Privacy statement under the RGPD
Name and address of the responsible person
The responsible party within the meaning of the Basic Data Protection Regulation and other national data protection laws of the Member States as well as other data protection regulations is:
Underground Division
Zona Industrial de Vila Verde, Rua H, Lote 15
3770-305 Oliveira do Bairro
Managers: Tiago Duarte / Miguel Silva
Phone: +351 234758064
E-mail: info@undergrounddivision.com
NIF: PT510033245
General information about data processing
Scope of processing of personal data
In principle, we collect and use personal data of our users only to the extent necessary to provide a functional website as well as our content
and services. The collection and use of personal data of our users occurs on a regular basis only after the user’s consent. An exception applies to cases in which prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law
Personal data is collected only when voluntarily provided in the context of the request. We use the data provided by you without consent only for the fulfillment and processing of the order. With the complete processing of the contract and the full payment of the purchase price, the data will be blocked for further use and deleted after the end of the fiscal and commercial retention periods, unless you have expressly consented to the further use of your data.
Communication of personal data
The data is communicated to the transport company in charge of the delivery, insofar as this is necessary for delivering the goods. For the purpose of payment processing, we pass on the payment data to the bank responsible for payment, or to the payment service selected in the order process.
Payment Processing via Paypal
In case of payment via Paypal, credit card via Paypal, direct debit via Paypal, or – when offered – “invoice purchase” via Paypal, we communicate your data required for payment in the context of payment processing to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”). With reference to the payment methods credit card via Paypal, direct debit via Paypal, or – when offered – “invoice purchase” via Paypal, Paypal reserves the right to carry out a creditworthiness check. The result of the creditworthiness check in the context of the statistical probability of default is used by PayPal to decide on the provision of the respective payment method. Credit information may contain probability values (so-called score values). To the extent that score values are included in credit scoring results, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of the score values includes, among other things, address data. More detailed information on data protection, for example and among others on the credit reference agencies used, can be found in the PayPal Privacy Policy.
Legal Basis for Processing Personal Data
Insofar as we obtain the consent of the data subject to the processing of personal data, art.1 6 paragraph 1 lit.a EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data.
When processing personal data necessary for the performance of a contract to which the data subject is a party, the art.6 paragraph 1 lit.b GDPR serves as the legal basis. The same applies to processing necessary to perform due diligence prior to the formation of the contract. If the processing of personal data is necessary to comply with a legal right to which our company is subject, GDPR Art. 6 para. 1 lit. c serves as the legal basis.
If vital interests of the data subject or another natural person require the processing of personal data, Art.6 paragraph 1 lit.d GDPR serves as the legal basis.
If the processing is necessary to safeguard a justified interest of our company, or a third party, and if the interests, fundamental rights, and fundamental freedoms of the data subject do not predominate over the interest referred to at the beginning, Art. 6 para. 1 lit. f GDPR serves as the legal basis for the processing.
Deletion of data and duration of storage
The personal data of the data subject will be deleted or blocked as soon as the purpose of the storage no longer exists. In addition, such storage may occur if provided for by the European or national legislator in the regulations, laws, or other EU regulations to which the controller is subject. The blocking or deletion of the data also occurs when a storage period prescribed by the aforementioned regulations expires, unless there is a need for additional storage of the data for the conclusion or fulfillment of a contract.
Provision of the website and creation of log files
Description and scope of data processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the calling computer.
Here the following data is collected:
1. information about the type of browser and version used
2. The user’s operating system
3. The user’s Internet service provider
4. The user’s IP address
5. Date and time of access
6. Websites from which the user’s system accesses our website
7. Websites accessed by the user’s system through our website
Log files contain IP addresses or other data, which make it possible to assign them to a particular user. This may be the case, for example, when the website link from which the user accesses the Internet pages, or the website link to which the user switches, contains personal data.
The data is also stored in our system log files. This does not include the user’s IP address or other data, which makes it possible to assign the data to a specific user. This data is not stored together with other personal data of the user.
