Privacy Policy

The processing of personal data, on the free movement of such data and repealing Directive 95/46/EC (the General Data Protection Regulation - DSGVO), the German Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG) and other data-related laws [e.g. the German Telemedia Act (Telemediengesetz - TMG)] are stored and processed by us.# Privacy policy

The protection of your privacy while using our website is very important to us. In the following, we therefore inform you about the collection of anonymous and personal data.

1) Provider / responsible party in terms of data protection

This app is a service of the company

SILPION IT-Solutions GmbH

Brandshofer Deich 48
20539 Hamburg

Phone: +49 (40) 39 99 76 50
Fax: +49 (40) 39 99 76 40

Email: info-at-komm-kickern.de Internet: www.silpion.de

represented by the managing directors Patrick Postel and Oliver Arne Hammerstein registered in the commercial register of the district court Hamburg under HRB 78585.

2) Data protection officer

ecolaw.de Society for Data Security & Data Protection mbH
represented by the managing director,

Mr. Florian König
Roseggerstrasse 1,
D-38440 Wolfsburg

Phone +49 (0)5361 27 29 293
Fax +49 (0)5361 27 29 296

Datenschutz-at-ecolaw.de
www.ecolaw.de

registered in the commercial register of the district court of Braunschweig under HRB 203444

3) Responsible supervisory authority

the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI),
Klosterwall 6,
20095 Hamburg,

Tel.: 040/142854-4040
Fax: 040/42854-4000

E-mail: mailbox-at-datenschutz.hamburg.de

4) Basic information

Your personal data (e.g. title, name, address, email address, telephone number, bank details) will be processed in compliance with the relevant legal data protection regulations, in particular REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27. April 2016 on the protection of individuals with regard to

According to the DSGVO and other regulations, data processing and use is only permitted if the DSGVO or another legal regulation expressly permits it or if the data subject consents (prohibition with reservation of permission). According to these legal bases, data processing and use is only permitted in particular if.

• a) the data subject has given his/her consent to the processing of personal data relating to him/her for one or more specific purposes;
• b) the processing is necessary for the performance of a contract to which the data subject is party or for the performance of pre-contractual measures taken at the data subject's request;
• c) processing is necessary for compliance with a legal obligation to which the controller is subject;
• d) processing is necessary in order to protect the vital interests of the data subject or another natural person;
• e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• f) processing is necessary for the purposes of the legitimate interests of the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.

Accordingly, we use and process your personal data only within the permissible scope of contract processing or if you have given informed consent.

As a matter of principle, we do not pass on your personal data, including your address and e-mail address, to third parties. Exceptions to this are our service partners who require the transmission of data for the processing of the contractual relationship or if we have expressly indicated this. In these cases, however, the scope of the transmitted data is always limited to the minimum necessary.

5) Anonymous data collection

In principle, you can visit our website without telling us who you are. We only learn the IP address of the requesting computer, the date and time of access, the browser and operating system used, the name of your Internet service provider, the website from which you are visiting us, and the pages of our website that you visit. This information is only evaluated for statistical purposes. As an individual user, you will remain anonymous, and a combination with your personal data will of course not take place unless you have expressly consented to this or one of the cases listed below applies.

Collection of personal data when visiting our website and when using our services in general Personal data is only collected by us if you provide it to us voluntarily and of your own accord. This may be the case, for example, when making an offer or for the execution of a contract, a survey or when registering for services for which registration with personal data should be required (such as for orders, special promotions, etc.). In such cases, we generally only collect the data that we are legally authorized to collect and that is absolutely necessary for the fulfillment of the services you have requested (for example, in the case of ordering processes, this would generally be your name, your address, your telephone number and your e-mail address; when registering for the newsletter, for example, only your e-mail address). If we collect personal data from you (for example, via a contact or order form), then you must always provide only the required data. The mandatory data fields are marked with an asterisk. All additional data provided by you is purely voluntary and does not have to be disclosed by you. If you nevertheless provide this data, then by disclosing it you give us your consent that we may also store and process this data of yours for the purpose stated in each case; in some cases we also request your express consent for purposes under data protection law that require express consent, which you can of course give voluntarily, is not tied to any further requirements and can be revoked at any time for the future.

For the highest possible security of your data, they are transmitted via TLS -encryption in encrypted form. This is to prevent misuse of the data by third parties. Your data will only be stored and processed by us on servers within the European Union. A transfer to third countries does not take place, unless we are entitled and / or obliged to do so by law or you have expressly consented to this in advance. However, these cases are then also clearly marked in each case.

