Data Protection Policy

 

I. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection regulations of the Member States and other regulations relating to data protection is:

Europa-Park GmbH & Co. Mack KG,
Europa-Park GmbH & Co Hotelbetriebe KG,
Europa-Park GmbH & Co Shopping KG,
Europa-Park Freizeit- & Familienpark Mack KG and
Mack Media GmbH & CO. KG

Europa-Park-Str. 2
77977 Rust, Germany

tel.: +49 (0) 7822-770
e-mail: info@europapark.de
website: https://www.europapark.de

 

II. Name and address of the Data Protection Officer

The controller’s Data Protection Officer is:
Sina Krenz
tel.: +49 (0) 7822-770
e-mail: datenschutz@europapark.de
website: https://www.europapark.de

 

III. General information on data processing

1. Scope of the processing of personal data

We process the personal data of our users strictly to the extent necessary to provide a fully functioning website and to deliver our content and services. We process the personal data of our users only with the user’s consent. An exception to this rule applies in those cases where it is not possible to obtain prior consent for practical reasons and where statutory regulations permit the data to be processed.

2. Legal basis for the processing of personal data

Where we obtain the consent of data subjects for the processing of personal data, Art. 6 (1) a) GDPR provides the legal basis.
Art. 6 (1) b) GDPR provides the legal basis for the processing of personal data that is necessary to fulfil a contract to which the data subject is party. This also applies for processing that is necessary for measures implemented prior to entering into a contract.
Art. 6 (1) c) GDPR provides the legal basis where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject.
Art. 6 (1) d) GDPR provides the legal basis where processing of personal data is necessary in order to protect the vital interests of the data subject or of another natural person.
Art. 6 (1) f) GDPR provides the legal basis where processing is necessary to safeguard the legitimate interests of our company or a third party, and where such interests are not outweighed by the interests or fundamental rights and freedoms of the data subject.

3. Data deletion and data storage period

The personal data of the data subject shall be deleted or blocked where there is no longer any reason to store it.
Data may be stored beyond this period where stipulated by the European or national legislative authorities in Union regulations, laws or other provisions to which the controller is subject. Data shall also be blocked or deleted if a storage period dictated by the aforementioned standards expires, unless it is necessary to continue to store the data for the purpose of concluding or fulfilling a contract.

 

IV. Providing the website and creating log files

1. Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the requesting computer.
The following data is collected:

• Information about browser type and version used
• The user’s operating system
• The user’s Internet provider
• Date and time of access
• Websites from which the user’s system accesses our website
• Websites accessed by the user’s system from our website

This data is also stored in our system’s log files. It does not include the user’s IP addresses or other data that enables said data to be linked to a specific user. This data is not stored together with other personal data of the user.

2. Legal basis for data processing

Art. 6 (1) f) GDPR provides the legal basis for the temporary storage of the data.

3. Purpose of data processing

It is necessary for the system to store the IP address temporarily to enable the website to be displayed on the user’s computer. To this end, the user’s IP address is stored for the duration of the session.

These purposes also constitute our legitimate interest in data processing pursuant to Art. 6 (1) f) GDPR.

4. Storage period

The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. Where data is collected to enable provision of the website, this is the case when the particular session has ended.

5. Objection and deletion options

The collection of data to enable provision of the website and the storage of data in log files is essential for the website to function properly. Consequently, there is no option available for the user to object.

 

V. Use of cookies

a) Description and scope of data processing

Our website uses cookies. Cookies are text files that are stored on the Internet browser or stored by the Internet browser on the user’s computer system. When a user visits a website, a cookie can be stored on the user’s operating system. This cookie contains a characteristic string that enables the browser to be clearly identified the next time it accesses the website.

We use cookies to make our website more user-friendly. Some elements of our website require the requesting browser to remain identifiable even after accessing a different page..

To this end, the following data is stored in the cookies and transmitted:

• Language settings
• Items in a shopping basket
• Log-in information

On our website, we also use cookies that enable an analysis of the users’ surfing habits.

As a result, the following data can be transmitted:

• Search terms entered
• Frequency of website visits
• Use of website functions

Technical methods are used to pseudonymise the user data collected in this way. As a result, the data can no longer be linked to the user accessing the website. The data is not stored together with other personal data of the users.

