Data sharing and international transfers

As explained in this Privacy Policy, we use various service providers to help us provide our services and keep your data secure. When we use these service providers, it is necessary for us to share your personal data with them.

We have concluded agreements with all service providers to whom we pass on your data, which oblige them to protect your data.
If your personal data is transferred outside the EU, we will ensure that your personal data receives an equivalent level of protection, either because the country to which your data is transferred has an “adequate” standard of data protection according to the European Commission, or by applying another safeguard, such as an enhanced contractual arrangement, i.e. the Standard Contractual Clauses (SCCs) adopted by the European Commission.

For example, when we use US service providers, we rely on either the SCCs or the EU-US Data Privacy Framework, depending on the provider. You can request a copy of the SCCs we have entered into with our service providers by sending an e-mail to the e-mail address provided in this Privacy Policy.

Your rights

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller

1. The right to information (Art. 15 GDPR)
You have the right to request confirmation from us as to whether personal data concerning you is being processed. If this is the case, you have a right to information about this data and to the following information

• Processing purposes
• Categories of personal data
• Recipients or categories of recipients
• Planned storage period or the criteria for determining this period
• the existence of the rights to rectification, erasure, restriction or objection
• Right to lodge a complaint with the competent supervisory authority
• If applicable, origin of the data (if collected from a third party)
• If applicable, existence of automated decision-making including profiling with meaningful information about the logic involved, the scope and the expected effects
• If applicable, transfer of personal data to a third country or international organisation

2. Right to rectification (Art. 16 GDPR)
If your personal data is incorrect or incomplete, you have the right to request that the personal data be corrected or completed without undue delay.

3. Right to restriction of processing (Art. 18 GDPR)
If one of the following conditions is met, you have the right to request that the processing of your personal data be restricted:

• You contest the accuracy of your personal data, for a period enabling us to verify the accuracy of the personal data.
• In the case of unlawful processing, you oppose the erasure of the personal data and request the restriction of their use instead.
• We no longer need your personal data for the purposes of the processing, but you require your personal data for the establishment, exercise or defence of legal claims, or
• after you have lodged an objection to the processing, for the duration of the examination as to whether our legitimate reasons outweigh your reasons.

4. Right to erasure (“right to be forgotten”) (Art. 17 GDPR)
If one of the following reasons applies, you have the right to demand the immediate erasure of your personal data

• Your data is no longer necessary for the processing purposes for which it was originally collected.
• You withdraw your consent and there is no other legal basis for the processing.
• You object to the processing and there are no overriding legitimate grounds for the processing or you object pursuant to Art. 21 (2) GDPR.
• Your personal data is processed unlawfully.
• The deletion is necessary to fulfil a legal obligation under Union law or the law of the member state to which we are subject.
• The personal data was collected in relation to information society services offered in accordance with Article 8 (1) GDPR.

Please note that the above reasons do not apply if processing is necessary:

• For exercising the right of freedom of expression and information;
• For compliance with a legal obligation or for the performance of a task carried out in the public interest to which we are subject
• For reasons of public interest in the area of public health.
• For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
• For the establishment, exercise or defence of legal claims.

5. Right to data portability (Art. 20 GDPR)
You have the right to receive your personal data in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller.

6. Right to object to certain data processing (Art. 21 GDPR)
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR. This also applies to profiling based on these provisions.
If the personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

7. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data relating to you infringes the GDPR.
The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
A list of the competent supervisory authorities in Germany can be found on the website of the Federal Commissioner for Data Protection under the following link.