If per­son­al data is processed by you, you are the data sub­ject with­in the mean­ing of the GDPR and you have the fol­low­ing rights vis-à-vis the per­son responsible:

(1) Right to information

You can request con­fir­ma­tion from the per­son respon­si­ble as to whether per­son­al data relat­ing to you is being processed by us.

If such pro­cess­ing is present, you can request infor­ma­tion from the per­son respon­si­ble for the fol­low­ing information:

1. the pur­pos­es for which the per­son­al data are processed;
2. the cat­e­gories of per­son­al data being processed;
3. the recip­i­ents or cat­e­gories of recip­i­ents to whom your per­son­al data has been or will be disclosed;
4. the planned dura­tion of the stor­age of the per­son­al data con­cern­ing you or, if spe­cif­ic infor­ma­tion on this is not pos­si­ble, cri­te­ria for deter­min­ing the stor­age duration;
5. the exis­tence of a right to rec­ti­fi­ca­tion or era­sure of per­son­al data con­cern­ing you, a right to restric­tion of pro­cess­ing by the per­son respon­si­ble or a right to object to this processing;
6. the exis­tence of a right of appeal to a super­vi­so­ry authority;
7. all avail­able infor­ma­tion about the ori­gin of the data if the per­son­al data are not col­lect­ed from the data subject;
8. the exis­tence of auto­mat­ed deci­sion-mak­ing includ­ing pro­fil­ing in accor­dance with Art. 22 para. 1 and 4 GDPR and — at least in these cas­es — mean­ing­ful infor­ma­tion about the log­ic involved as well as the scope and intend­ed effects of such pro­cess­ing for the data subject.

You have the right to request infor­ma­tion as to whether your per­son­al data is being trans­mit­ted to a third coun­try or to an inter­na­tion­al orga­ni­za­tion. In this con­text, you can request infor­ma­tion about the appro­pri­ate guar­an­tees in accor­dance with Art. 46 GDPR to be informed in con­nec­tion with the transfer

(2) Right to Rectification

You have a right to cor­rec­tion and/or com­ple­tion to the per­son respon­si­ble if the processed per­son­al data con­cern­ing you is incor­rect or incom­plete. The per­son respon­si­ble must make the cor­rec­tion immediately.

(3) Right to restric­tion of pro­cess­ing
Under the fol­low­ing con­di­tions, you can request the restric­tion of the pro­cess­ing of your per­son­al data:

1. if you con­test the accu­ra­cy of the per­son­al data con­cern­ing you for a peri­od that enables the per­son respon­si­ble to check the accu­ra­cy of the per­son­al data;
2. the pro­cess­ing is unlaw­ful and you refuse to delete the per­son­al data and instead request that the use of the per­son­al data be restricted;
3. the per­son respon­si­ble no longer needs the per­son­al data for the pur­pos­es of pro­cess­ing, but you need them to assert, exer­cise or defend legal claims, or
4. if you object to the pro­cess­ing pur­suant to Art. 21 para. 1 GDPR and it is not yet cer­tain whether the legit­i­mate rea­sons of the per­son respon­si­ble out­weigh your reasons.

If the pro­cess­ing of the per­son­al data con­cern­ing you has been restrict­ed, this data — apart from its stor­age — may only be used with your con­sent or to assert, exer­cise or defend legal claims or to pro­tect the rights of anoth­er nat­ur­al or legal per­son or for rea­sons of impor­tant pub­lic inter­est of the Union or a Mem­ber State are processed.

If the restric­tion of pro­cess­ing has been restrict­ed accord­ing to the above con­di­tions, you will be informed by the per­son respon­si­ble before the restric­tion is lifted.

