Data protection information

To enable you to use our website without restriction, we use "cookies". Cookies are small text files that enable the recognition of users and an analysis of our website use. A randomly generated unique identification number is stored in them. A cookie also contains information about its origin and the retention period. Cookies cannot store any other data. The setting of cookies does not allow us to view files on your computer.

The cookies set by our website do not pose any risk to the user's computer, as they do not cause any damage and do not contain viruses or similar.

We distinguish three types of cookies that we use for the operation of our website:

• Functionally necessary cookies to ensure technical operation and basic functions of our website. This type of cookie is used to store your selection in the cookie disclaimer. 
• Statistical/marketing cookies to understand how visitors interact with our website and to be able to set targeted advertising activities. Information is only collected and analysed anonymously. In this way we gain valuable insights to optimize the website and our product range. 
• Third-party cookies if third-party media content is requested, for example when playing YouTube videos.  

The use of cookies can be prevented through browser settings. If your browser supports the "do-not-track" technology and you have activated it, no user profile is created during your visit. However, please note that our website may not be fully functional without cookies.

Legal basis

The legal basis for using functionally necessary cookies is our legitimate interest according to article 6 paragraph 1 GDPR to ensure technical operability and basic functions of our website and to save your chosen cookie settings and operate the website accordingly.

The legal basis for using cookies for marketing and analysis purposes (see "Matomo" section below), which you can select in the cookie disclaimer, is your consent in accordance with article 6 paragraph 1 GDPR.

The legal basis for using third-party cookies is exclusively your consent in accordance with article 6 paragraph 1 GDPR, which you can give either via cookie disclaimer or by retrieving respective content - for example when playing a YouTube video (see section "YouTube videos").

Notice of withdrawal, notice of objection:

You can revoke your given consent at any time. Under certain circumstances, you have the right to object to processing operations based on a legitimate interest of the data controller. For more information on your rights as a data subject, see section 5.

Recipient 

This data is transmitted to processors, but not to third parties.

Retention period

The retention period of a cookie can be found in the table above.

Requirement to provide data

You are not obliged to provide this data. If you reject the functional cookies, you may have problems with accessing and using our website. Rejecting other types of cookie will not negatively impact your website experience.

Provided that you have given your consent for statistics/marketing cookies, our website uses the software "Matomo" (www.matomo.org) as a web analysis tool in order to align our website even better and more specifically. The software sets cookies on your computer, which enable recognising your browser. If subpages of the website are loaded, following data is stored:

• Date and time of accessing one of our web pages
• Your browser type
• Your browser settings
• Your operating system
• The last page you visited
• The transferred data volume and access status (file transferred, file not found etc.)
• Your IP address

The data collected with Matomo is stored on our own servers. 

Our website includes integrated Twitter functions that you can see directly on the page. Tweets, time-lines and other Twitter functions can be displayed on our site. Twitter is provided by Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA (shortened to ‘Twitter’ in the following text). Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland is responsible for data processing for people living in the EU, the EFTA states or the United Kingdom. We use the option Twitter provides to deactivate the use of data on our website for identification purposes.

Cookies are not stored on your computer and data is not transferred to Twitter unless you interact with the Twitter functions. If you use the integrated Twitter functions, at least the following data will be transferred to Twitter: IP address and cookie information, the specific address of the page of our website you visited, location, browser type and operating system. The data is transferred regardless of whether you are logged into a Twitter user account or whether you have a Twitter user account. Twitter stores the data as log data, which is used for advertising, for internal security measures, and/or to design its website to better meet your requirements. If you are logged in to Twitter, the data is directly associated with your account. You can prevent this association by logging out of your Twitter account before interacting with the Twitter functions.
 
Further information on Twitter’s data protection measures can be found here: https://twitter.com/privacy. By interacting with the Twitter functions you are consenting to data pro-cessing by Twitter. We at x-tention do not process this data ourselves.
 

