We are pleased to welcome to you to our website and thank you for your interst in our company.
The protection of any personal information collected, processed and used while you are visiting our homepage is a matter of great importance to us. Your details are protected in line with legal requirements. In the following, you can read what information is collected during your visit to the homepage, and how it is used.
I. Name and Address of the Data Controller
In terms of the General Data Protection Regulation and other national data protection laws of the EU member states and other data protection-related regulations, the data controller is:
EDAG Engineering Limited
11-13 Parade,
Walton House,
Second Floor
Royal Leamington Spa
Warwickshire, CV32 4DG
Great Britain
Tel.: +44 1926 915020
E-mail: info-uk(at)edag.com
Website: https://uk.edag.com
II. Name and Address of the Data Protection Officer
The data controller's data protection officer is:
Mr. Javier Rodriguez
EDAG Engineering Limited
11-13 Parade,
Walton House,
Second Floor
Royal Leamington Spa
Warwickshire, CV32 4DG
Great Britain
Tel.: +44 1926 915020
E-mail: info-uk(at)edag.com
Website: https://uk.edag.com
III. General Data Processing Information
- Extent to which personal data is processed
We only ever collect and use personal data of our users to the extent to which this is necessary to provide a fully functional website and our contents and services. The regular collection and use of personal data of our users is only ever made with the user's consent. One exception to this rule applies in cases in which, for factual reasons, it is not possible to obtain the user's prior consent, and the processing of this data is permitted by law.
- Legal basis for the processing of personal data
Insofar as we obtain the consent of the data subject to process his or her personal data, Art. 6 para. 1 p. 1 point a of the EU General Data Protection Regulation (GDPR) shall serve as the legal basis for the processing of personal data.
Art. 6 para. 1 p. 1 point b of the GDPR shall serve as the legal basis for the processing of personal data necessary for the performance of a contract to which the data subject is party. This shall also apply to processing necessary for the performance of pre-contractual measures.
Insofar as the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6 para. 1 p. 1 point c of the GDPR shall serve as the legal basis.
Should processing be necessary to protect the legitimate interests of our company or a third party and such interests are not overridden by the interests, fundamental rights and freedoms of the data subject, then Art. 6 para. 1 p. 1 point f of the GDPR shall serve as the legal basis for processing.
- Data erasure and storage period
TThe personal data of the data subject will be deleted or blocked as soon as the purpose for which it has been saved ceases to apply. Further, data may also be stored if provided for by European or national legislators in Union directives, laws or other regulations, to which the data controller is subject. The data will also be deleted or blocked at such time as the storage period prescribed by the designated standards expires, unless it is necessary for the data to be stored for a further period for the conclusion or performance of a contract.
IV. Provision of the Website and Creation of Log Files
- Description and extent of data processing
Every time our website is accessed, our system automatically acquires data and information from the computer system of the calling computer.
The following data is collected:
(1) The user's IP address
(2) Date and time of access.
The data is also stored in the log files of our system. This data is not stored with other personal data of the user.
- Legal basis for data processing
Art. 6 para. 1 p. 1 point f of the GDPR is the legal basis for the temporary storage of the data and the log files.
- Purpose of data processing
The temporary storage of the IP address by the system is necessary in order to be able to deliver the website to the user's computer. To this end, the user's IP address must be stored for the duration of the session.
Data is stored in log files to ensure that the website functions properly. In addition, the data serves to optimise the website and to guarantee the security of our IT systems. No data evaluation is carried out for marketing purposes in this context.
These purposes are also in our legitimate interests in data processing under Art. 6 para. 1 p. 1 point f of the GDPR.
- Storage duration
Data is deleted as soon as it is no longer needed for the purpose for which it was collected. In the case of data being collected in order to make the website available, this is the case when the session is terminated.
In the case of data stored in log files, this is the case after a maximum of seven days. Storage beyond this point in time is possible. In this case, the user's IP address will be deleted or distorted, so that it can no longer be attributed to the accessing client.
- Right to object and right of elimination
Data acquisition is essential for the provision of the website and the storage of data in log files is essential for operating the website. The user therefore has no right to object.
