A         General information
B         Definitions of terms
C         Scope and supervisory authorities in charge
D         Data collection and purpose (scope of usage)
E         Transmission of data
F          Contract data processing
G         Storage of data
H         Your rights as data subject affected by data processing measures
I           Data Protection Officer
J          Changes in this Data Protection Declaration
K         Respect for special national features                                                                             


A. General information

I. General notes pursuant to this Data Protection Declaration; our contact information

The purpose of this Data Protection Declaration ("DPD") of our company, Ticketbande B.V. (also deemed to be the "controller" in the meaning of the General Data Protection Regulation, i.e. EU Regulation 2016/679 from 27 April 2016 - "GDPR"),is in particular to inform you in your capacity as data subjects affected by data processing in a transparent, simple and understandable manner inter alia about:

what data we collect, and how and why this is done;

how we handle your data, if applicable including with the involvement of third parties;

what substance matters the GDPR applies to;

what rights and possibilities of influence you have with regard to your data and its use;

what rights we have and how these may affect your rights.

Our contact information is as follows:

ePassage24 GmbH
Niederkasseler Lohweg 16
40547 Düsseldorf
Deutschland

Telefonnummer: +49 (0)211 54 222 955
Email: post@epassage24.de


II. Definitions of terms in the area of data protection law

In data protection law as well as in applications bearing relevance to data protection law, terms are sometimes used which are not self-explanatory per se and/or have not yet become so much a part of everyday language use that everyone could be expected to readily understand what the respective terms mean. For this reason, the following Section B. (Definitions of terms) explains some of the most frequently used terms in more detail.


III. Our understanding of our role with regard to data protection

Data protection is important to us, and we take a variety of measures to ensure that your data is in good hands with us. The principles laid down in the GDPR are also at the same time the principles we adhere to when handling your data. This includes not least the imperative of purpose limitation and minimisation. In this connection, we generally only request a minimum amount of data from you (or, if applicable, from third parties) which is necessary for us to structure the business / customer relationship with you in accordance with the recognised principles of business diligence / customary usage in business and to be able to offer you an excellent service. This principle of necessity continues to be applied at the level of our employees, i.e. generally only those employees who are absolutely necessary for the performance of the activities entrusted to them have access to personal data. At the same time, we only store data for as long as is necessary for the aforementioned purposes unless longer storage obligations emanate from statutory regulations. A further component in our data protection system is technology design and organisation. Through modern data processing systems, other technical precautions and, if necessary, the involvement of external specialised companies, we guarantee a high degree of data security (e.g. through the use of data encryption technology) within the company, ensuring that the risk of unauthorised external access is ruled out to the greatest extent possible. At the same time, data is stored in such a manner so that it can be easily located and, if necessary, restored at any time. In addition to the lawfulness of acquiring data, we endeavour to only use accurate data in our data processing. As a result, we are happy to receive update notices from you.


IV. Legal foundations

We process data processing in particular on the basis of the GDPR as well as the German Federal Data Protection Act ("BDSG") and other relevant provisions of EU and national law in the field of law governing data protection, which may also include professional and other special legal regulations. To take one example: if you provide your effective consent, art. 6 sec. 1 a) of the GDPR may serve as the specific legal basis for collecting your data for certain purposes.


B. Definitions of terms

Contract processor: a natural or legal person that processes personal data on behalf of another party (namely the data controller),for example a data processing centre.

German Federal Data Protection Act (BDSG): a federal German law in the field of data protection, issued on 30 June 2017 and, like the GDPR, scheduled to enter into force on 25 May 2018.

Legitimate interest: there may be a legitimate interest both in enabling as well as avoiding data processing, depending on the perspective of the party (company) or data subject (natural person). In practice, it usually depends on which party's interests are of overriding importance in the specific situation, whereby a multitude of factors (type of data, situation surrounding its collection, intended use, etc.) must be accordingly weighed out while taking into account the fundamental rights and freedoms of the data subject concerned.

Data subject: the person whose data is the subject of a data processing procedure. To be specific, in this case: you.

Browser: a computer program for displaying websites on the World Wide Web, i.e. a kind of user interface for Internet applications. Well-known examples include Microsoft Edge, Mozilla Firefox or Google Chrome.

Cookie: text information in a smaller file format which is sent via the web browser of an Internet site that is visited to your computer (or another terminal device used for the Internet) and stored there. If you visit the site again, this will be recognized by the cookie that has been set, which allows you to for example directly activate certain usage preferences (such as the language setting) or intermediate statuses of previous usage (such as the shopping basket of an online shop).

