DEEN
Become a member

A. Privacy policy under the GDPR

This page is a translation provided for convenience only. The German version of this privacy policy is the legally binding one.

I. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states, as well as other data protection provisions, is:

AIESEC Alumni German e.V.
c/o AIESEC Deutschland e.V.
Bonner Talweg 8, 53113 Bonn
Germany
Email: [email protected]
Website: www.aiesec-alumni.de

II. Name and address of the data protection officer

The data protection officer of the controller is:

Christian Scholtz
Contact: [email protected]

WS Datenschutz GmbH

III. General information on data processing

1. Scope of processing of personal data

As a rule, we only collect and use our users' personal data insofar as this is necessary to provide a functioning website and our content and services. As a rule, the collection and use of our users' personal data only takes place with the user's consent. An exception applies in cases where prior consent cannot be obtained for factual reasons and processing of the data is permitted by statutory provisions.

2. Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for processing operations involving personal data, Art. 6 (1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data.

When processing personal data that is necessary for the performance of a contract to which the data subject is party, Art. 6 (1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary for carrying out pre-contractual measures.

Insofar as processing of personal data is necessary to fulfil a legal obligation to which our association is subject, Art. 6 (1)(c) GDPR serves as the legal basis.

Should the vital interests of the data subject or of another natural person require the processing of personal data, Art. 6 (1)(d) GDPR serves as the legal basis.

If processing is necessary to safeguard a legitimate interest of our association or of a third party, and if the interests, fundamental rights and freedoms of the data subject do not override the former interest, Art. 6 (1)(f) GDPR serves as the legal basis for the processing.

3. Erasure of data and storage period

The data subject's personal data will be erased or blocked as soon as the purpose of storage no longer applies. Storage may also take place if provided for by the European or national legislature in EU regulations, laws or other provisions to which the controller is subject. Data will also be blocked or erased if a storage period prescribed by the standards mentioned expires, unless further storage of the data is necessary for the conclusion or performance of a contract.

IV. Provision of the website and creation of log files

1. Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.

The following data is collected in this process:

  1. Information about the browser type and version used
  2. The user's operating system
  3. The user's internet service provider
  4. The user's IP address
  5. Date and time of access
  6. Websites from which the user's system reaches our website
  7. Websites accessed by the user's system via our website

The data is also stored in our system's log files. This data is not stored together with other personal data of the user.

2. Legal basis for data processing

The legal basis for the temporary storage of the data and the log files is Art. 6 (1)(f) GDPR.

3. Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this, the user's IP address must remain stored for the duration of the session.

Storage in log files takes place to ensure the functionality of the website. In addition, the data helps us optimise the website and ensure the security of our information technology systems. The data is not evaluated for marketing purposes in this context.

These purposes also constitute our legitimate interest in data processing under Art. 6 (1)(f) GDPR.

4. Duration of storage

The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. In the case of data collected for the provision of the website, this is the case when the respective session has ended.

In the case of data stored in log files, this is the case after seven days at the latest. Storage beyond this is possible. In this case, the users' IP addresses are erased or anonymised so that it is no longer possible to identify the accessing client.

5. Right to object and removal

The collection of data for the provision of the website and the storage of data in log files is mandatory for the operation of the website. Consequently, users have no option to object.

V. Use of cookies

1. Description and scope of data processing

Our website uses cookies. Cookies are text files that are stored on the user's computer system via the internet browser. When a user visits a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is visited again.

We use cookies to make our website more user-friendly. Some elements of our website require the accessing browser to be identifiable even after a page change.

The following data is stored and transmitted in the cookies:

  1. Language settings
  2. Items in a shopping cart
  3. Log-in information

Our website also uses cookies that allow analysis of users' browsing behaviour.

In this way, the following data may be transmitted:

  1. Search terms entered
  2. Frequency of page views
  3. Use of website functions

The user data collected in this way is pseudonymised by technical measures. It is therefore no longer possible to attribute the data to the accessing user. The data is not stored together with other personal data of the users.

When our website is accessed, users are informed about the use of cookies for analysis purposes via an information banner and referred to this privacy policy. In this context, users are also informed of how the storage of cookies can be prevented in their browser settings.

When our website is accessed, the user is informed about the use of cookies for analysis purposes, and their consent to the processing of personal data used in this context is obtained. This also refers to this privacy policy.

2. Legal basis for data processing

The legal basis for the processing of personal data using cookies is Art. 6 (1)(f) GDPR.

