Pursuant to art. 15 GDPR in connection with § 34 German Federal Data Protection Act (BDSG) you have the right to receive information of our data stored by us as well as pursuant to § 35 BDSG the right of deletion/blocking unauthorized data, respectively the right of correction of false data.

Upon your request, we will inform you in writing which of your personal data we have stored. As far as possible, we will conduct appropriate measures to adapt or correct your data. Please direct all requests for information or objections to data processing per e-mail (including your complete address) to our Responsible Person for data protection. If your personal data is processed, you are a data subject and have the following rights:

1. Right to information

You can request a confirmation from our data protection officer contact if your personal data has been processed by us. In case of such data processing, you can further request the following:

• Purpose for the processing of personal data;
• Categories of personal data processed;
• Recipient/categories of recipients towards which your personal data has been disclosed/are disclosed;
• Planned duration of storage of such personal data or, in case specific information is not possible, criteria for the determination of the storage period;
• Existence of the right of correction/deletion of your personal data, right  of limiting the data processing, right of objecting the data processing;
• Existence of the right of complaint towards the authorities;
• All available information regarding origin of the data, when the personal data was not received from you;
• Existence of an automatic decision process including profiling pursuant to art. 22, para. 1 and 4 GDPR and – at least in this cases – information on the involved logic as well as extent and the envisaged impact of such processing for the respective person.

You have the right to request information, if your personal data has been transferred to a third-party-country or an international organization. In this context, you can require to be informed of the appropriate guarantees pursuant to art. 46 GDPR.

2. Right to correction

You have a right to correction and/or completion vis-à-vis the data controller, if the personal data processed and concerning you is inaccurate or incomplete. The controller shall carry out the rectification without undue delay.

3. Right to restrict processing

You may request the restriction of the processing of personal data relating to you under the following conditions:

• if you contest the accuracy of the personal data concerning you for a period of time which enables the controller to verify the accuracy of the personal data;
• if the processing is unlawful and you reject the deletion of the personal data and instead request the restriction of the use of personal data;
• if the data controller does no longer need the personal data for the purpose of processing, whereas you need the same for enforcing, exercising or defending of your legal remedies; or
• if you have filed an objection against the processing pursuant to art. 21, para. 1 GDPR and it has not yet been determined, whether the legitimate reasons of the data controller outweigh your reasons.

Where the processing of personal data relating to you has been restricted, those data may be processed, with the exception of their storage only with (i) your consent, (ii) for the establishment, exercise or defense of legal claims, (iii) for the protection of the rights of another natural or legal person or (iv) for reasons of substantial public interest of the Union or of a Member State.

If the restriction of processing has been limited in accordance with the above-mentioned conditions, you will be informed by the data controller before the restriction is lifted.

4. Right to deletion

a) Obligation to deletion

You may request the data controller to delete the personal data concerning you without undue delay, and the controller is obliged to delete this data immediately, if one of the following reasons applies:

• The personal data concerning you is no longer necessary for the purpose for which the data was collected and/or processed.
• You withdraw your consent, on which the processing pursuant to art. 6, para. 1 lit. a
  or art. 9, para. 2 lit. a GDPR was based, and there is no further legal basis for the processing
• You file an objection against the processing pursuant to art. 21, para. 1 GDPR and there are no legal reasons for the processing or you file an objection pursuant to art. 21, para. 2 GDPR.
• The personal data concerning you has not lawfully been processed.
• The deletion of the personal data concerning you is necessary in order to comply with a legal obligation pursuant to the EU right or the right of the member state, which is applicable for the data controller.
• The personal data concerning you has been collected with respect to offered services of the information cooperation pursuant to art. 8, para. 1 GDPR.

b) Information to third parties

If the controller has published the personal data concerning you and is obliged to delete the same pursuant to art. 17, para. 1 GDPR, he shall take appropriate measures, including available technology, in order to inform the other data controller that you, as the concerned person, have requested the deletion of all links to the personal data or copies of the personal data.

c) Exceptions

The right to deletion does not exist in cases where the processing is necessary:

• to exercise the right to freedom of speech and information;

• to fulfill a legal obligation, which requires the processing pursuant to the law of the EU or another member state applicable to the data controller, or which is in the public interest or is carried out in the exercise of official authority;
• due to reasons of the public interest concerning public health pursuant to art. 9, para. 2 lit. h and i as well as art. 9, para. 3 GDPR;
• for archiving, scientific, historical research or statistic purposes which are in the public interest pursuant to art. 89, para. 1 GDPR, to the extent the right defined under provision a)makes impossible the realization of these goals of processing or substantially affects the same, or
• for enforcing, exercising or defending legal remedies.

5. Right to be informed

Have you exercised the right to correction, deletion of restriction towards the data controller, the same is obliged to inform all recipients of these personal data of the correction, deletion or restriction of the personal data, unless this is not possible or only possible with unreasonable efforts. You have the right towards the data controller to be informed of all the respective recipients.

6. Right to data portability

You have the right, to receive the personal data concerning you, which you have provided to the data controller, in a typical and machine-readable format.
Furthermore, you have the right to forward these data to another data controller without being prevented to do so by the data controller, which has already received your data, unless

(a) the processing is based on a consent pursuant to art. 6, para. 1 lit. a GDPR or art. 9, para. 2 lit. a
GDPR or on a contract pursuant to art. 6, para. 1 lit. b GDPR and

(b) the processing is conducted with the help of automated processes.
In exercising this right, you also have the right to obtain that the personal data concerning you is transferred directly from one data controller to another, if this is technically possible.

The right to data portability shall not apply to processing of personal data, which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right of objection

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data, which is carried out on basis of art. 6 para. 1 lit. e or f GDPR; this also applies to profiling based on these provisions.

The controller does not further process the personal data relating to you, unless he is able to present mandatory reasons for the processing, which outweigh your interests and rights.

If personal data relating to you is processed, you have the right to object the processing at every time for such marketing purposes; this also applies to profiling to the extent it is connected to the direct marketing.

You have the option, in connection with the use of services of information companies, irrespective of the regulation 2002/58/EG, to exercise your right to object via automated processes which use technical specifications.

8. Right against automated processing in individual cases

You have the right, not to be a subject to a decision solely derived from an automated processing – including profiling – which has legal effects on you or affects you in a similar manner. This does not apply if the decision necessary for the conclusion or fulfillment of a contract between you and us is lawful as well as mandatory, based on legal requirements of the Union member states, and if these regulations contain measures to ensure your rights as well as your rightful interests. This does also not apply if you have given your express consent.

With respect to the afore-mentioned cases, the controller undertakes measures in order to preserve your rights and lawful interests, including at least the right of obtaining support of a person of our company to demonstrate the case and the right to challenge the decision.

9. Right to complain to the supervisory authority

Without prejudice to a right to complain to the supervisory authority, or other legal remedies you have the right to complain to the supervisory authority, in particular in the state of your residence, your workplace or the place of the presumed violation, if you are of the opinion the processing of your personal data is not in compliance with the GDPR.  You will find the name and the contact details of the respective supervisory authorities in the European Union under

http://ec.europa.eu/justice/data-protection/article-29/structure/data-protection-authorities/index_en.htm

The supervisory authority, which receives the complaint informs the complainant of the status and results of its complaint, including the options for legal remedies pursuant to art. 78 GDPR.

Responsible for our company is the following data protection authority:

Landesbeauftragte für Datenschutz und Informationsfreiheit
Nordrhein-Westfalen
Postfach 20 04 44
40102 Düsseldorf
Tel.: 0211/38424-0
Fax: 0211/38424-999
E-Mail: poststelle@ldi.nrw.de