Privacy policy
I. Name and address of the person responsible
Responsible in terms of the basic data protection regulation and other national data protection laws of the member states as well as other data protection regulations is the:
aquaTurm Hotel GmbH
Güttingerstr. 15
78315 Radolfzell
Thorsten Räffle, managing director, ibid.
Phone +49-(0)7732-52 338
info[sign]aquaTower.com
II. data protection officer(s)
In accordance with the statutory provisions, aquaTurm Hotel GmbH does not require a data protection officer(s). Nevertheless, you can contact us personally, in writing or by telephone on all topics relating to data protection on this site:
Thorsten Räffle, Güttingerstr. 15, 78315 Radolfzell, Tel. +49-(0)7732-52 338, info[atzeichen]aquaTurm.de
III. general information on data processing
Scope of the processing of personal data
As a matter of principle, we process personal data of our users only to the extent necessary to provide a functional website and our contents and services. The processing of personal data of our users regularly only takes place with the user’s consent. An exception is made in those cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law.
Legal basis for the processing of personal data
Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 para. 1 lit. a EU Data Protection Basic Regulation (DSGVO) serves as the legal basis.
When processing personal data which is necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 lit. b DSGVO serves as the legal basis. This also applies to processing operations which are necessary to carry out pre-contractual measures.
Insofar as processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 para. 1 lit. c DSGVO serves as the legal basis.
In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 lit. d DSGVO serves as the legal basis.
If the processing is necessary to safeguard a legitimate interest of our company or of a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the former interest, Article 6 (1) (f) FADP serves as the legal basis for the processing.
Data deletion and storage period
The personal data of the person concerned will be deleted or blocked as soon as the purpose of the storage no longer applies. Furthermore, data may be stored if this has been provided for by the European or national legislator in EU regulations, laws or other regulations to which the person responsible is subject. Data will also be blocked or deleted when a storage period prescribed by the above-mentioned standards expires, unless there is a need to continue storing the data for the purpose of concluding or fulfilling a contract.
IV. Provision of the website and creation of log files
Description and scope of data processing
Whenever our website is called up, our system automatically collects data and information from the computer system of the calling computer.
The following data is collected:
(1) Information about the browser type and the version used
(2) The user’s operating system
(3) The IP address of the user in anonymous form
(4) Date and time of access
(5) Websites from which the user’s system accesses our website
(6) Websites that are accessed by the user’s system via our website, insofar as these websites are linked on our website.
This data is stored in the log files of our system. Not affected by this are the IP addresses of the user or other data which allow the data to be assigned to a user. This data is not stored together with other personal data of the user.
Legal basis for data processing
The legal basis for the temporary storage of data is Art. 6 para. 1 lit. f DSGVO.
Purpose of data processing
The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session. However, the IP address is anonymised and therefore objectively and subjectively without exception does not serve to identify the visitor.
It is stored in log files to ensure the functionality of the website. In addition, the data serves us to optimise the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.
These purposes also include our legitimate interest in data processing in accordance with Art. 6 para. 1 lit. f DSGVO.
Duration of storage
The data will be deleted as soon as they are no longer necessary for the purpose for which they were collected. In the case of the collection of data for the purpose of providing the website, this is the case when the respective session (i.e. the visit to our site) has ended.
If the data is stored in log files, it is deleted after seven days at the latest. Storage beyond this period is possible. In this case, the IP addresses of the users, which have been made anonymous for us anyway, will be deleted or alienated, so that an allocation of the calling client is not possible from this point of view either.
Possibility of objection and removal
The collection of data for the provision of the website and the storage of the data in log files is mandatory for the operation of the website. There is therefore no possibility of objection on the part of the user.
V. Use of cookies
Description and scope of data processing
Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user’s computer system. If a user calls up a website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again.
We use cookies to make our website more user-friendly. Some elements of our website require the calling browser to be able to be identified even after a page change.
We use cookies on our website which enable an analysis of the surfing behaviour of the users. In this way the following data can be transmitted:
(1) Entered search terms
(2) Frequency of page views
(3) Use of website functions
The user data collected in this way is made anonymous by technical precautions. It is therefore no longer possible to assign the data to the calling user. The data is not stored together with other personal data of the users.
