This is an English translation for convenience. The German version is legally binding.
Privacy notice of ELOQUIA GmbH
The controller within the meaning of the General Data Protection Regulation, of other data protection laws applicable in the Member States of the European Union and of other provisions of a data-protection nature is:
ELOQUIA GmbH
Kaiserstraße Nr. 10
60311 Frankfurt am Main
Telefon: +49 (0)69 23 00 20
Telefax: +49 (0)69 23 39 20
Webseite: www.eloquia.com
E-Mail: info@eloquia.com
The data protection officer of the controller is:
Herr Rechtsanwalt Jens Engelhardt und als Stellvertreter Herr Rechtsanwalt Prof. Sven Kolja Braune
c/o Notos Xperts GmbH
Heidelberger Str. 6
64283 Darmstadt
E-Mail: datenschutz@notos-xperts.de
Any data subject may contact our data protection officer directly at any time with all questions and suggestions concerning data protection.
The privacy notice of Eloquia GmbH is based on the terms defined in the General Data Protection Regulation (GDPR). Our privacy notice is intended to be easy to read and understand. To ensure this, we explain the terms used in advance:
Personal data means any information relating to an identified or identifiable natural person (hereinafter the “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Data subject means any identified or identifiable natural person whose personal data are processed by the controller.
Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Restriction of processing means the marking of stored personal data with the aim of limiting their processing in the future.
Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
Controller or controller responsible for the processing means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Recipient means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.
Third party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
Consent means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Data protection, data security and confidentiality are a high priority for Eloquia GmbH. The lasting protection of your personal data, your company data and your business secrets is particularly important to us.
In principle you can visit our website without providing any information about your person. However, if you wish to make use of our company’s services via our website, this makes the provision of your personal data necessary. As a rule, we use the data you provide and the data collected by the website and stored during use exclusively for our own purposes, namely to operate and provide our website and to initiate, carry out and process the services/offers provided via the website (performance of a contract), and we do not pass these on to outside third parties unless there is an officially ordered obligation to do so. In all other cases we obtain your separate consent.
The processing of your personal data takes place in accordance with the requirements of the General Data Protection Regulation and in compliance with the country-specific data protection provisions applicable to Eloquia GmbH. By means of this privacy notice we wish to inform you about the nature, scope and purpose of the personal data we process. In addition, we use this privacy notice to inform you of the rights to which you are entitled.
Eloquia GmbH has implemented technical and organisational measures to ensure an appropriate level of protection for the personal data processed via this website. Nevertheless, internet-based data transmissions can in principle have security gaps, so that absolute protection cannot be guaranteed.
Each time the website of Eloquia GmbH is accessed by a data subject or an automated system, it collects a range of general data and information. This general data and information is stored in the server log files. The following may be recorded: (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (so-called referrer), (4) the sub-pages accessed via an accessing system on our website, (5) the date and time of access to the website, (6) an Internet Protocol address (IP address), (7) the internet service provider of the accessing system, and (8) other similar data and information that serve to avert danger in the event of attacks on our information-technology systems.
When using this general data and information, Eloquia GmbH does not draw any conclusions about the data subject. Rather, this information is needed in order to (1) deliver the contents of our website correctly, (2) optimise the contents of our website and the advertising for it, (3) ensure the lasting functionality of our information-technology systems and the technology of our website, and (4) provide law enforcement authorities with the information necessary for prosecution in the event of a cyberattack. This anonymously collected data and information is therefore evaluated by Eloquia GmbH both statistically and with the aim of increasing data protection and data security in our company, in order ultimately to ensure an optimal level of protection for the personal data we process. The anonymous data of the server log files is stored separately from all personal data provided by a data subject.
| Date/Data | Legal basis | Purpose of storage | Storage period | Objection / option to remove |
|---|---|---|---|---|
| General system data | Art. 6 (1) (f) GDPR (legitimate interest) | The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the data subject’s computer. For this purpose, the data subject’s IP address must remain stored for the duration of the session. | The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of data collected to provide the website, this is the case when the respective session has ended. In the case of data stored in log files, this is the case after seven days at the latest. Storage beyond this is possible. In this case the data subjects’ IP addresses are deleted or anonymised so that the calling client can no longer be assigned. | No, as it is strictly necessary for the operation of the website |
Our website provides a contact form which can be used for electronic contact. If a data subject takes advantage of this option, the data entered into the input mask is transmitted to us and stored. This data is (e.g.):
*mandatory information
At the time the message is sent, the following data is also stored:
A list of the relevant data follows. Examples may include:
Alternatively, contact via the email address provided is possible. In this case, the personal data of the data subject transmitted with the email is stored.
