Data Privacy Statement

On the following pages you will find information on the types of personal data processed by us, as well as on the purpose, the basis and the duration of such data processing.

Overview / Contents

In this Data Privacy Statement you can find the following information:

A. Our contact data and general information on our data processing activity

A.1 Name and contact data of the data controller

A.2 Contact data of the data protection officer

A.3 General information on the legal bases of processing personal data

A.4 General remarks to data erasure and storage duration

A.5 Sources of personal data

A.6 Recipients and categories of recipients of personal data

A.7 Contacting by e-mail, fax or phone call

B. Scope of processing personal data through our website

B.1 Provision of the website and creation of log files

B.2 Use of cookies by us or by third-party providers

B.3 Data processing when using a contact form

B.4 Use of the web analytics application Matomo (formerly PIWIK)

B.5 Use of the web mapping service Google Maps

B.6 Encryption of the website and the communication

B.7 Transfer of personal data to a third country (non-EU country)

C. The rights of you as data subject

C.1 Right to access

C.2 Right to rectification

C.3 Right to erasure

C.4 Right to restriction of processing

C.5 Right to be informed

C.6 Right to data portability

C.7 Right to object in the case of data processing for a legitimate interest and/or for direct marketing

C.8 Right to withdraw a consent given before

C.9 Automated decision-making, including profiling

C.10 Voluntariness of data provision

C.11 Right to lodge a complaint with a supervisory authority

A. Our contact data and general information on our data processing activity

A.1 Name and contact data of the data controller

Data controller for the collection and use of personal data in the sense of data protection law:

Dieter A. Roth GmbH

Boschstr. 1-3

75210 Keltern

VAT-No: DE 262139218

Registration Court: Amtsgericht Mannheim (District Court Mannheim)

Registration number: HRB 705215

represented by the managers Dieter A. Roth and Ralf Roth

Email: info@roth-kompensatoren.de

Website: https://roth-kompensatoren.de

A.2 Contact data of the data protection officer

We are not obliged by law to appoint a company data protection officer. Neither have we appointed one voluntarily. You can turn to us with any question concerning data protection via the above-named contact options.

A.3 General information on the legal bases of processing personal data

In the most general sense, the following applies to the processing of personal data by us:

· If we obtain your consent to the processing operations of personal data, point (a) of Article 6(1) of the General Data Protection Regulation (EU) (hereinafter: “GDPR”) serves as legal basis for the processing of personal data.

· With regard to the processing of personal data that are necessary for the performance of a contract, point (b) of Article 6(1) of the GDPR serves as legal basis. This also applies if the processing is necessary for taking steps prior to entering into a contract, e.g. in the cases of orders, offers and/or contract negotiations.

· If the processing of personal data is necessary for compliance with a legal obligation to which we are subject, point (c) of Article 6(1) of the GDPR serves as legal basis.

· In the event that the vital interests of yours or of another natural person require the processing of personal data, point (d) of Article 6(1) of the GDPR serves as legal basis.

· If the processing of your personal data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us, this is done according to the legal basis provided in point (e) of Article 6(1) of the GDPR.

· If the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, and your interests, fundamental rights and freedoms do not override such interests, point (f) of Article 6(1) of the GDPR serves as legal basis for the processing.

A.4 General remarks to data erasure and storage duration

In general, we erase or block personal data as soon as the purpose of storage ceases to apply. Storage may be continued even after that if it has been provided for by the European or national legislators in Union regulations, national laws and other legal rules to which we are subject as controller. The blocking or erasure of data is also carried out when a storage period required by the said legal norms expires, unless the necessity for further storage exists in order to enter into or perform a contract.

More specifically, this means that:

If we process the personal data on the base of a consent to the processing (point (a) of Article 6(1) of the General Data Protection Regulation, GDPR in short), the processing ends when you withdraw your consent unless another legal basis exists for the data processing. This is the case e.g. if at the time of withdrawal we are still entitled to process your data for the purposes of performance of a contract (see also the text below regarding this).

If we process the data on grounds of our legitimate interests (point (f) of Article 6(1) of the GDPR) in the framework of an assessment carried out previously, we store these data until the legitimate interest does not exist anymore, the assessment leads to another result or you have raised an effective objection according to Article 21 of the GDPR (see also the highlighted “Reference to the special right to object” in Chapter C below).