(4) Right to erasure

a) Oblig­a­tion to delete
You can request the per­son respon­si­ble to delete the per­son­al data con­cern­ing you imme­di­ate­ly, and the per­son respon­si­ble is oblig­ed to delete this data imme­di­ate­ly if one of the fol­low­ing rea­sons applies:

1. The per­son­al data con­cern­ing you are no longer nec­es­sary for the pur­pos­es for which they were col­lect­ed or oth­er­wise processed.
2. You revoke your con­sent, on which the pro­cess­ing pur­suant to Art. Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR and there is no oth­er legal basis for processing.
3. You lay acc. Art. 21 para. 1 DSGVO objec­tion to the pro­cess­ing and there are no over­rid­ing legit­i­mate rea­sons for the pro­cess­ing, or you sub­mit acc. Art. 21 para. 2 DSGVO objec­tion to the processing.
4. The per­son­al data con­cern­ing you have been processed unlawfully.
5. The dele­tion of the per­son­al data con­cern­ing you is nec­es­sary to ful­fill a legal oblig­a­tion under Union law or the law of the Mem­ber States to which the per­son respon­si­ble is subject.
6. The per­son­al data con­cern­ing you was col­lect­ed in rela­tion to infor­ma­tion soci­ety ser­vices offered pur­suant to Art. 8 para. 1 GDPR.

b) Infor­ma­tion to third par­ties
Has the per­son respon­si­ble made the per­son­al data con­cern­ing you pub­lic and is he/she acc. Art. 17 para. 1 GDPR, he shall take appro­pri­ate mea­sures, also of a tech­ni­cal nature, tak­ing into account the avail­able tech­nol­o­gy and the imple­men­ta­tion costs, to inform those respon­si­ble for data pro­cess­ing who process the per­son­al data that you, as the per­son con­cerned, want them to delete it all links to such per­son­al data or copies or repli­ca­tions of such per­son­al data.

c) Excep­tions
The right to era­sure does not exist if pro­cess­ing is necessary

1. to exer­cise the right to free­dom of expres­sion and information;
2. to ful­fill a legal oblig­a­tion that requires pro­cess­ing under Union or Mem­ber State law to which the con­troller is sub­ject, or to per­form a task that is in the pub­lic inter­est or in the exer­cise of offi­cial author­i­ty vest­ed in the controller;
3. for rea­sons of pub­lic inter­est in the field of pub­lic health in accor­dance with Art. 9 para. 2 lit. h and i as well as Art. 9 para. 3 GDPR;
4. for archiv­ing pur­pos­es in the pub­lic inter­est, sci­en­tif­ic or his­tor­i­cal research pur­pos­es or for sta­tis­ti­cal pur­pos­es acc. Art. 89 para. 1 GDPR, inso­far as the right men­tioned under sec­tion a) is like­ly to make it impos­si­ble or seri­ous­ly impair the achieve­ment of the objec­tives of this pro­cess­ing, or
5. to assert, exer­cise or defend legal claims.

(5) Right to Information

If you have assert­ed the right to cor­rec­tion, dele­tion or restric­tion of pro­cess­ing against the per­son respon­si­ble, he is oblig­ed to inform all recip­i­ents to whom the per­son­al data con­cern­ing you have been dis­closed of this cor­rec­tion or dele­tion of the data or restric­tion of pro­cess­ing, unless this proves to be impos­si­ble or involves a dis­pro­por­tion­ate effort.

You have the right to be informed about these recip­i­ents by the per­son responsible.

(6) Right to Data Portability

You have the right to receive the per­son­al data con­cern­ing you that you have pro­vid­ed to the per­son respon­si­ble in a struc­tured, com­mon and machine-read­able for­mat. In addi­tion, you have the right to trans­mit this data to anoth­er per­son respon­si­ble with­out hin­drance by the per­son respon­si­ble for pro­vid­ing the per­son­al data, pro­vid­ed that

1. the pro­cess­ing is based on con­sent acc. Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a con­tract acc. Art. 6 para. 1 lit. b GDPR is based and
2. the pro­cess­ing is car­ried out using auto­mat­ed procedures.

In exer­cis­ing this right, you also have the right to have the per­son­al data con­cern­ing you trans­mit­ted direct­ly from one per­son respon­si­ble to anoth­er per­son respon­si­ble, inso­far as this is tech­ni­cal­ly fea­si­ble. The free­doms and rights of oth­er peo­ple must not be impaired by this.

The right to data porta­bil­i­ty does not apply to pro­cess­ing of per­son­al data that is required to per­form a task that is in the pub­lic inter­est or in the exer­cise of offi­cial author­i­ty that has been assigned to the controller.

