Privacy policy

Name and address of the person responsible
The controller within the meaning of the GDPR and other national data protection laws of the member states as well as other data protection regulations is

codecentric AG
Hochstraße 11
42697 Solingen
Germany

Phone: +49 [0] 212 23 36 28 0
Email: info@codecentric.de
Website: www.codecentric.de

Address of the data protection officer
The data protection officer of the controller can be contacted as follows:

codecentric AG
Hochstraße 11
42697 Solingen
Germany

E-Mail (data privacy): datenschutz@codecentric.de

1. General information on data processing
2. ⁠ Provision of the website and creation of log files⁠
3. Use of cookies⁠
4. Newsletter
5. Softwerker
6. ⁠Focus topics and white papers
7. Contact form
8. Forms for inquiries and registrations on LinkedIn
9. codecentric curriculum vitae⁠
10. Google Analytics⁠
11. Hubspot⁠⁠
12. Audio and video conferences/ online events⁠
13. Usercentrics⁠
14. Algolia⁠
15. Google Tag Manager
16. ⁠ Google Ads and Google Conversion-Tracking⁠
17. Google reCAPTCHA⁠
18. Social media plugins⁠
19. Rights of the data subject

1.1. Scope of processing personal data

We only process our users' personal data to the extent necessary to provide a functional website and our content and services. The processing of our users' personal data is carried out regularly only with the user's consent. An exception applies in cases where prior consent cannot be obtained for practical reasons and the processing of the data is permitted by law.

1.2. Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 (1) lit. a GDPR serves as the legal basis.

When processing personal data that is necessary for the performance of a contract to which the data subject is party, Art. 6 (1) lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary for the implementation of pre-contractual measures.

Insofar as the processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 (1) lit. c GDPR serves as the legal basis.

In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 (1) lit. d GDPR serves as the legal basis.

If processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights, and freedoms of the data subject do not outweigh the former interest, Art. 6 para. 1 lit. f GDPR serves as the legal basis for processing.

1.3. Data deletion and storage period

The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may also take place if this has been provided for by European or national legislators in EU regulations, laws, or other provisions to which the controller is subject. The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfillment of a contract.

2.1. Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.

The following data is collected:

1. Information about the browser type and version used
2. The user's operating system
3. The user's Internet service provider
4. The user's IP address
5. Date and time of access
6. Websites from which the user's system accesses our website
7. Websites accessed by the user's system via our website

The data is also stored in our system's log files. This data is not stored together with other personal data of the user.

2.2 Legal basis for data processing

The legal basis for the temporary storage of data and log files is Art. 6 (1) lit. f GDPR.

2.3. Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.

Storage in log files is done to ensure the functionality of the website. In addition, the data serves us for the technical optimization of the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.

These purposes also constitute our legitimate interest in data processing pursuant to Art. 6 (1) lit. f GDPR.

2.4. Duration of storage

The data is deleted as soon as it is no longer necessary for the purpose for which it was collected. In the case of data collection for the provision of the website, this is the case when the respective session has ended.

In the case of storage of the data in log files, this is the case after seven days at the latest. Storage beyond this is possible. In this case, the IP addresses of the users are deleted or alienated so that an assignment of the calling client is no longer possible.

2.5. Right to object and right to erasure

The collection of data for the provision of the website and the storage of data in log files is essential for the operation of the website. Consequently, there is no right to object on the part of the user.

3.1. Description and scope of data processing

Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user's computer system. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is accessed again.

We use cookies to make our website functional. Some elements of our website require that the accessing browser can be identified even after a page change.

We also use cookies on our website that enable us to analyze the surfing behavior of users.

This allows the following data to be transmitted:

• Search terms entered
• Frequency of page views
• Use of website functions

When visiting our website, the user is informed about the use of cookies for analysis purposes and their consent to the processing of personal data used in this context is obtained.

3.2. Legal basis for data processing

The legal basis for the processing of personal data using technically necessary cookies within the meaning of Section 25 (2) TTDSG is Art. 6 (1) lit. f GDPR.

The legal basis for the processing of personal data using cookies for analysis purposes is Art. 6 (1) (a) GDPR, provided that the user has given their consent.

Otherwise, the legal basis for the processing of personal data using technically necessary cookies is Art. 6 (1) (f) GDPR.

3.3. Purpose of data processing

The purpose of using technically necessary cookies is to enable users to use websites. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognized even after a page change.

We need cookies for the following applications:

• Security
• Identity verification
• Network management

The user data collected by technically necessary cookies is not used to create user profiles.

Analysis cookies are used for the purpose of improving the quality of our website and its content. Analysis cookies tell us how the website is used, enabling us to continuously optimize our offering.

The purposes are to measure the effectiveness of advertising and to record the interests of visitors.