7) Data processing for contract fulfillment

(7.1) Purpose of processing

Within the scope of, for example, our ordering process, you provide us with your personal data. The mandatory data marked with an "asterisk" in this context is personal data that is required for the conclusion of a contract with us. Of course, you are not obliged to provide your personal data. However, without your communication of the required data (in the case of an offer, for example, your address), we can not provide the service requested by you (eg the performance of the contract). In the case of some payment procedures, we require the necessary payment data in order to pass them on to a payment service provider commissioned by us. The processing of your data entered in the ordering process is therefore always for the purpose of fulfilling the contract.

(7.2) Legal basis

The legal basis for this processing is Art. 6 (1) b) DSGVO.

(7.3) Recipient categories

Internally in the Silpion Group, Kickertool GbR, payment service provider, if applicable shipping service provider, if applicable CRM system.

(7.4) Storage period

We store the data required for the processing of the contract until the expiry of the statutory warranty and, if applicable, contractual warranty periods.

We retain the data required by commercial and tax law for the periods specified by law, regularly ten years (cf. § 257 HGB, § 147 AO).

E-mail addresses that we receive solely for the purpose of sending newsletters are deleted immediately as soon as you unsubscribe from the newsletter.

8) Use of cookies

We use cookies on various pages to make visiting our website more attractive and to enable the use of certain functions. These are small text files that are stored on your computer. Most of the cookies we use are deleted from your hard drive at the end of the browser session (so-called session cookies). Other cookies remain on your computer and enable us to recognize your computer on your next visit (so-called permanent cookies). Our partner companies are not permitted to collect, process or use personal data via our website using cookies. The cookies used by Google, for example, are explained here [https://policies.google.com/technologies/types].

8.1) Matomo

On this website, data is collected and stored using the web analysis service software Matomo (www.matomo.org), a service of the provider InnoCraft Ltd, 150 Willis St, 6011 Wellington, New Zealand, ("Mataomo"). Pseudonymized usage profiles can be created and evaluated from this data for the same purpose. Cookies can be used for this purpose. Cookies are small text files that are stored locally in the cache of the site visitor's Internet browser. Among other things, the cookies enable the recognition of the Internet browser. The data collected using Matomo technology (including your pseudonymized IP address) is processed on our servers. .

The information generated by the cookie in the pseudonymous user profile is not used to personally identify the visitor to this website and is not merged with personal data about the bearer of the pseudonym.

If you do not agree to the storage and analysis of this data from your visit, then you can object to the storage and use below at any time by mouse click. In this case, a so-called opt-out cookie is stored in your browser, which means that Matomo does not collect any session data. Please note that the complete deletion of your cookies means that the opt-out cookie is also deleted and may have to be reactivated by you.

9) Integration of third-party services and content

It may happen that third-party content, such as videos from YouTube, maps from Google Maps, RSS feeds or graphics from other websites are integrated within this online offer. This always requires that the providers of this content (hereinafter referred to as "third-party providers") perceive the IP address of the user. Without the IP address, they could not send the content to the browser of the respective user. The IP address is thus necessary for the display of this content. We endeavor to use only such content whose respective providers use the IP address only for the delivery of the content. However, we have no influence if the third-party providers store the IP address, e.g. for statistical purposes. Insofar as this is known to us, we will inform users of this.

10) Revocation of your consent

If you have given us your consent under data protection law for certain data uses and/or services, you can of course revoke this at any time with effect for the future. For this purpose, a simple message to the address given below is sufficient:

SILPION IT-Solutions GmbH

Brandshofer dike 48
20539 Hamburg

Phone: +49 (40) 39 99 76 50
Fax: +49 (40) 39 99 76 40

Email: info-at-komm-kickern.de

11) Your rights as a data subject

You have various rights as a data subject in relation to your personal data. We have taken appropriate measures here as a data controller to provide you as a data subject with all information pursuant to Articles 13 and 14 of the GDPR and all notices pursuant to Articles 15 to 22 and Article 34 of the GDPR that relate to the processing in a precise, transparent, comprehensible and easily accessible form in clear and simple language; this applies in particular to information specifically aimed at children. The information shall be provided in writing or in another form, including electronically where appropriate. If requested by you, the information may also be provided orally, provided that your identity as a data subject has been proven in another form.