(7) Right to Object

You have the right, for rea­sons aris­ing from your par­tic­u­lar sit­u­a­tion, to object at any time to the pro­cess­ing of your per­son­al data, which is based on Art. 6 para. 1 lit. e or f GDPR to file an objec­tion; this also applies to pro­fil­ing based on these provisions.

The per­son respon­si­ble no longer process­es the per­son­al data relat­ing to you unless he can demon­strate com­pelling legit­i­mate grounds for the pro­cess­ing which out­weigh your inter­ests, rights and free­doms, or the pro­cess­ing serves to assert, exer­cise or defend legal claims.

If the per­son­al data con­cern­ing you is processed in order to oper­ate direct adver­tis­ing, you have the right to object at any time to the pro­cess­ing of your per­son­al data for the pur­pose of such adver­tis­ing; this also applies to pro­fil­ing inso­far as it is asso­ci­at­ed with such direct advertising.

If you object to the pro­cess­ing for direct mar­ket­ing pur­pos­es, the per­son­al data relat­ing to you will no longer be processed for these purposes.

In con­nec­tion with the use of infor­ma­tion soci­ety ser­vices, you have the option – notwith­stand­ing Direc­tive 2002/58/EC – to exer­cise your right to object by means of auto­mat­ed pro­ce­dures that use tech­ni­cal specifications.

(8) Right to revoke the dec­la­ra­tion of con­sent under data pro­tec­tion law

You have the right to revoke your dec­la­ra­tion of con­sent under data pro­tec­tion law at any time. The revo­ca­tion of the con­sent does not affect the legal­i­ty of the pro­cess­ing car­ried out on the basis of the con­sent up to the point of revocation.

(9) Auto­mat­ed indi­vid­ual deci­sion-mak­ing includ­ing profiling

You have the right not to be sub­ject to a deci­sion based sole­ly on auto­mat­ed pro­cess­ing, includ­ing pro­fil­ing, which pro­duces legal effects con­cern­ing you or sim­i­lar­ly sig­nif­i­cant­ly affects you. This does not apply if the decision

1. is nec­es­sary for the con­clu­sion or per­for­mance of a con­tract between you and the per­son responsible,
2. is per­mit­ted on the basis of legal pro­vi­sions of the Union or the Mem­ber States to which the per­son respon­si­ble is sub­ject and these legal pro­vi­sions con­tain appro­pri­ate mea­sures to pro­tect your rights and free­doms as well as your legit­i­mate inter­ests or
3. takes place with your express consent.

How­ev­er, these deci­sions must not be based on spe­cial cat­e­gories of per­son­al data accord­ing to Art. 9 para. 1 GDPR, unless Art. 9 para. 2 lit. a or g DSGVO applies and appro­pri­ate mea­sures have been tak­en to pro­tect your rights and free­doms and your legit­i­mate interests.

With regard to the cas­es referred to in (1) and (3), the per­son respon­si­ble shall take appro­pri­ate mea­sures to safe­guard your rights and free­doms and your legit­i­mate inter­ests, includ­ing at least the right to obtain human inter­ven­tion on the part of the per­son respon­si­ble, to express his or her point of view and to chal­lenge the decision.

(10) Right to lodge a com­plaint with a super­vi­so­ry authority

With­out prej­u­dice to any oth­er admin­is­tra­tive or judi­cial rem­e­dy, you have the right to lodge a com­plaint with a super­vi­so­ry author­i­ty, in par­tic­u­lar in the mem­ber state of your place of res­i­dence, your place of work or the place of the alleged infringe­ment, if you believe that the pro­cess­ing of your per­son­al data vio­lates vio­lates the GDPR.

The super­vi­so­ry author­i­ty to which the com­plaint was lodged will inform the com­plainant about the sta­tus and the results of the com­plaint, includ­ing the pos­si­bil­i­ty of a judi­cial rem­e­dy under Art. 78 GDPR.

Con­tact per­son for data protection

If you have any ques­tions about the col­lec­tion, pro­cess­ing or use of your per­son­al data, or if you need infor­ma­tion, cor­rec­tion, block­ing or dele­tion of data, please contact:

smuggler’s nest
Bernd Theis­sen
Kirschen­stein­weg 17
52156 Mon­schau
Tele­phone +49 2472 912988
Email: fewo@schmugglernest.de