These purposes also constitute our legitimate interest in the subsequent processing of personal data in accordance with Art. 6 (1) lit. f GDPR.

3.4. Duration of storage, possibility of objection and removal

Cookies are stored on the user's computer and transmitted to our site by the user. Therefore, as a user, you have full control over the use of cookies. By changing the settings in your Internet browser, you can deactivate or restrict the storage of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all the functions of the website to their full extent.

4.1. Description and scope of data processing

On our website, you have the option of subscribing to a free newsletter. When you register for the newsletter, the data from the input mask is transmitted to us. This includes the user's email address. Further data is not collected or is only collected on a voluntary basis.

The following data is also collected during registration:

• IP address of the accessing computer
• Date and time of registration

Your consent is obtained during the registration process for the processing of the data.

No data is passed on to third parties in connection with data processing for the purpose of sending newsletters. The data is used exclusively for sending the newsletter.

We use the CRM tool "HubSpot" to manage your consent and the personal data transmitted. Details on data processing can be found in this privacy policy in the section "HubSpot".

4.2. Legal basis for data processing

The legal basis for processing the data after the user has registered for the newsletter is Art. 6 (1) (a) GDPR, provided the user has given their consent.

4.3. Purpose of data processing

The user's email address is collected for the purpose of delivering the newsletter.

The collection of other personal data during the registration process serves to prevent misuse of the services or the email address used.

4.4. Duration of storage

The data will be deleted as soon as it is no longer necessary for the purpose for which it was collected. The user's email address will therefore be stored for as long as the newsletter subscription is active.

4.5. Right to object and right to erasure

The user concerned can unsubscribe from the newsletter at any time.

This also allows the user to revoke their consent to the storage of personal data collected during the registration process.

5.1. Description and scope of data processing

On our website, you can subscribe to the free magazine "Der Softwerker" as a digital or print edition. The data from the input mask is transmitted to us. For online subscriptions only, this includes the user's first name and email address. If you subscribe to the print edition, your last name and address are also collected. No further data is collected, or only on a voluntary basis.

The following data is also collected during registration:

• IP address of the accessing computer
• Date and time of registration
• URL of the page on which the form was submitted

Your consent is obtained during the registration process for the processing of the data.

No data is passed on to third parties in connection with data processing for the dispatch of the online edition. The data is used exclusively for the dispatch of the online edition.

If you also subscribe to the print edition of Softwerker, we will forward your name and address to shipping service providers so that we can send you the print edition. These service providers are bound by data protection regulations as independent data controllers and will use the data exclusively for the purpose of fulfilling their tasks.

We use the CRM tool "HubSpot" to manage your consent and the personal data transmitted. Details on data processing can be found in this privacy policy in the section "HubSpot."

5.2. Legal basis for data processing

The legal basis for processing the data after the user has taken out an online and/or print subscription is Art. 6 (1) (a) GDPR, provided the user has given their consent.

5.3. Purpose of data processing

The user's email address is collected for the purpose of delivering the online edition of Softwerker. The first name is collected in the aforementioned context in order to choose the form of address in the accompanying email.

The collection of surnames and addresses serves to deliver the print edition of Softwerker.

The collection of other personal data during the registration process serves to prevent misuse of the services or the email address used.

5.4. Duration of storage

The data will be deleted as soon as it is no longer required for the purpose for which it was collected. The email address, surname and address of the user will therefore be stored for as long as the Softwerker subscription is active.

5.5. Right to object and right to erasure

The Softwerker subscription can be canceled by the user concerned at any time.

This also allows the consent to the storage of personal data collected during the registration process to be revoked.

6.1. Description and scope of data processing

On our website, you have the option of subscribing to information on specific topics or requesting white papers on topics such as artificial intelligence, cloud transformation, IT security, and much more. When you register, the data from the input mask is transmitted to us. This includes the user's email address, first and last name, company name, job title, and postal code.

The following data is also collected during registration:

• IP address of the accessing computer
• Date and time of registration
• URL of the page on which the form was submitted

No further data is collected, or only on a voluntary basis.

Your consent is obtained during the registration process for the processing of your data.

No data is passed on to third parties in connection with data processing for the purpose of sending focus updates or white papers. The data is used exclusively for sending content.

We use the CRM tool "HubSpot" to manage your consent and the personal data you have provided. Details on data processing can be found in this privacy policy in the "HubSpot" section.

6.2. Legal basis for data processing

The legal basis for processing data after the user has registered for focus updates or white papers is Art. 6 (1) (a) GDPR, provided the user has given their consent.

6.3. Purpose of data processing

The user's email address is collected for the purpose of sending focus updates or white papers. First and last names are processed for personal communication and to detect any misuse. The company name and job title are used to tailor the information on focus topics or white papers to the user's needs. The postal code is used to provide the correct regional contact person in case of queries.