When visiting our website, users are informed of the use of cookies for analytical purposes by way of an info banner and are advised of this Data Protection Policy. In this context, users are also advised how to prevent the storage of cookies by adjusting their browser settings accordingly.

When they visit our website, we inform the user that we use cookies for analytical purposes and obtain their consent for processing of the personal data used within this context. We also advise them of our Data Protection Policy in this connection.

b) Legal basis for data processing

Art. 6 (1) f) GDPR provides the legal basis for processing the personal data with the use of cookies.

c) Purpose of data processing

The purpose of using technically essential cookies is to make it easier for users to navigate websites. Some functions of our website are not available without the use of cookies. These functions require the browser to be recognised even after accessing a different page.

We need cookies for the following applications:

• Shopping basket
• Changing language settings
• Remembering search terms

The user data collected by technically essential cookies is not used to create user profiles.

Analysis cookies are used for the purpose of improving the quality of our website and its content. The analysis cookies show us how the website is used, enabling us to continue to optimise the content.

These purposes also constitute our legitimate interests in data processing pursuant to Art. 6 (1) f) GDPR.

d) Storage period, objection and deletion options

Cookies are stored on the user’s computer and transmitted by it to our website. As a user, you therefore have full control over the use of cookies. You can disable or restrict the transmission of cookies by adjusting the settings in your Internet browser accordingly. Cookies that have already been stored can be deleted at any time. This can be done automatically. If cookies are disabled for our website, not all functions of the website may be available to you to their full extent.

In the Cookie Settings, you can change your setting for cookies on our website. You can find an overview of all cookies used here.

 

VI. Newsletter

1. Description and scope of data processing

You have the option of subscribing to a free newsletter on our website. When registering for the newsletter, the details stated on the input screen are transmitted to us.

• Address details
• E-mail address
• Date of birth

The following data is also collected upon registration:

• IP address of the requesting computer
• Date and time of registration

During the registration process, we obtain your consent for processing of the data and we advise you of our Data Protection Policy.

Where you state your e-mail address when purchasing goods or services on our website, this address may be used by us for sending newsletters. In such cases, we shall only use the newsletter to advertise our own goods and services that are similar to those purchased.

No data processed for the purpose of sending newsletters shall be forwarded to third parties. The data is used solely for newsletter distribution.

2. Legal basis for data processing

Art. 6 (1) a) GDPR provides the legal basis for processing the data following registration for the newsletter by the user, where consent has been given by the user to do so.

Section 7 (3) UWG [German Law Against Unfair Competition] provides the legal basis for sending the newsletter as a result of purchasing goods or services.

3. Purpose of data processing

The user’s e-mail address is stored for the purpose of sending the newsletter.

The purpose of collecting other personal data during the registration process is to prevent misuse of the services or the e-mail address used.

4. Storage period

The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. The user’s e-mail address is therefore stored until such time as the newsletter subscription is cancelled.

Other personal data collected during the registration process is usually deleted after a period of seven days.

5. Objection and deletion options

The user may cancel his/her subscription to the newsletter at any time. Each newsletter contains a corresponding link for this purpose.
This link also provides an option for you to withdraw your consent to the storage of the personal data collected during the registration process.

 

VII. Registration

1. Description and scope of data processing

On our website, we offer users the option of registering by providing personal data. The data is entered on the input screen, transmitted to us and stored by us. The data is not forwarded to third parties. The following data is collected during the registration process:

• Address details
• E-mail address
• Date of birth

At the time of registration, the following data is also saved:

• The IP address of the user
• Date and time of registration

During the registration process, the user’s consent to the processing of this data is obtained.

2. Legal basis for data processing

Art. 6 (1) a) GDPR provides the legal basis for processing data, where consent has been given by the user to do so.

Additionally, Art. 6 (1) b) GDPR provides the legal basis for processing data where registration is required in order to fulfil a contract to which the user is party, or to implement measures prior to entering into a contract.

3. Purpose of data processing

The user is required to register in order to make use of certain content and services on our website.

• Request for information
• Credit balance retrieval
• Contact request

The user is required to register in order to fulfil a contract with the user or to implement measures prior to entering into a contract.

• Ordering goods and services
• Reservations of all types.

