Data protection

Data protection provisions about the website christmas-garden.de

I. Introduction and terms

1. GENERAL

We process personal data when operating our websites christmas-garden.de and presse.christmas-garden.de (hereinafter referred to individually and collectively as the "website"). We treat this data confidentially and process it in accordance with the applicable laws - in particular the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and the Telecommunications Digital Services Data Protection Act (TDDDG). With these data protection provisions, we want to inform you about what personal data we collect from you, for what purposes and on what legal basis we use it and, if applicable, to whom we disclose it. In addition, we will explain to you what rights you have to protect and enforce your data privacy.

2. TERMS

Our privacy policy contains technical terms that are used in the GDPR and the BDSG. For your better understanding, we would like to explain these terms in simple terms in advance:

2.1 Personal data
"Personal data" means any information relating to an identified or identifiable person (Art. 4 No. 1 GDPR). Details of an identified person can be, for example, their name or email address. However, personal data is also data for which the identity is not immediately apparent, but can be determined by combining your own or third-party information to find out who the person is. A person can be identified, for example, by providing their address or bank details, their date of birth or user name, their IP addresses and/or location data. All information that can be used to identify a person in any way is relevant here.

2.2 Processing
Art. 4 no. 2 GDPR defines "processing" as any operation which is performed on personal data. This applies in particular to the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.

II Controller and data protection officer

3. RESPONSIBLE

Responsible for data processing is:
Company: Christmas Garden Deutschland GmbH ("we")
Legal representative: Sebastian Stein; Christian Diekmann
Address: Potsdamer Str. 58 10785 Berlin
Phone: +49 30-81075-0
Email: info@christmas-garden.de

4. DATA PROTECTION OFFICER

We have appointed an external data protection officer for our company. You can reach him at:
Name: Reinher Karl
Address: HABEWI GmbH & Co. KG, Palmaille 96, 22767 Hamburg
Phone: +49 40 46008966
Fax: +49 40 46008977
E-mail: datenschutz@habewi.de

III Processing framework

5. PROCESSING FRAMEWORK: WEBSITE

As part of the website, we process the personal data of you listed in detail below in Section IV. We only process data that you actively provide on the website (e.g. by filling in forms) or that you automatically provide when using our website.
Your data is processed exclusively by us and is not sold, lent or passed on to third parties. If we use the help of external service providers to process your personal data, this is done within the framework of so-called order processing, in which we as the client are authorized to issue instructions to our contractors. We use external service providers for hosting and operating our website. We host our website with the external provider HostPress GmbH (address: Bahnhofstraße 34 66571 Eppelborn) in the data center location Losheim and Saarwellingen, Germany. If other external service providers are used for individual processing operations listed in Section IV, they will be named there.
We do not transfer data to third countries and do not plan to do so. We will provide information about exceptions to this principle in the processing operations described below. Any data transfer to third countries then takes place on the basis of the so-called EU standard contractual clauses.

IV. The processing in detail

6. PROVISION OF THE WEBSITE AND SERVER LOG FILES

6.1 Description of the processing

Each time you visit the website, we automatically collect information that your browser transmits to our server. This is the following data:
a) IP address
b) browser software used, as well as its version and language
c) operating system Operating system
d) the website from which visitors have accessed the website (so-called referrer)
e) the subpages accessed on the website
f) the date and time of access to the website
g) Internet service provider
h) Country and location from which a user has visited the website
These are also stored in the so-called log files of our system. The temporary storage of your IP address by the system is necessary in order to be able to deliver our website to the user's end device. For this purpose, the user's IP address must remain stored for the duration of the session. Your IP address is also recorded in the log files for security reasons to prevent attacks on our website (in particular so-called DDoS attacks) and to prevent fraud.

6.2 Purpose
Processing is carried out to enable the website to be accessed and to ensure its stability and security. In addition, the processing serves the statistical evaluation and improvement of our online offer.

6.3 Legal basis
Processing is necessary to safeguard the overriding legitimate interests of the controller (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in the purpose stated in section 6.2.