When calling our website, users are informed by an info banner about the use of cookies for analysis purposes and are referred to this privacy policy. In this context, there is also a reference to how the storage of cookies can be prevented in the browser settings.
2. legal basis for data processing
The legal basis for the processing of personal data using cookies is Art. 6 para. 1 lit. f DSGVO.
The legal basis for the processing of personal data using technically necessary cookies is Art. 6 para. 1 lit. f DSGVO.
- 3. purpose of the data processingThe purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For these it is necessary that the browser is recognized even after a page change.
We require cookies for the following applications:(1) Adoption of language settings
(2) Memorizing search termsWithout exception, the user data collected by technically necessary cookies will not be used to create user profiles.
4. the use of analysis cookies is for the purpose of improving the quality of our website and its contents. Through the analysis cookies, we learn how the website is used and can thus constantly optimize our offer. Through the analysis we gain knowledge about
the distribution of visits over weekdays;
the distribution of visits by hours of the day;
pages that link to our site;
keywords with which our site is searched using the internal search function;
keywords with which our site is found in search engines;
the more or less great acceptance of the contents offered by us;
the entry pages;
the exit pages;
the number of subpages and contributions called up during a visit;
the duration of the visits.
These purposes also include our legitimate interest in the processing of personal data in accordance with Art. 6 para. 1 lit. f DSGVO
5. duration of storage, possibility of objection and removal
Cookies are stored on the user’s computer and are transmitted by the user to our site. Therefore you as a user have full control over the use of cookies. By changing the settings in your Internet browser, you can deactivate or restrict the transmission of cookies. Already stored cookies can be deleted at any time. This can also be done automatically. If cookies for our website are deactivated, it may not be possible to use all the functions of the website to their full extent.
VI. newsletter (this function is currently not available on our website)
Dismissed!
VII. contact forms
Description and scope of data processing
On our website we offer users the possibility to contact us by providing personal data. The data is entered into an input mask, transmitted to us and stored. Without exception, the data will not be passed on to third parties. When contacting us, the data entered in the respective contact form will be collected and stored. The completed contact form can only be sent if the person making contact confirms that he/she is aware of this data protection declaration and agrees to the contents of this data protection declaration.
Upon receipt of the contact form, the date and time of the contact will be registered by us.
Legal basis for data processing
The legal basis for the processing of the data is Art. 6 para. 1 lit. a DSGVO if the user has given his consent.
If the registration serves the fulfilment of a contract to which the user is a party or the implementation of pre-contractual measures, the additional legal basis for the processing of the data is Art. 6 para. 1 letter b DSGVO.
Purpose of data processing
A registration of the user is necessary for the contact desired by him. In addition to the general contact form, a number of special forms offer the possibility to ask us about specific topics or concerns. Often these questions serve to prepare a first direct contact. In this way, the data and information collected will enable us to clarify certain questions in advance of the first direct contact.
Duration of storage
The data will be deleted as soon as they are no longer necessary for the purpose for which they were collected. This is the case for the data collected during the establishment of contact, if the direct contact has been established. At the latest 7 days after direct contact has been established, the data will be deleted.
Possibility of objection and removal
As a user, you can have the data collected via the contact form amended or deleted at any time. A simple declaration in text form (e.g. email) is sufficient for this.
VIII. e-mail contact
Description and scope of data processing
As an alternative to using the contact forms, it is also possible to contact us via the e-mail address provided. In this case, the user’s personal data transmitted with the e-mail will not be stored separately, but the e-mail will be forwarded promptly from the collective address by e-mail to the office in our company responsible for processing the inquiry.
Without exception, the data will not be passed on to third parties outside the company. The data will be used exclusively within the company for processing the conversation.
Legal basis for data processing
The legal basis for the processing of the data is Art. 6 para. 1 lit. a DSGVO if the user has given his consent.
The legal basis for the processing of data transmitted in the course of sending an e-mail is Art. 6 para. 1 letter f DSGVO. If the e-mail contact is aimed at the conclusion of a contract, the additional legal basis for processing is Art. 6 para. 1 lit. b DSGVO.
