Privacy Policy

Privacy Policy

  1. Name and contact details of the controller

The controller within the meaning of the European General Data Protection Regulation (GDPR) and other national data protection laws is:

scoutbee GmbH
Gregor Stühler
Holundergasse 10, 97262 Hausen bei Würzburg
Phone: +49 (0)931 466219 60
E-mail: connect@scoutbee.com

Contact details of the data protection officer
PROLIANCE GmbH / www.datenschutzexperte.de
Datenschutzbeauftragter
Leopoldstr. 21
80802 Munich
datenschutzbeauftragter@datenschutzexperte.de

  1. General information concerning the processing of personal data
  2. Scope of processing of personal data

We (the “Controller” pursuant to the GDPR) take the protection of your data very seriously. In principle, we only process (Art. 4 (2) GDPR) the personal data of our users (“data subjects” within the meaning of GDPR) insofar as this is necessary to deliver a functional website along with our services and content. The collection and use of personal data concerning our users only regularly occurs with the user’s consent. Exceptions apply in cases where obtaining prior consent is not possible due to the factual circumstances and the data processing is permitted by statutory regulations. As a rule, our services are directed towards adults. Persons under the age of 18 should not transfer personal data to us without the consent of their parents or legal guardian(s).

  1. Legal basis for the processing of personal data

Insofar as we obtain the data subject’s consent for the processing of personal data, Art. 6 (1)(a) GDPR is the legal basis for the processing of personal data.

For the processing of personal data that is necessary for the performance of a contract to which the data subject is party or in order to take steps prior to entering into a contract, Art. 6 (1)(b) GDPR is the legal basis.

Insofar as processing is necessary for compliance with a legal obligation to which our company is subject, Art. 6 (1)(c) GDPR is the legal basis.

If processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, Art. 6 (1)(f) GDPR is the legal basis for processing.

  1. Duration of storage and deletion of personal data

The personal data concerning the data subject will be erased or blocked as soon as the purpose of storage ceases to apply. Storage may extend beyond this period if this is stipulated by EU or national lawmakers in EU directives, laws or other regulations to which the controller is subject, particularly laws concerning taxes and accounting. The data will also be blocked or erased after the expiration of a storage period prescribed by the above regulations, unless continued storage of the data is necessary in order to enter into a contract or for contract performance.

  1. General information concerning data transmission to the USA

At https://www.privacyshield.gov/list you can find a list of the companies that have committed to the EU-US Privacy Shield agreement (https://www.privacyshield.gov/EU-US-Framework) and that are consequently regarded by the EU Commission as countries with an appropriate level of data protection pursuant to Art. 45 GDPR. In the following, you can learn whether we or third parties may transfer data to servers in the USA or other states outside the EU by consulting the respective third-party providers.

  1. Links to third-party providers

Insofar as our website contains links to third-party services purely as recommendations, partners or customers, such websites are not subject to our privacy policy, but rather to the privacy policy of the third-party provider. This does not include the third parties that are listed individually below.

III. Provision of website and log files

  1. Description and scope of data processing

For each visit to our website, our system automatically collects data and information from the computer system of the visiting device.
The following data is collected in this context:

  • a) Browser type and browser version
  • b) Operating system used
  • c) Referrer URL
  • d) Host name of the accessing computer
  • e) Time and date of server request

This data will also be stored in our system log files. This data will not be stored together with other personal data of the user.

  1. Legal basis for data processing

The legal basis for temporary storage of data and log files is Art. 6 (1)(f) GDPR. We have a legitimate interest in improving the functionality and stability of the website.

  1. Purpose of data processing

It is necessary for the system to temporarily store the IP address in order to deliver the website to the user’s device. For this purpose, the user’s IP address must be saved for the duration of the session. Storage in log files occurs in order to ensure the functional operation of the website. We also use this data to optimise the website and to ensure the security of our IT systems. The data will not be analysed for marketing purposes in this context. These purposes are also based on our legitimate interest in data processing pursuant to Art. 6 (1)(f) GDPR.

  1. Duration of storage

The data will be erased as soon as it is no longer required to fulfil the purpose for which it was collected. Where data is collected for the provision of the website, this is the case when the respective session has ended. Apart from this, the duration of storage is based on the stipulations of tax law and accounting law.

In case of data storage in log files, this occurs after seven days at the latest. Storage for longer periods of time is possible. In this case, the IP addresses of the users will be deleted or disguised so that it is no longer possible to identify the visiting client.