If we process the data for the purpose of performance of a contract, we store the data as long as the contract has been finally performed and executed and no claim can be asserted from the contract anymore, i.e. until the moment when the limitation takes effect. The general limitation period for claims is three (3) years according to Section 195 of the German Civil Code (“BGB”). However, certain claims such as claims for damages only lapse after 30 years (see Section 197 BGB). If there are reasonable grounds to assume that this is relevant to the individual case, we store the personal data over this time period. The said limitation periods start at the end (i.e. on 31 December) of the year in which the claim comes into being and the creditor learns of the conditions that justify the claim and the person of the debtor, or should have learned thereof without gross negligence.

Please be advised that in addition to it we are also subject to retention obligations on grounds of the rules of commercial law, taxation and accounting. Such rules oblige us to retain certain data, to which personal data may also belong, as proof of our lawful business activity and/or book-keeping for a time period between six (6) and ten (10) years. These retention periods override the above-mentioned obligations to erase. The retention periods also start with the end of the year concerned, i.e. on 31 December.

A.5 General information on the sources of personal data

The personal data processed by us come first of all from the data subjects themselves, e.g. while they

· as users of our website convey us or our webserver information such as the IP address via the web browser and their terminal device (such as a PC, a smartphone, a tablet computer or a laptop),

· as interested parties request information materials or an offer from us,

· as customers place an order and/or conclude a contract with us,

· as media representatives request information materials, press releases, opinions or the like,

· as suppliers supply us with goods as agreed upon and/or as business partners render us services.

Personal data processed by us may only originate exceptionally from third parties, for example, if somebody acts in the name of a third party.

A.6 Categories of recipients of personal data

Your personal data will only be transferred or conveyed to a third party if this is absolutely necessary for the given purpose and permissible as well. We always give the person to whom we transfer the data and the purpose of the data transfer in the context of the data processing operations described hereunder or, in the event of data transmissions to non-EU countries, additionally at the end of Chapter B of this Data Privacy Statement.

The categories of recipients can basically be as follows:

· service providers,

· suppliers,

· business partners,

· tax advisors.

A.7 Contacting us by e-mail or phone call

You can turn to us via different means of contact if you wish, for example by e-mail or telephone. Also when you write us an e-mail message or you call us by phone, we process your personal data necessarily, because we or rather our systems will at least save the personal data that you have given in your e-mail message or phone call.

No data transfer to a third party takes place in this context. The data will be used exclusively for the purpose of processing the conversation.

Purposes of the processing: The processing of personal data obtained when you contact us by e-mail or phone serves us exclusively for the processing of your request. In doing so, we require at least your e-mail address or your telephone number in order to be able to give an answer at all.

Legal basis for the data processing: If you have given us your consent according to point (a) of Article 6(1) of the GDPR during active contacting, it serves as legal basis for the processing of data.

If the contacting or your request aims at entering into a contract, point (b) of Article 6(1) of the GDPR is the legal basis for the data processing (taking steps prior to entering into a contract).

Duration of storage: The data will be erased as soon as they become unnecessary to achieve the purpose of their collection.

For personal data that have been sent by e-mail, this is the case when the actual conversation with you was finished and then a waiting period of maximum 6 months has elapsed so that we can have recourse to your request or the details of the communication once again as the circumstances may require during this period. The conversation is finished when it follows from the circumstances that the given issue has been resolved conclusively.

In the event of an incoming telephone call or an outgoing call at our company, your telephone number or the name/company name registered by your telephone company, as well as the date and time of the call are saved in our telephone system in a so-called circular buffer that overwrites the oldest data with the new data. This generally leads to the automatic erasure of the data in the telephone system after about 3-4 months.

Communication may be subject to retention obligation on grounds of the rules of commercial law or tax law that take priority (see the above remarks to “Data erasure and storage duration”).

Opportunity for objection and removal: You have the opportunity at any time to withdraw a consent given by you to the processing of personal data or to object to the further processing of any personal data on grounds of legitimate interests (see also the reference to the special right to object in Chapter C of this Data Privacy Statement). In such a case, the conversation cannot be continued.

The withdrawal of consent or the object to further data processing is possible by means of informal communication (e.g. by an e-mail message) sent to us.

I this case, all personal data that has been saved in the course of contacting will be erased.