Among other things, you are of course entitled at any time to request information in writing or electronically about the data stored about you and its origin, the recipient(s) to whom data is disclosed and the purpose for which it is stored. In addition, you have the right to demand that incorrect data be corrected and, if the legal requirements for this are met, that your data be deleted or blocked. For this purpose, a simple message to the address given below is sufficient:

SILPION IT-Solutions GmbH

Brandshofer dike 48
20539 Hamburg

Phone: +49 (40) 39 99 76 50
Fax: +49 (40) 39 99 76 40

Email: info-at-komm-kickern.de

In detail, you have named the following rights:

11.1) Right to confirmation and information

You can ask us to confirm whether personal data concerning you is being processed by us. If we process data about you, you can request information about the following:

• a) the purposes for which the personal data are processed;
• b) the categories of personal data which are processed;
• c) the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed;
• d) the planned duration of the storage of the personal data concerning you or, if concrete information on this is not possible, criteria for determining the storage period;
• e) the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by us or a right to object to such processing;
• f) the existence of a right of appeal to a supervisory authority;
• g) any available information about the origin of the data, if the personal data are not collected from the data subject;
• h) the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR and, at least in these cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.

Furthermore, you have the right to request information about whether the personal data concerning you is transferred to a third country or to an international organization. In this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 DSGVO in connection with the transfer.

11.2) Right to rectification.

You have a right to rectification and/or completion towards us, insofar as the processed personal data concerning you are inaccurate or incomplete. We must, of course, carry out the rectification without undue delay.

11.3) Right to restriction of processing

You may request the restriction of the processing of personal data concerning you under the following conditions:

• a) if you dispute the accuracy of the personal data concerning you for a period of time that allows us to verify the accuracy of the personal data;
• b) if the processing is unlawful and you refuse the erasure of the personal data and instead request the restriction of the use of the personal data;
• c) if we no longer need the personal data for the purposes of processing, but you require it for the assertion, exercise or defense of legal claims; or
• d) if you have objected to the processing pursuant to Article 21 (1) DSGVO and it has not yet been determined whether the legitimate grounds to which we are entitled override your grounds.

If the processing of personal data relating to you has been restricted, this data may - apart from being stored - only be processed by us or by authorized third parties with your consent or for the assertion, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the Union or a Member State.

If the restriction of processing has been restricted in accordance with the above conditions, we will inform you before the restriction is lifted.

11.4) Right to deletion

a) Obligation to delete

You may request that we delete the personal data concerning you without undue delay, and we are obliged to delete such data without undue delay, if one of the following reasons applies:

• aa) The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
• bb) You revoke your consent on which the processing was based pursuant to Art. 6 (1) a) or Art. 9 (2) a) DSGVO and there is no other legal basis for the processing.
• cc) You object to the processing pursuant to Art. 21 (1) DSGVO and there are no overriding legitimate grounds for the processing or you object to the processing pursuant to Art. 21 (2) DSGVO.
• dd) The personal data concerning you have been processed unlawfully.
• ee) The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union law or the law of the Member States to which we are subject.
• ff) The personal data concerning you has been collected in relation to information society services offered in accordance with Art. 8(1) DSGVO.

b.) Information to third parties

If we have made the personal data concerning you public and we are obliged to erase it pursuant to Art. 17(1) DSGVO, we shall take reasonable steps, including technical measures, having regard to the available technology and the cost of implementation, to inform the data controllers processing the personal data that you, as the data subject, have requested that they erase all links to or copies or replications of such personal data.

c) Exceptions

The right to erasure does not exist to the extent that the processing is necessary

• aa.) for the exercise of the right to freedom of expression and information;
• bb.) for compliance with a legal obligation which requires processing under Union or Member State law to which we are subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
• cc.) for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) and Art. 9(3) DSGVO;
• dd.) for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Art. 89(1) DSGVO, where the right referred to in section a) is likely to render impossible or seriously prejudice the achievement of the purposes of such processing; or
• ee.) for the assertion, exercise or defense of legal claims.

11.5) Right to information

If you have asserted the right to rectification, erasure or restriction of processing against us, we are obliged to inform all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.

You have the right against us to be informed about these recipients.

11.6) Right to data portability

You have the right to receive the personal data concerning you that you have provided to us in a structured, common and machine-readable format. In addition, you have the right to transfer this data to another controller without hindrance, provided that.