  1. Right to object and option of removal

The collection of data to provide the website and the storage of data in log files is required for the operation of the website. Accordingly, the user has no option of objection in this regard.

  1. Use of cookies
  2. Description and scope of data processing

Our website uses cookies. Cookies are text files that are stored in the internet browser or which the internet browser stores on the user’s computer system. If a user accesses a website, a cookie may be stored on the user’s operating system. This cookie contain a characteristic sequence that enables unambiguous identification of the browser when accessing our website again. On our website, we also use cookies that allow us to analyse the browsing patterns of users.

The following data may be transmitted in this way:

  • Search terms entered
  • Frequency of website access
  • Use of website functions

When accessing our website, the user will be informed about the use of cookies for analytical purposes and give consent to the processing of the personal data used in this context. Reference will also be made to this privacy policy.

  1. Legal basis for data processing

The legal basis for the processing of personal data using cookies that are technically required is Art. 6 (1)(f) GDPR. We have a legitimate interest in improving the functionality and stability of the website. The legal basis for the processing of personal data using cookies for the purposes of analysis, if the user has granted consent in this regard, is Art. 6 (1)(a) GDPR.

  1. Purpose of data processing

Analytical cookies are used for the purpose of improving the quality of our website and its content. Analytical cookies allow us to learn how the website is used and allow us to optimise our services continually.

These purposes are also based on our legitimate interest in the processing of personal data pursuant to Art. 6 (1)(f) GDPR.

  1. Duration of storage

Cookies are stored on the user’s device and transmitted to our website by the device. For this reason, you as user have complete control over the use of cookies. Apart from this, the duration of storage is based on the stipulations of tax law and accounting law.

  1. Right to object and option of removal

You can deactivate or limit the transfer of cookies by changing the settings in your internet browser. Cookies can be deleted at any time after being stored. This can also occur automatically. If cookies are deactivated for our website, it is possible that not all features on the website can be used to their full extent.

  1. Contact form and e-mail contact
  2. Description and scope of data processing

There is a contact form on our website that can be used to contact us electronically. If a user takes advantage of this option, the data entered in the input screen will be transmitted to us and stored. This data includes:

  • Name
  • E-mail

E-mail address At the time the message is sent, the following data will also be stored:

  • Data and time of registration
  • E-mail address
  • Name and phone number if provided

During the sending process, your consent will be obtained for data processing and reference will be made to this privacy policy.

Alternatively, contact is possible via the e-mail address provided. In this case, the user’s personal data submitted with the e-mail will be stored.

In this context, the data will not be transferred to third parties. The data will exclusively be used to process the conversation.

  1. Legal basis for data processing

The legal basis for the processing of data if the user has granted consent is Art. 6 (1)(a) GDPR.

The legal basis for the processing of data that is transmitted when sending an e-mail is Art. 6 (1)(f) GDPR. If the aim of e-mail contact is to enter into a contract, an additional legal basis for processing is Art. 6 (1)(f) GDPR.

  1. Purpose of data processing

We only process personal data from the input screen in order to establish contact. In case of contact via e-mail, we also have the required legitimate interest in data processing. Other personal data processed during the sending process helps to prevent misuse of the contact form and to guarantee the security of our IT systems.

  1. Duration of storage

The data will be erased as soon as it is no longer required to fulfil the purpose for which it was collected. For the personal data from the input fields in the contact form and data sent via e-mail, this is the case once the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the situation in question has been resolved definitively.

Apart from this, the duration of storage is based on the stipulations of tax law and accounting law.

  1. Right to object and option of removal

The use has the right to withdraw consent to the processing of personal data at any time. If users contact us via email, they can object to the storage of their personal data at any time. If this is the case, the conversation cannot be continued. This can be accomplished via e-mail or contact by phone. All personal data that was stored during contact will be deleted in this case.

  1. Registration
  2. Description and scope of data processing

On our website, we offer users the opportunity to register by providing personal data. Data is entered in an input screen and transmitted to us and stored. The data will not be transferred to third parties.

The following data is collected during the registration process:

  • Name
  • E-mail

At the time of registration, the following data will also be stored:

  • The user’s IP address
  • Data and time of registration

During the registration process, the user’s consent will be obtained to process this data.

  1. Legal basis for data processing

The legal basis for the processing of data if the user has granted consent is Art. 6 (1)(a) GDPR.

  1. Purpose of data processing

User registration is required in order to provide certain content and services on our website since we only offer content within the closed system.