3. Purpose of data processing

The purpose of using technically necessary cookies is to make it easier for users to use websites. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognised even after a page change.

We need cookies for the following applications:

  1. Shopping cart
  2. Adopting language settings
  3. Remembering search terms

User data collected through technically necessary cookies is not used to create user profiles.

Analytics cookies are used for the purpose of improving the quality of our website and its content. Through analytics cookies, we learn how the website is used and can continuously optimise our offering.

These purposes also constitute our legitimate interest in the processing of personal data under Art. 6 (1)(f) GDPR.

4. Storage period, right to object and removal

Cookies are stored on the user's computer and transmitted to our site from there. As a user, you therefore have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Cookies already stored can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may not be possible to use all functions of the website to their full extent.

The transmission of Flash cookies cannot be prevented via browser settings, but can be prevented by changing the Flash Player's settings.

5. Details on individual providers

a) Remarketing
Facebook

This website uses the "Custom Audiences" remarketing function of Facebook Inc. ("Facebook"). This function serves to present interest-based advertisements ("Facebook ads") to visitors of this website when they visit the Facebook social network. For this purpose, the Facebook remarketing tag has been implemented on this website. Via this tag, a direct connection to the Facebook servers is established when the website is visited. This transmits to the Facebook server that you have visited this website, and Facebook assigns this information to your personal Facebook user account. Further information on the collection and use of data by Facebook, as well as your related rights and options for protecting your privacy, can be found in Facebook's privacy notices. Alternatively, you can deactivate the "Custom Audiences" remarketing function here. To do so, you must be logged in to Facebook.

Google

This website uses the remarketing function of Google Inc. ("Google"). This function is used to present interest-based advertisements to visitors of the website within the Google advertising network. The website visitor's browser stores so-called "cookies", text files that are stored on your computer and that make it possible to recognise the visitor when they visit websites that belong to Google's advertising network. Visitors may then be shown advertisements on these websites relating to content they previously accessed on websites that use Google's remarketing function. According to its own statements, Google does not collect any personal data in this process. Should you nevertheless not want the Google remarketing function, you can generally deactivate it by making the relevant settings at http://www.google.com/settings/ads. Alternatively, you can deactivate the use of cookies for interest-based advertising via the Network Advertising Initiative by following the instructions at http://www.networkadvertising.org/managing/opt_out.asp.

LinkedIn Retargeting

Our website uses functions of the LinkedIn network. The provider is LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. Each time one of our pages containing LinkedIn functions is accessed, a connection to LinkedIn's servers is established. LinkedIn is informed that you have visited our websites with your IP address. If you click the LinkedIn "Recommend button" while logged in to your LinkedIn account, LinkedIn can assign your visit to our website to you and your user account. We would like to point out that, as the provider of the pages, we have no knowledge of the content of the data transmitted or its use by LinkedIn. Further information can be found in LinkedIn's privacy policy. If you would like to deactivate this feature, please click here.

b) Social media
Facebook plugins (Like & Share button)

Our pages integrate plugins of the Facebook social network, provider Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA. You can recognise the Facebook plugins by the Facebook logo or the "Like button" on our page. An overview of the Facebook plugins can be found here: https://developers.facebook.com/docs/plugins/.

When you visit our pages, the plugin establishes a direct connection between your browser and the Facebook server. This gives Facebook the information that you have visited our page with your IP address. If you click the Facebook "Like button" while logged in to your Facebook account, you can link the content of our pages to your Facebook profile. This allows Facebook to associate your visit to our pages with your user account. We would like to point out that, as the provider of the pages, we have no knowledge of the content of the data transmitted or its use by Facebook. Further information can be found in Facebook's privacy policy at: https://de-de.facebook.com/policy.php.

If you do not want Facebook to be able to associate your visit to our pages with your Facebook user account, please log out of your Facebook user account.

Instagram plugin

Our pages integrate functions of the Instagram service. These functions are offered by Instagram Inc., 1601 Willow Road, Menlo Park, CA 94025, USA.

If you are logged in to your Instagram account, you can link the content of our pages to your Instagram profile by clicking the Instagram button. This allows Instagram to associate your visit to our pages with your user account. We would like to point out that, as the provider of the pages, we have no knowledge of the content of the data transmitted or its use by Instagram.

Further information can be found in Instagram's privacy policy: https://instagram.com/about/legal/privacy/.