6.4 Storage period
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended. The log files are deleted after 7 days as standard.

7. COOKIES

7.1 Description of the processing
Our website uses cookies. Cookies are small text files that are stored on the user's device when visiting a website. Cookies contain information that enables the recognition of an end device and possibly certain functions of a website. We differentiate between our own cookies and external, so-called third-party cookies. So-called "session cookies" and "persistent cookies" are used on our website. "Session cookies" are automatically deleted when you end your internet session and close the browser. Persistent cookies remain stored on your end device for a longer period of time. If cookies are technically necessary for the operation of our website, your consent is not required. All other cookies that are not technically necessary are only set after you have actively consented to the use of cookies via our consent tool. To obtain and document consent, we use the "Consentmanager" service, which is operated by consentmanager AB, Håltegelvägen 1b, 72348 Västerås, Sweden. The consent tool stores your selection itself in a cookie on your end device. This means that you do not need to make a new decision about cookies when you visit our website again.
You can find out which cookies are used on our website and for what purpose, how long they are stored on your device and what consent you may have already given in the settings of the consent tool Consentmanager.

7.2 Purpose
We use cookies to make our website more user-friendly and to offer the functions described in section 7.1.

7.3 Legal basis
With regard to technically necessary cookies and the use of the consent tool, processing is necessary to safeguard the overriding legitimate interests of the controller (Art. 6 para. 1 lit. f GDPR in conjunction with § 25 para. 2 TDDDG). Our legitimate interest lies in the purpose stated in Section 7.2. The legal basis for the processing of all other cookies - i.e. cookies that are not technically necessary - is consent (Art. 6 para. 1 lit. a GDPR in conjunction with Section 25 para. 1 TDDDG). Such consent is voluntary.

7.4 Storage period, revocation of consent
Cookies are automatically deleted at the end of a session or at the end of the specified storage period. As cookies are stored on your end device, you as the user have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your internet browser. Cookies that have already been saved can be deleted. This can also be done automatically. If cookies are deactivated, deleted or restricted for our website, it may be that individual functions of our website cannot be used or can only be used to a limited extent. You can revoke any consent you have given to the use of cookies at any time in the settings of the consent tool with effect for the future.

7.5 Recipients
When cookies are used, data may be transmitted to the corresponding providers of these third-party services. Under certain circumstances, data may also be transferred to third countries outside the European Union or the European Economic Area. We provide information about the recipients of data and the transfer to third countries in the settings of the consent tool or in the corresponding section on the third-party service in this privacy policy. If necessary, personal data will be transmitted to the service provider of the consent tool "Consentmanager", consentmanager AB.

8. CONTACT BY E-MAIL

8.1 Description of processing
You can also contact us via the email addresses provided on the website. To contact us, you can write to us using the e-mail address provided on the website. In this case, the personal data transmitted with the e-mail will be processed by us.

8.2 Purpose
The data transmitted with and in your e-mail will be used exclusively for the purpose of processing and responding to your request.

8.3 Legal basis
Processing is necessary to safeguard the overriding legitimate interests of the controller (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in the purpose stated in section 8.2. If the e-mail contact is aimed at the conclusion or fulfillment of a contract, the data processing is carried out for the fulfillment of the contract (Art. 6 para. 1 lit. b GDPR).

8.4 Storage period
We delete the data as soon as it is no longer required for the purpose for which it was collected. This is usually the case when the respective communication with you has ended. Communication ends when it can be inferred from the circumstances that your request has been conclusively clarified. If statutory retention periods prevent deletion, the data will be deleted immediately after the statutory retention period has expired.