Data processing: the use or pooling of data in the broadest sense, whether automated or not, such as the collection, recording, organisation, arrangement, storage, adaptation or alteration, read-out, enquiry, use, disclosure by transmission, dissemination or any other form of provision, comparison or linkage, restriction, erasure or destruction of data.

GDPR: a regulation of the European Union (EU 2016/679) in the field of data protection, issued on 27 April 2016 and entering into effect on 25 May 2018 (with direct effect for Germany as well).

Last contact: by last contact with you we mean a situation in which a contractual relationship between you and us has not come about and we have not "heard" from you for more than 3 (three) months, whereby it is not the acoustic nature of the contact that matters. Any type of contact between you and us that is perceivable to us, rather (including for example via email, letter or short message),is sufficient to allow the aforementioned 3-month period to begin anew.

Personal data: any information relating to an identified or identifiable natural person; the latter is the case when a person can be identified, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier or one or more specific characteristics which express the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.

Special category of personal data: that personal data revealing a natural person's racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic or biometric data (with identification function),health data or data relating to sex life or sexual orientation.

Profiling: any type of automated processing of personal data for the purpose of evaluating certain personal aspects of a natural person, in particular to analyse or predict aspects relating to work performance, economic situation, health, personal preferences, interests, reliability, conduct, whereabouts or change in location by such person.

When in the following reference is made to data, this means personal data. The terms European Union, EU and Union are used interchangeably.


C. Scope and supervisory authorities in charge

Application independently of the nationality of the data subject

Data protection regulations usually involve the protection of natural persons and their personal data. This is also the case with the key laws and regulations bearing relevance in this context, the GDPR and the German Federal Data Protection Act ("BDSG"),to which we in our capacity as a German company (regularly referred to as "controller" or "controlling party " in law governing data protection) are automatically subject. The question as to the extent that legal persons can also claim protection under data protection law from data processing companies has not yet been fully clarified. As a precautionary measure and with the aim of having a data protection-friendly orientation and alignment, which also includes the granting of optional rights in connection with the release of information on your part, we treat legal persons like natural persons if they are affected in a personal way or where such affection at least comes close to how a natural person would be affected in a comparable situation. This is the case, for example, when natural persons behind the legal persons are involved, i.e. they also appear as natural persons in a recognisable manner in company-related actions. We must adhere to the legal data protection requirements described here (as well as other) legal requirements of a data protection nature not only towards German data subjects or nationals of EU member states, but towards all persons regardless of their nationality with regard to whom we perform (or have performed) actions bearing relevance to data processing relevant in the EU, even if the actual processing takes place outside the EU.


D. Collection of data and purpose limitation (scope of use)

I. Type of data collection

Data collection is the first step and at the same time a part of data processing. It is only (legally) permissible if legal requirements (in particular those laid down in the GDPR and the BDSG) that are imposed on measures of this type are met. In our company's practice, the following four situations in particular may legitimate the collection of data (and its further processing as well):

(a) (possibly explicit) consent has been granted;

(b) the action is necessary either to execute a contract with you or, however, to perform pre-contractual measures at your request;

(c) the measure is necessary to fulfil a legal obligation incumbent on us (e.g. a legal obligation to store data);

(d) there is a legitimate interest to our benefit which overrides your interests, rights, etc., relating to data in individual cases.

In our practice, types of data collection are used that are described in more detail below:


Collection from you (the "data subject")

As a rule, we generally collect data relevant for the purposes of our company directly from you, which can be done in various ways:

You contact us by using the contact form on our website, with which certain basic data is to be provided;

You contact us in another way, e.g. by enquiring about a product, and would like more detailed information, which we are supposed to send to your address;

You provide us with data on your own initiative - by whatever means of communication this may be - for example in order to receive an individual offer from us or to apply with us for a contract;

We contact you (for instance at an informational event) within the scope of what is permissible under competition law, which results in a business transaction for which we ask you to provide us with certain data in order to complete such / perform additional actions.

As a rule, we regard the aforementioned processes as those in which either your (at least tacit) consent has been provided or, however, the data processing results from a request from you involving data. Your consent must not be provided in any particular form. However, since we have an obligation to submit proof that you have indeed provided your consent with regard to the processing of data on a consensual basis, but this cannot be documented directly in every communication situation (for example: telephone conversations),we may contact you again in the follow-up to such an event and ask for formal confirmation of your consent.