B. Scope of processing personal data through our website

Basically, we only collect and use personal data of users in the framework of the use of our website to the extent to which this is necessary and/or reasonable for the provision of an operational website as well as of our contents and services. As a general rule, the collection and use of personal data of our users is only carried out with the consent of the user. An exception applies to cases where a prior consent cannot be obtained due to practical reasons and/or the processing of data is allowed by legal regulations.

B.1 Provision of the website and creation of log files

Whenever the website is called, our webserver automatically records data and information for technical reasons. They are saved in the log files of the server. These data are as follows:

· date and time of the access,

· URL (address) of the referring website (HTTP referer),

· websites that are called by the user’s system through our website,

· screen resolution of the user,

· file(s) retrieved and report on the success of retrieval,

· amount of transmitted data,

· the user’s internet service provider,

· browser, browser type and browser version, browser engine and engine version,

· operating system, operating system version, operating system type, as well as

· the user’s anonymised IP address and internet service provider,

· country of origin of the IP address.

The data are collected via our hosting provider and are processed completely separate from other data. These data are not processed together with other personal data of the user. It is not possible for us to associate these data with a given person. The data are processed exclusively in a depersonalised form.

Purposes of the data processing: The temporary data processing by the system is necessary in order that the contents of our website can be delivered to the computer of the user. For this purpose, the user’s IP address must be stored for the duration of the session.

Storage takes place in log files to ensure the viability of the website. Furthermore, the data help us to optimise our offer and the website and to ensure the security of our information technology system, as well as to prevent fraud. There is no data analysis for marketing purposes in this context.

Legal basis of the data processing: The temporary storage of the data and log files is carried out on grounds of the legal basis provided in point (f) of Article 6(1) of the GDPR. Our predominant legitimate interest in this data processing resides in the aforementioned purposes.

Duration of storage: The data will be erased as soon as they become unnecessary to achieve the purpose of their collection. In the event of data recording for the provision of the website, this is true when the actual session has been finished. In the case of storing the data in log files, this is generally true after seven days. Storage beyond this time is possible. In this case, the user’s IP addresses will be erased or distorted so that they cannot be associated with the calling client anymore.

Opportunity for objection and removal: The recording of data for the provision of the website and the storage of data in log files are absolutely necessary for the operation of the webpage. Accordingly, the user has no opportunity for objection here. However, the user can finish the use of the website at any time and prevent the further collection of the said data thereby.

B.2 Use of cookies by us or by third-party providers

When individual sites are called, we or rather the hosting provider of our website may employ so-called cookies. These are small text files that are stored on your terminal device (PC, smartphone, tablet computer etc.). When you call a website, a cookie may be saved by your browser. This cookie contains a specific character sequence that enables the clear identification of the browser when the website is called again.

In addition, it is possible that third-party suppliers also employ cookies. These cookies could also enable the analysis of the users’ surfing behaviour in some circumstances. If this is the case, we inform you about it separately in this Data Privacy Statement, directly at the information on the actual third-party supplier tools (such as analysis tools, plugins or the like) further on in this Data Privacy Statement. Should such third-party supplier tools be used indeed, you will be informed about this use of cookies when you visit our website and your consent will be requested for the processing of personal data used in this context.

In addition, we employ cookies as technically essential cookies that are necessary to make our website usable or to design it more user-friendly. Some elements of our webpage require it for instance that the calling browser can be identified even after a page break.

Purpose of the data processing: The purpose of the use of technically essential cookies is to make the use of websites simpler for the users. Some functions of our webpage cannot be offered without the use of cookies. They require that the browser can be recognised even after a page break. The user data collected by technically essential cookies will not be used for creating user profiles.

The use of analysis and/or tracking cookies takes place in order to improve the quality of our website and its contents. By means of the analysis cookies we gain knowledge of the way our website is used and can continuously optimise our offer.

Legal basis for the data processing: The legal basis for the processing of personal data using technically essential cookies is point (f) of Article 6(1) of the GDPR, i.e. a legitimate interest on our part. Our legitimate interest resides in the above-mentioned purposes.

The legal basis for the processing of personal data using cookies for analysis and/or tracking purposes is point (a) of Article 6(1) of the GDPR if we request the explicit consent of you as user for such a cookie and you give the consent, i.e. your appropriate informed consent.

Duration of storage: The technically essential cookies used by us will be erased again at the end of your browser session, i.e. when you close your browser (so-called session cookies).

Should analysis and/or tracking cookies be employed (which will be explicitly pointed out), they remain on your terminal device and enable us or our service provider (third-party supplier) to recognise your browser the next time you visit the site (permanent cookies).