Purpose of data processing
The processing of the personal data from the sender’s email serves us solely to process the contact. In this case, this also includes the necessary legitimate interest in processing the data.
Duration of storage
The data will be deleted as soon as they are no longer necessary for the purpose for which they were collected. For personal data sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is terminated when it can be concluded from the circumstances that the matter in question has been finally clarified.
Possibility of objection and removal
The user has the possibility to revoke his consent to the processing of personal data at any time. If the user contacts us by e-mail, he can object to the storage of his personal data at any time. In such a case, the conversation via email cannot be continued. A simple declaration in text form (e.g. email) is sufficient for the objection or the request for deletion. All personal data stored in the course of the contact will be deleted in this case.
IX. Web analysis by Google Analytics
If you have given your consent, this website uses Google Analytics, a web analysis service provided by Google LLC (“Google”). The use includes the operating mode “Universal Analytics”. This makes it possible to assign data, sessions and interactions across multiple devices to a pseudonymous user ID and thus to analyze the activities of a user across multiple devices. This privacy notice is provided by www.intersoft-consulting.de.
Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. However, in the event that IP anonymisation is activated on this website, your IP address will be shortened by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area before this happens. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. We would like to point out that on this website Google Analytics has been extended by an IP anonymization to ensure an anonymized collection of IP addresses (so-called IP masking). The IP address transmitted by your browser within the scope of Google Analytics is not merged with other data from Google. Further information on terms of use and data protection can be found at https://www.google.com/analytics/terms/de.html or https://policies.google.com/?hl=de.
Purposes of processing
On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on the website activities and to provide further services to the website operator in connection with the use of the website and the internet.
Legal basis
The legal basis for the use of Google Analytics is your consent in accordance with Art. 6 Para. 1 S.1 lit. a DSGVO.
Recipients / categories of recipients
The recipient of the collected data is Google.
Transfer to third countries
Personal data is transferred to the USA under the EU-US Privacy Shield on the basis of the adequacy decision of the European Commission. You can download the certificate here.
Duration of data storage
The data sent by us and linked to cookies, user IDs (e.g. User ID) or advertising IDs are automatically deleted after 14 months. Data whose retention period has been reached is automatically deleted once a month.
Rights of data subjects
You can revoke your consent at any time with effect for the future by preventing the storage of cookies through a corresponding setting in your browser software; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent.
You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser add-on. Opt-out cookies prevent the future collection of your data when visiting this website. To prevent Universal Analytics from collecting data across multiple devices, you must opt-out on all systems in use.
Click here to set the opt-out cookie: [ga_optout]
X. Live cam
In the top right menu you will find a link to the Aquaturm livecam. This link leads directly to the provider livespotting.tv, where the livecam is operated and published.
As soon as you have clicked on the link to the livecam, you are on a subpage of livespotting.tv. Your visit there is subject to the privacy policy of livespotting.tv, which is published here:
http://livespotting.tv/company.html#a_datenschutz
XI. Booking system
When you click on our Booking Offers page, you will be taken to the booking system, which provides HS/3 hotel software and runs it completely on our behalf, including payment processing.
There is an agreement with HS/3 Hotelsoftware about order data processing. This agreement contains the following provisions regarding your data protection rights as a booking guest (HS/3 = “Contractor”; Aquaturm = “Customer”):
General obligations of the Contractor
(1) The Contractor is obliged to design his company and his operating procedures in such a way that the data to which he has access in connection with the maintenance and care work is protected from unauthorised access by third parties.
(2) The Contractor shall inform the Customer immediately if, in his opinion, an instruction issued by the Customer violates legal regulations. The Contractor is entitled to suspend the execution of the relevant instruction until it is confirmed or changed by the Customer.
(3) The Contractor is obliged to inform the Customer immediately of any violation of data protection regulations or of the contractual agreements made and/or the instructions issued by the Customer which has occurred in the course of the processing of data by him or by other persons involved in the processing.