In this context, no data is passed on to third parties. The data is used exclusively for processing the conversation.
| Date/Data | Legal basis | Purpose of storage | Storage period | Objection / option to remove |
|---|---|---|---|---|
| Data from the contact form and email contact | The legal basis for processing the data in the case of enquiries via the contact form and/or email is as a rule Art. 6 (1) (b) GDPR (performance of a contract; pre-contractual measures); Art. 6 (1) (c) GDPR (fulfilment of a legal obligation, e.g. answering data protection questions) and otherwise Art. 6 (1) (f) GDPR (legitimate interest). | The processing of the personal data from the input mask/email serves us solely to handle the contact. This also constitutes the requisite legitimate interest in processing the data. The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information-technology systems. | The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. For the personal data from the input mask of the contact form and that sent by email, this is the case when the respective conversation with the data subject has ended. The conversation is ended when it can be inferred from the circumstances that the matter concerned has been conclusively clarified. The foregoing does not apply where the correspondence is subject to a commercial-law retention obligation. The personal data additionally collected during the sending process is deleted after a period of seven days at the latest. | The data subject has the option of objecting to the storage of their personal data at any time. In such a case the conversation cannot be continued. |
The newsletter is sent on the basis of your registration on the website using the double-opt-in procedure. When registering for the newsletter, the following data from the input mask is transmitted to us:
In addition, the following data is collected during registration:
For the processing of the data, your consent is obtained during the registration process by way of the double opt-in, and reference is made to this privacy notice.
| Date/Data | Legal basis | Purpose of storage | Storage period | Objection / option to remove |
|---|---|---|---|---|
| Newsletter data pursuant to section 7.1 | The legal basis for processing the data following registration for the newsletter by the data subject, where consent of the data subject is present, is Art. 6 (1) (a) GDPR (consent) | The collection of the data subject’s email address serves to deliver the newsletter. The collection of other personal data during the registration process serves to prevent misuse of the services or of the email address used. | The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. The data subject’s email address is therefore stored for as long as the newsletter subscription is active. The other personal data collected during the registration process is generally deleted after a period of seven days. | The data subject can cancel the newsletter subscription at any time. For this purpose, a corresponding unsubscribe link can be found in every newsletter. Cancelling the subscription also constitutes a withdrawal of consent to the storage of the personal data collected during the registration process. |
We only pass on the personal data we collect to third parties where this is justified under data protection law. You will find specific information on the scope and recipients in the foregoing provisions. Otherwise, we only disclose your personal data to other companies and individuals whom we have engaged to perform individual tasks and services for us. The disclosure of your personal data to these companies is limited to the extent necessary to perform their activity. These companies are likewise bound by the data protection regulations, have been carefully selected by us and are regularly monitored by us. Beyond this, we only pass on your personal data to third parties insofar as we are required to do so by law or by court order.
We expressly draw your attention to your right of withdrawal (newsletter) pursuant to section 13.8.
We collect and process the personal data of applicants for the purpose of handling the application procedure. Processing may also be carried out by electronic means. This is in particular the case where an applicant submits the relevant application documents to us by electronic means, for example by email. If we conclude an employment contract with you as an applicant, the data transmitted is stored for the purpose of handling the employment relationship in compliance with the statutory provisions. If the controller does not conclude an employment contract with the applicant, the application documents are automatically deleted six months after notification of the rejection decision, provided that no other legitimate interests of the controller stand in the way of deletion. Other legitimate interest in this sense is, for example, an obligation to provide evidence in proceedings under the General Equal Treatment Act (AGG).