4. Storage period

The data is erased as soon as it is no longer required to achieve the purpose for which it was collected.

For data collected during the registration process, this is the case where registration on our website is cancelled or altered.

For data collected during the registration process for the purpose of fulfilling a contract or for implementing measures prior to entering into a contract, this is the case where the data is no longer required to execute the contract. It may be necessary to store the personal data of the contract partner even after the contract has been concluded in order to meet contractual or statutory obligations.

• Continuing obligations
• Warranty periods
• Retention periods for tax purposes

5. Objection and deletion options

As a user, you have the right to cancel registration at any time. You can change the data stored under your name at any time.

The data can be deleted at any time by logging in to the user profile or by sending an e-mail to datenschutz@europapark.de .

If the data is necessary for the purpose of fulfilling a contract or for implementing measures prior to entering into a contract, premature deletion of the data is only possible where there are no contractual or statutory obligations to retain such data.

 

VIII. Contact form and e-mail contact

1. Description and scope of data processing

A contact form, which can be used to contact us electronically, is available on our website. If the user makes use of this option, the data entered on the input screen will be transmitted to us and stored by us. This data includes:

• First name and last name
• Address details
• E-mail address
• Where provided, phone number

At the time the message is sent, the following data is also stored:

• The IP address of the user
• Date and time of registration

Before the contact form is transmitted, we obtain your consent for the processing of the data and we advise you of this Data Protection Policy.

Alternatively, you may contact us using the e-mail address provided. In such cases, the user’s personal data transmitted in the e-mail is stored.

The data is not forwarded to third parties in this connection. The data is used solely for processing the conversation.

2. Legal basis for data processing

Art. 6 (1) a) GDPR provides the legal basis for processing data, where consent has been given by the user to do so.

Art. 6 (1) f) GDPR provides the legal basis for processing the personal data that is transmitted in an e-mail. Additionally, Art. 6 (1) b) GDPR provides the legal basis for processing data where the purpose of the e-mail contact is to conclude a contract.

3. Purpose of data processing

We process the personal data entered on the input screen solely for the purpose of processing the request. If contact is made by e-mail, this also constitutes the legitimate interest required for processing of the data.
The purpose of the other personal data processed during the transmission of the contact form is to prevent misuse of the contact form and to ensure the safety of our information technology systems.

4. Storage period

The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. For the personal data entered on the input screen of the contact form and the personal data sent by e-mail, this is the case when the conversation with the user has ended. The conversation is deemed to have ended when the circumstances suggest that the issue has been conclusively resolved.

Additional personal data collected during the transmission of the contact form is usually deleted after a period of seven days.

5. Objection and deletion options

The user has the right at any time to withdraw his/her consent to processing of the personal data. If the user contacts us by e-mail, he/she may object to the storage of his/her personal data at any time. In such cases, the conversation cannot be continued.

The data can be deleted at any time by logging in to the user profile or by sending an e-mail to datenschutz@europapark.de.

In this case, all personal data stored when contacting us is deleted.

 

Web analysis
IX. Web analysis by Matomo (formerly PIWIK)

Scope of the processing of personal data

We use the open-source software tool Matomo (formerly PIWIK) on our website to analyse the surfing habits of our users. The software places a cookie on the user’s computer (see above for a description of cookies). If individual pages of our website are accessed, we store the following data:

• Two bytes of the IP address of the user’s requesting system
• The accessed website
• The website from which the user was referred to the accessed website (referrer)
• The sub-pages called up from the accessed website
• The amount of time spent browsing the website
• The frequency of visits to the website

The software runs exclusively on our website’s servers. The users’ personal data is stored there only. The data is not forwarded to third parties.
The software is configured in such a way that it prevents the full IP addresses from being stored; 2 bytes of the IP address are blanked out (e.g. 192.168.xxx.xxx). This means that the truncated IP address can no longer be linked to the requesting computer.
You can find more information on the privacy settings of the Matomo software at the following link: https://matomo.org/docs/privacy/.