(4) In the event that the Contractor determines or facts justify the assumption that data processed by him for the Customer has been
special types or special categories of personal data within the meaning of Section 3 (9) BDSG or Art. 9 DSGVO or
personal data subject to professional secrecy, or
personal data relating to criminal offences or infringements of regulations or the suspicion of criminal offences or infringements of regulations, or
personal data on bank or credit card accounts
unlawfully transmitted or otherwise unlawfully come to the knowledge of third parties, the Contractor must inform the Client immediately and completely about the time, nature and extent of the incident(s) in writing or in text form (fax/e-mail). The information must include a statement of the nature of the unlawful knowledge. In addition, the information shall contain a description of possible adverse consequences of the unlawful acquisition of knowledge. Furthermore, the Contractor is obliged to inform immediately which measures have been taken by the Contractor to prevent the unlawful transmission or unauthorized knowledge by third parties in the future.
(5) From 25 May 2018, the Contractor shall comply with its obligations under Article 30(2) DSGVO to keep a processing register.
Control powers of the contracting authority
(1) The Client has the right to check at any time and to the extent necessary that the Contractor complies with the statutory provisions on data protection and/or the contractual provisions agreed between the parties and/or that the Contractor complies with the Client’s instructions.
(2) The Contractor is obliged to provide information to the Customer to the extent necessary to carry out the inspection within the meaning of paragraph 1.
(3) After prior notification and with a reasonable period of notice, the Customer may carry out the inspection within the meaning of paragraph 1 at the Contractor’s premises during normal business hours. In doing so, the customer shall ensure that the inspections are only carried out to the extent necessary if the contractor’s operating procedures are disturbed by the inspections.
(4) In the event of measures taken by the supervisory authority against the Customer within the meaning of § 38 BDSG or, as of 25 May 2018, in accordance with Art. 58 DSGVO in conjunction with Art. 58 DSGVO, the Contractor shall be obliged to inform the Customer of the measures taken. § 40 BDSG (new), in particular with regard to duties of information and control, to provide the necessary information to the Customer.
Subcontracting relationships
(1) The commissioning of subcontractors by the contractor is only permitted with the written consent of the customer.
(2) The contractor must carefully select the subcontractor and check before the order is placed that the subcontractor can comply with the agreements made between the customer and the contractor. In particular, the Contractor must check in advance and regularly during the term of the contract that the subcontractor has taken the technical and organisational measures required for the protection of personal data in accordance with § 9 BDSG and, from 25.05.2018, in accordance with Art. 32 DSGVO. The result of the control is to be documented by the contractor and sent to the client on request. The contractor is obliged to have the subcontractor confirm that the subcontractor has appointed a company data protection officer within the meaning of § 4f BDSG or, as of 25.05.2018, in accordance with Art. 37 DSGVO in conjunction with Art. 32 DSGVO. § 38 BDSG (new), insofar as the subcontractor is legally obliged to appoint a data protection officer.
(3) The Contractor shall ensure that the regulations agreed in this contract and any supplementary instructions of the Client, if applicable, also apply to the subcontractor. The contractor shall regularly monitor compliance with these obligations.
(4) The obligation of the subcontractor must be in writing. Copies of the written obligation must be sent to the customer on request.
(5) The contractor is in particular obliged to ensure by contractual provisions that the control powers (clause 5 of this contract) of the customer and supervisory authorities also apply vis-à-vis the subcontractor and that corresponding control rights are agreed by the customer and supervisory authorities. In addition, it shall be contractually regulated that the subcontractor must tolerate these control measures and any on-site inspections.
Data Secrecy
(1) When processing data for the customer, the contractor is obliged to maintain data secrecy in the sense of § 5 BDSG or, from 25.05.2018, to maintain confidentiality. The Contractor undertakes to observe the same rules of secrecy protection as those incumbent on the Client. The Customer is obliged to inform the Contractor of any special secrecy protection rules.
(2) The Contractor warrants that he is aware of the applicable data protection regulations and is familiar with their application. The Contractor further assures that he will familiarise the employees employed in the execution of the work with the provisions of data protection applicable to them and that they have been bound to data secrecy within the meaning of § 5 BDSG. As of 25 May 2018, the Contractor shall instead oblige the persons mentioned in sentence 2 to confidentiality in a manner sufficient to comply with Art. 28 para. 3 lit. b), unless they are already subject to an appropriate statutory duty of confidentiality elsewhere.