Collection in the case of third parties

Regularly, we (also) collect personal data relating to your person from third parties, essentially for the sake of assessing business-related risks which may ensue from an intended transaction, whereby if you have not provided your consent to such this is only permissible if there is a justified interest on our part or if there is a statutory constellation constituting an exception. Such an interest (to our benefit) may be deemed to be the case, for example, if we are involved in a transaction with you in which we are/would be subject to an extensive obligation to render advance performance, and we would consult an appropriate provider (such as Creditreform) to assess your creditworthiness in order to analyse the risk associated with such. If necessary, we would also inform ourselves by using public registers and generally accessible (public) sources (e.g. www.Bundesanzeiger.de),which would also lie in the domain of information collection from third parties and the requirements associated with this if such is to be deemed lawful. Data obtained in this way never involves automated decision-making in our company, however, and is instead merely intended to broaden the basis for our own decision-making process. If we collect data on you from third parties, we shall subsequently inform you of the nature and extent of this in accordance with legal requirements no later than within one month of obtaining the data collected in this manner. Our aforementioned information obligation may be waived in certain exceptional cases, e.g. if the fulfilment of this obligation would be associated with undue effort.


Automated data collection

Every time you access the contents of our website, data is temporarily stored which may allow identification. The following data are saved every time a page is called up at www.ticketbande.de: date and time of the call-up, name of the Internet service accessed, the resource called up and the action/enquiry used by the client, amount of data transmitted, message as to whether the call-up was successful, IP address of the accessing computer. The stored data is collected for the purpose of statistical evaluation of the use of the website and summarised anonymously. Furthermore, it is used to defend against or analyse attacks on the website. If necessary, cookies may also be used in connection with your use of our website, in which case we shall keep a corresponding notice ready for you directly on the website and request your consent, which you are (of course) completely free to grant. You can also set your browser (see its "help" menu for more details) to block all cookies (and hence automatically those from our website as well) or alternatively to notify you before such a cookie is set. In this case, however, you may no longer be able to use our website to its full extent and/or only with considerable delay, and user-specific default settings for the purpose of more convenient use (e.g. correct language setting) may no longer be available. Once cookies have been set, you can delete them yourself at any time with the help of your browser.

Tracking and analysis tools also use cookies. We use such cookies as well. In particular, we use ff. tracking and analysis tools:

PayPal as a payment processor

On this website, the controller has integrated components of PayPal. PayPal is an online payment service provider. Payments are processed via so-called PayPal accounts, which represent virtual private or business accounts. PayPal is also able to process virtual payments through credit cards when a user does not have a PayPal account. A PayPal account is managed via an e-mail address, which is why there are no classic account numbers. PayPal makes it possible to trigger online payments to third parties or to receive payments. PayPal also accepts trustee functions and offers buyer protection services.

The European operating company of PayPal is PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg.

If the data subject chooses "PayPal" as the payment option in the online shop during the ordering process, we automatically transmit the data of the data subject to PayPal. By selecting this payment option, the data subject agrees to the transfer of personal data required for payment processing.

The personal data transmitted to PayPal is usually first name, last name, address, email address, IP address, telephone number, mobile phone number, or other data necessary for payment processing. The processing of the purchase contract also requires such personal data, which are in connection with the respective order.

The transmission of the data is aimed at payment processing and fraud prevention. The controller will transfer personal data to PayPal, in particular, if a legitimate interest in the transmission is given. The personal data exchanged between PayPal and the controller for the processing of the data will be transmitted by PayPal to economic credit agencies. This transmission is intended for identity and creditworthiness checks.

PayPal will, if necessary, pass on personal data to affiliates and service providers or subcontractors to the extent that this is necessary to fulfill contractual obligations or for data to be processed in the order.

The data subject has the possibility to revoke consent for the handling of personal data at any time from PayPal. A revocation shall not have any effect on personal data which must be processed, used or transmitted in accordance with (contractual) payment processing.

The applicable data protection provisions of PayPal may be retrieved under https://www.paypal.com/us/webapps/mpp/ua/privacy-full.


Stripe as a payment processor

On this website, the controller has integrated components of Stripe. Stripe is a payment service that allows cashless payment of products and services on the Internet. Stripe is a technical procedure by which the online dealer immediately receives a payment confirmation. This enables a trader to deliver goods, services or downloads to the customer immediately after ordering.