 

X. Web analysis by Amazon Pixel

This website uses the web analysis services Amazon Conversion Pixel and Amazon Remarketing Pixel developed by Amazon.com, Inc., 410 Terry Ave. North Seattle, WA, USA.
When you visit this website, Amazon receives the information that you have accessed our website. For this purpose, Amazon downloads a so-called web beacon (invisible graphics), thereby setting a cookie on your computer. The data specified under the “Data processing on this website” section of this Policy is then transmitted to Amazon. The IP address communicated by your browser in this respect is not combined with other Amazon data.
Amazon uses the cookie placed on your computer to recognize you on other websites, in apps and within Amazon services, and to provide you with personalised advertising, where appropriate.
You can prevent cookies from being stored on your computer by adjusting your browser settings accordingly. We must point out, however, that in this case not all functions of this website, such as the shopping basket, may be available to you to their full extent. You can also prevent the collection of data generated by the cookie and related to your use of the website for Amazon, as well as processing of this data by Amazon, by clicking on this link and selecting the setting “Do not personalise ads from Amazon for this Internet browser”: https://www.amazon.com/adprefs. Alternatively, you can select the appropriate settings at http://www.youronlinechoices.com
This sets an opt-out cookie in your browser, which prevents your data from being collected by Amazon Pixel when you visit our website in future. This applies until such time as you delete the opt-out cookie.
You can find further information from Amazon on the collection of data at: https://www.amazon.com/b?ie=UTF8&node=5160028011.

We have no influence over the data collected, nor are we aware of the full scope of data collection. This data is transferred to the US and evaluated there.
Further information on the purpose and scope of data collection and processing and further information on your rights in this connection and the setting options to protect your privacy is set out in the above Data Protection Policy and is available from: Amazon EU S.à.r.l, Amazon Services Europe S.à.r. l. and Amazon Media EU S.à.r. l., all located at 5, Rue Plaetis, 2338 Luxembourg; e-mail: ad-feedback@amazon.de. Amazon.deGmbH, Marcel-Breuer-Str. 12, 80807 Munich is commissioned as the data processor.

 

XI. Web analysis by Google Analytics with anonymisation function

We use Google Analytics, a web analysis service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, hereinafter referred to as “Google”, on our website. Google Analytics uses so-called cookies; these are text files that are stored on your computer and enable an analysis of how you use the website.
The information collected by the cookies, for example the time, place and frequency of your website visits, including your IP address, is transmitted to a Google server in the US and stored there.
On our website, we use Google Analytics with the suffix "_gat._anonymizeIp". In this case, your IP address will be truncated by Google within the Member States of the European Union or in other countries that are party to the Agreement on the European Economic Area and thereby anonymised.
Google will use this information to evaluate how you use our website, to compile reports on website activities for us, and to provide further services connected with the use of the website and the Internet. Google will also forward this information to third parties if necessary, insofar as this is legally stipulated or insofar as third parties process this data on behalf of Google.
By their own account, Google will not link your IP address with other Google data under any circumstances. You can prevent the installation of cookies by adjusting your browser settings accordingly; in this case, however, we must point out that not all functions of this website may be available to you to their full extent.
Google also offers a deactivation add-on for the most common browsers, which gives you more control over what data is collected by Google on the websites visited by you. The add-on informs Google Analytics JavaScript (ga.js) that no information about the website visit should be sent to Google Analytics. However, the Google Analytics deactivation add-on for browsers does not prevent information from being transmitted to us or to any other web analysis services used by us. You can find further information on the installation of the browser add-on at this link.
Alternatively, the analysis of your website visits by Google Analytics can be disabled with future effect by clicking on the following link. Clicking on the link sets a so-called “opt-out cookie”; this prevents your website visits from being analysed on our website in the future:
Click here to disable Google Analytics cookies.
Please note that if you delete the cookies in your browser settings, the opt-out cookie might also be deleted and you may have to re-enable it.

 

XII. Web analysis by YouTube

This website contains at least one plug-in from YouTube, a company owned by Google Inc., based in San Bruno, California, USA. As soon as you visit any pages of our website that contain a YouTube plug-in, a connection is established to the YouTube servers. The YouTube server is informed of what specific page of our website you visited. Should you be logged in to your YouTube account at the same time, this would enable YouTube to establish a direct link between your personal profile and your surfing habits. You can prevent this link from being established by logging out of your account beforehand. Further information on the collection and use of your data by YouTube is available in YouTube’s Data Protection Policy at www.youtube.com.