| Date/Data | Legal basis | Purpose of storage | Storage period | Objection / option to remove |
|---|---|---|---|---|
| Data in applications and in the application procedure | The legal basis for processing the data is as a rule Art. 6 (1) (b) GDPR (performance of the employment contract; pre-employment-contract measures); Art. 6 (1) (c) GDPR (fulfilment of a legal obligation, e.g. answering questions about the application procedure) and otherwise Art. 6 (1) (f) GDPR (legitimate interest) as well as special statutory authorisation provisions such as collective agreements, works agreements, the Income Tax Act, etc. Reference is additionally made to the record of processing activities for Personnel/HR. | If we conclude an employment contract with you as an applicant, the data transmitted is stored for the purpose of handling the employment relationship in compliance with the statutory provisions. | If the controller does not conclude an employment contract with the applicant, the application documents are automatically deleted six months after notification of the rejection decision, provided that no other legitimate interests of the controller stand in the way of deletion. Other legitimate interest in this sense is, for example, an obligation to provide evidence in proceedings under the General Equal Treatment Act (AGG). | Only general options for objection and removal. |
On our website we offer the option of booking language and preparation courses online via the software of semcosoft. The following data of yours is processed in this context:
Contact data
Address data
| Date/Data | Legal basis | Purpose of storage | Storage period | Objection / option to remove |
|---|---|---|---|---|
| Booking data pursuant to section 9 | The legal basis for processing the booking data is Art. 6 (1) (b) GDPR (performance of a contract) | The processing of the data serves exclusively to perform the contract | The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. | Termination of the contract |
10.1 Description and scope of the data processing
Our website uses cookies. Cookies are text files that are stored in or by the internet browser on the computer system of the data subject. If a data subject accesses a website, a cookie may be stored on the data subject’s operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is accessed again.
We use cookies to make our website more user-friendly. Some elements of our website require the calling browser to be identifiable even after a change of page.
The following data is stored and transmitted in the cookies:
In addition, we use cookies on our website that enable an analysis of the browsing behaviour of data subjects.
In this way the following data can be transmitted:
The data of the data subjects collected in this way is pseudonymised by technical means. The data can therefore no longer be assigned to the calling data subject. The data is not stored together with other personal data of the data subjects.
When our website is accessed, the data subjects are informed about the use of cookies for analysis purposes by an information banner and referred to this privacy notice. In this context, reference is also made to how the storage of cookies can be prevented in the browser settings.
Using the following links, you can find out how to deactivate cookies in the most important browsers:
When our website is accessed, the data subject is informed about the use of cookies for analysis purposes and his or her consent to the processing of the personal data used in this context is obtained. Reference is also made in this context to this privacy notice.
| Date/Data | Legal basis | Purpose of storage | Storage period | Objection / option to remove |
|---|---|---|---|---|
| Cookies | Art. 6 (1) (f) GDPR (legitimate interests) for technically strictly necessary cookies; otherwise: Art. 6 (1) (a) GDPR (consent) | The purpose of using technically necessary cookies is to make the use of websites easier for data subjects. Some functions of our website cannot be offered without the use of cookies. For these it is necessary for the browser to be recognised even after a change of page. The analysis cookies are used for the purpose of improving the quality of our website and its contents. Through the analysis cookies we learn how the website is used and can thus continuously optimise our offering. These purposes also constitute our legitimate interest in processing the personal data under Art. 6 (1) (f) GDPR. | Cookies are stored on the data subject’s computer and transmitted by it to our site. As a data subject you therefore also have full control over the use of cookies. | By changing the settings in your internet browser you can deactivate or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all the functions of the website to their full extent. The transmission of Flash cookies cannot be prevented via the browser settings, but can be prevented by changing the settings of the Flash Player |
11.1 Data protection provisions on the use of Google Analytics (with anonymisation function)
On this website we have integrated the Google Analytics component (with anonymisation function). Google Analytics is a web analysis service. Web analysis is the collection, gathering and evaluation of data about the behaviour of visitors to websites. A web analysis service records, among other things, data about which website a data subject came to a website from (so-called referrer), which sub-pages of the website were accessed, or how often and for what duration a sub-page was viewed. Web analysis is used predominantly to optimise a website and for the cost-benefit analysis of internet advertising.
The operating company of the Google Analytics component is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.
For web analysis via Google Analytics, the controller uses the addition “_gat._anonymizeIp”. By means of this addition, the IP address of the data subject’s internet connection is shortened and anonymised by Google if access to our website takes place from a Member State of the European Union or from another contracting state of the Agreement on the European Economic Area.
The purpose of the Google Analytics component is to analyse the flow of visitors to our website. Google uses the data and information obtained, among other things, to evaluate the use of our website, to compile online reports for us showing the activities on our website, and to provide further services connected with the use of our website.
Google Analytics places a cookie on the information-technology system of the data subject. What cookies are has already been explained above. By placing the cookie, Google is enabled to analyse the use of our website. Each time one of the individual pages of this website operated by the controller and on which a Google Analytics component has been integrated is accessed, the internet browser on the information-technology system of the data subject is automatically prompted by the respective Google Analytics component to transmit data to Google for the purpose of online analysis. In the course of this technical procedure, Google obtains knowledge of personal data, such as the IP address of the data subject, which Google uses, among other things, to trace the origin of visitors and clicks and subsequently to enable commission settlements.