V. Use of Cookies
- Description and extent of data processing
Our website makes use of cookies. Cookies are text files stored on the user's computer system in or by the Internet browser. If a user accesses a website, a cookie can be stored on the user's operating system. This cookie contains a characteristic character string that enables the browser to be clearly identified the next time the website is accessed.
We use cookies to make our website more user-friendly. Some elements of our website require the accessing browser to be identified if the user changes from one page to another.
The following data is stored and transmitted in the cookies:
(1) The user's IP address
(2) Date and time of access
(3) Amount of data transferred
(4) Enquiring domain
On our website, we also use cookies which make it possible to analyse the user's surfing habits.
The following data can be transmitted in this way:
(1) Equipment type, model, brand, screen resolution
(2) Operating system, versions, families
(3) Browser, version, configuration, engines, plugins, language, language code
(4) Location data
(5) Provider details
(6) Pages per visit, number of visits, repeat visits, time of visit, date of visit
(7) Entry pages, exit pages, page URL, title of page, search items, downloads
(8) Search machines, search item, websites, social networks
(9) Campaigns, campaign key word
When accessing our website, the user is informed that cookies are used for analysis purposes, and requested to provide his or her consent to the processing of the personal data used in this respect. Information regarding this data privacy statement is also issued in this context.
- Legal basis for data processing
The legal basis for the processing of personal data using technically necessary cookies is Art. 6 para. 1 p. 1 point f of the GDPR.
The legal basis for the processing of personal data using cookies for analysis purposes, provided the user's consent for this purpose has been obtained, is Art. 6 para. 1 p. 1 point a of the GDPR.
- Purpose of data processing
The purpose of using technically necessary cookies is to simplify the use of the website for the user. Some of our website functions cannot be offered without the use of cookies. For these, it is necessary for the browser to be recognised after changing from one page to another.
The user data collected by technically necessary cookies are not used to create user profiles.
The analysis cookies are used for the purpose of improving the quality of our website and its contents. Through the analysis cookies, we find out how the website is used, which enables us to constantly improve our services. This enables us to provide optimum user guidance and to present as varied a website as possible, along with new contents, when you when you re-visit the site.
These purposes are also in our legitimate interests in the processing of personal data under Art. 6 para. 1 p. 1 point f of the GDPR.
- Storage duration, right to object and right of elimination
Cookies are stored on the user's computer, from which they are transmitted to our website. As the user, you therefore have complete control over the use of cookies. You can deactivate or restrict the transmission of cookies by altering the settings in your Internet browser. Cookies which have already been stored may be deleted at any time. This can also be done automatically. If cookies for our website are deactivated, there may be some website functions that it is no longer possible to use to the full.
VI. Job applications via Workable
As part of our recruitment process, we collect and process personal data relating to job applicants. We are committed to being transparent about how we collect and use this data and to meeting our data protection obligations.
1. Description
On our website, we offer the list of open positions, and you can apply via a link that will redirect you to an external ATS called Workable.
We use Workable, an online application provided by Workable software limited, to assist with our recruitment process. We use Workable to process personal information as a data processor on our behalf. Workable is only entitled to process your personal data in accordance with our instructions.
Where you apply for a job opening posted by us, these privacy notice provisions will apply to our processing of your personal information in addition to our other privacy notice which has been provided to you separately or is available on our website.
Where you apply for a job opening via the application function on a job site or similar online service provider (“partner”), you should note that the relevant partner may retain your personal data and may also collect data from us in respect of the progress of your application. Any use by the partner of your data will be in accordance with the partner’s privacy notice.
2. Your personal information
Information we collect from you
We collect and process some or all of the following types of information from you:
Information that you provide when you apply for a role. This includes information provided through an online job site, via email, in person at interviews and/or by any other method.
In particular, we process personal details such as name, email address, address, telephone number, date of birth, qualifications, experience, information relating to your employment history, skills experience that you provide to us, as well as your video in case you conduct your interview using the video interview feature.
If you contact us, we may keep a record of that correspondence.
A record of your progress through any hiring process that we may conduct.
Details of your visits to Workable’s website including, but not limited to, traffic data, location data, weblogs and other communication data, the site that referred you to Workable’s website and the resources that you access.