Legal Basis for Data Processing
The legal basis for the temporary storage of data and log files is Art. 6 para. 1 lit.f GDPR
Purpose of data processing
The temporary storage of the IP address by the system is necessary to enable the delivery of the website to the user’s computer. To do this, the user’s IP address must be maintained for the duration of the session.
Storage in log files is necessary to ensure the functionality of the website. In addition, the data is used to optimize the website and to ensure the security of our information technology systems. In this context no evaluation of the data for marketing purposes takes place.
These are the purposes that legitimize our interest in data processing in accordance with art.6 paragraph1 lit.f GDPR.
Length of storage
Data will be deleted as soon as it is no longer required for the purpose of its collection. In the case of data collection for website operation, this occurs when the respective session is closed.
In the case of data storage in log files, this is the case after seven days at the latest. Further storage is possible. In this case, the IP addresses of the users are deleted or divested, to make an assignment of the calling client impossible.
Possibility of revocation and deletion
The collection of data for the operation of the website and the storage of the data in log files is essential for the operation of the website. Therefore, the user has no possibility of revocation.Use of cookies
Description and scope of data processing (analysis of browsing habits)
On our website we use cookies, which allow us to analyze the browsing habits of users. In this way the following data can be transferred
1. search terms
2. Amount of website visits
3. Use of functions offered by the website
The user data collected in this way are pseudonymized by technical measures. Thus, the attribution of the data to the respective user is no longer possible. The data are not stored together with other personal data of the user.
Description and scope of data processing (basket function)
Some cookies remain on your computer so that we can recognize your computer when you next visit (permanent cookies). Our partners are not authorized to collect, process or use through our website personal data by means of cookies. Most browsers accept cookies by default. In the security settings you can individually accept or block temporary or stored cookies. If you disable cookies, certain functions of our website may be blocked, or some websites may be presented incompletely. To use our basket, temporary cookies must be accepted! The data stored in our cookies are not associated with your personal data (surname, address, etc.). The data stored in our cookies are not associated with your personal data (last name, address, etc.) without your express consent.
Data collection via the use of Google-Analytics
Our website uses Google-Analytics, an online data analysis service of Google Inc. and Google-Analytics uses so-called “cookies”. These are text files stored on your computer which enable an analysis of your use of the website. This collects information such as operating system, browser, IP address, the website you opened previously (referer-URL), date and time of your visit on our website. The information created with these text files concerning the use of our website is transferred to a Google server in the USA and stored there. Google will use this information to evaluate your use of our website, to compile reports on website activities for website operators and to provide other services relating to website and internet use. If this is required by law or if third parties process this data on behalf of Google, Google will also transmit this information to these third parties. This use is anonymized or pseudonymized.
Legal basis for data processing
Legal basis for processing personal data using cookies is art.6 paragraph1 lit.f GDPR.
Purpose of data processing
Analysis cookies are used for continuous improvement of the quality of our website and its contents. The information provided by analysis cookies helps us to understand how our visitors use the websites and so we can continually improve our offerings.
These are the purposes that legitimize our interest in processing personal data in accordance with art.6 paragraph1 lit.f GDPR.
Length of storage, possibility of revocation and deletion
Cookies are stored on the user’s computer and transmitted by the user to our website. In this way you, as the user, have complete control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may not be possible to use all functions of the website to their fullest extent.
The transfer of Flash-Cookies cannot be suppressed through browser settings, however, through changes to Flash Player settings.
Newsletter
Description and scope of data processing
On our website you have the possibility to subscribe to a free newsletter. When you subscribe to the newsletter, we will receive the data from the entry form.
In addition, when signing up the following data will be collected:
1. IP address of the calling computer
2. Date and time of the registration
For data processing, your consent is obtained as part of the registration process and this privacy policy is referred to.
The data is used exclusively for sending the newsletter.