YouTube videos which are stored on "www.youtube.com" are integrated in our website and can be played directly from our website. YouTube is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA (hereinafter referred to as "Google"). Here we use the "extended privacy mode" option provided by YouTube, which means that no data about you as a user is transferred to YouTube if you do not play the videos. 

Only when you play the videos, YouTube cookies are stored on your computer and data is transferred to the YouTube operator Google. If you play videos stored on YouTube, following data will be transmitted to Google: IP address and cookie ID, specific address of the accessed page on our site, language setting of the browser, system date and time of the access and identification of your browser. The data transfer takes place regardless of whether you are logged in to YouTube or whether you do not have a user account. If you are logged in, this data is directly assigned to your account. You can prevent this assignment by logging out before clicking the play button. YouTube or Google stores this data as user profiles and uses them for advertising, market research and/or demand-oriented design of their website. You have a right of objection to the creation of user profiles, which you must address directly to YouTube's operator Google. 

For information on YouTube's privacy policy please read Google's documentation on www.google.at/intl/de/policies/privacy/. By playing YouTube videos, you consent to data processing by Google. Concerned data will not be processed by us.

We use the "Google Maps" component by Google on our website.

When using "Google Maps" no cookies are set. Please note that data is only transferred to Google when you actively select it, i.e. click on the map and use the component. Google is solely responsible for processing personal data (e.g. IP address, location); we do not have access to this data.

The use of "Google Maps" and the information obtained via "Google Maps" is subject to the Google's terms of use http://www.google.de/intl/de/policies/terms/regional.html and the additional terms and conditions for "Google Maps", which can be found under following link: https://www.google.com/intl/en_EN/help/terms_maps.html.

Transfer to third countries

We cannot guarantee that data will not be transferred to the USA when you play a YouTube video or use Google Maps. The European Court of Justice (ECJ) Schrems II judgement (C-311/18) found that the USA does not ensure an adequate level of data protection, as US authorities can be granted access to the personal data of EU citizens, and EU citizens have no effective legal remedies against it. By playing the videos or using the maps on our website you give your express consent to the transfer of your data to the USA (point (a) of Article 49(1) GDPR).
 

Purpose

If you contact us via the website contact form, by email or telephone, we will store the data you provide to process your enquiry and for follow-up questions.

Legal basis

Our legitimate interest according to article 6 paragraph 1 GDPR is to answer your inquiry or to initiate or fulfil a contract according to article 6 paragraph 1 GDPR.

Retention period

Data will only be stored as long as necessary to achieve respective purposes or within the scope of legal retention periods.

Recipient

Your personal data may be passed on within the x-tention group (see section 2) or to external processors, but in no case to third parties.

Requirement to provide data

If you are contacting us 

• with regard to initiating a contract, you are required to provide your data for the purpose of concluding the contract; 
• with regard to fulfilling a contract, you are obliged to provide the data required for us to process your request correctly;
• for a reason other than those mentioned above, you are not obliged to provide this data.

Not providing your data would mean that we would not be able to continue processing your request. This could mean that you are breaching your existing duty to cooperate.
 

Purpose

You can subscribe to our newsletter via the website. This will keep you up to date and you will receive interesting company news, relevant information and invitations to our events. For this purpose we need your name, email address and declaration that you agree to receiving the newsletter. When you register for our newsletter, we will also save your IP address and date and time of your registration. In case a third party misuses your email address and subscribes to our newsletter without your knowledge, this will serve as safeguard on our part and as proof of your consent. We use the Double-Opt-In-Procedure.

Additionally, statistics on opening, reading and clicking behaviour are generated in connection with the newsletter. This enables us to offer better services and to send you only the information that really interests you.

Legal basis

Legal basis for sending the newsletter is your consent in accordance with article 6 paragraph 1 GDPR. The compilation of statistics is based on our legitimate interest pursuant to article 6 paragraph 1 GDPR, whereby our interest results from the aforementioned purpose. An objection is of course also possible by cancelling the newsletter.