• a) the processing is based on consent pursuant to Art. 6 para. 1 lit. a) DSGVO or Art. 9 para. 2 lit. a) DSGVO or on a contract pursuant to Art. 6 para. 1 lit. b) DSGVO and
• b) the processing is carried out with the help of automated procedures.

In exercising this right, you also have the right to have the personal data concerning you transferred directly from us to another controller, insofar as this is technically feasible. Freedoms and rights of other persons must not be affected by this.

The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

11.7) Right of objection

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out on the basis of Art. 6(1)(e) or (f) DSGVO; this also applies to profiling based on these provisions.

We will then no longer process the personal data concerning you, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the assertion, exercise or defense of legal claims.

If the personal data concerning you is processed for the purposes of direct marketing, you have the right to object at any time to processing of personal data concerning you for the purposes of such marketing; this also applies to profiling, insofar as it is related to such direct marketing.

If you object to the processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

You have the possibility, in connection with the use of information society services, notwithstanding Directive 2002/58/EC, to exercise your right to object by means of automated procedures using technical specifications.

11.8) Right to revoke the declaration of consent under data protection law

You have the right to revoke your declaration of consent under data protection law at any time. The revocation of the consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

11.9) Automated decision in individual cases including profiling.

You have the right not to be subject to a decision based solely on automated processing - including profiling - which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

• a) is necessary for the conclusion or performance of a contract between you and us,
• b) is permitted by legal provisions of the Union or the Member States to which we are subject and these legal provisions contain appropriate measures to protect your rights and freedoms as well as your legitimate interests, or
• c) is done with your explicit consent.

However, these decisions must not be based on special categories of personal data pursuant to Art. 9(1) of the GDPR, unless Art. 9(2)(a) or (g) applies and appropriate measures have been taken to protect the rights and freedoms as well as your legitimate interests.

With regard to the cases mentioned in a.) and c.), we take appropriate measures to protect the rights and freedoms as well as your legitimate interests.

11.10) Right to complain to a supervisory authority.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR.

12) E-mail advertising

If you have separately subscribed to the newsletter, your email address will be used for our own advertising purposes until you unsubscribe from the newsletter. You can unsubscribe at any time without incurring any costs other than the transmission costs according to the prime rates of your access provider. The unsubscription is possible at any time directly via the newsletter, by e-mail to info-at-komm-kickern.de.

13) Further information

If you have any further questions or suggestions on the subject of "data protection" with us, or if you would like information about your data or would like to have it corrected or deleted, please write to us by e-mail or letter to:

SILPION IT-Solutions GmbH

Brandshofer dike 48
20539 Hamburg

Phone: +49 (40) 39 99 76 50
fax: +49 (40) 39 99 76 40

Email: info-at-komm-kickern.de

Hamburg, August 2019

---

Excerpt from the Basic Data Protection Regulation (DSGVO):

REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of individuals with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation):

[...]

Article 13

Information obligation when personal data are collected from the data subject

Where personal data are collected from the data subject, the controller shall inform the data subject at the time of collection of such data of the following:

• a) the name and contact details of the data controller and, where applicable, his representative;
• b) the contact details of the data protection officer, if any;
• c) the purposes for which the personal data are to be processed and the legal basis for the processing;
• d) if the processing is based on Article 6(1)(f), the legitimate interests pursued by the controller or a third party;
• e) where applicable, the recipients or categories of recipients of the personal data; and
• f) where applicable, the controller's intention to transfer the personal data to a third country or an international organization and the existence or absence of an adequacy decision by the Commission or, in the case of transfers pursuant to Article 46 or Article 47 or Article 49(1), second subparagraph, a reference to the appropriate or adequate safeguards and how to obtain a copy of them or where they are available.

In addition to the information referred to in paragraph 1, the controller shall provide the data subject, at the time of collection of such data, with the following additional information necessary to ensure fair and transparent processing:

• a) the duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration;
• b) the existence of a right of access on the part of the controller to the personal data concerned, as well as the right to rectification or erasure or to restriction of processing or a right to object to processing, as well as the right to data portability;
• c) if the processing is based on Article 6(1)(a) or Article 9(2)(a), the existence of a right to withdraw consent at any time without affecting the lawfulness of the processing carried out on the basis of consent until withdrawal;
• d) the existence of a right of appeal to a supervisory authority;
• e) whether the provision of the personal data is required by law or by contract or necessary for the conclusion of a contract, whether the data subject is obliged to provide the personal data and what the possible consequences of not providing it would be; and
• f) the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) and, at least in such cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.