In addition, we store the data collected on grounds of a legitimate interest until the legitimate interest does not exist anymore, the assessment leads to another result or you raise an effective object according to Article 21 of the GDPR (see also the highlighted “Reference to the special right to object” in Chapter C below). It is revised regularly, at least once a year, whether the legitimate interest still exists. Our interest does not exist anymore especially if the data have no sufficient relevance for us in respect of the evaluation and statistics of the use of the website due to the lapse of time, which is to be assumed after three years at latest.

Opportunity for objection and removal: Cookies are stored on your computer and are transmitted from there to our site. This means that you have full control over the use of cookies. By changing the settings of your internet browser you are able to deactivate or restrict the transmission of cookies. The cookies that have already been saved can be erased at any time. This may also be done by an automatic process. We consider such “Do Not Track” setting of your browser as an object to the further processing and use of your personal data. Note: If our cookies have been deactivated, it may be possible that not every function of the website can be used to their full extent anymore.

B.3 Data processing when using a contact form

On our website, you can find at least one contact form that can be used for contacting us by electronic means in various areas and themes. When you take advantage of this opportunity, the data entered by you in the input mask will be transmitted to us and saved. The subsequent data processing basically concerns the actual issue that is linked to the contact form and/or your specific request to us.

You can learn the queried information in detail from the web form. The mandatory fields are distinctly marked thereby. We need the data that we request as mandatory fields essentially to be able to process your request / your matter. You may also transmit other data to us, but you do not have to.

At the time of sending your message, the following data will also be saved:

· your IP address,

· date and time when the request is sent.

For the processing of the data, you will be informed on the data processing once again in the framework of the sending process, with reference to this Data Privacy Statement.

Purposes of the data processing: The processing of the personal data received from the input mask of the contact form helps us to process the contact request and to process your issue. In the case of a contact request, a legitimate interest also exists for the processing of the data.

The other personal data processed during the sending process serve to prevent an abuse of the contact form and to ensure the security of our information technology systems.

Legal basis for the data processing: The legal basis for the data processing is our legitimate interest in the data processing provided in point (f) of Article 6(1) of the GDPR. Our legitimate interest resides in the fact that we have to process your data in order to be able to process your enquiry and/or contact request in general and to answer it as the case may be.

If your contact request and/or your enquiry is aimed at entering into a contract or the enquiry concerns a specific contract that has already been concluded between us, the (additional) legal basis for processing exists according to point (b) of Article 6(1) of the GDPR (taking steps prior to/after entering into a contract).

The legal basis for the processing of other personal data obtained during the sending process is our legitimate interest in the processing of data according to point (f) of Article 6(1) of the GDPR, which interest is here to prevent an abuse of the contact form and to ensure the security of our information technology systems.

Duration of storage: The data will be erased as soon as they become unnecessary to achieve the purpose of their collection.

For personal data deriving from the input mask of the contact form this is the case when the actual conversation has been finished with you. The conservation is to be regarded as finished when it can be seen from the circumstances that the given issue has been clarified conclusively.

As the case may be, the communication may be subject to a retention obligation on grounds of the rules of commercial law or taxation, which obligation takes priority (see also the “Remarks to data erasure and storage duration” above).

The personal data collected additionally during the sending process will be erased after seven days at the latest.

Opportunity for objection and removal: You can prevent the specific data processing when you take up contact with us in another way, which is possible for example by phone or by e-mail.

You have the opportunity at any time to object to the further data processing on grounds of a legitimate interest (see also the reference to the special right to object in Chapter C of this Data Privacy Statement). In such a case, the conversation cannot be continued.

The objection to the further data processing is possible by means of informal communication (e.g. by an e-mail message) sent to us.

In this case, all personal data that has been saved in the course of contacting will be erased.

B.4 Use of the web analytics application Matomo (formerly PIWIK)

General information on Matomo: On this website, data are collected and stored for marketing and optimisation purposes by means of Matomo (Piwik), an open source web analytics tool supplied by the company InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand (https://matomo.org). Using these data, it is possible to create usage profiles under a pseudonym. For this purpose, cookies may be employed. Cookies are small text files that are saved in the buffer of the web browser of the website visitor. Cookies make it possible to recognise the web browser. Without the explicit consent given by the data subject, the data collected by means of Matomo (Piwik) will not be used for the identification of the visitors of this website and will not be associated with the personal data concerning the holder of the pseudonym.