Apart from subscribing to the newsletter via website, we will also use your email address, which is known to us as part of an existing contractual relationship with you, to send you a newsletter. However, you will have the clear and unambiguous opportunity to refuse to receive the newsletter free of charge and without any problems, both when the e-mail address is collected and for each subsequent mailing. In this case, the legal basis is our legitimate interest in keeping you up to date with the information mentioned under "Purpose" - in connection with the exception for business relationships pursuant to § 107 (3) of the Telecommunications Act (TKG 2003).

Recipient

Your personal data may be transferred within the x-tention group (see section 2) or to external processors, but in no case third parties. We use the EWORX NETWORK & INTERNET GMBH Mailworx tool for sending newsletters. This company has undertaken to comply with data protection regulations.

Retention period

Deletion or non-processing for the above purpose takes place after cancellation of the newsletter.

Withdrawal

You can cancel your subscription to the newsletter at any time by pressing the "Unsubscribe newsletter" button. Your cancellation will be sent to following email address: @email. You can also contact us by email or telephone. We will then immediately delete your data in connection with the newsletter. The lawfulness of processing that took place between your consent and the revocation remains unaffected.

Requirement to provide data

You are not obliged to provide this data. However, if you do not provide it, you cannot subscribe to our newsletter.
 

Purpose

The personal data you provide during an application (including correspondence) will be processed for recording and storing and for coordination and evaluation in the application process. With your consent, your application data may be kept available for subsequent application procedures. We store your application data for the assertion and defence of legal claims. We also carry out an anonymous statistical evaluation of the applicant structure.

Without provisioning your data, it is not possible to consider an application, as we would not be able to assess whether you are suitable for the position.

Legal basis

The processing is based on the following legal bases:

• Initiation of a contract in the context of specific application procedures - article 6 paragraph 1 letter b GDPR.
• Consent in terms of keeping records - article 6 paragraph 1 letter a GDPR.
• The legitimate company interest to keep applicant data as evidence in the event of a defence against a claim for compensation under the öGlBG or dAAG - article 6 paragraph 1 letter f GDPR.

For x-tention Austria moreover:

• Statistical purposes which do not aim at personal results - paragraph 7 (1) DSG.

Retention period

After rejection, personal data will be stored for seven (7) months and deleted thereafter. If you give your consent within the scope of keeping records, your application data will only be deleted after two years from rejection.

Recipient

Your personal data may be transferred within the x-tention group (see section 2) or to external processors, but in no case to third parties. For the administration of applications we use a software solution provided by Sage GmbH. 

Requirement to provide data

• Application process: You are required to provide data during the course of your application. This is necessary for a potential contract. If you do not make your data available, we cannot continue processing your application. 
• Keeping data on file: You are not required to provide data for us to keep on file. If you do not make your data available for us to keep on file, we can no longer contact you with regard to future recruitment opportunities.
   

Depending on the contract, it may be necessary to process certain data in order to either use respective services or to be able to provide them on our part.

Purpose

We process required data for the initiation of a contract (submission of offers, participation in tenders, etc.).

Within straight business relations, data is processed required for provisioning our services, customer care and information, including internal documentation and administration. Data is also stored to comply with legal obligations (in particular the Federal Fiscal Code (Bundesabgabenverordnung BAO)) and to assert and defend legal claims.

Legal basis

Following legal bases apply in this case:

• Initiation or fulfilment of a contract - article 6 paragraph 1 letter b GDPR.
• Compliance with legal obligations - article 6 paragraph 1 letter c GDPR.
• The legitimate company interest to retain data as evidence for the assertion and defence of legal claims - article 6 paragraph 1 letter f GDPR.