Obligations of the Contractor after completion of the contract
(1) After termination of the contract, the Contractor shall hand over to the Client all documents, data and the results of processing or use that have come into his possession and are connected with the contractual relationship. The data carriers of the contractor must then be physically deleted. This also applies to any data backups at the Contractor. The deletion shall be documented in a suitable manner. Test and reject material is to be destroyed or physically deleted immediately.
(2) The customer has the right to control the complete return and deletion of the data at the contractor in accordance with the contract. This can also be done by inspecting the data processing equipment at the contractor’s premises. The on-site inspection shall be announced by the Customer with a reasonable period of notice.
Aquaturm will monitor the compliance with the obligations of HS/3 Hotel Software also and especially insofar as your data protection interests as a booking guest are affected. If violations are detected, Aquaturm will intervene immediately and ensure that the agreements made are observed without exception, also in your interest.
Furthermore, in the course of the booking process, please observe the data protection information and necessary declarations of consent which you will see in the booking system of HS/3 Hotel Software or which you are requested to submit.
XII Social Media Buttons
At the top right of our page you will find buttons, which can be activated by linking
to our Livecam
to our Facebook page
to our Google+ page
lead.
These buttons are provided with a simple link to the relevant pages. Third-party functions, in particular functions relevant to data protection, are not connected to these links on our site.
With regard to the link to our Livecam, we refer to the notes under point X. .
After clicking on the buttons and being on the corresponding target pages, please note the data protection information deposited on the pages of the providers.
XIII. rights of the data subject
If personal data are processed by you, you are the data subject within the meaning of the DSGVO and you are entitled to the following rights in relation to the person responsible:
Right of access to information
You can request confirmation from the person responsible as to whether personal data concerning you is being processed by us. If such processing has taken place, you can request information from the data controller about the following:
(1) the purposes for which the personal data are processed
(2) the categories of personal data which are processed;
(3) the planned duration of the storage of the personal data concerning you or, if it is not possible to give specific details, criteria for determining the duration of storage;
(4) the existence of a right of rectification or erasure of personal data concerning you, a right to have the processing limited by the controller or a right to object to such processing
(5) the existence of a right of appeal to a supervisory authority;
(6) the existence of automated decision-making, including profiling, in accordance with Art. 22 (1) and (4) FADP, and – at least in these cases – meaningful information on the logic involved and the scope and intended impact of such processing on the data subject.
You have the right to request information as to whether the personal data concerning you are being transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 DPA in connection with the transfer.
Right of rectification
You have the right to ask the data controller to correct and/or complete the data if the personal data processed concerning you is incorrect or incomplete. The data controller shall make the correction without delay.
- Right of rectificationYou have the right to ask the data controller to correct and/or complete the data if the personal data processed concerning you is incorrect or incomplete. The data controller shall make the correction without delay.Right to limit processing
Under the following conditions, you may request that the processing of personal data concerning you be restricted:
(1) if you dispute the accuracy of the personal data concerning you for a period which enables the controller to verify the accuracy of the personal data
(2) if the processing is unlawful and you object to the deletion of the personal data and request instead the restriction of the use of the personal data;
(3) if the controller no longer needs the personal data for the purposes of the processing, but you need the personal data for the purpose of asserting, exercising or defending legal claims; or
(4) if you have lodged an objection to the processing in accordance with Art. 21 para. 1 DPA and it has not yet been established whether the legitimate reasons given by the controller outweigh your reasons.If the processing of personal data relating to you has been restricted, such data may be processed – apart from storage – only with your consent or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person or on grounds of an important public interest of the Union or of a Member State.
If the restriction on processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.4. right of deletion
a) Duty to delete
You may request the controller to delete personal data concerning you without delay and the controller is obliged to delete such data without delay if one of the following reasons applies:
(1) the personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed
(2) you revoke your consent on which the processing was based pursuant to Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a FADP, and there is no other legal basis for the processing.
(3) You lodge an objection to the processing pursuant to Art. 21(1) DPA and there are no legitimate reasons for the processing, or you lodge an objection to the processing pursuant to Art. 21(2) DPA.
(4) The personal data concerning you have been processed unlawfully.