By means of the cookie, personal information, for example the time of access, the location from which an access was made and the frequency of visits to our website by the data subject, is stored. On each visit to our website, this personal data, including the IP address of the internet connection used by the data subject, is transmitted to Google in the United States of America. This personal data is stored by Google in the United States of America. Google may pass on this personal data collected via the technical procedure to third parties.
The data subject can prevent the placing of cookies by our website, as already shown above, at any time by means of a corresponding setting of the internet browser used and thereby permanently object to the placing of cookies. Such a setting of the internet browser used would also prevent Google from placing a cookie on the information-technology system of the data subject. In addition, a cookie already placed by Google Analytics can be deleted at any time via the internet browser or other software programmes.
Furthermore, the data subject has the option of objecting to and preventing the collection of the data generated by Google Analytics relating to the use of this website as well as the processing of this data by Google. To do so, the data subject must download and install a browser add-on under the link https://tools.google.com/dlpage/gaoptout. This browser add-on informs Google Analytics via JavaScript that no data and information about visits to websites may be transmitted to Google Analytics. The installation of the browser add-on is regarded by Google as an objection. If the information-technology system of the data subject is deleted, formatted or reinstalled at a later point in time, the data subject must reinstall the browser add-on in order to deactivate Google Analytics. If the browser add-on is uninstalled or deactivated by the data subject or another person attributable to their sphere of control, there is the option of reinstalling or reactivating the browser add-on.
Further information and the applicable data protection provisions of Google can be accessed at https://www.google.de/intl/de/policies/privacy/ and at http://www.google.com/analytics/terms/de.html. Google Analytics is explained in more detail under this link https://www.google.com/intl/de_de/analytics/.
11.2 Data protection provisions on the use of Matomo (with anonymisation function)
Our website uses the web analysis service Matomo in order to be able to analyse and regularly improve the use of our website. Through the statistics obtained we can improve our offering and make it more attractive for you as a data subject.
For this evaluation, cookies are stored on your computer. The information collected in this way is stored by the controller exclusively on its server in Germany. You can stop the evaluation by deleting existing cookies and preventing the storage of cookies. If you prevent the storage of cookies, we point out that you may not be able to use this website to its full extent. Preventing the storage of cookies is possible by adjusting the settings in your browser. Preventing the use of Matomo is possible by removing the following tick and thereby activating the opt-out plug-in: [Matomo iFrame].
This website uses Matomo with the “AnonymizeIP” extension. As a result, IP addresses are processed in shortened form, so that direct attribution to a person can be ruled out. The IP address transmitted by your browser by means of Matomo is not merged with other data collected by us.
The Matomo programme is an open-source project. Information from the third-party provider on data protection can be found at https://matomo.org/privacy-policy/.
| Date/Data | Legal basis | Purpose of storage | Storage period | Objection / option to remove |
|---|---|---|---|---|
| Data transmission via third-party cookies | Art. 6 (1) (f) GDPR (legitimate interest) | The purpose of and legitimate interest in setting third-party cookies is to improve our offering for you by analysing your user behaviour. As a rule, only a pseudonymised transmission of data to the third parties takes place. Otherwise, it is in your own hands to prevent a transmission of third-party cookies by means of a corresponding setting of your internet browser. Please compare the details under sections 10–12 individually. | Third-party cookies are stored on the data subject’s computer and transmitted by it to our site. As a data subject you therefore also have full control over the use of third-party cookies. | By changing the settings in your internet browser you can deactivate or restrict the transmission of third-party cookies. Third-party cookies that have already been stored can be deleted at any time. This can also be done automatically. The transmission of Flash cookies cannot be prevented via the browser settings, but can be prevented by changing the settings of the Flash Player |
12.1 Data protection provisions on the use of Google Maps
On this website we use the service offered by Google Maps. This allows us to display interactive maps directly within the website and enables you to make convenient use of the map function.
By visiting the website, Google receives the information that you have accessed the relevant sub-page of our website. In addition, only the technically necessary data is transmitted. This takes place regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data is assigned directly to your account. If you do not wish the assignment to your profile at Google, you must log out before activating the button. Google stores your data as usage profiles and uses them for the purposes of advertising, market research and/or the needs-based design of its website. Such an evaluation takes place in particular (even for users who are not logged in) to provide needs-based advertising and to inform other data subjects of the social network about your activities on our website. You have a right to object to the creation of these user profiles, whereby you must address Google to exercise it.