Information we collect from other sources
Workable provides us with the facility to link the data you provide to us, with other publicly available information about you that you have published on the Internet – this may include sources such as LinkedIn and other social media profiles.
Workable’s technology allows us to search various databases – some publicly available and others not, which may include your personal data (include your CV or resumé), to find possible candidates to fill our job openings. Where we find you in this way we will obtain your personal data from these sources.
We may receive your personal data from a third party who recommends you as a candidate for a specific job opening or for our business more generally.
3. Uses made of your information
Lawful basis for processing
We rely on legitimate interest as the lawful basis on which we collect and use your personal data. Our legitimate interests are the recruitment of staff for our business.
Where you apply for a job opening through the Indeed apply functionality, we rely on your consent, which is freely given by you during the application process, to disclose your personal data to Indeed on the basis described below.
4. Purposes of processing
We use information held about you in the following ways:
To consider your application in respect of a role for which you have applied.
To consider your application in respect of other roles.
To communicate with you in respect of the recruitment process.
To enhance any information that we receive from you with information obtained from third party data providers.
To find appropriate candidates to fill our job openings.
To help our service providers (such as Workable and its processors and data providers) and partners (such as the job sites through which you may have applied) improve their services.
Automated decision making/profiling
We may use Workable’s technology to select appropriate candidates for us to consider based on criteria expressly identified by us, or typical in relation to the role for which you have applied. The process of finding suitable candidates is automatic, however, any decision as to who we will engage to fill the job opening will be made by our staff.
5. Disclosure of your information
As set out above, we pass your information to our third party service providers, including Workable, who use it only in accordance with our instructions and as otherwise required by law.
Where you have applied for a job opening through the Indeed apply functionality, and where you have consented to this disclosure, we will disclose to Indeed certain personal data that we hold, including but not limited to a unique identifier used by Indeed to identify you, and information about your progress through our hiring process for the applicable job opening, as well as tangible, intangible, visual, electronic, present, or future information that we hold about you, such as your name, contact details and other information involving analysis of data relating to you as an applicant for employment (collectively “disposition data”). Indeed’s privacy notice in respect of Indeed’s use of the disposition data is available on Indeed’s website.
Where you have applied to a job opening through another service provider, we may disclose data similar to the disposition data defined above to such service provider. The service provider shall be the data controller of this data and shall therefore be responsible for complying with all applicable law in respect of the use of that data following its transfer by us.
6. How we store your personal data
Security
We take appropriate measures to ensure that all personal data is kept secure including security measures to prevent personal data from being accidentally lost, or used or accessed in an unauthorized way. We limit access to your personal data to those who have a genuine business need to know it. Those processing your information will do so only in an authorized manner and are subject to a duty of confidentiality.
We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
7. Where we store your personal data
Where we store your personal data in our own systems, it is stored United Kingdom.
The data that we collect from you and process using Workable’s services may be transferred to, and stored at, a destination outside the European Economic Area ("EEA"). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff maybe engaged in, among other things, the fulfilment of your orders, the processing of your payment details and the provision of support services. By submitting your personal data, you agree to this transfer, storing or processing.
In particular, your data may be accessible to i) Workable’s staff in the USA or ii) may be stored by Workable’s hosting service provider on servers in the USA as well as in the EU. The USA does not have the same data protection laws as the United Kingdom and EEA. A data processor agreement has been signed between Workable software limited and its overseas group companies, and between Workable software limited and each of its data processors. These data processor agreements are designed to help safeguard your privacy rights and give you remedies in the unlikely event of a misuse of your personal data.
If you would like further information, please contact us (see ‘Contact’ below). We will not otherwise transfer your personal data outside of the United Kingdom or EEA or to any organisation (or subordinate bodies) governed by public international law or which is set up under any agreement between two or more countries.
8. How long we keep your personal data
We will hold all the data for 24 months.
VII. Contact Form and E-Mail Contact
- Description and extent of data processing
There is a contact form on our website, and this can be used to contact us online. Should a user make use of this option, the data entered in the input mask are transmitted to us and stored. The following data is mandatory:
(1) Company
(2) Surname, first name
(3) E-mail address
(4) Your message to us
The following optional data may also be supplied:
(5) Title
(6) Telephone No.