  1. Duration of storage

The data will be erased as soon as it is no longer required to fulfil the purpose for which it was collected. Apart from this, the duration of storage is based on the stipulations of tax law and accounting law.

This is the case for data collected during the registration process if registration for our website is cancelled or modified.

VII. Newsletter

  1. Description and scope of data processing

On our website, we offer the option of subscribing to a free newsletter. Upon subscribing for the newsletter, the data from the input screen will be transmitted to us.

This includes the user’s name and (usually professional) e-mail address.

The following data is also collected during subscription:

  • IP address of the accessing computer
  • Data and time of registration

During the registration process, your consent will be obtained for data processing and reference will be made to this privacy policy.

In the context of data processing for newsletter mailing, data will not be transferred to third parties. The data will exclusively be used to mail the newsletter.

  1. Legal basis for data processing

The legal basis for the processing of data after the user subscribes to the newsletter if consent has been granted is Art. 6 (1)(a) GDPR.

  1. Purpose of data processing

The user’s e-mail address is collected in order to send the newsletter. Other personal data is collected during the subscription process in order to prevent misuse of the services or e-mail address used.

  1. Duration of storage

The data will be erased as soon as it is no longer required to fulfil the purpose for which it was collected. The user’s e-mail address will then be stored as long as the newsletter subscription is active. Apart from this, the duration of storage is based on the stipulations of tax law and accounting law.

Other personal data collected during the subscription process is generally erased after receiving a declaration of withdrawal.

  1. Right to object and option of removal

The user in question can terminate the newsletter subscription at any time. To this end, a corresponding link is provided in every newsletter. This also enables withdrawal of consent to the storage of personal data collected during the subscription process.

VIII. Cookie Consent

  1. Description and scope of data processing

This website uses Cookie Consent, a cookie service provided by Silktide Ltd, Brunel Parkway Pride Park, Derby, DE24 8HR, UK. Cookie Consent uses so-called “Cookies”. These are text files that are stored on your computer, making it possible to analyse your use of our website. The information generated by the cookie about your use of this website (including your IP address) is generally transferred to a Cookie Consent server and stored there. You can find more information about the use of this data at: https://silktide.com/privacy-policy.

  1. Legal basis for data processing

The legal basis for the processing of personal data using Cookie Consent is Art. 6 (1)(f) GDPR. We have a legitimate interest in improving the functionality and stability of the website.

  1. Purpose of data processing

The data is required for the improvement and analysis of our website. By anonymising the data, this statistical collection is exclusively used to improve our services. You can find more information in Cookie Consent’s privacy policy at https://silktide.com/privacy-policy.

  1. Duration of storage

Data is not stored for longer periods than necessary. Data will be erased after the statistical analysis has been performed. You can find more information at: https://silktide.com/privacy-policy.

  1. Right to object and option of removal

You can prevent the installation of cookies by changing the settings of your browser software accordingly. However, we inform you that in this case it may not be possible to use all features of this website to their full extent. More details are available at: https://silktide.com/privacy-policy.

  1. Active Campaign
  2. Description and scope of data processing

This website uses Active Campaign, a web analysis service of ActiveCampaign, Inc., 1 N Dearborn, 5th Floor, Chicago, Illinois 60602, USA. Active Campaign uses so-called “Cookies”. These are text files that are stored on your computer, making it possible to analyse your use of our website. The information generated by the cookie about your use of this website (including your IP address) is generally transferred to an Active Campaign server in the EU or USA and stored there. Active Campaign has committed to the EU-US Privacy Shield agreement, consult https://www.privacyshield.gov/EU-US-Framework (Art. 45 GDPR).

  1. Legal basis for data processing

The legal basis for the processing of personal data using Active Campaign is Art. 6 (1)(f) GDPR. We have a legitimate interest in improving the functionality and stability of the website.

  1. Purpose of data processing

The data is required for the improvement and analysis of our website. By anonymising the data, this statistical collection is exclusively used to improve our services. You can find more information in Active Campaign’s privacy policy at https://www.activecampaign.com/privacy-policy.

  1. Duration of storage

Data is not stored for longer periods than necessary. Data will be erased after the statistical analysis has been performed. You can find more information at: https://www.activecampaign.com/privacy-policy.

  1. Right to object and option of removal

You can prevent the installation of cookies by changing the settings of your browser software accordingly. However, we inform you that in this case it may not be possible to use all features of this website to their full extent.