The operating company of  Stripe is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin.

If the data subject chooses "Credit card" as the payment option in our online shop during the ordering process, the data of the data subject will be transmitted to Stripe. By selecting this payment option, the data subject agrees to the transmission of personal data required for payment processing.

In the case of purchase processing via credit card the buyer sends his credit card details to Stripe. Stripe then carries out a transfer to the online merchant after technical verification of the account status and retrieval of additional data to check the account assignment. The online trader is then automatically informed of the execution of the financial transaction.

The personal data exchanged with Stripe is the first name, last name, address, email address, IP address, telephone number, mobile phone number, or other data necessary for payment processing

The transmission of the data is aimed at payment processing and fraud prevention. The controller shall immediately transfer other personal data, even if a legitimate interest in the transmission exists. The personal data exchanged between Stripe and the controller shall be transmitted by Stripe to economic credit agencies. This transmission is intended for identity and creditworthiness checks.

Stripe provides personal data to affiliated companies and service providers or subcontractors as far as this is necessary for the fulfillment of contractual obligations or data in order to be processed.

The data subject has the possibility to revoke the consent to the handling of personal data at any time from Stripe. A revocation shall not have any effect on personal data which must be processed, used or transmitted in accordance with (contractual) payment processing.

The applicable data protection provisions of Stripe may be retrieved under https://stripe.com/de/privacy.


Video conferences

For the transmission of video and audio signals within our video conferences we use the open-source software BigBlueButton. On the basis of WebRTC, data or media streams are transmitted in encrypted form via Datagram Transport Layer Security (DTLS) and Secure Real-time Transport Protocol (SRTP). When using video conferencing, the entire data stream is routed through our server in order to achieve the best performance. These data are neither stored, recorded nor processed by us in any other form. The recording function of BigBlueButton is completely deactivated, unless this function is explicitly switched on by the customer. The IP addresses of the conference participants are neither stored in our log files nor in any other place.


STUN-/TURN-Server for video conferences

The STUN protocol recognizes clients that are, for example, behind a router or a firewall and have a NAT address. With the help of the STUN server, NAT clients can find out their public IP address and are then able to establish a direct communication link between participants. We use a server operated by us as the STUN/TURN server, so that the user's IP address is not transmitted to third parties.


Non-collection of special data

We do not collect any personal data in special categories (see section B above),nor do we seek your express consent insofar (for instance to have it "on reserve” if needed at a future time).

II. Purpose limitation (scope of use),type of data collected

Main purposes

If we collect data, this is only done for the operational purposes of our company, in particular to ensure:

orderly receipt, such as the awarding of contracts (irrespective of the type of legal transaction),including their execution;

the possibility of preparing cost estimates, quotations and similar;

the ability to formulate and execute contracts together with their payment and despatch-related processing;

adherence to statutory warranty obligations and any applicable contractual guarantees or also to assert these ourselves against third parties (e.g. suppliers);

(possibly also judicial) traceability and enforcement / enforceability of claims against customers as well as the defence of claims asserted against us;

the provision of a customer service at high level, which can be received by and can support customers in various ways if necessary and at the same time meet their high expectations regarding our company.

Secondary purposes

In addition, your data may be used for secondary purposes by our company, e.g. for:

determination of the satisfaction of our customers with our products / services (incl. website);

improvement of our products and services (incl. website);

enabling the development of tailor-made offers for customers;

support / (and if necessary) goodwill for our products / services above and beyond the warranty periods.

With regard to the collection / use of data for such secondary purposes (especially in the case of direct advertising),you may be entitled to extended rights compared to those for the main operational purposes, even if you have expressly consented to the collection of data. Cf. (inter alia) section H XI for details.


Change in purpose

If we wish to process your data for purposes other than those for which it was collected, and if we do not have your (separate) consent, we will only do so if the current purpose is still compatible with the original purpose. In determining compatibility, we comprehensively weigh out interests while taking into account inter alia: the context of the data collection at the time, the degree of connection between the purposes of collection at the time and current processing, the type (sensitivity) of the data and the consequences of further processing such for you as well as the existence of guarantees accompanying processing (e.g. encryption).