If the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject with information about that other purpose and any other relevant information pursuant to paragraph 2 prior to such further processing.

Paragraphs 1, 2 and 3 shall not apply if and to the extent that the data subject already has the information.

Article 14

Information obligation when personal data have not been collected from the data subject

If personal data are not collected from the data subject, the controller shall inform the data subject of the following:

• a) the name and contact details of the data controller and, if applicable, of his representative;
• b) in addition, the contact details of the data protection officer;
• c) the purposes for which the personal data are to be processed and the legal basis for the processing;
• d) the categories of personal data processed;
• e) where applicable, the recipients or categories of recipients of the personal data;
• f) where applicable, the controller's intention to transfer the personal data to a recipient in a third country or an international organization and the existence or absence of an adequacy decision by the Commission or, in the case of transfers pursuant to Article 46 or Article 47 or Article 49(1), second subparagraph, a reference to the appropriate or adequate safeguards and the possibility of obtaining a copy of them or where they are available.

In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing to the data subject:

• a) the duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration;
• b) if the processing is based on Article 6(1)(f), the legitimate interests pursued by the controller or a third party;
• c) the existence of a right of access by the controller to the personal data concerned, as well as the right to rectification or erasure or to restriction of processing and a right to object to processing, as well as the right to data portability;
• d) where the processing is based on Article 6(1)(a) or Article 9(2)(a), the existence of a right to withdraw consent at any time without affecting the lawfulness of the processing carried out on the basis of consent until withdrawal;
• e) the existence of a right of appeal to a supervisory authority;
• f) the source of the personal data and, if applicable, whether it is from publicly available sources;
• g) the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) and, at least in such cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.

The controller shall provide the information referred to in paragraphs 1 and 2

• a) taking into account the specific circumstances of the processing of the personal data, within a reasonable time after obtaining the personal data, but not later than within one month,
• b) if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to him, or,
• c) if the disclosure to another recipient is intended, at the latest at the time of the first disclosure.

If the controller intends to further process the personal data for a purpose other than that for which the personal data were obtained, the controller shall provide the data subject with information about that other purpose and any other relevant information pursuant to paragraph 2 prior to such further processing.

Paragraphs 1 to 4 shall not apply if and to the extent that.

• a) the data subject already has the information,
• b) the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes, subject to the conditions and safeguards referred to in Article 89(1), or insofar as the obligation referred to in paragraph 1 of this Article is likely to make impossible or seriously prejudice the achievement of the purposes of such processing In such cases, the controller shall take appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject, including making such information available to the public,
• (c) the obtaining or disclosure is expressly provided for by Union or Member State law to which the controller is subject and which provides for appropriate measures to protect the data subject's legitimate interests; or
• d) the personal data are subject to professional secrecy, including a statutory duty of confidentiality, in accordance with Union or Member State law and must therefore be treated confidentially.

Article 15

Right of access of the data subject

The data subject shall have the right to obtain from the controller confirmation as to whether personal data concerning him or her are being processed; if this is the case, he or she shall have the right to obtain access to such personal data and to obtain the following information:

• a) the purposes of processing;
• b) the categories of personal data processed;
• c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular in the case of recipients in third countries or international organizations;
• d) if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration;
• e) the existence of a right to obtain the rectification or erasure of personal data concerning him or her, or the restriction of processing by the controller, or a right to object to such processing;
• f) the existence of a right of appeal to a supervisory authority;
• g) if the personal data are not collected from the data subject, any available information on the origin of the data;
• h) the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) and, at least in such cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject. Where personal data are transferred to a third country or to an international organization, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 in connection with the transfer.

The controller shall provide a copy of the personal data that are the subject of the processing. For any additional copies requested by the data subject, the controller may charge a reasonable fee based on the administrative costs. If the data subject makes the request electronically, the information shall be provided in a commonly used electronic format, unless otherwise specified by the data subject.

The right to receive a copy under paragraph 1b shall not interfere with the rights and freedoms of other persons.

Section 3 Correction and deletion

Article 16

Right to rectification

The data subject shall have the right to obtain from the controller the rectification without undue delay of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject has the right to request that incomplete personal data be completed, including by means of a supplementary declaration.

Article 17

Right to erasure ("right to be forgotten").