  1. Intercom
  2. Description and scope of data processing

This website uses Intercom, a customer information service provided by Intercom, Inc., Intercom R&D Unlimited Company, 55 2nd Street, 4th Floor, San Francisco, California 94105, USA. Intercom has committed to the EU-US Privacy Shield agreement, consult https://www.privacyshield.gov/EU-US-Framework (Art. 45 GDPR). You can find more information about the use of this data at: https://www.intercom.com/.

  1. Legal basis for data processing

The legal basis for the processing of personal data using Intercom is Art. 6 (1)(f) GDPR. We have a legitimate interest in improving the functionality and stability of the website.

  1. Purpose of data processing

The data is required for the improvement and analysis of our website. By anonymising the data, this statistical collection is exclusively used to improve our services. You can find more information in Intercom’s privacy policy at https://www.intercom.com/.

  1. Duration of storage

Data is not stored for longer periods than necessary. Data will be erased after the statistical analysis has been performed. You can find more information at: https://www.intercom.com/.

  1. Right to object and option of removal

You can prevent the installation of cookies by changing the settings of your browser software accordingly. However, we inform you that in this case it may not be possible to use all features of this website to their full extent. More details are available at: https://www.intercom.com/.

  1. Matomo (formerly Piwik)
  2. Description and scope of data processing

This website uses Matomo, an open source software for statistical analysis of user visits provided by Innocraft Ltd., 150 Willis St, 6011 Wellington, New Zealand. Matomo uses so-called “Cookies”. These are text files that are stored on your computer, making it possible to analyse your use of the website. The information generated by the cookie about your use of this website is potentially transferred to servers outside the EU and stored there. The IP address is anonymised immediately after processing and before storage. The information generated by the cookie about the use of this website is not transferred to third parties. You can prevent the installation of cookies by changing the settings of your browser software accordingly. However, we inform you that in this case it may not be possible to use all features of this website to their full extent. You can find more details in the privacy policy at: https://matomo.org/privacy-policy.

  1. Legal basis for data processing

The legal basis for the processing of personal data using Google Analytics is Art. 6 (1)(f) GDPR. We have a legitimate interest in improving the functionality and stability of the website.

  1. Purpose of data processing

The data is required for the improvement and analysis of our website. By anonymising the data, this statistical collection is exclusively used to improve our services. You can find more information in Matomo’s privacy policy at https://matomo.org/privacy-policy.

  1. Duration of storage

Data is not stored for longer periods than necessary. Data will be erased after the statistical analysis has been performed. You can find more information at: https://matomo.org/privacy-policy.

  1. Right to object and option of removal

You can prevent the installation of cookies by changing the settings of your browser software accordingly. However, we inform you that in this case it may not be possible to use all features of this website to their full extent.

XII. Hotjar

  1. Description and scope of data processing

This website uses hotjar, a web analysis service provided by Hotjar Ltd, Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta. You can find more information about the use of this data at: https://www.hotjar.com/legal/policies/privacy.

  1. Legal basis for data processing

The legal basis for the processing of personal data using Hotjar is Art. 6 (1)(f) GDPR. We have a legitimate interest in improving the functionality and stability of the website.

  1. Purpose of data processing

The data is required for the improvement and analysis of our website. By anonymising the data, this statistical collection is exclusively used to improve our services. You can find more information in Hotjar’s privacy policy at https://www.hotjar.com/legal/policies/privacy.

  1. Duration of storage

Data is not stored for longer periods than necessary. Data will be erased after the statistical analysis has been performed. You can find more information at: https://www.hotjar.com/legal/policies/privacy.

  1. Right to object and option of removal

You can prevent the installation of cookies by changing the settings of your browser software accordingly. However, we inform you that in this case it may not be possible to use all features of this website to their full extent. You can find more information at: https://www.hotjar.com/legal/compliance/opt-out.

XIII. Facebook Plugin

  1. Description and scope of data processing

This website uses social media plugins (“Plugins”) for the social network facebook.com, which is operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA (“Facebook”). The plugins are labeled with a Facebook logo, the “Like” button or the additional text “Facebook social media plugin”.

If you access a page on our website that contains one of these plugins, your browser creates a direct connection with the servers of Facebook if you click on the plugin. If you like, you can also grant your consent under data protection law to the transfer of data to Facebook.