Further information on the purpose and scope of the data collection and its processing by the plug-in provider can be found in the provider’s data protection declarations. There you will also find further information about your related rights and setting options for protecting your privacy: http://www.google.de/intl/de/policies/privacy. Google also processes your personal data in the USA and has subjected itself to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.
| Date/Data | Legal basis | Purpose of storage | Storage period | Objection / option to remove |
|---|---|---|---|---|
| Data from the integration of Google Maps pursuant to section 12.1 | The legal basis for processing the data is our legitimate interest pursuant to Art. 6 (1) (f) GDPR. Our legitimate interest arises from the improvement and optimisation of our offering as well as the provision of a function that makes it easier to find locations and our business. | The purpose of the storage is to improve our offering, the visual and functional optimisation of the website, and the provision of a function that makes it easier to find locations and our business. | The data is deleted as soon as our legitimate interest no longer exists or we are obliged to delete the data on the basis of statutory or legal orders. | As a data subject you have the option at any time of objecting to the processing of your data pursuant to section 14.7 |
12.2 Note on data processing on our Facebook fan page
We, Eloquia GmbH, operate our own Facebook fan page at https://www.facebook.com/Eloquia/. As the operator of this Facebook page, we are, together with the provider of the social network Facebook (Facebook Ireland Ltd.), a controller within the meaning of Art. 4 No. 7 of the General Data Protection Regulation (GDPR). When our Facebook page is visited, personal data of the page visitors is processed by both controllers.
We have concluded an agreement with Facebook on joint responsibility under data protection law (Page Controller Addendum). With this agreement, Facebook acknowledges the joint responsibility with regard to so-called Insights data and assumes essential data protection obligations relating to the information of data subjects, data security or the reporting of data protection breaches. In addition, the agreement stipulates that Facebook is the primary point of contact for the exercise of data subject rights (Art. 15–22 GDPR). This is because, as the provider of the social network, Facebook alone has the direct access options to the necessary information and can also directly take any necessary measures and provide information. Should our support nevertheless be required, we can be contacted at any time.
In connection with the operation of this Facebook fan page, we use the Facebook Insights function in order to obtain anonymised statistical data about the users of our Facebook fan page. Facebook provides information about Insights and Facebook fan pages, for example via its privacy notices.
In connection with visiting our and other Facebook pages, Facebook also uses cookies and other comparable storage technologies. Further information on the use of cookies by Facebook can be found in its cookie policy.
On our Facebook fan page you also have the option of commenting on and rating our posts and of contacting us via private messages or participating in prize draws.
So that we can better understand how we can better achieve our business objectives with our Facebook page, demographic and geographic evaluations are also created on the basis of the recorded information and made available to us. We can use this information to place targeted interest-based advertisements without obtaining direct knowledge of the identity of the visitor. If visitors use Facebook on several devices, the recording and evaluation can also take place across devices, where these are registered visitors logged in to their own profile. The visitor statistics created are transmitted to us exclusively in anonymised form. We have no access to the underlying data in each case. Furthermore, we use our Facebook page to communicate with our customers, prospective customers and Facebook users and to provide information about us and our products. In this context we may receive further information, e.g. on the basis of user comments, private messages or because you follow us or share our content. The processing takes place exclusively for the purpose of communication and interaction with you. *Your data is deleted when the purpose ceases to apply, provided there is no retention obligation.* Users of Facebook can influence the extent to which their user behaviour when visiting our Facebook page may be recorded under the settings for advertising preferences. Further options are offered by the Facebook settings or the form for the right to object.
It cannot be ruled out that some of the recorded information is also processed outside the European Union by Facebook Inc., based in the USA. Facebook Inc. is certified under the US-EU data protection agreement “Privacy Shield” and thereby undertakes to comply with the European data protection requirements.
We ourselves do not pass on any personal data that we receive via our Facebook page.
For further information on our contact details, including those of our data protection officer, the rights of data subjects vis-à-vis us and how personal data is otherwise processed by us, please refer to the relevant sections of this privacy policy.
13.1 General information on the legal bases
Insofar as we obtain the consent of the data subject for processing operations of personal data, Art. 6 (1) (a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data.
In the case of processing of personal data that is necessary for the performance of a contract to which the data subject is party, Art. 6 (1) (b) GDPR serves as the legal basis. This also applies to processing operations that are necessary for the implementation of pre-contractual measures.
Insofar as processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 (1) (c) GDPR serves as the legal basis.