Please be advised that we process all data pertaining to Matomo exclusively on our own webserver, and these data are not revealed to any third party. Thus we are convinced that no consent is required here and we can base this data processing on a legitimate interest, since the involvement of a third party is excluded here. Accordingly, this means that so-called first party cookies are only employed and evaluated by us.

Purpose of the processing: The use of analytics tool or analytics cookies takes place for the purpose of improving the quality of our website and its contents. This enables us to learn how the website is utilised and to continuously optimise our offer.

Legal basis for the data processing: The legal basis for the processing of personal data is point (f) of Article 6(1) of the GDPR, i.e. a legitimate interest on our part. Our legitimate interest resides in the above-mentioned purposes. Our assessment has shown that we pursue legitimate objectives by analysing the user behaviour in order to improve and optimise our websites and nowadays the reasonable expectations of website visitors point at the analysis of user behaviour as well. We also assume that the information given here directs the expectations of the visitors of our website to the execution of an analysis.

Duration of storage: Cookies are stored on the user’s computer and are transmitted from there to our site. The IP address will be anonymised immediately after the processing and before it is saved. This means that you as user have full control over the use of cookies. By changing the settings of your internet browser, you will be able to deactivate or restrict the transmission of cookies. The cookies that have already been saved can be erased at any time. This may also be done by an automatic process. We consider such “Do Not Track” setting of your browser as an object to the further processing and use of your personal data. Note: If the cookies are deactivated for our website, it may be possible that not every function of the website can be used to their full extent anymore.

In addition, we store the data collected on grounds of a legitimate interest until the legitimate interest does not exist anymore, the assessment leads to another result or you raise an effective object ac-cording to Article 21 of the GDPR (see also the references to the special right to object in Section C.4 below). It is revised regularly, at least once a year, whether the legitimate interest still exists. Our interest does not exist anymore especially if the data have no sufficient relevance for us in respect of the evaluation and statistics of the use of the website due to the lapse of time, which is to be assumed after three years at latest, and then the data are erased irrevocably.

Opportunity for objection and removal: By changing the settings of your internet browser, you can prevent the storage of cookies. Please be advised that in this case it may be possible that not every function of this website can be used to their full extent anymore. In addition, you can also prevent the recording of the data produced by cookies and concerning your use of the website (including your IP address), as well as the processing of the data by us, by selecting the option Opt Out:

B.5 Use of the web mapping service Google Maps

This website uses Google Maps, a mapping service supplied by the company Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA („Google“), for the presentation of an interactive map. By the use of Google Maps, information on the use of this website (including your IP address) can be transmitted to a server of Google in the USA and stored there.

Google will possibly transmit the information gained via maps to third parties, provided this is prescribed by law or to the extent these data are processed by a third party on behalf of Google. Google will link your IP address to other data of Google under no circumstances. Nevertheless, it would be technically possible that Google can perform the identification of individual users at least on grounds of the received data. It is possible that personal data and personality profiles of the users of the Google website can be processed for other purposes, upon which we do not and cannot have any influence.

Purpose of the data processing: The use of Google Maps serves the purpose to improve our website and its contents and to provide you with a simple, useful and familiar mapping service for your guidance, for displaying our company headquarters, for planning your journey there etc.

Legal basis of the data processing: The legal basis of the processing of personal data by using Google Maps is provided in point (f) of Article 6(1) of the GDPR, i.e. a legitimate interest on our part. Our legitimate interest resides in the above-mentioned purposes. The company Google entered into the „EU-U.S.-Privacy Shield“, and so the data transmission to the USA is permitted.

Duration of storage: You as user can decide on the execution of the JavaScript code necessary for the tool via your browser settings. By changing the settings in your web browser, you can deactivate or restrict the execution of JavaScript. If the execution of JavaScript have been deactivated, it may be possible that not every function of the website can be used to their full extent anymore.

Opportunity for objection and removal: You have the option to deactivate the service of Google Maps in a simple manner and to prevent the data transmission to Google thereby: For this purpose, you should deactivate JavaScript in your browser.

To prevent the execution of JavaScript codes altogether, you can also install a JavaScript blocker, e.g. the browser plugin NoScript (see www.noscript.net or www.ghostery.com).

Note: If the execution of JavaScript is deactivated, it may be possible that not every function of the website can be used to their full extent anymore.