 

XIII. Web analysis by Facebook Pixel

This website uses the “Custom Audiences” remarketing function of Facebook Inc. (“Facebook”). The purpose of this function is to display interest-related ads (“Facebook ads”) to visitors to this website when logged on to the social network Facebook. To this end, the Facebook remarketing tag has been implemented on this website. By way of this tag, a direct connection to the Facebook servers is established when the website is accessed. The information that you have visited this website is sent to the Facebook server and Facebook links this information to your personal Facebook user account. More information on the collection and use of data by Facebook, your rights with regard to the above and settings to protect your privacy can be found in Facebook’s Data Privacy Policy: https://www.facebook.com/about/privacy/. Alternatively, you may disable the “Custom Audiences” remarketing function at https://www.facebook.com/settings/?tab=ads#_=_. You will have to be logged in to Facebook to do so.

 

XIV. Web analysis by Hotjar

To improve user experience on our website, we use the Hotjar (http://www.hotjar.com, 3 Lyons Range, 20 Bisazza Street, Sliema SLM 1640, Malta, Europe) software. Hotjar makes it possible to record and evaluate user behaviour (mouse movements, clicks, scrolling, etc.). To this end, Hotjar sets cookies on the user’s end device, enabling it to store user data, e.g. browser information, operating system, time spent on the website, etc., in anonymised form. You can prevent your data from being processed by Hotjar by disabling cookies in your web browser settings and deleting cookies that are already enabled. You can find out more about data processing by Hotjar here: https://www.hotjar.com/privacy.
If you do not wish website analysis to be carried out by Hotjar, you can opt out from this on all websites that use Hotjar by setting a DoNotTrack header in your browser. You can find information about this on the following website: https://www.hotjar.com/opt-out.

 

XV. Web analysis by Optimizely

This website uses Optimizely, a web analysis service provided by Optimizely, Inc. (“Optimizely”). Optimizely uses so-called “cookies”, text files that are stored on your computer and enable an analysis of how you use the website. The information generated by the cookies about your use of this website is normally sent to an Optimizely server in the US and stored there.
If IP anonymisation is enabled on this website, your IP address will, however, first be truncated by Optimizely within the Member States of the European Union or in other countries that are party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to an Optimizely server in the US and truncated there. Optimizely will use this information to assess your use of the website and to compile reports on website activity on behalf of this website operator.
The IP address communicated by your browser as part of Optimizely will not be combined with other Optimizely data. You can prevent the installation of cookies by adjusting your browser settings accordingly; in this case, however, we must point out that not all functions of this website may be available to you to their full extent. You can also disable Optimizely tracking at any time (thus preventing data generated by the cookie relating to your use of the website – including your IP address – from being collected and processed by Optimizely) by following the instructions at http://www.optimizely.com/opt_out.

You can find more information on the terms and conditions of use and data protection at https://www.optimizely.com/terms/ and https://www.optimizely.com/privacy/.
Please note that we have enabled IP anonymisation on this website to ensure that IP addresses are collected anonymously.

 

XVI. Web analysis by Local Measure

1. Use of Local Measure

We also use the social media aggregation tool https://www.localmeasure.com on our website. This tool enables us to filter, curate and compile galleries of content that is publicly available on Facebook, Twitter and Instagram and to reproduce such content on our websites. If you do want your posts to be used in this manner, please send an e-mail objecting to such use to datenschutz@europapark.de.

2. Legal basis for the processing of personal data

Art. 6 (1) f) GDPR provides the legal basis for processing the personal data of users.

3. Purpose of data processing

Processing the users’ personal data enables us to analyse the surfing habits of our users. Evaluating the data obtained in this way enables us to compile information on how the individual elements of our website are used. This helps us to optimise our website and to make it more user-friendly. These purposes also constitute our legitimate interests in data processing pursuant to Art. 6 (1) f) GDPR. Anonymising the IP address ensures that the users’ interest in the protection of their personal data is adequately taken into account.

4. Storage period

The data is deleted as soon as it is no longer required for record-keeping purposes. If possible, this is restricted to 38 months in the tools used.