Twitter plugin

Our pages integrate functions of the Twitter service. These functions are offered by Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. By using Twitter and the "Re-Tweet" function, the websites you visit are linked to your Twitter account and disclosed to other users. Data is also transmitted to Twitter in this process. We would like to point out that, as the provider of the pages, we have no knowledge of the content of the data transmitted or its use by Twitter. Further information can be found in Twitter's privacy policy at: https://twitter.com/privacy.

You can change your privacy settings on Twitter in the account settings at https://twitter.com/account/settings.

YouTube

With the YouTube player, we integrate our own videos from our YouTube channels, or videos from other providers, into our pages. Google's privacy notices inform you about how Google, the owner of YouTube, collects your data and how Google handles this data.

c) Analytics tools and advertising
Google Analytics

This website uses functions of the Google Analytics web analytics service. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics uses so-called "cookies". These are text files that are stored on your computer and that enable an analysis of your use of the website. The information generated by the cookie about your use of this website is generally transmitted to a Google server in the USA and stored there.

Google Analytics cookies are stored on the basis of Art. 6 (1)(f) GDPR. The website operator has a legitimate interest in analysing user behaviour in order to optimise both its website and its advertising.

IP anonymisation

We have activated the IP anonymisation function on this website. As a result, your IP address is shortened by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area before being transmitted to the USA. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide the website operator with further services relating to website and internet use. The IP address transmitted by your browser as part of Google Analytics is not merged with other data held by Google.

Browser plugin

You can prevent the storage of cookies by adjusting the settings of your browser software accordingly; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent. You can also prevent the data generated by the cookie relating to your use of the website (including your IP address) from being collected by Google, as well as the processing of this data by Google, by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

Objecting to data collection

You can prevent the collection of your data by Google Analytics by clicking the following link. An opt-out cookie will be set, which prevents the collection of your data on future visits to this website: deactivate Google Analytics

Further information on the handling of user data by Google Analytics can be found in Google's privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.

Data processing agreement

We have concluded a data processing agreement with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

Demographic characteristics in Google Analytics

This website uses the "demographic characteristics" feature of Google Analytics. This allows reports to be created that contain statements on the age, gender and interests of site visitors. This data comes from interest-based advertising by Google as well as visitor data from third-party providers. This data cannot be attributed to any specific person. You can deactivate this feature at any time via the ad settings in your Google account, or generally prohibit the collection of your data by Google Analytics as described under "Objecting to data collection" above.

d) Other
Google reCAPTCHA

We use "Google reCAPTCHA" (hereinafter "reCAPTCHA") on our websites. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google").

reCAPTCHA is used to check whether data entry on our websites (e.g. in a contact form) is being carried out by a human or by an automated program. For this purpose, reCAPTCHA analyses the behaviour of the website visitor based on various characteristics. This analysis begins automatically as soon as the website visitor enters the website. For the analysis, reCAPTCHA evaluates various information (e.g. IP address, the time the website visitor spends on the website, or mouse movements made by the user). The data collected during the analysis is forwarded to Google.

The reCAPTCHA analyses run entirely in the background. Website visitors are not notified that an analysis is taking place.

The data processing is carried out on the basis of Art. 6 (1)(f) GDPR. The website operator has a legitimate interest in protecting its website offerings from abusive automated spying and from spam.

Further information on Google reCAPTCHA, as well as Google's privacy policy, can be found at the following links: https://www.google.com/intl/de/policies/privacy/ and https://www.google.com/recaptcha/intro/android.html.

Google Web Fonts

This page uses web fonts provided by Google for the uniform display of typefaces. When a page is accessed, your browser loads the required web fonts into its browser cache in order to display texts and typefaces correctly.

For this purpose, the browser you use must connect to Google's servers. As a result, Google becomes aware that our website has been accessed via your IP address. The use of Google Web Fonts is in the interest of a uniform and appealing presentation of our online services. This constitutes a legitimate interest within the meaning of Art. 6 (1)(f) GDPR.

If your browser does not support web fonts, a standard font from your computer is used.

Further information on Google Web Fonts can be found at https://developers.google.com/fonts/faq and in Google's privacy policy: https://www.google.com/policies/privacy/.

VI. Newsletter

1. Description and scope of data processing

Our website offers the option of subscribing to a free newsletter. When subscribing to the newsletter, the data from the input mask is transmitted to us.

The following data is also collected upon subscription:

  1. IP address of the accessing computer
  2. Date and time of registration

Your consent to the processing of the data is obtained as part of the subscription process, with reference made to this privacy policy.

If you purchase goods or services on our website and provide your email address in doing so, we may subsequently use it to send a newsletter. In such a case, the newsletter is used exclusively to send direct advertising for our own similar goods or services.

