If personal data is processed by you, you are the data subject within the meaning of the GDPR and you have the following rights in relation to us:
1. Right to be informed
You may request confirmation from us as to whether personal data relating to you will be processed by us.
In the event of such processing, you may request the following information from us:
(1) the purposes for which the personal data will be processed;
(2) the categories of personal data processed;
(3) the recipients or categories of recipients to whom the personal data relating to you has been or will be disclosed;
(4) the planned duration of the storage of the personal data relating to you or, if it is not possible to provide specific information in this regard, criteria for determining the duration of the storage;
(5) the existence of a right to have your personal data corrected or deleted, a right to limit our processing or a right to object to such processing;
(6) the existence of a right of appeal to a supervisory authority;
(7) all available information about the origin of the data, if the personal data are not collected from the data subject;
(8) the existence of automated decision-making including profiling in accordance with Art. 22 Para. 1 and 4 GDPR and - at least in these cases - meaningful information on the logic involved and the scope and intended effects of such processing for the data subject.
You have the right to request information as to whether the personal data concerning you will be transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 DG in connection with the transfer.
2. Right of rectification
You have a right of rectification and/or integration with us if the personal data processed concerning you is inaccurate or incomplete. We will have to carry out the rectification immediately.
3. Right to restriction of processing
You may request the restriction of the processing of your personal data relating to you under the following conditions:
(1)You contest the accuracy of the personal data relating to you, for a period enabling the controller to verify the accuracy of the personal data;
(2)The processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
(3)The controller no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims; or
(4)You have objected to processing pursuant to Article 21 (1) GDPR pending the verification whether the legitimate grounds of the controller override your reasons.
If the processing of personal data relating to you has been restricted, this data – with the exception of storage – may only be processed with your consent or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.
If the processing restriction has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction will be removed.
4. Right to erasure
a) Erasure obligation
You can demand that the controller deletes your personal data relating to you without undue delay, and the controller shall have the obligation to erase this data without undue delay where one of the following grounds applies:
(1)The personal data relating to you are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
(2)You withdraw consent on which the processing is based according to point (a) of Article 6 (1), or point (a) of Article 9 (2) GDPR, and there is no other legal ground for the processing.
(3)You object to the processing pursuant to Article 21 (1) GDPR, and there are no overriding legitimate grounds for processing, or you object to the processing pursuant to Article 21 (2) GDPR.
(4)The personal data relating to you have been processed unlawfully.
(5)The erasure of the personal data relating to you is required to fulfil a legal obligation under Union or Member State law, to which the controller is subject.
(6)The personal data relating to you have been collected in relation to the offer of information society services referred to in Article 8 (1) GDPR.
b) Information to third parties
Where the controller has made the personal data public and is obligated to erase the personal data pursuant to Article 17 (1) GDPR, the controller, taking available technology and the cost of implementation into account, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you, as the data subject, have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
The right to erasure does not apply to the extent that the processing is necessary.
(1)for exercising the right of freedom of expression and information;
(2)for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in exercising official authority vested in the controller;
(3)for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9 (2) as well as Article 9 (3) GDPR;
(4)for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89 (1) of the GDPR, in so far as the law referred to in subparagraph a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
(5)for the establishment, exercise or defence of legal claims.
5. Right to be informed
If you have exercised your right to obtain from the controller the rectification, erasure or restriction of processing, it is obliged to notify all recipients to whom your personal data have been disclosed about the rectification or erasure of the data or restriction of processing, unless this proves to be impossible or involves a disproportionate effort.
You have the right to be informed by the controller about these recipients.
6. Right to object
You have the right at any time, for reasons that arise from your particular situation, to object to the processing of personal data concerning you which is based on point (e) or (f) of Article 6 (1) GDPR, including profiling based on those provisions. The controller will no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
7. Right to revoke your declaration of consent concerning data privacy
You have the right to revoke your declaration of consent under data protection law at any time. The revocation of your consent does not affect the legality of the processing carried out on the basis of your consent until you revoke it.
8. Right to complain to a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to complain to a supervisory authority, in particular in the Member State of your residence, place of work or place of alleged infringement, if you believe that the processing of the personal data concerning you infringes the GDPR.
The supervisory authority to which the complaint has been submitted shall inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy in accordance with Article 78 of the GDPR.
The responsible supervisory authority is the Bavarian State Office for Data Protection Supervision.