(5) The deletion of personal data relating to you is necessary to comply with a legal obligation under Union law or the law of the Member States to which the controller is subject.
(6) The personal data concerning you have been collected in relation to information society services offered in accordance with Article 8(1) of the DPA.(b) Information to third parties
If the data controller has disclosed the personal data concerning you and is obliged to delete them in accordance with Art. 17 para. 1 DPA, he shall take reasonable measures, including technical measures, taking into account the available technology and the implementation costs, to inform data controllers who process the personal data that you, as a data subject, have requested them to delete all links to these personal data or copies or replications of these personal data. However, this situation will not occur in the course of standard use of our website because, as we have said, we will not, without exception, pass on your data to third parties.
(c) Exceptions
The right of cancellation does not exist insofar as the processing is necessary
(1 ) on the exercise of the right to freedom of expression and information;
(2) to comply with a legal obligation requiring processing under Union or national law to which the controller is subject or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller;
(3) for reasons of public interest in the field of public health pursuant to Article 9 (2) lit. h and i and Article 9 (3) DSGVO;
(4) for archival, scientific or historical research purposes in the public interest or for statistical purposes pursuant to Art. 89 para. 1 DSGVO, insofar as the right referred to in section a) is likely to render impossible or seriously prejudice the attainment of the objectives of such processing, or
(5) to assert, exercise or defend legal claims.
Right to information
If you have asserted the right to rectify, erase or limit the processing vis-à-vis the controller, the controller is obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification, erasure or limitation of processing, unless this proves impossible or involves a disproportionate effort. You have the right vis-à-vis the controller to be informed of these recipients.
Right to data transferability
You have the right to receive the personal data concerning you that you have provided to the data controller in a structured, common and machine-readable format. You also have the right to have this data communicated to another person in charge without interference from the person in charge to whom the personal data has been communicated, provided that
(1) the processing is based on a consent pursuant to Art. 6 para. 1 letter a DSGVO or Art. 9 para. 2 letter a DSGVO or on a contract pursuant to Art. 6 para. 1 letter b DSGVO and
(2) the processing is carried out by means of automated procedures.
In exercising this right, you also have the right to obtain that the personal data concerning you be transferred directly from one controller to another controller, insofar as this is technically feasible. The freedoms and rights of other persons must not be affected by this.
The right to data transferability shall not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Right of objection
You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you which is carried out pursuant to Article 6 paragraph 1 letter e or f FADP; this also applies to profiling based on these provisions.
The controller will no longer process the personal data concerning you, unless he can demonstrate compelling reasons for processing which are justified on grounds of protection and which outweigh your interests, rights and freedoms, or unless the processing serves to assert, exercise or defend legal claims.
If the personal data concerning you are processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing, including profiling, insofar as it is linked to such direct marketing.
If you object to processing for the purposes of direct marketing, the personal data concerning you will no longer be processed for those purposes.
You have the possibility to exercise your right of objection in relation to the use of information society services, without prejudice to Directive 2002/58/EC, by using automated procedures involving technical specifications.
Right to revoke the declaration of consent under data protection law
You have the right to revoke your data protection declaration of consent at any time. Revocation of your consent does not affect the legality of the processing that has taken place on the basis of your consent until revocation.
Automated decision in individual cases including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, that has legal effect on you or significantly affects you in a similar manner. This shall not apply if the decision
(1) is necessary for the conclusion or performance of a contract between you and the person responsible
(2) is authorised by Union law or the law of the Member States to which the person responsible is subject and that law contains appropriate measures to safeguard your rights and freedoms and your legitimate interests; or
(3) with your express consent.
However, these decisions may not be based on special categories of personal data pursuant to Art. 9 para. 1 DSGVO, unless Art. 9 para. 2 lit. a or g DSGVO applies and appropriate measures have been taken to protect rights and freedoms and your legitimate interests.
With regard to the cases referred to in (1) and (3), the data controller shall take appropriate measures to safeguard the rights and freedoms and your legitimate interests, which shall include at least the right to obtain the intervention of a person from the data controller, to present his or her point of view and to challenge the decision.
Right to appeal to a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State in which you are resident, your place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you is in breach of the DPA.
The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Art. 78 DSGVO.