9TH NEWSLETTER

9.1 Description of processing
We send out a newsletter at irregular intervals. With the newsletter we inform you about exclusive information on advance sales, highlights in the Christmas Garden, raffles and much more about the Christmas Garden. You will only receive our newsletter if you actively subscribe to our mailing list. You can subscribe by completing and submitting a newsletter registration form on our website.
To register for the newsletter, all you need to do is enter your e-mail address. All other details (such as your first name and surname) are voluntary and are used solely to personalize the emails. We use the so-called double opt-in procedure to carry out and verify newsletter registrations. Registration takes place in several steps. First, you register for the newsletter on our website. You will then receive an e-mail from us at the e-mail address you have provided. In this e-mail, we ask you to confirm that you have actually registered for the newsletter and wish to receive it. Confirmation is provided by clicking on a confirmation link in the e-mail. Only after successful confirmation will we add you to our newsletter mailing list and send you future e-mails. As part of the double opt-in procedure, we store the date, time and your IP address both when you register and when you confirm.

9.2 Purpose
The processing takes place in order to offer the newsletter function and to be able to send newsletter emails to subscribers. The collection and storage of the date, time and IP addresses when subscribing to the newsletter serves to document the consent given and to protect against the misuse of email addresses.

9.3 Legal basis
The processing of our subscriber newsletter is based on consent in accordance with Art. 6 para. 1 lit. a GDPR. You can access the declaration of consent on the respective website/newsletter, e.g. https://www.christmas-garden.de/berlin/newsletter/. Your consent is voluntary. The collection and storage of date, time and IP addresses when registering for the newsletter is necessary to safeguard the overriding legitimate interests of the controller (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in the purpose stated in section 9.2.

9.4 Storage period and withdrawal of consent
If you do not confirm your subscription to our newsletter within 24 hours of receiving the corresponding registration email, your data will be deleted automatically. We process your personal data for the duration of your newsletter subscription. You can unsubscribe from our newsletter at any time by withdrawing your consent. A simple declaration (by e-mail to info@christmas-garden.de, or by post to Christmas Garden Deutschland GmbH, Potsdamer Str. 58 10785 Berlin) is sufficient for this. You can also unsubscribe from the newsletter by clicking on the unsubscribe link in every newsletter e-mail. If you withdraw your consent, we will no longer send you newsletters and your personal data will be removed from our active mailing list.

9.5 Recipients and transfer to third countries:
We use the services of the newsletter provider Brevo to manage our newsletter mailing list and to send emails. This takes place as part of order processing. Brevo is a service provided by Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin. Further information on data protection at Brevo can be found at https://www.brevo.com/de/legal/privacypolicy/

10. SOCIAL NETWORKS

10.1 Description of the processing
Our website does not use any social media plugins. The Facebook, Instagram, TikTok and YouTube logos displayed on our website are merely linked to the corresponding profiles of our company on the social networks. Data is not transmitted to the social networks when the logos are integrated. If you click on one of the logos, you will only be redirected to the external website of the respective social network.
However, our profiles within the social networks do constitute data processing. If you are logged in to the respective social network when you visit such a profile, this information is assigned to your user account there. If you interact with our profile, e.g. comment on, "share", "like" or "retweet" a post, this information is also stored in your user account. As a rule, we can also view your interactions with our profile.
On our social networks, we have the option of obtaining statistical data on the use of our social media pages via the so-called "Insights" function. These statistics are provided by the social network concerned. The "Insights" function cannot be disabled. We cannot decide to switch this function on or off. It is available to all operators, regardless of whether you use the Insights function or not. We are provided with the following data via Insights for a selectable period of time with regard to fans, subscribers, people reached and people interacting: Total number of page views, "Like" information including origin, page activity, post interactions, reach, post reach (divided into organic, viral and paid interactions), comments, shared content, replies and demographic evaluations, i.e. country of origin, gender and age. Insights statistics do not allow us to identify visitors to our social media profiles and view their profiles.
The social networks with which you communicate store your data using pseudonyms as user profiles and use them for advertising and market research purposes. For example, you may be shown advertisements within the social network and on other third-party websites that match your presumed interests. As a rule, cookies are used for this purpose, which the social network stores on your end device. You have the right to object to the creation of these user profiles; to exercise this right, you must contact the social networks directly.

10.2 Purpose
We maintain profiles on the aforementioned social networks for the purpose of public relations and corporate communication with customers and interested parties. We use the "Insights" function of Facebook, Insta-gram, TikTok and YouTube to evaluate the reach of our posts on the social network and to make them more appealing to our visitors in the future.