The data subject shall have the right to obtain from the controller the erasure without delay of personal data concerning him or her, and the controller shall be obliged to erase personal data without delay, where one of the following reasons applies:

• a) The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
• b) The data subject revokes the consent on which the processing was based pursuant to Article 6(1)(a) or Article 9(2)(a) and there is no other legal basis for the processing.
• c) The data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2).
• d) The personal data have been processed unlawfully.
• e) The erasure of the personal data is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
• f) The personal data have been collected in relation to information society services offered in accordance with Article 8(1).

If the controller has made the personal data public and is obliged to erase it pursuant to paragraph 1, it shall take reasonable steps, including technical measures, having regard to the available technology and the cost of implementation, to inform data controllers which process the personal data that a data subject has requested that they erase all links to, or copies or replications of, that personal data.

Paragraphs 1 and 2 shall not apply insofar as the processing is necessary for.

• a) for the exercise of the right to freedom of expression and information;
• b) for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• (c) for reasons of public interest in the field of public health as referred to in Article 9(2)(h) and (i) and Article 9(3);
• d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Article 89(1), where the right referred to in paragraph 1 is likely to make impossible or seriously prejudice the achievement of the purposes of such processing; or
• (e) for the establishment, exercise or defense of legal claims.

Article 18

Right to restriction of processing

The data subject shall have the right to obtain from the controller the restriction of processing where one of the following conditions is met:

• (a) the accuracy of the personal data is contested by the data subject for a period enabling the controller to verify the accuracy of the personal data,
• b) the processing is unlawful and the data subject objects to the erasure of the personal data and requests instead the restriction of the use of the personal data;
• c) the controller no longer needs the personal data for the purposes of the processing, but the data subject needs it for the establishment, exercise or defense of legal claims; or
• d) the data subject has objected to the processing pursuant to Article 21(1), as long as it is not yet established whether the legitimate grounds of the controller override those of the data subject.

Where processing has been restricted in accordance with paragraph 1, such personal data may be processed, except for storage, only with the consent of the data subject or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of substantial public interest of the Union or of a Member State.

A data subject who has obtained a restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction is lifted.

Article 19

Notification obligation in connection with the rectification or erasure of personal data or the restriction of processing

The controller shall notify all recipients to whom personal data have been disclosed of any rectification or erasure of personal data or restriction of processing pursuant to Article 16, Article 17(1) and Article 18, unless this proves impossible or involves a disproportionate effort. The controller shall inform the data subject of these recipients if the data subject so requests.

Article 20

Right to data portability

The data subject shall have the right to obtain personal data concerning him or her which he or she has provided to a controller in a structured, commonly used and machine-readable format, and the right to transmit such data to another controller without hindrance from the controller to whom the personal data have been provided, provided that

• a) the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) or on a contract pursuant to Article 6(1)(b); and
• b) the processing is carried out with the aid of automated procedures.

When exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to obtain that the personal data be transferred directly from one controller to another controller where technically feasible.

The exercise of the right under paragraph 1 of this Article shall be without prejudice to Article 17. This right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The right referred to in paragraph 2 shall not affect the rights and freedoms of other persons.

Section 4 Right to object and automated decision-making in individual cases

Article 21

Right to object

The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her carried out on the basis of Article 6(1)(e) or (f), including any profiling based on those provisions. The controller shall no longer process the personal data unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

If personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing; this also applies to profiling insofar as it is related to such direct marketing.

If the data subject objects to the processing for direct marketing purposes, the personal data will no longer be processed for these purposes.

The data subject shall be expressly informed of the right referred to in paragraphs 1 and 2 at the latest at the time of the first communication with him or her; this information shall be provided in a comprehensible form separate from other information.

In the context of the use of information society services, notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by means of automated procedures using technical specifications.

The data subject shall have the right to object, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her which is carried out for scientific or historical research purposes, or for statistical purposes pursuant to Article 89(1), unless the processing is necessary for the performance of a task carried out in the public interest.

Article 22

Automated decisions in individual cases, including profiling

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

Paragraph 1 shall not apply if the decision

• a) is necessary for the conclusion or performance of a contract between the data subject and the controller,
• b) is permitted by Union or Member State law to which the controller is subject and that law contains appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject; or
• (c) is carried out with the explicit consent of the data subject.

In the cases referred to in paragraph 2(a) and (c), the controller shall take reasonable steps to safeguard the rights and freedoms as well as the legitimate interests of the data subject, which shall include, at least, the right to obtain the intervention of a data subject on the part of the controller, to express his or her point of view and to contest the decision.