(7) Street, number
(8) Postcode, city
(9) Country
The following data is also stored at the time the message is sent:
(10) The user's IP address
(11) Date and time of registration
Your consent to the processing of this data will be requested and reference made to this data privacy statement when you send your message.
Alternatively, an e-mail address is provided if you prefer to contact us this way. In this case, the personal data of the user transmitted with the e-mail is stored.
In this respect, there is no disclosure of data to third parties. Such data is used solely to process the communication.
- Legal basis for data processing
The legal basis for the processing of data, provided the user's consent has been obtained, is Art. 6 para. 1 p. 1 point a of the GDPR.
The legal basis for the processing of data collected when an e-mail is being sent is Art. 6 para. 1 p. 1 point a of the GDPR. If the point of the e-mail contact is to enter into a contract, then Art. 6 para. 1 p. 1 point b of the GDPR will serve as an additional legal basis for processing.
- Purpose of data processing
The sole reason for processing personal data from the input mask is to enable us to handle communication with you. If contact is established by e-mail, this also establishes a legitimate interest in processing the data.
The other personal data collected when the message is sent serve to prevent any abuse of the contact form and to guarantee the security of our IT systems.
- Storage duration
Data is deleted as soon as it is no longer needed for the purpose for which it was collected. For personal data from the input mask of the contact form and data transmitted by e-mail, this is the case when a particular communication with the user is finished. Communication is finished when circumstances indicate that the matter concerned has been fully resolved.
The additional personal data collected while the message is being sent will be deleted after a period of no more than seven days has elapsed.
- Right to object and right of elimination
The user has the right to withdraw his or her consent to the processing of the personal data at any time. If the user contacts us by e-mail, he or she can object to the storage of his or her personal data at any time. If this is the case, then the communication cannot be continued.
In this case, all personal data collected as a result of contact being made will then be deleted.
VIII. Web Tracking
- Description and extent to which personal data is processed
This website uses Google Analytics, a web analytics service of Google Inc. ("Google"). This makes it possible for data, sessions and interaction across multiple devices to be assigned to a pseudonymised user-ID, permitting the cross-device analysis of the activities of a user.
Google Analytics makes use of "cookies", text files which are stored on your computer and enable the use of the website to be analysed. As a rule, the information relating to your use of this website generated by the cookie is transferred to a Google server in the USA, where it is saved. If IP address anonymisation has been activated on this website, Google will truncate your IP address within member states of the European Union or other states party to the Agreement on the European Economic Area. Only in exceptional cases is the IP address transferred to a Google server in the USA and truncated there. On behalf of the owner of this website, Google will use this information to evaluate your usage of the website, to compile reports on the website activities, and to perform further services relating to the use of the website and Internet for the website owner.
To do this, the following data concerning you is processed: - The user's IP address
- Date and time of access
- Login information
- Amount of data transferred
- Enquiring domain
- Equipment type, model, brand, screen resolution
- Operating system, versions, families
- Browser, version, configuration, engines, plugins, language, language code
- Location data
- Provider details
- Pages per visit, number of visits, repeat visits, time of visit, date of visit
- Entry pages, exit pages, page URL, title of page, search items, downloads
- Search engines, search item, websites, social networks
- Campaigns, campaign key word
The IP address sent by your browser via Google Analytics is not merged with other data by Google.
- Legal basis for the processing of personal data
The legal basis for the use of Google Analytics is Art. 6 para. 1 p. 1 point f of the GDPR.
- Purpose of data processing
The purpose behind the use of the web analytics service is to analyse and make regular improvements to the use of our website. The statistics obtained enable us to improve our services and make them more interesting to you, our users. For the exceptional cases in which personal data is transferred to the USA, Google submits to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.
These purposes are also in our legitimate interests in data processing under Art. 6 para. 1 p. 1 point f of the GDPR.
- Storage duration, right to object and right of elimination
Any data that is sent by Google and linked with cookies, user authentication (e.g. user ID) or advertising IDs is automatically deleted after 14 months. According to Google, data which has come to the end of its storage period is automatically deleted once a month. We draw your attention to the fact that we have no influence over how long data is stored by Google.