For sending our newsletter we use the list provider MailChimp. MailChimp is an offering of The Rocket Science Group, LLC, 512 Means Street, Suite 404, Atlanta, GA 30318 (“Rocket”). On 22.07.2008 Rocket signed the “Safe Harbor” agreement, which is a privacy agreement between the European Union and the United States.
The data stored when registering are transmitted to Rocket and stored by Rocket. The data collected upon registration are not transmitted to third parties. After registration, MailChimp sends an e-mail to confirm your registration. In addition, MailChimp offers several variants of analysis concerning how the newsletters sent were opened and how they were used, for example, how many users an email was sent to, whether emails were declined and whether users, after receiving the email, unsubscribed from the list. However, these analyses only concern groups and are not used by us in the context of individual evaluations. In addition, MailChimp uses the Google Analytics analytics tool from Google Inc and eventually connects it with the newsletter. You can find further details concerning Google Analytics in this privacy policy statement under “Data collection via the use of Google-Analytics.
Legal basis for the processing of data
Legal basis for data processing after registration made by the user in order to obtain the newsletter is the user’s consent, art. 6 paragraph1 lit.a GDPR.
Purpose of data processing
The collection of the user’s e-mail address serves the purpose of sending the newsletter.
The collection of further personal data in the context of the registration process serves to prevent an abuse of the services or the e-mail address used.
Length of storage
The data will be deleted as soon as it is no longer needed for the purpose of its collection. In other words, the user’s e-mail address remains stored as long as the newsletter subscription is active.
Possibility of revocation and deletion
The subscription to the newsletter can only be cancelled by the user concerned. A corresponding button for this purpose can be found on the newsletter website.
Registration
Description and scope of data processing
On our website we offer users the possibility to register with personal data. For this purpose the data is entered into an encrypted entry form, transferred to a service provider and stored. In the context of the registration process the following data is collected:
1. e-mail address
2. Password
3. Form of address, first name, last name
When registering, the following data is stored:
1. IP address of the user
2. Date and time of registration
In the context of the registration process the user consents to the processing of this data.
Registration via Single Sign-on technology (Facebook, Google and Amazon)
We offer the possibility of registration for our services via single sign-on technology. This makes further registration impossible. To register you will be redirected to the Single Sign-on technology provider’s page, where you can register with your usage data. In this way your profile data stored there and our services are linked. In this way we automatically obtain the following information from the respective provider: first name, last name, e-mail address, User-ID and gender.
Of this data we use only your first name, last name, e-mail address, user ID and your gender. This information is essential for the conclusion of the contract in order to identify you.
Facebook-Connect
For more information about Facebook Connect and the privacy settings, please refer to the privacy policy and terms of service of Facebook Inc.
Google Sign in
For more information about Google Sign in and the privacy settings, please refer to the Google Inc. privacy policy and terms of service.
Legal Basis for Data Processing
Legal basis for data processing is the consent of the user, art. 6 paragraph1 lit.a GDPR.
When processing personal data necessary for the performance of a contract, whose contractual party is the user, or for processing due diligence prior to the formation of the contract, the additional legal basis for the for data processing is art.6 paragraph1 lit.b GDPR.
Purpose of data processing
The user registration serves for the execution of a contract, of which the user is the contractual party, or for the processing of inquiries prior to the formation of the contract.
The registration data serves the processing of the order in our online store.
Length of storage
Data will be deleted as soon as it is no longer needed for the purpose of its collection.
This is the case during the registration process for the execution of a contract or for the processing of inquiries prior to the formation of a contract, if the data is no longer required for the execution of the contract. Even after conclusion of the contract, there may be a need to store personal data of the contracting party in order to fulfill contractual or legal obligations.
Abrogation and deletion possibility
As a user you can cancel your registration at any time. You may also obtain a change of the stored personal data at any time.
Send revocation via e-mail or post to:
Underground Division
Industrial Area of Vila Verde Rua H, Lote 15
3770-305 Oliveira do Bairro
E-mail: info@undergrounddivision.com
If the data is necessary for the execution of a contract or for the execution of steps prior to the formation of the contract, the anticipated cancellation of the data is only possible, when there are no contractual or legal obligations that prevent the cancellation.