You can find the data privacy statements and the conditions of use for Google products and specifically for Google Maps here: https://policies.google.com/technologies/product-privacy?hl=de

B.6 Encryption of the website and the communication

The website as well as the data transmissions on it are encrypted according to the SSL-Standard (https protocol).

B.7 Transfer of personal data to a third country (non-EU country)

There is an intention to transmit personal data to countries outside the EU and the EEA. More specifically, this intention concerns data transmission to the following company:

· Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA („Google“), as provider of the mapping service Google Maps.

Data transfers always take place on the basis of the standard data protection clauses approved by the European Commission. By agreement to the standard data protection clauses of the European Commission according to point (c) of Article 46(2) of the GDPR and further contractual stipulations, a sufficient level of data protection is ensured.

C. The rights of you as data subject

If personal data of yours are processed, you are a “data subject” and you are entitled to the following rights vis-á-vis us as data controller:

C.1 Right to access

You have the right to obtain confirmation from us free of charge as to whether or not we are processing personal data concerning you. Where that is the case, you have right of access to these personal data and further information as given in Article 15 of the GDPR. For this purpose, you can contact us by mail or by e-mail.

C.2 Right to rectification

You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the above-mentioned purposes of the processing, you also have the right to have incomplete personal data completed, including by means of providing a supplementary statement. For this purpose, you can contact us by mail or by e-mail.

C.3 Right to erasure

You have the right to obtain from us the erasure of personal data concerning you without undue delay if any of the conditions provided for in Article 17 of the GDPR applies. For this purpose, you can contact us by mail or by e-mail.

C.4 Right to restriction of processing

You have the right to obtain from us restriction of processing if any of the conditions provided for in Article 18 of the GDPR applies. For this purpose, you can contact us by mail or by e-mail.

C.5 Right to be informed

If you have exercised your right to rectification, erasure or restriction of processing against the data controller, the data controller is obliged to communicate this rectification or erasure of data or restriction of processing to each other recipient to whom the personal data concerning you have been disclosed, unless this proves impossible or involves disproportionate effort.

You have the right to obtain information from the data controller about these recipients.

C.6 Right to data portability

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from us if any of the conditions provided for in Article 20 of the GDPR applies. For this purpose, you can contact us by mail or by e-mail.

C.7 Right to object in the case of data processing for a legitimate interest and/or for direct marketing

Insofar as we exceptionally process personal data on grounds of point (f) of Article 6(1) of the GDPR (i.e. for the purposes of legitimate interests), you have the right to raise an objection with us, on grounds relating to your particular situation, at any time to the processing of personal data concerning you. If we cannot demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or else we process the relevant data of yours for the purposes of direct marketing, we will no longer process your personal data (see Article 21 of the GDPR). For this purpose, you can contact us by mail or by e-mail.

In this sense, a technical procedure applied by you shall also be regarded as objection, including e.g. distinct technical information transmitted by your web browser to us (“Do Not Track” notice).

Where personal data are processed for the purposes of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing, including profiling to the extent that it is related to such direct marketing.

C.8 Right to withdraw a consent given before

You have the right to withdraw your granted consent to the collection and use of personal data at any time with effect for the future. For this purpose, you can contact us by mail or by e-mail. This does not affect the lawfulness of data processing on grounds of the consent until the withdrawal.

C.9 Automated decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision:

- is necessary for entering into, or performance of, a contract between you and us;

- is authorised by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms; or

- is based on your explicit consent.

There is no such automated decision-making by us.

C.10 Voluntariness of data provision

If the provision of personal data is a statutory or contractual requirement, we point it out basically at the time when personal data are obtained. The data collected by us are partly necessary to enter into a contract, i.e. when we cannot fulfil, or cannot sufficiently fulfil, our contractual obligation towards you otherwise. There is no obligation for you to provide personal data. However, failure to provide such data may cause that we cannot perform or offer any of the service, action, measure or the like requested by you, or it will be impossible to enter into a contract with you.

C.11 Right to lodge a complaint with a supervisory authority

Without prejudice to any other right, you have the right to lodge a complaint with a supervisory authority for data protection, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the data protection law.

Our competent authority:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg

(Baden-Württemberg State Supervisor for Data Protection and the Freedom of Information)

Königstraße 10A

70173 Stuttgart

Website: www.baden-wuerttemberg.datenschutz.de.

Status of our Data Privacy Statement: 16 November 2020