You can prevent cookies from being stored by adjusting your browser software accordingly; we would, however, like to draw your attention to the fact that if you do so, this might possibly result in your not being able to use all the functions offered on this website to the full. Further, you can prevent the acquisition of the data generated by the cookie and relating to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser plug-in available on the following link: tools.google.com/dlpage/gaoptout.
Opt-out cookies prevent the future acquisition of your data when visiting this website. To prevent acquisition across multiple devices by Universal Analytics, you will have to activate the opt-out for all systems in use. Click here to set the opt-out cookie: ga-optout text=“Deactivate Google Analytics“
This website uses Google Analytics with the "_anonymizeIp()" function. This ensures that IP addresses are processed in truncated form, making it impossible to trace them to a specific user. Should the data about you that has been collected produce a direct personal link, this is immediately blocked, so the personal data is instantly deleted.
Information on the third-party provider: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. The conditions of use can be found on: www.google.com/analytics/terms/de.html; a data privacy summary can be found on: www.google.com/intl/de/analytics/learn/privacy.html, and the data privacy statement on: http://www.google.de/intl/de/policies/privacy.
To this purpose, we have also entered into a data processing contract with Google.
IX. Integration of Google Maps
- Description and extent of data processing
We use the Google Maps service on this website. This enables us to display interactive maps directly on the website, making it easy and convenient for you to use the map function.
Should you visit the website, Google receives the information that you have activated the corresponding subpage of our website. In addition, the following data is transmitted:
(1) IP address of the accessing computer
(2) Date and time of enquiry
This happens regardless of whether or not Google has provided a user account by means of which you have logged on. If you have logged on to Google, your data is assigned directly to your account. If you do not wish the data to be assigned to your profile with Google, you must log out before clicking on the link.
Further, depending on what settings the user has made, it is even possible for Google to collect location data. However, your consent to such data being used is always necessary, and you can refuse to let Google have this in your response to the query.
Further information concerning the purpose and scope of data acquisition and its processing by the plugin provider can be found in the provider's data privacy statements, where you will also find additional information on your rights in this respect and setting options to protect your private sphere. https://www.google.de/intl/en/policies/privacy.
Google also processes your personal data in the USA, and submits to the EU-US Privacy Shield, www.privacyshield.gov/EU-US-Framework.
- Legal basis for data processing
The legal basis for processing is Art. 6 para. 1 p. 1 point f of the GDPR. Provided the user's consent has been obtained, the legal basis for the processing of data is Art. 6 para. 1 p. 1 point a of the GDPR.
- Purpose of data processing
Google stores your data as usage profiles, which it then uses for advertising or market research purposes, and/or the needs-based design of its website. An analysis of this type is carried out (even for users who have not logged on) in particular to provide needs-based advertising, and to inform other people using the social network of your activities on our website.
- Storage duration
We have no influence on the data collected and data processing operations, nor do we know the full extent of data acquisition, the purposes for which it is processed, or storage periods. Likewise, we have no information regarding the deletion by Google of any data collected.
- Right to object and right of elimination
To prevent data from being assigned to an existing profile with Google, log out before activating the link. You have the right to object to the creation of these user profiles, and to exercise this right, you must contact Google.
X. Use of Hubspot
- Description and extent of data processing
For analysis purposes, as well as for e-mailing, blogs and posting social media, we use HubSpot, a service provided by HubSpot Inc., on our website. HubSpot Inc. is a US company which has a subsidiary in Ireland (HubSpot, 2nd floor 30 North Wall Quay, Dublin 1, Ireland, Tel.: +353 1 5187500). HubSpot uses cookies which are stored on the user's computer and collect certain types of data. The following data is collected: - IP address
- Location
- Browser
- Duration of visit
- Websites opened
- Legal basis for data processing
If the user's consent has been obtained, the legal basis for the processing of personal data by the HubSpot service is Art. 6 para. 1 p. 1 point a of the GDPR and the analogous provisions according to the applicable data protection law. The use of the service for the purpose of emailing, blogging and social media posting is otherwise based on our legitimate interest in accordance with Art. 6 para. 1 p. 1 point f of the GDPR and the analogous provisions in accordance with the applicable data protection law.
- Purpose of data processing
The purpose of using the service for analysis is to be able to analyze and regularly improve the use of our website. The statistics obtained allow us to improve our offer and make it more interesting for you as a user.