Contact form or e-mail contact
Description and scope of data processing
On our website we provide a contact form for initial electronic contact. If you opt for this, your data entered in the entry form is transmitted to our company and stored. This data is:
1. Order number
2. Telephone number
3. First and last name
4. IBAN
5. Key code
When the message is sent, the following data is also stored:
1. user’s IP address
2. Date and time of registration
For data processing, your consent is obtained as part of the sending process and this privacy policy is referred to.
Alternatively contact can be made via the e-mail address indicated. In this case the personal data of the user transmitted with the e-mail is stored.
The data is used exclusively for processing the conversation.
In the context of processing customer requests we use the Zendesk ticket system, a platform for customer service of Zendesk Inc, 989 Market Street #300, San Francisco, CA 94102. In this context data such as last name, first name, postal address, phone number, e-mail address are collected through our website so that your information needs can be answered.Zendesk is a certified partner of the so-called “Privacy Shield Frameworks” and therefore meets the minimum conditions necessary for a legally compliant processing of request data.
More detailed information regarding the data processing carried out by is contained in Zendesk’s privacy policy under http://www.zendesk.com/company/privacy.
Legal Basis for Data Processing
Legal basis for data processing is consent of the user, Art. 6 para. 1 lit.a GDPR.
Legal basis for processing data transmitted in the context of sending an email is art. 6 paragraph1 lit.f GDPR. If the purpose of the e-mail contact is the conclusion of a contract, the legal basis art. 6 paragraph1 lit.b GDPR applies in addition to the processing.
Purpose of data processing
The processing of personal data obtained from the entry form serves only the processing of the initial contact. In case of an initial contact via e-mail is there substantiated the justified and necessary interest in the processing of the data.
Other personal data, processed during the submission process, serves to prevent misuse of the contact form and to ensure the security of our information technology systems.
Length of storage
Data will be deleted as soon as it is no longer needed for the purpose of its collection. With reference to personal data from the entry form, the contact form and those sent by e-mail, this is the case when the respective conversation with the user has been closed. The conversation is considered closed when it can be inferred from the circumstances that the relevant facts have been definitively clarified.
Additional personal data collected during the sending process will be deleted after a maximum of seven days.
Possibility of revocation and deletion
The user has the possibility at any time to revoke his or her consent to the processing of personal data. If the user contacts us by e-mail, he can object to the storage of his personal data at any time. In this case the conversation will not be continued.
Send revocation via mail or post to:
Underground Division
Zona Industrial de Vila Verde, Rua H, Lote15
3770-305 Oliveira do Bairro
E-mail: info@undergrounddivision.com
In this case, all personal data stored during the contact will be deleted
Push Messages via Google Firebase
On our website we offer the free Push Message service. With a mouse click on the “Sign Up” button you can subscribe to this service. At the same time you can terminate this service at any time in your browser settings
1. Social Media
8.1 Google+
Our pages utilize the functions of Google +1. Provider is Google Inc. 1600
Amphitheatre Parkway Mountain View, CA 94043, USA.
Collection and transmission of information: With the help of the Google +1 button you can
publish information worldwide. Through the Google +1 button you and other
users obtain content from Google and our partners. Google stores both the
information, that you have assigned +1 to a content, as well as information about the page
that you visited when you clicked +1. Your +1 may be displayed as notes, along with
your profile name and photo in Google services, for example in search results or on your Google profile, or
your Google profile, or elsewhere on websites and in ads on the Internet.
Google records information about your +1 activities in order to
improve Google services for you and others. In order to use the Google +1,
you need a public profile, visible worldwide, which must contain at least
the name you selected for the profile. This name is used across all Google services.
In some cases this name can also replace another name that you
used when sharing content through your Google account. The identity of your Google profile
may be displayed to users who know your email address, or who
have information that can be used to identify you.