Retention period

Data is only stored as long as necessary for the fulfilment of mutual contractual obligations.
In order to comply with legal obligations (§ 132 BAO, §§ 190, 212 UGB), data is stored for a period of 7 years from the end of a calendar year. In certain cases, such as for the assertion and defence of legal claims, data can be stored for longer. Especially contracts and related data are stored for 30 years due to the general limitation period according to § 1489 ABGB. Until the time of deletion, data will be restricted so that no further processing or access takes place.

Deviating for x-tention Germany:

Data is stored for ten years from the end of a calendar year (§ 147 AO, §§ 238 and 257 HGB).

Deviating for x-tention Switzerland:

Data is stored for ten years from the end of a calendar year (article 958f ZGB, article 70 Z 2 MWSTG).

Recipient

To provide our services, we use members of the x-tention group (see section 2) and various external contractual or business partners, who participate in the delivery or service to the required extent. They are contractually bound to secrecy. Data will be passed on to authorities or courts if we are legally obliged to do so.

Requirement to provide data

• You are required to provide data for the purposes of initiating or fulfilling a contract. If you do not provide the data there may be delays in processing your request, or the contract may not be concluded or may be terminated.
• In addition, you are required to make your data available so we can fulfil our legal obligations (in particular documentation obligations). Not providing your data would leave us unable to fulfil our legal obligations. This could lead to you being liable for compensation if we were to be sanctioned.

Activity as external data protection officer

Purpose

For our function as an external data protection officer for our customers, we need to process your data in line with the legal requirements in Articles 37 to 39 GDPR. 

Legal basis

The legal basis for processing your data is the fulfilment of the legal obligations of a data protection officer (point (c) of Article 6(1) GDPR) in accordance with Articles 38 and 39 GDPR, plus the fulfilment of contracts between us and our customers (point (b) of Article 6(1) GDPR). The legal basis for processing special categories of data is the public interest in safeguarding the fundamental right to data protection (point (g) of Article 9(2) in connection with point (c) of Article 6(1) GDPR).

Retention period

The data is stored for as long as is required to fulfil contractual obligations on both sides.
To comply with legal obligations (in particular Section 132 BAO, Sections 190 and 212 UGB), it is stored for a duration of seven (7) years from the end of the calendar year. In particular cases data may be stored for longer, such as for establishing and defending legal claims. In particular contracts and related data are stored for thirty (30) years, based on the general statute of limitations in accordance with Section 1489 ABGB. The data is restricted until the time when it is erased, so it cannot be further processed or accessed.

Exception for x-tention Germany:

Data is stored for ten (10) years from the end of the calendar year (see in particular Section 147 AO and Sections 238 and 257 HGB).

Exception for x-tention Switzerland:

Data is stored for ten (10) years from the end of the calendar year (see in particular Article 958f ZGB and Article 70(2) MWSTG).

Recipient

As well as transferring your data to possible data processors, we will forward it to authorities or courts if we are legally obliged to do so.

Requirement to provide data

You are legally required to provide your data (see legal basis above). If you do not provide your data, we cannot process your request.
 

Purpose

As is customary at any company event, photos and/or videos are taken by members of the x-tention group. Our aim is not to identify individual persons, but purely to document the event. For documentation purposes, the photos and/or videos are stored securely and published on the internet (on our homepage), in our company magazine or our newsletter. They are also archived. It may happen that we present the photos/videos at future x-tention group events (e.g. annual/anniversary events).

Legal basis

Processing (production, presentation and publication of photos/videos) is based on our justified interest in documenting x-tention group events and archiving them (article 6 paragraph 1 letter f GDPR, for Austria also § 12 DSG). This also includes our interest of informing the public, customers and other interested parties about company events and documenting our own company history with photo and video recordings for future generations.

Retention period

The photos/videos are stored as long as required for their purpose. Photo/video recordings are generally deleted immediately if they are not suitable for the above-mentioned purposes, if they would violate the legitimate interests of depicted persons or in case of an objection by affected persons.