The data collected via the HubSpot service is used for mailing lists, blogs and social media postings, making customer care easier and clearer.
The purposes described above are also in our legitimate interests in the processing of personal data under Art. 6 para. 1 p. 1 point f of the GDPR and the analogous provisions in accordance with the applicable data protection law.
- Storage duration, right to object and right of elimination
We use data that has been acquired by means of the HubSpot service for the above-mentioned purposes only, and do not disclose such data to third parties. To this purpose, we have also entered into a data processing contract with HubSpot Inc.
You can prevent the acquisition of data by HubSpot by making the appropriate browser settings to forbid cookies from being stored. Instructions can be found on http://www.meine-cookies.org/cookies_verwalten/index.html
If you would like to prevent your data from being used for marketing purposes, you can unsubscribe by clicking on http://www.youronlinechoices.eu/
Further information on data processing by HubSpot and the HubSpot data protection conditions can be found at https://legal.hubspot.com/legal-stuff, https://legal.hubspot.com/privacy-policy, and https://legal.hubspot.com/website-terms-of-use.
- Forwarding of Personal Data
HubSpot processes your personal data in the USA. With your consent to the integration of the service, you also consent to the processing of your data in the USA pursuant to Art. 49 para. 1 sentence 1 point a of the GDPR and the analogous provisions pursuant to applicable data protection legislation. We would like to point out that the European Court of Justice regards the US as a country with a level of data protection that is insufficient by EU standards. In view of this fact, no other suitable data protection safeguards exist. There is therefore a risk of your data being processed by U.S. authorities for control and monitoring purposes, possibly without the possibility of legal recourse. If you do not want this to happen, click Refuse.
XI. Rights of Data Subject
If personal data concerning you is processed, you are the data subject as defined in the GDPR, and have the following rights against the data controller:
- Right to information
You can ask the controller to provide you with confirmation as to whether or not personal data concerning you is processed by us.
If such processing is being undertaken, you can ask the controller to provide you with information concerning the following:
(1) The purposes for which the personal data is processed;
(2) The personal data categories which are processed;
(3) The recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
(4) The planned storage duration of the personal data concerning you or, if it is not possible to provide concrete information on this point, criteria for defining the storage duration;
(5) The existence of a right to correct or delete the personal data concerning you, a right to limit processing by the controller, or a right to object to such processing;
(6) The existence of a right to lodge a complaint with a supervisory authority;
(7) All available information concerning the origin of the data, if the personal data was not acquired from the data subject him or herself;
(8) The existence of automated decision-making and profiling in accordance with Art. 22 para. 1 and 4 of the GDPR and – at least in these cases – meaningful information on the logic involved and the implications and intended impact of such processing for the data subject.
You have the right to request information on whether or not the personal data concerning you is transmitted to a third country or international organisation. In this context, you may ask for information on appropriate guarantees in accordance with Art. 46 of the GDPR relating to the transmission of data.
- Right to correction
You have a right to have the controller correct or complete any personal data concerning you which, having been processed, is either incorrect or incomplete. The data controller must carry out any corrections without undue delay.
- Right to restrict processing
Subject to the following conditions, you can request that processing of the personal data concerning you be restricted:
(1) If you dispute the accuracy of the personal data concerning you for a period which allows the controller to check the accuracy of the personal data;
(2) the processing is unlawful and you refuse deletion of the personal data, instead requesting that use of the personal data be restricted;
(3) the controller no longer needs the personal data for processing purposes, but you need it in order to establish, exercise or defend legal claims, or
(4) if you have filed an objection to the processing of the data in accordance with Art. 21 para. 1 of the GDPR, and it is not yet clear whether the legitimate reasons of the controller outweigh your reasons.
If the processing of the personal data concerning you has been restricted, then, storage aside, this data may only be processed with your consent, or to establish, exercise or defend legal claims, or to protect the rights of another natural or legal person, or for reasons of substantial public interest on the basis of Union or Member State law.
If restriction of the processing has been restricted under the above-mentioned conditions, you will be informed by the controller before the restriction is lifted.