Use of the information collected: In addition to the above purposes,
the information you provide is used in accordance with Google’s valid privacy policy.
Google occasionally publishes summary statistics
of the +1 activities of users, or passes on these statistics to users and partners, such as
publishers, advertisers or related websites.
8.2 Facebook
On our pages are integrated plugins of the social network Facebook, provider Facebook Inc.
Hacker Way, Menlo Park, California 94025, USA. The Facebook plugins can be recognized by the
Facebook logo or the “Like-Button” on our page. An overview
of Facebook plugins can be found at: developers.facebook.com/docs/plugins/.
When you visit our site, the plugin establishes a direct connection between
your browser and the Facebook server. Facebook thus gets the information
that you have visited our page with your IP address. If you click on the Facebook “Like
this” button while logged into your Facebook account, you can
link the contents of our pages to your Facebook profile. In this way Facebook can
attribute your visit on our pages to your user account. We draw your attention to the fact that we, as
providers of the pages, obtain no knowledge of the content of the transmitted data, nor of their use
by Facebook. For even more information on this topic, please read the privacy policy
a Facebook under de-de.facebook.com/policy.php
If you do not want Facebook to be able to link your visit on our pages to your Facebook user account
you must log out of your Facebook user account.
8.3 Twitter
On our pages are included functions of the Twitter service. These functions are offered by Twitter Inc.
1355 Market Street, Suite 900, San Francisco, CA
94103, USA. Using Twitter and the “Re-Tweet” function the websites you have visited are connected to your Twitter account and informed to other users.
At the same time data is transferred to Twitter. We draw your attention to the fact that we, as
providers of the pages, obtain no knowledge of the content of the transmitted data, nor of their use
by Twitter. For even more information on this topic, please read the privacy policy of
Twitter under twitter.com/privacy.
You can change the Twitter privacy settings in the account settings under
twitter.com/account/settings .
8.4 Instagram
Included on our pages are functions of the Instagram service. These functions are provided by Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA. If you are logged into your Instagram account, you can create a link between the content of our pages and your Instagram profile by clicking on the Instagram button. In this way Instagram can attribute your visit on our pages to your user account. We draw your attention to the fact that we, as the provider of the pages, have no knowledge of the content of the transmitted data, nor of its use by Instagram.
8.5 Pinterest
On our website we use social plugins from the Pinterest social network, operated by Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA (“Pinterest”). If you open a page containing one of these plugins, your browser establishes a direct connection to Pinterest’s servers. The plugin transmits log information to Pinterest’s server in the USA. This log information may contain your IP address, the address of the pages visited, which also contain Pinterest functions, browser type and settings, date and time of the query, the way you use Pinterest and cookies.
Further information regarding the purpose, the volume and further processing and use of data by Pinterest, as well as, the respective rights and the possibilities of protecting your privacy can be found in Pinterest’s privacy policy:°https://about.pinterest.com/de/privacy-policy.
8.6 Youtube
The processor has integrated components of YouTube into this website. YouTube is a video sharing platform, which allows video publishers to present video clips free of charge to other users, who can view, rate and comment on these videos also free of charge. YouTube allows the publication of all types of video, i.e., through the Internet portal you can watch movies and entire television programs, as well as music videos, trailers, or videos created by other users.
YouTube’s management company is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a branch of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.
Each time you access an individual page of this website operated by the processor and in which a YouTube component (YouTube video) has been integrated, the browser of the respective person’s IT system is automatically influenced by the respective YouTube component to download a representation of the respective YouTube component from YouTube. Further information regarding YouTube can be obtained under https://www.youtube.com/yt/about/de/. In the context of this technical process, YouTube and Google obtain knowledge about the specific subpage that the person concerned has visited on our website.
If said person is at the same time logged on to YouTube, YouTube recognizes, at the moment when a subpage containing a YouTube video is opened, which specific subpage of our website this person has visited. This information is collected by YouTube and Google and assigned to the respective YouTube account of the person concerned.