In connection with the data processing for sending newsletters, the data is not passed on to third parties. The data is used exclusively for sending the newsletter.

2. Legal basis for data processing

The legal basis for processing the data following a user's newsletter subscription is, where the user's consent is given, Art. 6 (1)(a) GDPR.

The legal basis for sending the newsletter as a result of the sale of goods or services is § 7 (3) of the German Act Against Unfair Competition (UWG).

3. Purpose of data processing

Collecting the user's email address serves to deliver the newsletter.

Collecting other personal data as part of the subscription process serves to prevent misuse of the services or of the email address used.

4. Duration of storage

The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. The user's email address is therefore stored for as long as the newsletter subscription remains active.

Other personal data collected as part of the subscription process is generally erased after a period of seven days.

5. Right to object and removal

The newsletter subscription can be cancelled by the affected user at any time. A corresponding link can be found in every newsletter.

This also allows the consent to storage of the personal data collected during the subscription process to be withdrawn.

VII. Registration

1. Description and scope of data processing

Our website offers users the option of registering by providing personal data. The data is entered into an input mask and transmitted to us and stored. The data is not passed on to third parties. The following data is collected as part of the registration process:

The following data is also stored at the time of registration:

  1. The user's IP address
  2. Date and time of registration

As part of the registration process, the user's consent to the processing of this data is obtained.

2. Legal basis for data processing

The legal basis for processing the data is, where the user's consent is given, Art. 6 (1)(a) GDPR.

If the registration serves to perform a contract to which the user is party, or to carry out pre-contractual measures, the additional legal basis for processing the data is Art. 6 (1)(b) GDPR.

3. Purpose of data processing

Registration by the user is necessary for providing certain content and services on our website.

Registration by the user is necessary to perform a contract with the user or to carry out pre-contractual measures.

4. Duration of storage

The data is erased as soon as it is no longer required to achieve the purpose for which it was collected.

For the data collected during the registration process, this is the case when the registration on our website is cancelled or amended.

For data collected during the registration process for the purpose of performing a contract or carrying out pre-contractual measures, this is the case when the data is no longer required to perform the contract. Even after the contract has ended, there may be a need to store the contracting party's personal data in order to comply with contractual or statutory obligations.

5. Right to object and removal

As a user, you have the option to cancel your registration at any time. The data stored about you can be amended at any time.

Where the data is necessary to perform a contract or to carry out pre-contractual measures, early erasure of the data is only possible insofar as this is not precluded by contractual or statutory obligations.

VIII. Contact form and email contact

1. Description and scope of data processing

Our website provides a contact form that can be used for electronic contact. If a user makes use of this option, the data entered into the input mask is transmitted to us and stored. This data is:

The following data is also stored at the time the message is sent:

  1. The user's IP address
  2. Date and time of registration

Your consent to the processing of the data is obtained as part of the sending process, with reference made to this privacy policy.

Alternatively, contact can be made via the email address provided. In this case, the user's personal data transmitted with the email is stored.

In this context, the data is not passed on to third parties. The data is used exclusively for processing the conversation.

2. Legal basis for data processing

The legal basis for processing the data is, where the user's consent is given, Art. 6 (1)(a) GDPR.

The legal basis for processing data transmitted in the course of sending an email is Art. 6 (1)(f) GDPR. If the email contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 (1)(b) GDPR.

3. Purpose of data processing

The processing of personal data from the input mask serves solely to process the contact request. In the case of contact by email, this also constitutes the necessary legitimate interest in the processing of the data.

The other personal data processed during the sending process serves to prevent misuse of the contact form and to ensure the security of our information technology systems.

4. Duration of storage

The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. For personal data from the contact form's input mask and data sent by email, this is the case once the respective conversation with the user has ended. A conversation is deemed ended when it can be inferred from the circumstances that the matter concerned has been conclusively clarified.

Personal data additionally collected during the sending process is erased after a period of seven days at the latest.

5. Right to object and removal

The user may withdraw their consent to the processing of personal data at any time. If the user contacts us by email, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.

All personal data stored in the course of making contact will be erased in this case.

IX. Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR, and you have the following rights against the controller:

1. Right of access

You may request confirmation from the controller as to whether personal data concerning you is being processed by us.