Requirement to provide data

You are not obliged to have your photograph taken or be filmed. There are no downsides for you if you choose not to provide your data.
 

Objection

If you do not want to have your photo taken/be filmed, please inform the photographer at the event immediately. You can also contact us after photos/videos have been taken. For more information about your right to object, see below.

Purpose

At selected events we would like to offer people who cannot be present an opportunity to participate via live stream. Speakers are usually mentioned by name. It is also possible that persons may be depicted as visitors to a trade fair stand in the recorded area. An identification of these persons is not intended, but cannot be excluded.

The live streams will be offered via common channels such as YouTube and will usually be accessible to everyone. A further use of the recordings than the live broadcast is not planned.

Legal basis

Processing (recording and simultaneous transmission of videos) is based on our legitimate interest in making the event accessible to as many people as possible. Visitors to events are informed about live broadcasts on site and thus have the opportunity to avoid entering the camera's field of view. 

Retention period

Storage of recordings beyond the duration of a live broadcast is not planned. Recorded images and sound files are therefore deleted immediately after broadcasting.

Requirement to provide data

You are not obliged to consent to being filmed. There are no downsides for you if you choose not to provide your data.
 

Objection

There is no obligation to be filmed. If you do not wish to be filmed, we will offer possibilities to use our services without being filmed.

Management of requests to exercise data subject rights

Purpose

he purpose is to process your requests in connection with data subject rights as set out in the GDPR. We also store this data after having completed the requests as proof that we have fulfilled our statutory obligation to respond to your request adequately and in good time.

Legal basis 

The legal basis for processing your requests is Article 12 et seq. GDPR. As stated there, we must send you any communication in connection with your rights as a data subject. The storage of data after the request has been completed is based on our legitimate interest in accordance with point (f) of Article 6(1) GDPR, where our interest arises from the aforementioned purpose.

Retention period

Your data is stored for three (3) years after the request has been completed. This is in line with the general limitation period as laid out in Section 24(4) DSG and Section 195 German Civil Code (BGB). The data is restricted until the time when it is erased, so it cannot be further processed for other purposes.

Requirement to provide data

You are legally required to provide your data (see legal basis above). If you do not provide your data, we cannot process your requests.
 

Purpose

The purpose is to process applications related to rights of data subjects under GDPR. We store this data beyond the completion of an application to prove that we have fulfilled our legal obligation to process an application in a timely and appropriate manner.

Legal basis 

The legal basis for processing applications is article 12 ff GDPR. We must send you all communications related to your rights as a data subject. Storage beyond the processing of applications is based on our legitimate interest in accordance with article 6 paragraph 1 letter f GDPR, whereby this interest results from the above-mentioned purpose.

Retention period

Data will be stored for three years after completing the application. This is due to the general statute of limitations according to § 24 (4) öDSG and § 195 dBGB. Until the time of deletion, data will be restricted so that no further processing for other purposes takes place.

We use our appearances in social media to inform about us, job vacancies and our products or services and to get in contact with users. We receive statistical evaluations of usage data collected by respective social media in anonymised form to better adapt our offers to user interests.

Legal basis for communication is either the initiation or fulfilment of a contract (article 6 paragraph 1 letter b GDPR), if you contact us in this regard, or our legitimate interest (article 6 paragraph 1 letter f GDPR) in answering other inquiries.

Legal basis for processing in joined responsibility with respective social media is our legitimate interest (article 6 paragraph 1 letter f GDPR) in the above described processing of data for analysis and marketing purposes for continuous improvement of our social media presence.

Since the members of x-tention group have various appearances in social media (see a detailed list in section Appearances of the x-tention group in social media below), we consider current developments in data protection in social media and take them very seriously. We therefore inform you that, based on the current case law of the European Court of Justice, there is a joined responsibility as per article 26 GDPR between the operator of a media presence and respective provider of social media for processing your usage data. We have taken the necessary precautions for this joined responsibility, as this was made possible for us by respective provider. 