Via the YouTube component YouTube and Google always obtain the information that the data subject visits our website, when this person, at the time he or she opens our website, is also logged into YouTube; this occurs, regardless of whether the data subject clicks on a YouTube video or not. If you do not want this information to be transmitted to YouTube and Google, you should avoid this transmission by logging out of your YouTube account before logging in.
Data Subject Rights
The following list lists all data subject rights as per GDPR. Rights with no relevance to the website itself do not have to be listed. In other words, the list can be shortened.
Once your personal data is processed, you will be considered a data subject within the meaning of the provisions of the GDPR and will have the following rights in relation to the responsible party:
Right to information
You may demand that the responsible party confirm whether your personal data is processed by us.
If this is the case, you may demand information from the responsible party on the following aspects:
1. 1. the purposes for which the personal data is processed
2. the categories of personal data being processed
3. the recipients or categories of recipients who obtain or will obtain these personal data
4. the planned duration of storage of your personal data or, if specific information is not available, criteria for determining the duration of storage;
5. the existence of a right to rectification or erasure of your personal data, the right to restrict the processing carried out by the controller, or the right to object to such processing;
6. the existence of a right of appeal to a supervisory authority;
7. all available information about the source of the data, if the personal data have not been obtained from the data subject
8. the existence of automated decisions, including profiling, pursuant to Art. 22 paragraphs 1 and 4, of the GDPR and, at least in these cases, significant information about the logic involved, the scope and impact of this processing for the data subject.
Every person has the right to know whether his or her personal data is transmitted to a third country or an international organization. In this context, you can request information regarding the appropriate safeguards conf. art.46 GDPR, concerning this transmission.
Right of rectification
Every person has a right of rectification and/or completion with the person responsible, insofar as the personal data processed is incorrect or incomplete. The person responsible must carry out the rectification immediately.
Right to restriction of processing
Every person may request the restriction of the processing of his or her personal data, under the following conditions:
1. If you contest the accuracy of your personal data for a period of time that allows the responsible party to verify the accuracy of your personal data;
2. when the processing is unlawful and you refuse the deletion of the personal data and instead demand the restriction of the use of the personal data;
3. the controller no longer needs the personal data for the purposes of processing, but you need this personal data for the purposes of establishing, exercising or defending legal claims; or
4. when you object to the processing in accordance with Art. 21 para1 GDPR and you are not yet sure, whether the fair reasons of the responsible party prevail over your reasons.
If the processing of your personal data has been restricted, this data may only be processed – apart from storage thereof – with your consent, or for the establishment, exercise or defense of rights or to protect the rights of another natural or legal person or for reasons of special public interest of the Union or of one of the Member States.
If the restriction of processing is based on the above conditions, the responsible party will inform you before suspending the restriction.
Right of cancellation
Obligation to cancel
You can demand that the responsible party cancel your personal data immediately and the responsible party is obliged to cancel this data immediately if one of the reasons mentioned below applies:
1. 1. Your personal data is no longer necessary for the purposes for which it was collected or processed.
2. If you withdraw your consent, on which you base the processing conf. art.6 paragraph1 lit.a or art.9 paragraph2 lit.f GDPR and if there is no other legal basis for the processing.
3. If you object to the processing pursuant to art.21 paragraph 1 GDPR and where there are no overriding justifiable grounds with respect to the processing, or where you object to the processing pursuant to art.21 paragraph 2 GDPR.
4. Your personal data is processed unlawfully.
5. The erasure of your personal data is necessary to comply with a legal obligation under Union law or the law of the Member States to which the controller is subject.
6. Your personal data has been collected in connection with services offered by the information society as per art.8 paragraph1 GDPR.
Information to third parties
If the responsible party has made your personal data public and if, conf. art.17 paragraph1 GDPR, it is required to cancel this data, the responsible party shall take appropriate measures, including of a technical nature and taking into account available technology and implementation costs, to inform data processors and those who process personal data, that the data subject requires them to cancel all links directing to this data or to copies or replications of such personal data.