The content of the plugins is directly sent to your browser by Facebook and embedded into the website. Embedding plugins means that Facebook will be informed that you have visited the corresponding page of our website. If you are logged in to Facebook, Facebook can attribute the visit to your Facebook account. If you interact with the plugins, for instance by pressing the “Like” button or publishing a comment, the relevant information will be transmitted by your browser directly to Facebook and stored there, potentially on servers in the USA. Facebook has committed to the EU-US Privacy Shield agreement, consult https://www.privacyshield.gov/EUUS-Framework (Art. 45 GDPR).

  1. Legal basis for data processing

The legal basis for the processing of data is Art. 6 (1)(a) GDPR.

  1. Purpose of data processing

The purpose of data processing is networking and publicizing our website. Please consult the purpose and scope of data collection and further processing and use of data by Facebook, as well as your rights and optional settings in this regard to protect your privacy, in Facebook’s privacy policy at https://www.facebook.com/about/privacy/update.

  1. Duration of storage

Facebook collects data in this process. The duration of storage is independent of our operation and thus unknown to us. Apart from this, the duration of storage is based on the stipulations of tax law and accounting law.

  1. Right to object and option of removal

If you do not wish for Facebook to collect data concerning you on our website, you must log out of Facebook before visiting our website. After clicking on the plugin, the data is stored without possibility of withdrawal or can only be erased by Facebook.

XIV. Instagram

  1. Description and scope of data processing

This website uses social media plugins for the social network Instagram, which is operated by Instagram LLC, 1601 Willow Rd, Menlo Park CA, 94025 USA. The embedded “Insta” button on this website informs Instagram that you have visited our website. If you are already logged into Instagram, Instagram can attribute your visit to our website with your Instagram account and link this data together. The data transmitted by clicking on the “Insta” button is stored by Instagram.

  1. Legal basis for data processing

The legal basis for the processing of data is Art. 6 (1)(a) GDPR.

  1. Purpose of data processing

Please consult the purpose and scope of data collection and further processing and use of data by Instagram, as well as your rights and optional settings in this regard to protect your privacy, in Instagram’s privacy policy at https://help.instagram.com/519522125107875?help.

  1. Duration of storage

Instagram collects data in this process. The duration of storage is independent of our operation and thus unknown to us. Apart from this, the duration of storage is based on the stipulations of tax law and accounting law.

  1. Right to object and option of removal

If you have an Instagram account and would not like Instagram to collect data concerning you on this website and link such data with your account data stored with Instagram, you must log out of Instagram before visiting the website. After clicking on the plugin, the data is stored without possibility of withdrawal or can only be erased by Instagram.

  1. Twitter
  2. Description and scope of data processing

This website uses features of the Twitter service. These features are provided by Twitter Inc., 1355 Market St, Suite 900, San Francisco, CA 94103, USA. By using Twitter and the “Retweet” function, the websites you visit are linked with your Twitter account and disclosed to other users. In this process, data is also transmitted to Twitter in the USA. Twitter has committed to the EU-US Privacy Shield agreement, consult https://www.privacyshield.gov/EU-USFramework (Art. 45 GDPR).

We hereby inform you that, as the website operator, we have no knowledge concerning the content of the data transmitted or how it is used by Twitter. You can find more information in Twitter’s privacy policy at https://twitter.com/de/privacy.

  1. Legal basis for data processing

The legal basis for the processing of data is Art. 6 (1)(a) GDPR.

  1. Purpose of data processing

The purpose of data processing is networking and publicizing our website. Please consult the purpose and scope of data collection and further processing and use of data by Twitter as well as your rights and optional settings in this regard to protect your privacy, in Twitter’s privacy policy at https://twitter.com/de/privacy.

  1. Duration of storage

Twitter collects data in this process. The duration of storage is independent of our operation and thus unknown to us. Apart from this, the duration of storage is based on the stipulations of tax law and accounting law.

  1. Right to object and option of removal

You can modify your data protection settings for Twitter in your account settings at http://twitter.com/account/settings. After clicking on the plugin, the data is stored without possibility of withdrawal or can only be erased by Twitter.

XVI. Google Fonts

  1. Description and scope of data processing

For unified display of typefaces, this website uses the so-called Web Fonts that are provided by Google LLC., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. When accessing a page, your browser loads the necessary Web Fonts in your browser cache to display texts and fonts correctly and as desired. To this end, the browser you use must establish a connection to the Google servers. In this way, Google obtains knowledge that your IP address has accessed our website. If your browser does not support Web Fonts, your computer will use a standard font.