At this point, we would like to point out that the primary processing of your usage data in social media is done by respective social media provider and we receive this data - if at all - exclusively in anonymised form and therefore primary responsibility lies with the social media provider in accordance with GDPR. We also recommend you assert your rights directly with respective social media providers. Corresponding links to data protection information can be found in detail in the social media section below. You can also assert your rights of data subjects within the scope of our joined responsibility towards us. In this case we will immediately contact respective social media providers.

Personal data may be passed on within x-tention group or to external processors, but in no case to third parties.

With some social media, it may occur that usage data is processed outside the European Union. Regarding US providers certified under the Privacy-Shield, we would like to point out that they thereby comply with data protection standards of the European Union, in particular the GDPR. Transmission of data to the USA is permitted in accordance with article 45 GDPR as long as respective social media providers hold a Privacy-Shield certificate.

Your data, which we process during your social media contact, is processed up to the deletion of your account in respective social media, unless a longer storage is necessary due to the processing purpose, legal regulations or for the assertion or defense of rights. As soon as these reasons are any longer present, your data will be deleted.

We receive and process usage data exclusively in anonymous form. For more information about storage periods, please visit the data protection information of respective social media.

Requirement to provide data

If you are using a social media platform to contact us with regard to initiating a contract, you are required to provide your data for the purpose of concluding the contract. If you are using it for other reasons, you are not obliged to provide your data. If you do not provide your data when contacting us with regard to initiating a contract, we will not be able to continue processing your correspondence. There are no downsides for you if you choose not to provide your data when contacting us for other reasons.
 

Facebook

LinkedIn

Xing

Twitter

YouTube

The members of the x-tention group are represented in various social media with their own appearances:

x-tention Informationstechnologie GmbH (AT)

• Facebook: https://www.facebook.com/xtentionIT 
• LinkedIn: https://www.linkedin.com/company/19005518 
• XING: https://www.xing.com/companies/x-tentioninformationstechnologiegmbh 
• YouTube: https://www.youtube.com/user/xtentiongmbh 
• Twitter: https://twitter.com/itwithcare 

Soffico GmbH

• Facebook: https://www.facebook.com/sofficoGmbH/ 
• LinkedIn: https://www.linkedin.com/company/soffico-gmbh/
• XING: https://www.xing.com/companies/sofficogmbh 
• Twitter: https://twitter.com/soffico_gmbh
• YouTube: https://www.youtube.com/channel/UCt2-2ynI4idYkOPF-kx6GVw 

FAKTOR D consulting GmbH

• Facebook: https://www.facebook.com/FAKTORDconsulting 
• LinkedIn: https://www.linkedin.com/company/faktordconsulting
• YouTube: https://www.youtube.com/channel/UC6VPIcye_G-TI30-XC5yUdw
• XING: https://www.xing.com/companies/faktordconsulting 

In accordance with article 15 GDPR, you have the right to make a request for access to information and to be informed of all data relating to you processed within the company. In that case, information must be provided to you. You also have the right to obtain following information:

• The processing purposes
• The categories of personal data processed
• The recipients or categories of recipients to whom the personal data has been or will be disclosed, particularly recipients in third countries or international organisations
• If possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration
• The existence of a right of rectification or erasure of personal data or of a right of opposition to or limitation of the processing by the controller
• The existence of a right to appeal to a supervisory authority
• If the personal data is not collected from you, all available information about the data origin
• The existence of automated decision making, including profiling and meaningful information about the logic involved and the scope and intended impact of such processing on yourself
• Appropriate safeguards in accordance with article 46 GDPR when personal data is transferred to a third country or an international organisation

As per article 16 GDPR, you have the right to request the correction and/or completion of incorrect personal data without delay.