Type of data collected or stored

The following data(s) may in particular be considered to be data collected by us and then stored: Your name, your address, your date of birth, if applicable (especially for commercial customers) your profession or the branch in which you work, possibly also your marital status (depending e.g. on the type of contractual agreement to be concluded),your (other) data to expedite contact (e.g. e-mail and / or telephone and / or fax),if applicable your bank account, if applicable certain additional data of your company (such as the company's key data, commercial register number, tax numbers, management relationships) as well as our own findings following data collection, such as your order history with us and associated payment history, complaints, assertion of warranty or other contract related rights, etc., possible need for additional products, services etc.


E. Transmission of data

No data are transmitted by us to third parties in principle unless this is necessary for:

the fulfilment of primary and secondary purposes, whereby such forwarding is restricted to companies associated with us (parent company, subsidiaries and affiliates, i.e. companies which we either control or which control us or are under the joint control of a third party and us) or other companies if we are contractually associated with them in order to fulfil operational purposes towards you (e.g. subcontractors, freight forwarders, consignors);

coordination with our (external) advisors in tax, business and legal matters, which as a rule involves persons who are already subject to statutory confidentiality requirements due to their professional status;

the execution of payment transactions, regardless of whether we are the paying party or the party that is to effect payment;

enabling assessment of the (in particular) financial risk of a contemplated or already agreed-upon, but not yet fully completed, legal transaction with regard to various characteristics of the (future) contracting partner, such as its creditworthiness, liquidity, payment history, etc.

the fulfilment of public-law obligations, for example in response to a request by a government authority on the basis of pertinent statutory provisions

F. Contract data processing

We do work together with contract processor. Guarantee contracts obligate such contractors to comply in particular with our Data Protection Guidelines as well as the GDPR itself.


G. Storage of data

In accordance with the principle of storage limitation, we only store your data for as long as is necessary for the purposes for which it is being/has been processed. For example, if a business contact with you has not been solidified following a phase of attempting to initiate a contractual relationship, and if there are no prospects that this will still happen in the foreseeable future, either, there is no longer any operative interest in the storage of data after the expiry of the time-barring period in which possible claims - regardless of which party such have accrued to - would come about due to a possible pre-contractual obligation. In some situations, such an interest in storage may even lapse in an even shorter period of time. However, due to legal regulations - over which we naturally have no control - we may be forced to retain data longer than we ourselves would consider necessary. Such storage obligations arise in particular under commercial and tax law, in some cases under professional law or other special legal regulations, according to which, for example, every commercial/business letter, whether received or sent must be kept for a period of 6 years (beginning at such date). This can, among other things, influence your claim for cancellation, postponing it for a certain period of time or downgrading it to a claim for restriction. For further details, please refer to section H VI. (below).


H. Your rights (rights of the data subject)

I. General information

Not an exhaustive list of your rights under the GDPR, no formal requirements
To promote readability, we have not explained every right to which you may or actually are entitled down to the last detail, and we have also looked at which cases may arise for our company or for you in your capacity as the data subject in practical terms through the data processing to be carried out by us. The present discussion is therefore not exhaustive with regard to the rights to which you are entitled, but is supplemented (especially in marginal areas) by the GDPR and other pertinent legislation wherever applicable. No special form or formal requirements must be met to assert your rights, i.e. this can also be done by telephone or e-mail.

 Periods and deadlines for our reaction to the assertion of your rights
If you assert rights under this section H, we will inform you without undue delay, but at the latest - subject to the following clause - within a period of one month after receipt of your application about the effects this will have in your specific case (in particular what legal consequences this may have). If your application is based on a complex issue and at the same time we are confronted with a large number of applications, we are entitled to only react within a period of 3 months, whereby we will notify you of and justify such a delay within the aforementioned one-month period. We must also respond to you within one month and state the grounds for such if we do not wish to take action at your request.


Costs

Notification of your rights, the fulfilment of other information obligations by us and measures taken to implement your rights are free of charge to you. We are only entitled to charge a reasonable fee corresponding to our time and effort or to refuse to process the request in the case of manifestly unfounded or (in particular excessive) requests.


