9. Your rights as the person concerned

If your personal data is processed when you visit our website, you as the "person concerned" within the meaning of the GDPR are entitled to the following rights:

9.1 Information
You can also request from us information about whether we process personal data relating to you. This right to information does not exist if the granting of the requested information would violate the obligation to maintain secrecy in accordance with Section 83 Tax Consultancy Act (StBerG), or if the information has to be kept secret for other reasons, especially due to a legitimate prevailing interest of a third party. In deviation from this, there may an obligation to provide information if your interests outweigh the interest in confidentiality, especially when taking imminent damage into consideration. The right to information is further excluded if the data is stored only because it may not be deleted due to statutory retention periods, or exclusively serves for purposes of data backup or data protection monitoring, if the provision of information would require a disproportionately high level of effort and processing for other purposes is excluded by means of appropriate technical and organisational measures. If the right to information is not excluded in your case, and your personal data is processed by us, you can request the following information:

• Purposes of processing the data
• Categories of personal data processed by you
• Recipient or categories of recipients to whom your personal data is disclosed, especially in the case of recipients in third countries
• If possible, the planned duration for which your personal data is stored or, if this is not possible, the criteria for defining the storage period
• The existence of a right to correction or deletion or restriction of the processing of the personal data relating to you or a right to object to this processing
• The existence of a right to complain to a supervisory authority for data protection
• If the personal data was not collected from you as the person concerned, the information available about the origin of the data
• Where applicable, if an automated decision-making process exists including profiling and meaningful information about the logic involved as well as the consequences and the intended effects of automated decision-making processes
• Where applicable, if data is transmitted to recipients in third countries, provided that no decision was taken by the EU Commission regarding the adequacy of the level of protection in accordance with Art. 45 Par. 3 GDPR, information about which appropriate guarantees are provided in accordance with Art. 46 Par. 2 GDPR for protecting personal data.

9.2 Correction and completion
If you determine that we have incorrect personal data relating to you, you can request us to correct this incorrect data immediately. In the case of incomplete personal data relating to you, you can request the completion of this data.

9.3 Deletion
You have a right to deletion ("right to be forgotten"), if the processing of this data is not necessary to exercise the right to freedom of expression, the right to information or to comply with a legal obligation or to perform a task that is within the public interest and if one of the following reasons applies:

• The personal data is no longer necessary for the purposes for which is was processed.
• The justification for the processing was exclusively based on your consent, which you have withdrawn.
• You have objected to the processing of your personal data which we have made public.
• You have objected to the processing of the personal data we have not made public and there are no overriding reasons for the processing.
• Your personal data was processed unlawfully.
• The deletion of the personal data is necessary for the fulfilment of a statutory obligation to which we are subject.

There is no claim to the deletion of data if the deletion in the event of lawful, non-automated data processing is not possible, or if it is possible only with a disproportionately high effort due to the special type of storage, and your interest in its deletion is only slight. In this case, the personal data will not be deleted but its processing will be restricted.

9.4 Restriction of processing
You can request us to restrict the processing of your personal data if one of the following reasons apply:

• You dispute the correctness of the personal data. In this case, you can request the restriction for the period that enables us to verify the correctness of the data.
• The processing of the data is unlawful and instead of deletion, you request the use of your personal data to be restricted.
• Your personal data will no longer be required by us for the purposes of processing, which you require to establish, exercise or defend legal claims.
• You have made an objection in accordance with Art. 21 Par. 1 GDPR. The restriction of the processing can be requested for as a long as it has not been determined whether legitimate reasons outweigh your reasons.

Restricting the processing of the data means that the personal data is processed only with your consent or to establish, exercise or defend legal claims, or to protect the rights of other natural or legal persons or for reasons of important public interest. We are obligated to inform you before we remove this restriction.

9.5 Data portability
You have a right to data portability provided that the processing is based on your consent (first sentence of Art. 6 Abs. 1(a) or Art. 9 Par. 2 (a) GDPR or on a contract to which you are a Party, and the data is processed by means of automated procedures. In this case, the right to data portability includes the following rights, provided that the rights and freedom of other persons are not affected: You can ask us to provide you with the personal data that you have submitted to us in a structured, common and machine-readable format. You have the right to transmit this data to a different party responsible without any obstacles on our part. If technically feasible, you can request us to transmit your personal data directly to a different party responsible.

9.6 Objection
If the processing is based on the first sentence of Art. 6 Par. 1(e) GDPR (performance of a task in the public interest or in the exercise of official authority) or on the first sentence of Art. 6 Par. 1(f) GDPR (legitimate interest of the party responsible or a third party), you have the right to object at any time to the processing of the person data relating to you for reasons arising from your particular situation. This also applies to profiling based on the first sentence of Art. 6 Par. 1(e) or (f) GDPR. After you have exercised your right to object, we will no longer process your personal data unless we can demonstrate compelling legitimate reasons that are worth protecting for the processing that outweigh your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
You can object to the processing of the personal data relating to you for purposes of direct advertising at any time. This also applies to profiling that is connected with such direct advertising. After you have exercised this right to object, we will no longer use the relevant personal data for the purpose of direct advertising.
You have the option of notifying us about your objection by telephone, e-mail, fax or by writing to the company address stated at beginning of this privacy policy.

9.7 Withdrawal of consent
You have the right to withdraw your consent at any time with effect for the future. You can informally notify us of your withdrawal by telephone, e-mail, telefax or by writing to our postal address. Doing so does not affect the lawfulness of consent-based processing that was carried out up to the point of withdrawal. After we receive your withdrawal, the data processing that is based exclusively on your consent will be discontinued.

9.8 Complaints
If you believe that the processing of personal data relating to you is unlawful, you can make a complaint to the supervisory authority for data protection that is responsible for your place of residence or workplace or for the alleged violation.

10. Status and updating of this privacy policy
This privacy policy has the status of 25th May, 2018. We reserve the right to update the privacy policy in due course in order to improve data protection and/or to align it with changes in administrative practices or jurisdiction.