- Right to deletion
a) Obligation to delete
You can ask the controller to delete the personal data concerning you without undue delay, and the controller is obliged to delete this data without delay if one of the following reasons applies:
(1) The personal data concerning you is no longer needed for the purposes for which it was collected or otherwise processed.
(2) You revoke your consent, which served as the basis for processing in accordance with Art. 6 para. 1 lit. a or Art. 9 para. 2 point a of the GDPR, and there is no other legal basis for the processing.
(3) You file an objection to processing in accordance with Art. 21 para. 1 of the GDPR, and there are no overriding legitimate reasons for the processing, or you file an objection to processing in accordance with Art. 21 para. 2 of the GDPR.
(4) The personal data concerning you has been unlawfully processed.
(5) Deletion of the personal data concerning you is necessary in order to ensure compliance with a legal obligation under Union or Member State law to which the data controller is subject.
(6) The personal data concerning you has been acquired in relation to the offer of information society services in accordance with Art. 8 para. 1 of the GDPR.
b) Information to third parties
If the controller has made the personal data concerning you public, and is obliged to delete such data in accordance with Art. 17 para. 1 of the GDPR, then, taking into account the technologies available and implementation costs, he - the controller - applies appropriate measures, which may also be of a technical nature, to inform the people responsible for processing personal data that, as a data subject, you have requested that they should delete all links to this personal data as well as all copies or replications of this personal data.
c) Exceptions
The data subject does not have the right to have his or her data deleted if processing is necessary
(1) to exercise the rights to freedom of expression and freedom of information;
(2) to comply with a legal obligation calling for processing on the basis of Union or Member State law to which the controller is subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller;
(3) for reasons of public interest in the field of public health in accordance with Art. 9 para. 2 points h and i and Art. 9 para. 3 of the GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 para. 1 of the GDPR, insofar as the right set out in section a) is likely to render impossible or seriously impair the achievement of the purposes of this processing, or
(5) to establish, exercise or defend legal claims.
- Right to information
If you have exercised your right to have the controller correct, delete or restrict the processing of your data, then the controller is obliged to inform all recipients to whom the personal data concerning you has been disclosed of such correction or deletion of the data or restriction of the processing, unless it proves impossible to do so or would involve unreasonable expense and effort.
You are entitled to have the controller inform you of these recipients.
- Right to data portability
You have the right to receive the personal data concerning you with which you have provided the controller in a structured, commonly used and machine-readable format. Further, you have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided
(1) the processing is based on consent in accordance with Art. 6 para. 1 p. 1 point a of the GDPR or Art. 9 para. 2 point a of GDPR or on a contract in accordance with Art. 6 para. 1 p. 1 point b of the GDPR, and
(2) the processing is carried out by automated means.
In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. This shall not adversely affect the rights and freedoms of others.
The right to data portability does not apply to processing of personal data for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
- Right to object
You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6 para. 1 p. 1 point e or f of the GDPR; this also applies to profiling based on these provisions.
The controller will no longer process the personal data concerning you unless the controller can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing serves to establish, exercise or defend legal claims.
If personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing purposes; this also applies to profiling, insofar as it is related to such direct marketing.
Should you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for such purposes.
In the context of the use of information society services – notwithstanding Directive 2002/58/EG – you are entitled to exercise your right to object by automated means using technical specifications.
- Right to withdraw declaration of consent under data protection law
You have the right to withdraw your declaration of consent to the processing of personal data at any time. The withdrawal of consent shall not affect the lawfulness of processing based on your consent before its withdrawal.
- Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing - including profiling - which produces legal effects that concern you or significantly affects in a similar way.
This does not apply if the decision
(1) is necessary for entering into or the performance of a contract between you and the data controller,
(2) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and your legitimate interests, or
(3) is made with your explicit consent.
These decisions must not, however, be based on special categories of personal data referred to in Art. 9 para. 1 of the GDPR, unless Art. 9 para. 2 point a or g applies, and suitable measures have been undertaken to safeguard your rights and freedoms and your legitimate interests.
With regard to the cases described in points (1) and (3), data controller will implement suitable measures to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
- Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data concerning you infringes the GDPR.
The supervisory authority with which the complaint has been lodged will inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy in accordance with Art. 78 of the GDPR.