Contact details for the filing / execution of your rights

All of your rights contained in this section H – with the execption however of your right to appeal – are to be addressed towards us. Insofar, we hereby inform you again of our contact details which read as follows:

ePassage24 GmbH
Niederkasseler Lohweg 16
40547 Düsseldorf
Deutschland

Telefonnummer: +49 (0)211 54 222 955
Email: post@epassage24.de


II. Right to information

You have the right to obtain information from us as to whether we process personal data relating to you. If this is the case, the information also extends to inter alia:

(a) what kind of data are processed and for what purposes;

(b) to whom data may have been passed on (and which guarantees, if applicable, have been provided by the recipient with respect to handling of your data in compliance with law governing data protection, for example in the event that a third country is involved);

(c) duration - or criteria for the duration - of the (planned) storage of this data;

(d) if applicable, the origin of data (in the case of collection from third parties);

(e) if necessary, pertinent information on the (system) logic used and the scope and intended effects of data processing on you if these were the subject of an automated decision-making process (note: we do not perform such processes at our company ourselves).

You will receive a copy of this information from us, in the case of an electronic application on your part in electronic form (i.e. in a common electronic format). We may charge a reasonable fee for additional copies in accordance with the administrative expenses associated with this.


III.  Right to withdraw consent that has already been given

You have the right to withdraw your consent at any time. Such withdrawal does not affect the lawfulness of consent-based data processing performed before the point in time of withdrawal, but means that beginning at such point in time we may no longer perform any activities relating to your data if the consent withdrawn in the meantime was the only legal basis for this. This is not the case, for example, if we are still obligated to store the data. The withdrawal can be notified without adhering to any formal requirements and is in any case also possible in the form in which you previously provided your consent.


IV. Right to correction

You have the right to request us to correct any inaccurate personal data concerning you without undue delay. Taking into account the purposes of the processing, you furthermore have the right to request completion of incomplete personal data, including by means of a supplementary declaration. If your data has been disclosed to third parties, we will inform them of the correction unless this is impossible or would be associated with unreasonable effort and expense. If you so request, we will disclose the aforementioned third parties to you.


V. Right to erasure (also the so-called "right to be forgotten")

Claim to erasure

Subject to the exceptions set out in subsection 3. below, you may request us to erase your personal data immediately if:

(a) this/these data (in particular their further storage) is (are) no longer necessary for the purposes of the collection;

(b) you have withdrawn your consent in the case of consent-based data processing;

(c) you object to further processing;

(d) the processing of data was unlawful;

(e) the erasure is necessary in order to fulfil a legal obligation under European Union law or national law;

(f)  the data have been collected from a child (under 16 years of age) relating to services of the information society, which in this context is understood as a service generally provided subject to charge, and which is performed electronically by means of distance selling (i.e. without direct physical contact between the parties involved) and by individual call-up.

In the event your data is erased, we usually assume that you consent to our including your name in our list of persons who do not (no longer) wish to be contacted by us. This minimises the chance that you will be contacted in the future, for example if your data is collected in another context. If you do not desire this, please let us know.


Additional rights in the event of publication of your data and third-party participation

If we have disclosed the data to which your erasure claim relates, we will (while taking into account the technology available and implementation costs) undertake reasonable measures to ensure that the controllers responsible for such data are informed that you have requested the erasure of the data (including links to and reproductions of the data). If your data has been disclosed to third parties (in another manner),we will inform them of the erasure unless this is impossible or would involve unreasonable effort and expense. Upon your request, we will disclose the aforementioned third parties to you.


Exceptions from the claim to erasure

You are not entitled to an erasure claim - even only temporarily if applicable - especially if data processing is necessary:

(i) to exercise freedom of expression and information;

(ii) to fulfil a legal obligation applicable to us under European Union law or national law (this may be e.g. a legal obligation to keep records [before their expiry]);

(iii) to assert, exercise or defend legal claims,

or if

(iv) in the event of your withdrawal in the above meaning (section III),there is another legal basis for data processing;

(v) in the event of your objection in the above meaning (section V. 1. c),firstly, there are overriding legitimate grounds for data processing and, secondly, your objection is not only directed against direct advertising and any possibly related profiling (in the latter case - involving direct advertising, profiling relating to such - you are always entitled to a right of erasure).


Rights similar to erasure

If you (at least temporarily) have no claim to erasure, you may nevertheless have a claim to a limitation on (further) data processing by us. For more information, please refer to section VI immediately following.

VI. Right to restriction of processing

If we have collected data unlawfully and you are therefore (actually) entitled to an erasure claim, you can demand from us that we restrict data processing instead of such erasure. The same applies to lawfully collected data in the case we have in the meantime achieved the purpose, but you need the data to assert, exercise or defend legal claims. If you have filed an objection to the data processing involving you (and we do not have to comply with this if only because it is directed against direct advertising/related profiling) or if you dispute the accuracy of data, you can request us to restrict the use of your data during the corresponding review phase (weighing of interests in the event of an objection, examination of the data for actual inaccuracy).  This means that we may only process such limited data (aside from its storage and special cases of overriding public interest) with your consent or in order to assert, exercise or defend against legal claims or to protect the rights of another natural or legal person.