Where such processing is taking place, you may request the following information from the controller:

  1. the purposes for which the personal data is processed;
  2. the categories of personal data being processed;
  3. the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
  4. the envisaged period for which the personal data concerning you will be stored, or, where it is not possible to specify this, the criteria used to determine that period;
  5. the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller, or a right to object to such processing;
  6. the existence of a right to lodge a complaint with a supervisory authority;
  7. any available information as to the source of the data, where the personal data is not collected from the data subject;
  8. the existence of automated decision-making, including profiling, pursuant to Art. 22 (1) and (4) GDPR and — at least in those cases — meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

You have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

2. Right to rectification

You have a right to rectification and/or completion vis-à-vis the controller if the personal data concerning you that is processed is inaccurate or incomplete. The controller must carry out the rectification without delay.

3. Right to restriction of processing

Under the following conditions, you may request the restriction of the processing of personal data concerning you:

  1. if you contest the accuracy of the personal data concerning you, for a period enabling the controller to verify the accuracy of the personal data;
  2. if the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
  3. if the controller no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise or defence of legal claims; or
  4. if you have objected to the processing pursuant to Art. 21 (1) GDPR, pending verification as to whether the legitimate grounds of the controller override your grounds.

Where the processing of personal data concerning you has been restricted, such data may — with the exception of its storage — only be processed with your consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a member state.

If the restriction of processing has been restricted under the above conditions, you will be informed by the controller before the restriction is lifted.

4. Right to erasure

a) Obligation to erase

You may request the controller to erase the personal data concerning you without delay, and the controller is obliged to erase this data without delay, if one of the following reasons applies:

  1. The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
  2. You withdraw the consent on which the processing was based pursuant to Art. 6 (1)(a) or Art. 9 (2)(a) GDPR, and there is no other legal basis for the processing.
  3. You object to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 (2) GDPR.
  4. The personal data concerning you has been processed unlawfully.
  5. Erasure of the personal data concerning you is necessary to comply with a legal obligation under Union or member state law to which the controller is subject.
  6. The personal data concerning you was collected in relation to the offer of information society services pursuant to Art. 8 (1) GDPR.

b) Information to third parties

Where the controller has made the personal data concerning you public and is obliged pursuant to Art. 17 (1) GDPR to erase it, it shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform controllers processing the personal data that you, as the data subject, have requested the erasure of any links to, or copies or replications of, that personal data.

c) Exceptions

The right to erasure does not apply insofar as processing is necessary:

  1. for exercising the right of freedom of expression and information;
  2. for compliance with a legal obligation which requires processing under Union or member state law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  3. for reasons of public interest in the area of public health pursuant to Art. 9 (2)(h) and (i) as well as Art. 9 (3) GDPR;
  4. for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Art. 89 (1) GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
  5. for the establishment, exercise or defence of legal claims.

5. Right to notification

If you have asserted the right to rectification, erasure or restriction of processing vis-à-vis the controller, the controller is obliged to communicate this rectification, erasure or restriction of processing to every recipient to whom the personal data concerning you was disclosed, unless this proves impossible or involves disproportionate effort.

You have the right vis-à-vis the controller to be informed about these recipients.

6. Right to data portability

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, insofar as

  1. the processing is based on consent pursuant to Art. 6 (1)(a) GDPR or Art. 9 (2)(a) GDPR, or on a contract pursuant to Art. 6 (1)(b) GDPR, and
  2. the processing is carried out by automated means.

In exercising this right, you further have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. This must not adversely affect the rights and freedoms of others.

The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you carried out on the basis of Art. 6 (1)(e) or (f) GDPR; this also applies to profiling based on these provisions.

The controller shall no longer process the personal data concerning you, unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of the personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

In connection with the use of information society services, and notwithstanding Directive 2002/58/EC, you have the option to exercise your right to object by automated means using technical specifications.

8. Right to withdraw consent under data protection law

You have the right to withdraw your consent under data protection law at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of the consent before its withdrawal.

9. Automated decision-making in individual cases, including profiling

You have the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal effects concerning you or similarly significantly affects you. This does not apply where the decision:

  1. is necessary for entering into, or the performance of, a contract between you and the controller,
  2. is authorised by Union or member state law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or
  3. is based on your explicit consent.

However, such decisions may not be based on special categories of personal data under Art. 9 (1) GDPR, unless Art. 9 (2)(a) or (g) applies and suitable measures to protect your rights, freedoms and legitimate interests have been taken.

With regard to the cases referred to in (1) and (3), the controller shall take reasonable measures to safeguard your rights and freedoms and legitimate interests, which shall include at least the right to obtain human intervention on the part of the controller, to express your point of view, and to contest the decision.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority with which the complaint was lodged shall inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.