In the event that vital interests of the data subject or of another natural person make processing of personal data necessary, Art. 6 (1) (d) GDPR serves as the legal basis.
If processing is necessary to safeguard a legitimate interest of our company or of a third party and the interests, fundamental rights and freedoms of the data subject do not override the former interest, Art. 6 (1) (f) GDPR serves as the legal basis for the processing.
13.2 General information on data deletion and storage period
The personal data of the data subject is deleted or blocked as soon as the purpose of the storage ceases to apply. Storage may also take place where this has been provided for by the European or national legislator in Union-law regulations, laws or other provisions to which the controller is subject. The data is also blocked or deleted when a storage period prescribed by the aforementioned norms expires, unless there is a need for further storage of the data for the conclusion or performance of a contract.
If personal data relating to you is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:
14.1 Right of access
You can request confirmation from the controller as to whether personal data relating to you is being processed by us.
If such processing is taking place, you can request information from the controller about the following:
You have the right to request information as to whether the personal data relating to you is transferred to a third country or to an international organisation. In this connection, you can request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.
14.2 Right to rectification
You have a right to rectification and/or completion vis-à-vis the controller, where the processed personal data relating to you is inaccurate or incomplete. The controller must carry out the rectification without undue delay.
14.3 Right to restriction of processing
Under the following conditions you can request the restriction of the processing of the personal data relating to you:
Where the processing of the personal data relating to you has been restricted, this data may – apart from being stored – only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the Union or of a Member State.
Where the restriction of processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.
14.4 Right to erasure
14.4.1 Obligation to erase
You can request the controller to erase the personal data relating to you without undue delay, and the controller is obliged to erase this data without undue delay where one of the following grounds applies:
14.4.2 Information to third parties
Where the controller has made the personal data relating to you public and is obliged to erase it pursuant to Art. 17 (1) GDPR, it shall, taking account of available technology and the cost of implementation, take reasonable measures, including technical measures, to inform controllers which are processing the personal data that you, as a data subject, have requested the erasure by them of any links to, or copies or replications of, this personal data.
14.4.3 Exceptions
The right to erasure does not exist insofar as processing is necessary
Furthermore, the right to erasure does not exist insofar as the personal data must be stored by the controller on the basis of statutory retention obligations and periods. In such a case, the personal data is blocked instead of erased.
14.5 Right to information
If you have asserted the right to rectification, erasure or restriction of processing vis-à-vis the controller, the controller is obliged to communicate this rectification or erasure of the data or restriction of processing to all recipients to whom the personal data relating to you has been disclosed, unless this proves impossible or involves disproportionate effort.
You have the right vis-à-vis the controller to be informed about these recipients.
14.6 Right to data portability
You have the right to receive the personal data relating to you which you have provided to the controller in a structured, commonly used, machine-readable and interoperable format. In addition, you have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, where
In exercising this right, you also have the right to have the personal data relating to you transmitted directly from one controller to another, where technically feasible. The freedoms and rights of other persons may not be adversely affected by this.
The right to data portability does not apply to processing of personal data which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
14.7 Right to object
You have the right, on grounds relating to your particular situation, to object at any time to the processing of the personal data relating to you which is carried out on the basis of Art. 6 (1) (e) or (f) GDPR; this also applies to profiling based on these provisions.
The controller shall no longer process the personal data relating to you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
If the personal data relating to you is processed for direct marketing purposes, you have the right to object at any time to the processing of the personal data relating to you for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing.
If you object to the processing for direct marketing purposes, the personal data relating to you will no longer be processed for these purposes.
You have the option, in connection with the use of information society services – notwithstanding Directive 2002/58/EC – of exercising your right to object by automated means using technical specifications.
14.8 Right to withdraw the data protection consent declaration
You have the right to withdraw your data protection consent declaration at any time and without giving reasons. In the event of withdrawal, we will delete your personal data without undue delay and no longer process it. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the withdrawal.
14.9 Automated decision in individual cases including profiling
You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision
However, these decisions may not be based on special categories of personal data pursuant to Art. 9 (1) GDPR, unless Art. 9 (2) (a) or (g) applies and suitable measures to safeguard the rights and freedoms as well as your legitimate interests have been taken.
With regard to the cases referred to in (1) and (3), the controller takes suitable measures to safeguard the rights and freedoms as well as your legitimate interests, which include at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.
14.10 Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of the personal data relating to you infringes the GDPR.
The supervisory authority with which the complaint has been lodged shall inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
Status: 29.10.2018
Responsible body: Eloquia GmbH