10.3 Legal basis
The legal basis for data processing in the context of our profiles on social networks is the protection of our overriding legitimate interests (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in the purpose stated in section 10.2. If you are asked for consent by the respective operator of a social network, the legal basis is Art. 6 para. 1 lit. a GDPR. Data processing takes place with regard to our presence on Facebook, otherwise on the basis of joint responsibility in accordance with Art. 26 GDPR.

10.4 Recipients and transfer to third countries
The respective social networks are operated by the companies listed below. Further information on data protection with regard to our profile on the social networks can be found in the linked data protection provisions.
i) Facebook: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Privacy Policy: https://www.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0#applications
j) Instagram: Meta Platforms Ireland Limited, ATTN: Privacy Operations, Merrion Road, Dublin 4, D04 X2K5, Ireland, Privacy Policy: https://privacycenter.instagram.com/policy/?entry_point=ig_help_center_data_policy_redirect
k) TikTok: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. Privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/de
l) YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, YouTube/Google privacy policy: https://policies.google.com/privacy

The social networks also process your personal data in the USA.

11. GOOGLE ANALYTICS

11.1 Description of processing
Our website uses "Google Analytics", a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as "Google"). Google Analytics uses cookies (see section 7.), which enable your use of our website to be analyzed. The information generated by the cookies is usually transmitted to a Google server in the USA and stored there. However, we only use Google Analytics with IP anonymization. This means that your IP address will be shortened by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. The statistics compiled by Google Analytics record in particular how many users visit our website, the country or location from which access is made, which subpages are accessed and which links or search terms visitors use to reach our website. You can find the Google Analytics user conditions at https://policies.google.com/terms. An overview of data protection at Google Analytics can be found at https://support.google.com/analytics/answer/6004245?hl=de Google's privacy policy can be viewed at www.google.de/intl/de/policies/privacy.

11.2 Purpose
The processing takes place in order to be able to evaluate the use of our website. The information thus obtained is used to improve and tailor our online presence.

11.3 Legal basis
Processing is based on consent in accordance with Art. 6 para. 1 lit. a GDPR. This is obtained by us via the consent tool (see section 7.1). Such consent is voluntary.

11.4 Storage period and right to object, withdrawal of consent
We have explained the storage period and your control and setting options for cookies in section 7.4. You can revoke the consent you have given with regard to Google Analytics at any time in the settings of the consent tool with effect for the future. Alternatively, you can object to data processing by Google Analytics at any time by downloading and installing the browser add-on offered by Google at tools.google.com/dlpage/gaoptout?hl=en. The analysis data processed and stored by Google Analytics will be automatically deleted by us after 14 months.

11.5 Recipients and transfer to third countries
According to the German data protection supervisory authorities (Data Protection Conference), Google Analytics is jointly responsible for data processing on our behalf. Against this background, we have also concluded the "Google Measurement Controller-Controller Data Protection Terms" with Google. Google also processes your personal data in the USA.

12. GOOGLE WEBFONTS

12.1 Description of the processing
Our website uses "Google Webfonts", a font replacement service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as "Google"). Google Web Fonts replaces the standard fonts of your device with fonts from Google's catalog when displaying our website. If your browser prevents the integration of Google Web Fonts, the text on our website will be displayed in the standard fonts of your device. The Google fonts are loaded directly from a Google server. In order for this to happen, your browser sends a request to a Google server. As a result, your IP address may also be transmitted to Google in connection with the address of our website. However, Google Web Fonts does not store any cookies on your end device. According to Google, data processed as part of the Google Web Fonts service is transferred to resource-specific domains such as fonts.googleapis.com or fonts.gstatic.com. They are not associated with data that may be related to the use of other Google services such as the search engine of the same name or Gmail. Further information on data protection at Google Web Fonts can be found at https://developers.google.com/fonts/faq/privacy?hl=de. General information on data protection at Google can be found at policies.google.com/privacy?hl=en-DE.

