hl=de and services.google.com/sitestats/de.html.

14.2 Purpose
Processing is undertaken to be able to implement targeted online advertising and evaluate its effectiveness and reach.

14.3 Legal basis
Processing is undertaken on the basis of consent according to Art. 6 Para. 1 la GDPR. This is collected by us via the consent tool “Consentmanager” (see section 7.1). This consent is voluntary.

14.4 Duration of storage, right to object, right of revocation
We stated the storage period and your control and setting options for cookies in section 7. You can also object to data processing by Google Ads Conversion at any time via the following website: www.google.com/ads/preferences. You can revoke the consent given by you in respect of data collection by Google Ads Conversion at any time in the consent tool settings with effect for the future.

14.5 Recipient and transfer to third states
Personal data may be transmitted to Google by the integration of Google Ads Conversion. Google also processes your personal data in the USA.

15. GOOGLE TAG MANAGER
Our website uses “Google Tag Manager”, a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as “Google“). No personal data is captured by Google Tag Manager nor are any cookies set. This service only enables us to integrate and manage tags on our website. Tags are small code elements on our website that are helpful for measuring, together with other tools building on it, e.g., traffic and visitor behaviour, assessing the impact of online advertising and social channels, adjusting re-marketing and orientation to target groups, testing and optimising the website. As a precaution, the integration of Google Tag Manager is nonetheless on the basis of consent according to  Art. 6 Para. 1a GDPR, which is obtained via the consent tool “Consentmanager“ (see section 7.1) and can also be revoked there. You can find further information on Google Tag Manager at www.google.com/intl/de/tagmanager/use-policy.html.

V. Security Measures 

16. Security Measures 
To protect your personal data from unauthorised access, we have equipped our website with an SSL or TLS-certificate. SSL stands for “Secure-Sockets-Layer” and TLS “Transport Layer Security” and encrypts the communication of data between a website and a user’s end device. You can identify active SSL or TLS encryption by a lock icon displayed on the far left of the browser’s address bar.

VI. Your rights

17. Data subject rights
You have the following data subject rights in respect of the data processing carried out by our company, as described above:

17.1 Information (Art. 15 GDPR)
You have the right to require us to confirm to you whether we are processing personal data concerning you. If this is the case, then you have a right under the conditions stated in Art. 15 GDPR to information about this personal data and the information listed in detail in Art. 15 GDPR.

17.2 Correction (Art. 16 GDPR)
You have the right to require us to immediately correct any personal data concerning you that is incorrect  or to complete any incomplete personal data.

17.3 Deletion (Art. 17 GDPR)
You have the right to require us to immediately erasure personal data concerning you, if one of the reasons detailed in Art. 17 GDPR, e.g., if your data is no longer required for one of the purposes pursued by us.

17.4 Restriction of data processing (Art. 18 GDPR)
You have the right to require us to restrict processing if one of the conditions listed in Art. 18 GDPR is met, e.g., if you contest the accuracy of your personal data, data processing is restricted until we can verify the accuracy of your data.

17.5 Data portability (Art. 20 GDPR)
You have the right under the conditions listed in Art. 20 GDPR, to require the issue of data concerning you in a structured, current and machine-readable format.

17.6 Revocation of consent (Art. 7 para. 3 GDPR)
You have the right to revoke your consent at any time to processing that is based on consent. The revocation applies from the time it is communicated. In other words, it applies to the future. Processing does not therefore become retrospectively illegal by the revocation of consent.

17.7 Complaints (Art. 77 GDPR)
If, in your opinion, the processing of your personal data contravenes the GDPR, you have the right to make a complaint to the supervisory authorities. You can exercise this right with a data commissioner in the EU member-state where you are resident, your workplace or the place of the alleged violation.

17.8 Prohibition of automated decisions/profiling (Art. 22 GDPR)
Decisions that have legal consequences for you or significantly affect you may not be made exclusively by automated processing of personal data, including profiling. We inform you that we do not use automated decision-making including profiling in respect of your personal data.

17.9 Right to object (Art. 21 GDPR)
If we process your personal data on the basis of Art. 6 par. 1f GDPR (for protection of overriding legitimate interests), you have the right under the conditions detailed in Art. 21 GDPR to object to this. This only applies, however, if there are grounds that arise from your particular circumstances. Subsequent to an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and liberties. Nor do we have to cease processing if it serves the establishment, exercise, or defence of legal claims. In any case, including independently of a specific situation, you have the right to object to the processing of your personal data for direct marketing purposes.

Valid as of: February 2025