5. Objection and deletion options

Cookies are stored on the user’s computer and transmitted by it to our website. As a user, you therefore have full control over the use of cookies. You can disable or restrict the transmission of cookies by adjusting the settings in your Internet browser accordingly. Cookies that have already been stored can be deleted at any time. This can be done automatically. If cookies are disabled for our website, not all functions of the website may be available to you to their full extent.

On our website, we offer our users the possibility of opting out of the analysis procedure. Please follow the appropriate link to do so. This sets another cookie on your system, which indicates to our system that the user’s data is not to be stored. If the user deletes the relevant cookie from his/her own system in the meantime, the opt-out cookie will have to be reset.

 

XVII. Using Webfonts

A JavaScript code is loaded on our website. If you have activated JavaScript in your browser and have not installed a JavaScript blocker, your browser will transmit your personal data where applicable. We are not aware of what data is linked to the received data and for what purposes this data is used. In order to fully prevent the execution of JavaScript code, you can install a JavaScript blocker (e.g. www.noscript.net).

We use the following web fonts on our website: Google Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043 USA (you can find more information in the privacy statement of Google).

 

XVIII. Rights of the data subject

If personal data relating to you is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

1. Right to information

You have the right to obtain from the controller confirmation as to whether or not personal data relating to you is being processed by us.

"

If such data is processed, you may request information about the following details from the controller:

"

• the purposes for which the personal data is processed;
• the categories of personal data processed;
• the recipient or categories of recipients to whom the personal data relating to you has been or will be disclosed;
• the envisaged period for which the personal data relating to you will be stored or, where specific details are not available, the criteria for determining the storage period;
• the existence of a right to rectification or erasure of the personal data relating to you, a right to restriction of processing by the controller or a right of objection to such processing;
• the existence of a right to lodge a complaint with a supervisory authority;
• where the personal data is not collected from the data subject, all available information as to its source;
• the existence of an automated decision-making process, including profiling, pursuant to Art. 22 (1) and (4) GDPR, and - at least in these cases - detailed information on the logic involved, and the consequences and envisaged effects of such processing for the data subject.

You have the right to request information on whether the personal data relating to you is transmitted to a third country or to an international organisation. In this context, you may request information on the appropriate safeguards pursuant to Art. 46 GDPR in connection with such transmission.

In this respect, this right to information may be restricted where it is likely to render impossible or seriously compromise the achievement of the objectives of research and statistics and where such restriction is necessary to be able to achieve said objectives.

2. Right to rectification

You have the right to have the controller rectify and/or complete the data, provided that the processed personal data relating to you is incorrect or incomplete. The controller shall rectify the data without delay.

In this respect, your right to rectification may be restricted where it is likely to render impossible or seriously compromise the achievement of the objectives of research and statistics and where such restriction is necessary to be able to achieve said objectives.

3. Right to restriction of processing

Under the following conditions, you may request that the processing of the personal data relating to you be restricted:

• if you contest the accuracy of the personal data relating to you for a period that enables the controller to verify the accuracy of said personal data;
• where processing is unlawful and you refuse to have the personal data erased and request the restriction of its use instead;
• where the controller no longer requires the personal data for the purposes of processing, but you require this data for the establishment, exercise or defence of legal claims, or
• where you have objected to processing pursuant to Art. 21 (1) GDPR and it has not yet been determined if the legitimate reasons of the controller override your own legitimate reasons.

Where processing of the personal data relating to you has been restricted, such data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

Where processing has been restricted under any of the aforementioned conditions, you shall be informed by the controller before the restriction on processing is lifted.

In this respect, your right to restriction of processing may be restricted where it is likely to render impossible or seriously compromise the achievement of the objectives of research and statistics and where such restriction is necessary to be able to achieve said objectives.