Even without your initiative, we will limit the use of your information to the extent described above if the last contact with you (see section B) goes back longer than a period corresponding to 3 (three) years plus the remainder of the year in which the last contact occurred. This shall not affect any rights of restriction or erasure that may have arisen at an earlier point in time.

If data restriction in the aforementioned meaning has occurred and is due to be revoked (e.g. because it could be determined that the data is not accurate),we will inform you before this step is taken. If your data has been disclosed to third parties, we will inform them of the data restriction unless this is impossible or would involve unreasonable effort and expenses. If you so request, we will name the aforementioned third parties to you.


VII. Right to transfer of data

If we process your data automatically on the basis of consent given by you or within the scope of a contractual relationship, you can require us to receive the corresponding data in a structured form in a common, machine-readable format, for example in order to be able to forward it ourselves (and without any influence whatsoever by us) to another data controller. As far as is technically feasible and such does not affect the rights of other persons, you may also request that we forward such data stocks directly to another data controller selected by you (e.g. a company with whom you wish to conclude a contract). An additional claim for erasure in your favour, if applicable, will not be affected by a data transfer request.


VIII. Right to notification in the event of data breach

If a situation occurs in which the violation of data (e.g. a so-called data breach) poses a great risk to your personal rights and freedoms, we will inform you immediately. Such notification includes inter alia the data of your contact person in this context as well as information on the impending consequences of injury and the measures already taken or planned to be taken to contain these consequences. Such notification may be waived if we have subsequently initiated such effective containment measures that no great risk in the aforementioned meaning can be assumed any longer and if the data have already been significantly secured against unauthorised access - particularly by means of technical measures (e.g. encryption) - or if the notification would involve unreasonable efforts and expenses (in which case we would arrange a public announcement or measure having a similarly broad impact).


IX. Your right to not be subject exclusively to automated decision-making processes in connection with data processing

In principle (i.e. except in exceptional cases),you have the right not to be subject to a decision based exclusively on automated processing - including profiling - if this has legal effect towards you or has a significantly negative effect on you in a similar manner. Our company does not use such decision-making structures at the present time and we would inform you separately should this change and your data be affected.


X. Right of appeal

You may complain at any time about our conduct relating to the processing of data to the supervisory authority in charge (cited above in section C II). Of course, you can also file a complaint with us, and we will try to solve any problems that may arise together.


XI. Right of objection

If we have processed your data to protect our legitimate interests (or to fulfil a task in the public interest),you can object to this at any time. Further processing by us is then (still) only permissible if we can demonstrate reasons for processing which are so important that they override your interests, rights and freedoms, or if such serves the purpose of asserting, exercising or defending against legal claims. If your objection is directed against the use of your data for purposes of direct advertising/related profiling, we will (no longer) use / process your data in this context. You may send your objection to us or our Data Protection Officer in any form.


I. Data Protection Officer

Due to the (small) size of our company, there is no legal obligation to appoint a data protection officer, nor have we appointed one on a voluntary basis. However, our entire company staff will be pleased to help you with all your questions in connection with this "Information on the Declaration of Consent", the Declaration of Consent as such, other questions regarding the processing of your data and, of course, your rights under section H and the assertion of these rights.


J. Changes in this Data Protection Declaration

This Data Protection Declaration may be changed from time to time, for example in order to adapt it to respective / updated decisions in case law involving data protection handed down by the courts, which were not yet known / foreseeable as of 25 May 2018. We will announce any changes on our website, with changes of a particularly serious nature being communicated in individual form (generally by e-mail) to all customers / users / suppliers / other data subjects relevantly affected whose contact data we still have at the respective point in time.


K. Respect for special national features

Our business activities extend to many European countries (and even beyond). If it should be the case that we owe you a higher data protection standard with regard to individual items than under the GDPR in the country in which our data protection activities have an effect, in which you are domiciled and which is also a Member State of the European Union or the EEA (except for Switzerland) under national law there, we would ask you to inform us as to the nature and scope of this without undue delay since we also want to abide by such requirements, whereby we - we mention this only by way of clarification - also perform our own research in such matters.