12.2 Purpose
The processing takes place in order to be able to display the text of our website in a more legible and aesthetically pleasing way.

12.3 Legal basis
Processing is necessary to safeguard the overriding legitimate interests of the controller (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in the purpose stated in section 12.2.
12.4 Recipients and transfer to third countries
The use of Google Web Fonts may result in personal data being transferred to Google. Google also processes your personal data in the USA.

13. GOOGLE ADS CONVERSION

13.1 Description of the processing
Our website uses the advertising service "Google Ads Conversion", which is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as "Google"). With the help of Google Ads Conversions, we can place advertisements on external websites to draw your attention to our offers. The service also enables us to determine the reach and success of individual advertising measures. Our advertisements are delivered by Google via so-called "ad servers". For this purpose, Google uses so-called "Ad Server" cookies, which are used to measure certain parameters for measuring success, such as the display of ads or clicks by users. If you access our website via a Google ad, Google Ads will store a cookie on your end device (see section 7). According to Google, these cookies are not intended to identify you personally. The unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions) and opt-out information (marking that the user no longer wishes to be addressed) are usually stored as analysis values for this cookie. The cookies enable Google to recognize your internet browser. If you visit the website of a Google Ads customer and the cookie stored on your device has not yet expired, Google and the customer can recognize that you clicked on the ad and were redirected to our website. A different cookie is assigned to each Google Ads customer. Cookies can therefore not be tracked via the websites of Google Ads customers. We ourselves do not process any personal data with our Google Adwords advertising measures. Google only provides us with statistical evaluations. Based on these evaluations, we can recognize which of the advertising measures used are particularly effective. We do not receive any further data from the use of the advertising material; in particular, we cannot identify users on the basis of this information. When you visit our website, a connection is therefore established to the Google servers. We have no influence on the scope and further use of the data collected by Google through the use of Google Ads Conversion and therefore inform you according to our state of knowledge: Through the integration of Google Ads Conversion, Google receives the information which subpage of our website you have accessed or clicked on an advertisement from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, there is a possibility that Google will find out your IP address and store it.

Further information on data protection at Google can be found here: policies.google.com/privacy?hl=en.

13.2 Purpose
The processing takes place in order to carry out targeted online advertising for our own offers and to be able to evaluate their effectiveness and reach.

13.3 Legal basis
Processing is based on consent in accordance with Art. 6 para. 1 lit. a GDPR. This is obtained by us via the consent tool "Consentmanager" (see section 7.1). Such consent is voluntary.

13.4 Storage period and right to object, withdrawal of consent
We have explained the storage period and your control and setting options for cookies in section 7. You can also object to data processing by Google Ads Conversion at any time via the following website: https://policies.google.com/privacy?hl=de. You can revoke the consent you have given with regard to data collection by Google Ads Conversion at any time in the settings of the consent tool with effect for the future.

13.5 Recipients and transmission to third countries
The integration of Google Ads Conversion may result in personal data being transmitted to Google. Google also processes your personal data in the USA.

14. GOOGLE TAG MANAGER

Our website uses the "Google Tag Manager", a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as "Google"). No personal data is collected via Google Tag Manager and no cookies are set. This service only enables us to integrate and manage tags on our website. Tags are small code elements on our website that are helpful for measuring traffic and visitor behaviour with other tools, measuring the impact of online advertising and social channels, using remarketing and targeting, testing and optimizing the website. You can find more information about Google Tag Manager at https://support.google.com/tagmanager/answer/9323295?hl=de#.

15 CHATBASE

15.1 Description of the processing
Our websites use a chatbot from Chatbase(https://www.chatbase.co) of Chatbase.co Inc, 4700 Keele Street, 215 Bergeron Centre, Toronto, ON, Canada, M3J 1P3. Chatbots can respond to your questions about our services and other input without human assistance. For this purpose, the chatbots analyze further data in addition to your input in order to provide suitable answers (e.g. names, e-mail addresses and other contact data, customer numbers and other identifiers, orders and chat histories). Your IP address, log files, location information and other metadata can also be recorded via the chatbot.