4. Right to erasure

a) Erasure obligation

You may request that the controller erase the personal data relating to you without undue delay and the controller shall be obligated to erase said personal data without undue delay where one of the following reasons applies:

• The personal data relating to you is no longer required for the purposes for which it was collected or otherwise processed.
• You withdraw your consent on which the processing pursuant to Art. 6 (1) a) or Art. 9 (2) a) GDPR was based, and where there is no other legal basis for the processing.
• You object to processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate reasons for said processing, or you object to processing pursuant to Article 21 (2) GDPR.
• The personal data relating to you has been processed unlawfully.
• It is necessary to delete the personal data relating to you for compliance with a legal obligation under the Union or Member State law to which the controller is subject.
• The personal data relating to you was collected in relation to the offer of information society services referred to in Article 8 (1) GDPR.

b) Information for third parties

Where the controller has made the personal data relating to you public and is obliged pursuant to Art. 17 (1) GDPR to delete said data, the controller, taking account of available technology and the cost of implementation, shall adopt appropriate measures, including technical measures, to inform controllers who are processing the personal data that you as the data subject have requested that said controllers delete any and all links to, or copies or replications of, this personal data.

c) Exceptions

There shall be no right to erasure where processing is necessary

• for exercising the right to freedom of expression and information;
• for compliance with a legal obligation, which requires processing under the Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• for reasons of public interest in the area of public health pursuant to Art. 9 (2) h) and i), and Art. 9 (3) GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89 (1) GDPR, insofar as the right referred to in a) above is likely to render impossible or seriously compromise the achievement of the objectives of this processing; or
• for the establishment, exercise or defence of legal claims.

5. Right to notification

Where you have exercised your right to rectification, erasure or restriction of processing vis-à-vis the controller, the latter shall be obligated to notify each recipient to whom the personal data relating to you has been disclosed of any such rectification, erasure or restriction of processing, unless this proves impossible or involves a disproportionate amount of effort.

You have the right to request that the controller inform you of these recipients.

6. Right to data portability

You have the right to receive the personal data relating to you and provided to the controller by you in a structured, commonly used and machine-readable format. You also have the right to transmit said data to another controller without being hindered from doing so by the controller to whom the personal data was provided, where

• the processing is based on consent pursuant to Art. 6 (1) a) GDPR or Art. 9 (2) a) GDPR or on a contract pursuant to Art. 6 (1) b GDPR, and
• the processing is carried out by automated means.

In exercising this right, you also have the right to have the personal data relating to you transmitted directly from one controller to another, where technically feasible. Freedoms and rights of other persons must not be comprised hereby.

The right to data portability shall not apply for the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right of objection

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data relating to you that is performed on the basis of Art. 6 (1) e) or f) GDPR; this shall also apply for any profiling based on these provisions.

The controller shall no longer process the personal data relating to you, unless it can demonstrate compelling legitimate reasons for the processing which overrides your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims.

Where the personal data relating to you is processed for direct marketing purposes, you have the right to object at any time to the processing of the personal data relating to you for said marketing purposes; this shall also apply for profiling to the extent that this is related to said direct marketing.

Where you object to the processing of data for direct marketing purposes, the personal data relating to you shall no longer be processed for such purposes.

In the context of the use of information society services, notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

Where personal data relating to you is processed for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 (1) GDPR, you also have the right, on grounds relating to your particular situation, to object to such processing.

In this respect, your right to objection may be restricted where it is likely to render impossible or seriously compromise the achievement of the objectives of research and statistics and where such restriction is necessary to be able to achieve said objectives.

8. Right to withdrawal of the declaration of consent under data protection law

You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of any processing for which consent was given and which was carried out prior to the withdrawal thereof.

9. Automated individual decision-making process (including profiling)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects on you or significantly affects you in a similar manner. This shall not apply where the decision

(1) is necessary for the purpose of concluding or performing a contract between you and the controller,
(2) is permissible under the Union or Member State law to which the controller is subject, and these statutory regulations stipulate suitable measures for safeguarding your rights and freedoms and your legitimate interests, or
(3) is made with your explicit consent.

However, these decisions may not be based on specific categories of personal data pursuant to Art. 9 (1) GDPR, unless Art. 9 (2) a) or g) applies and suitable measures for safeguarding your rights and freedoms and your legitimate interests are in place.

With regard to the cases mentioned in (1) and (3) above, the controller shall adopt appropriate measures to safeguard your rights and freedoms and your legitimate interests; such measures should at least include the right to obtain human intervention on the part of the controller, to express your own point of view and to contest the decision.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual place of residence, place of work or place of the alleged infringement, where it your opinion that the processing of the personal data relating to you is in breach of GDPR regulations.

The supervisory authority with which the complaint was lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of judicial remedy pursuant to Article 78 GDPR.