Exceptions
The right of cancellation does not apply where the processing is necessary to
1. exercise the right of freedom of expression and information;
2. to comply with a legal obligation, imposed by Union or Member State law, to which the controller is subject, with regard to the processing or execution of an obligation in the public interest or in the exercise of official authority, of which the controller has been entrusted;
3. for reasons of public interest in the public health sector, as per art. 9 paragraph 2 lit.h and i, as well as art. 9 paragraph 3 GDPR;
4. for archiving purposes of public interest, scientific or historical interest, research or statistical purposes, conf. art.89 paragraph 1 GDPR, to the extent that the right referred to under point (3) is likely to make the achievement of these purposes impossible or seriously undermine them, or
5. establishment, exercise or defense of rights.
Right to information
If you have asserted the right to rectification, cancellation or restriction of processing with the responsible party, the responsible party is obliged to communicate this rectification, cancellation or restriction of processing to all recipients, to whom this personal data has been disclosed, unless this is impossible or involves a disproportionate effort.
The controller is obliged to inform you who these recipients are.
Right to data portability
The responsible party is required to make the personal data provided to you available in a structured, common, machine-readable format. In addition, you have the right to transfer this data to another controller without hindrance from the controller who obtained the personal data, provided that
1. the processing is based on a consent pursuant to art.6 paragraph 1 lit.a GDPR or art.9 paragraph 2 lit. a GDPR or a contract pursuant to art.6 paragraph 1 lit.b GDPR and
2. the processing is carried out with the aid of automated processes.
In exercising this right, you may also exercise the right to demand that your personal data be transmitted by the controller directly to another controller, insofar as this is technically feasible. The freedoms and rights of other persons must not be affected.
The right to data portability does not apply to the processing of personal data required for the performance of a duty carried out in the public interest or in the exercise of official authority vested in the person responsible.
Right to object
At any time you have the right to object, on grounds arising from your particular situation, to the processing of your personal data that is carried out on the basis of the provisions of art.6 paragraph 1 lit.e or f GDPR; this also applies to profiling on the basis of these provisions.
The controller no longer processes your personal data unless he can show compelling legitimate grounds relating to the processing which override your interests, rights and freedoms, or where the processing is for the establishment, exercise or defense of rights.
If your personal data are processed for the purposes of direct advertising, you have the right to object at any time to the processing of your personal data for the purposes of such advertising; this also applies to profiling to the extent that it is associated with direct advertising.
If you object to the processing for direct advertising purposes, your personal data will no longer be processed for this purpose.
Irrespective of Directive 2002/58/EC, you have the option, in the context of using information society services, to exercise your right of objection by means of automated procedures using technical specifications.
Rights of revocation of the declaration of consent in data protection
The user has the right to revoke his declaration of consent at any time in the context of data protection. Revocation of consent does not affect the legality of processing carried out on the basis of consent until revocation.
Automated decision in specific cases, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, that has legal effects for you or significantly affects you in a similar manner. This does not apply if the decision
1. is necessary for the conclusion or performance of a contract between you and the responsible party,
2. is permitted by the legislation of the Union or of the Member States to which the responsible party is subject and when such legislation contains appropriate measures to safeguard the user’s rights and freedoms and legitimate interests, or
3. with his express consent.
However, these decisions shall not be based on special categories of personal data under Art.9 paragraph1 GDPR , unless Art.9 paragraph2 lit a or g GDPR applies and when appropriate measures have been taken to protect your rights and freedoms and legitimate interests.
With regard to the cases cited under 1. and 3., the responsible party takes appropriate measures to safeguard your rights and freedoms as well as your legitimate interests, including at least the right to obtain the intervention of a person by the responsible party, the right to express your own position and the right to challenge the decision.
Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or place of the alleged breach, if you consider that the processing of your personal data is contrary to the GDPR.
The supervisory authority, to which the complaint has been lodged, must inform the complainant of the status and the results of his complaint, including the possibility of judicial remedy under Art.78 GDPR.