According to article 17 GDPR, you have the right to request that your personal data be deleted immediately. The responsible person is obliged to delete personal data immediately if one of the following reasons applies:

• Your personal data is no longer required for the purposes which it was collected for or otherwise processed.
• You revoke your consent on which the processing is based on under article 6(1)(a) or article 9(2)(a) GDPR and there is no other legal basis for the processing.
• You object to the processing in accordance with article 21(1) GDPR and there are no legitimate grounds for the processing. Or you object to the processing as per article 21(2) GDPR.
• Your personal data was processed unlawfully.
• The deletion of your personal data is necessary to comply with a legal obligation under Union or national law to which the controller is subject.
• Your personal data has been collected in relation to information society services offered in accordance with article 8(1) GDPR.

The right of deletion does not exist if the processing is necessary:

• to the exercise the right to freedom of expression and information
• to comply with a legal obligation requiring processing under Union or national law to which the controller is subject or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller
• on grounds of public interest in the field of public health as per article 9(2)(h) and (i) and article 9(3) GDPR
• for archiving, scientific or historical research purposes in the public interest or for statistical purposes in accordance with article 89 (1) GDPR, if above-mentioned law is likely to render impossible or seriously impede the processing objectives, or
• to assert, exercise or defend legal claims.

If the controller has made your personal data public and is obliged to delete it, they shall take reasonable measures, including technical measures, considering available technology and implementation costs, to inform data controllers who process the data that a subject has requested deletion of all links or copies or replications of their personal data.

According to article 18 GDPR, you have the right to request the restriction of processing if:

• you dispute the accuracy of personal data, for a period that would enable the controller to verify the data accuracy
• the processing is unlawful and you object to the deletion of the personal data and request instead the restriction of data usage
• the controller no longer needs your personal data for the processing purposes, but you need it to assert, exercise or defend legal claims, or
• you have lodged an objection to the processing in accordance with article 21 (1) GDPR, until it is established that the controller's legitimate reasons outweigh yours.

If the processing has been restricted, personal data may be processed, except storage, only with your consent or for pursuing, exercising or defending legal claims or protection of the rights of another natural or legal person or on grounds of an important public interest of the Union or a Member State. The lifting of an imposed restriction must be notified in advance.

If you have asserted the right to rectification, erasure or limitation of processing towards a controller, they are obliged to notify all recipients to whom your personal data has been disclosed of this rectification, erasure or limitation of processing. Unless this proves impossible or involves a disproportionate effort.

You have the right to receive the data, which you have provided to a controller, in a structured, common and machine-readable format. You have the right to have this data transferred to another controller, without interference from the controller whom your data has been transferred to, provided that

• the processing is based on a consent as per article 6(1)(a) or article 9(2)(a) GDPR or on a contract as per article 6(1)(b) GDPR, and
• the processing is done by automated procedures.

You can also request your data to be transferred directly from one responsible person to another, as far as this is technically feasible. It should be noted, that this right to data transfer must not affect the rights and freedoms of other persons.

According to article 21 GDPR, you have the right to object at any time to the processing of personal data carried out on basis of article 6(1)(f) GDPR for reasons arising from your particular situation. The right of objection may be exercised if the processing

• is necessary to safeguard the legitimate interests of the controller or of a third party where those interests or fundamental rights and freedoms, which require the protection of personal data, prevail (in particular child data), and
• the controller cannot demonstrate compelling legitimate reasons for processing that outweigh your interests, rights and freedoms or the processing does not serve to assert, exercise or defend legal claims.

The right of objection may also be exercised where the processing is carried out for direct marketing purposes.

Notwithstanding directive 2002/58/EC, you may exercise your right of objection through automated procedures involving technical specifications when using information society services.

You have the right to revoke your data protection declaration of consent at any time. Revocation of your consent does not affect the legality of processing that has taken place on basis of your consent until revocation.

If you are of the opinion that the processing of your personal data violates data protection law or your data protection rights have otherwise been violated in any way, please contact us. This will enable us to deal with your concerns. You also have the right to contact the data protection authority.