The information generated by the information call about your use of this website (including your IP address) is generally transferred to a Google server in the EU or USA and stored there. Google has committed to the EU-US Privacy Shield agreement, consult https://www.privacyshield.gov/EU-US-Framework (Art. 45 GDPR). You can find more information in Google’s privacy policy at https://policies.google.com/privacy?hl=de.

  1. Legal basis for data processing

Google Web Fonts is used in the interest of a unified and attractive display of our website. This constitutes a legitimate interest within the meaning of Art. 6 (1)(f) GDPR.

  1. Purpose of data processing

The purpose of use is the unified and attractive display of our website.

  1. Duration of storage

We do not store the data in this process. Regarding the storage of data by Google, we refer to the privacy policy: https://policies.google.com/privacy?hl=de.

  1. Right to object and option of removal

Since we do not collect any data in this context, withdrawal is not possible. Apart from this, we refer to the right to object against Google. Contact for this purpose: https://www.google.de/contact/impressum.html.

XVII. Rights of the data subject

For the processing of personal data, you are a data subject within the meaning of the GDPR and have the following rights with respect to the controller:

  1. Right of the data subject to access information

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

  • a) The purposes of the processing;
  • b) The categories of personal data concerned;
  • c) The recipients or categories of recipient to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations;
  • d) Where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
  • e) The existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
  • f) The right to lodge a complaint with a supervisory authority;
  • g) Where the personal data is not collected from the data subject, any available information as to their source;
  • h) The existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Where personal data is transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer.

In case of processing for scientific or historical research purposes or statistical purposes, this right can be restricted insofar as this would make impossible or significantly impede the research or statistical purposes and the restriction is necessary in order to fulfill the research or statistical purposes.

  1. Right to rectification

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

In case of processing for scientific or historical research purposes or statistical purposes, this right can be restricted insofar as this would make impossible or significantly impede the research or statistical purposes and the restriction is necessary in order to fulfill the research or statistical purposes.

  1. Right to erasure

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

  • a) The personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • b) The data subject withdraws consent on which the processing is based according to Article 6 (1)(a) GDPR, or Article 9(2)(a) GDPR, and where there is no other legal ground for the processing.
  • c) The data subject objects to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) GDPR.
  • d) Host name of the accessing computer
  • e) Time and date of server request
  • d) The personal data has been unlawfully processed.
  • e) The personal data has to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
  • f) The personal data has been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

Where the controller has made the personal data public and is obliged pursuant to the above paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, this personal data.

The above paragraphs 1 and 2 shall not apply to the extent that processing is necessary

  • a) For exercising the right of freedom of expression and information;
  • b) For compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  • c) For reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) GDPR as well as Article 9(3) GDPR;
  • d) For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) GDPR in so far as the right referred to in paragraph 1 above is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
  • e) For the assertion, exercise or defence of legal claims.
  1. Right to restriction of processing

The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:

  • a) The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
  • b) The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of is use instead;
  • c) The controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims;
  • d) The data subject has objected to processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where processing has been restricted under paragraph 1 above, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

A data subject who has obtained restriction of processing pursuant to paragraph 1 above shall be informed by the controller before the restriction of processing is lifted.

In case of processing for scientific or historical research purposes or statistical purposes, this right can be restricted insofar as this would make impossible or significantly impede the research or statistical purposes and the restriction is necessary in order to fulfill the research or statistical purposes.

  1. Right to be informed

The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 GDPR to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.

  1. Right to data portability

The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit this data to another controller without hindrance from the controller to which the personal data has been provided, where:

  • a) the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(b)
  • GDPR or on a contract pursuant to Article 6(1)(b) GDPR and
  • c) The processing is carried out by automated means.

In exercising his or her right to data portability pursuant to the above paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to the right to erasure of data. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

  1. Right to withdraw consent for data processing

You have the right to withdraw your consent to data processing at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

  1. Right to object

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

 Where personal data is processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.

Where personal data is processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) (GDPR), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest. This right of objection can be restricted insofar as this would make impossible or significantly impede the research or statistical purposes and the restriction is necessary in order to fulfill the research or statistical purposes.

  1. Automated individual decision-making, including profiling

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

The above paragraph 1 shall not apply if the decision:

  • a) Is necessary for entering into, or performance of, a contract between the data subject and a data controller;
  • b) Is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or
  • c) Is based on the data subject’s explicit consent.

In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1) GDPR, unless Article 9(2)(a) or (g) GDPR applies and suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place.

  1. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this regulation.

The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 GDPR.