15.2 Purpose
User profiles can be created on the basis of the data collected. The data can also be used to display interest-based advertising, provided that the other legal requirements (in particular your consent) are met. For this purpose, the chatbots can be linked to analysis and advertising tools. The data collected can also be used to improve our chatbots and their response behavior (machine learning).

15.3 Legal basis
The legal basis for the use of the chatbot is Art. 6 para. 1 lit. b GDPR, insofar as the chatbot is used to initiate a contract or in the context of contract fulfillment. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG, insofar as the consent includes the storage of cookies or access to information in the user's end device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time. In all other cases, the use is based on our legitimate interest in the most effective customer communication possible (Art. 6 para. 1 lit. f GDPR).

15.4 Storage period
The data entered by you in the course of communication will remain with us or the chatbot operator until you request us to delete it, revoke your consent to storage or the purpose for data storage no longer applies (e.g. after your request has been processed).

15.5 Recipient and storage location
This data is stored on the chatbot provider's servers in the USA. You can find more information on the handling of user data in Chatbase's privacy policy: https://www.chatbase.co/legal/privacy.

V. Safety measures

16. SECURITY MEASURES

To protect your personal data from unauthorized access, we have provided our website with an SSL or TLS certificate. SSL stands for "Secure Sockets Layer" and TLS for "Transport Layer Security" and encrypts the communication of data between a website and the user's end device. You can recognize active SSL or TLS encryption by a small padlock logo that is displayed on the far left in the address bar of the browser.

VI Your rights

17. RIGHTS OF DATA SUBJECTS

With regard to the data processing described above by our company, you have the following rights as a data subject:

17.1 Information (Art. 15 GDPR)
You have the right to request confirmation from us as to whether we are processing personal data concerning you. If this is the case, you have a right to information about this personal data and to the information listed in detail in Art. 15 GDPR under the conditions specified in Art. 15 GDPR.

17.2 Rectification (Art. 16 GDPR)
You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you and, where applicable, to have incomplete personal data completed.

17.3 Erasure (Art. 17 GDPR)
You have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the grounds listed in Art. 17 GDPR applies, e.g. if your data is no longer required for the purposes pursued by us.

17.4 Restriction of data processing (Art. 18 GDPR)
You have the right to obtain from us restriction of processing if one of the conditions listed in Art. 18 GDPR is met, e.g. if you contest the accuracy of your personal data, data processing will be restricted for the period necessary to enable us to verify the accuracy of your data.

17.5 Data portability (Art. 20 GDPR)
You have the right, under the conditions set out in Art. 20 GDPR, to request the data concerning you to be provided in a structured, commonly used and machine-readable format.

17.6 Withdrawal of consent (Art. 7 para. 3 GDPR)
You have the right to withdraw your consent at any time in the case of processing based on consent. The revocation applies from the time it is asserted. In other words, it is effective for the future. Withdrawal of consent therefore does not retroactively render the processing unlawful.

17.7 Complaint (Art. 77 GDPR)
If you believe that the processing of personal data concerning you infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. You can assert this right with a supervisory authority in the EU Member State of your place of residence, your place of work or the place of the alleged infringement.

17.8 Prohibition of automated decision-making/profiling (Art. 22 GDPR)
Decisions that have legal consequences for you or significantly affect you may not be based solely on automated processing of personal data, including profiling. We hereby inform you that we do not use automated decision-making, including profiling, with regard to your personal data.

17.9 Right to object (Art. 21 GDPR)
If we process your personal data on the basis of Art. 6 para. 1 lit. f GDPR (for the protection of overriding legitimate interests), you have the right to object to this under the conditions listed in Art. 21 GDPR. However, this only applies if there are grounds relating to your particular situation. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms. We also do not have to stop processing if it serves the assertion, exercise or defense of legal claims. In any case - regardless of a particular situation - you have the right to object to the processing of your personal data for direct marketing purposes at any time.

Status: October 2024