The collection of other personal data during the registration process serves to prevent misuse of the services or the email address used.

6.4. Duration of storage

The data will be deleted as soon as it is no longer required for the purpose for which it was collected. The user's email address will therefore be stored for as long as the subscription is active.

6.5. Right to object and right to erasure

The subscription can be canceled by the user concerned at any time.

This also allows the consent to the storage of personal data collected during the registration process to be revoked.

10.1. Scope of processing

Google Analytics uses cookies that enable an analysis of your use of our websites. The information collected by the cookies about your use of this website is usually transferred to a Google server in the USA and stored there.

We use the User ID function. With the help of the User ID, we can assign a unique, permanent ID to one or more sessions (and the activities within these sessions) and analyze user behavior across devices.

We use Google Signals. This allows Google Analytics to collect additional information about users who have enabled personalized ads (interests and demographic data), and ads can be delivered to these users in cross-device remarketing campaigns.

In Google Analytics 4, IP address anonymization is enabled by default. Due to IP anonymization, your IP address is truncated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. According to Google, the IP address transmitted by your browser as part of Google Analytics is not merged with other Google data.

During your visit to the website, your user behavior is recorded in the form of "events." Events can include:

• Page views
• First visit to the website
• Start of session
• Your "click path," interaction with the website
• Scrolls (whenever a user scrolls to the bottom of the page (90%))
• Clicks on external links
• Internal search queries
• Interaction with videos
• File downloads
• Ads viewed/clicked
• Language setting

The following is also recorded:

• Your approximate location (region)
• Your IP address (in abbreviated form)
• Technical information about your browser and the devices you use (e.g., language setting, screen resolution)
• Your internet service provider
• The referrer URL (via which website/advertisement you came to this website)

10.2. Purposes of processing

On behalf of the operator of this website, Google will use this information to evaluate your use of the website and to compile reports on website activity. The reports provided by Google Analytics are used to analyze the performance of our website.

10.3. Recipients

The recipients of the data are/may be

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as a processor pursuant to Art. 28 GDPR)
• Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
• Alphabet Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

It cannot be ruled out that US authorities may access the data stored by Google.

10.4. Third country transfer

If data is processed outside the EU/EEA and there is no level of data protection that meets European standards, we have concluded EU standard contractual clauses with the service provider to ensure an adequate level of data protection. The parent company of Google Ireland, Google LLC, is based in California, USA. The transfer of data to the USA and access by US authorities to data stored by Google cannot be ruled out. From a data protection perspective, the USA is currently considered a third country. You do not have the same rights there as you do within the EU/EEA. You may have no legal recourse against access by authorities.

10.5. Storage period

The data sent by us and linked to cookies is automatically deleted after 2 months. Data that has reached its retention period is automatically deleted once a month.

10.6. Legal basis

The legal basis for this data processing is your consent in accordance with Art. 6 (1) (a) GDPR in conjunction with Art. 49a GDPR.

10.7. Revocation

You can revoke your consent at any time with effect for the future by accessing the cookie settings and changing your selection there. The lawfulness of the processing carried out on the basis of the consent until revocation remains unaffected.

You can also prevent the storage of cookies from the outset by adjusting your browser software settings accordingly. However, if you configure your browser to reject all cookies, this may result in restrictions on the functionality of this and other websites. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by

• not giving your consent to the setting of the cookie or
• downloading and installing the browser add-on to deactivate Google Analytics here .

For more information about the terms of use of Google Analytics and data protection at Google, please visit https://marketingplatform.google.com/about/analytics/terms/us/ and https://policies.google.com/?hl=en

12.1. Purpose of processing

We use the "Zoom" tool to conduct conference calls, online meetings, video conferences, and/or webinars (hereinafter: "online meetings"). "Zoom" is a service provided by Zoom Video Communications, Inc., which is based in the USA.

The controller responsible for data processing directly related to the holding of "online meetings" is codecentric AG, Hochstraße 11, 42697 Solingen, Germany.

Please note: When you visit the "Zoom" website, the provider of "Zoom" is responsible for data processing. However, visiting the website is only necessary for the use of "Zoom" in order to download the software for using "Zoom." You can also use Zoom if you enter the respective meeting ID and, if necessary, additional access data for the meeting directly in the Zoom app. If you do not want to or cannot use the Zoom app, the basic functions can also be used via a browser version, which you can also find on the Zoom website.

12.2. What data is processed?

Various types of data are processed when using Zoom. The scope of the data also depends on what information you provide before or during participation in an online meeting.

The following personal data is subject to processing:

• User information: first name, last name, telephone number (optional), email address, password (if single sign-on is not used), profile picture (optional), department (optional)
• Meeting metadata: topic, description (optional), participant IP addresses, device/hardware information
• For recordings (optional): MP4 file of all video, audio, and presentation recordings, M4A file of all audio recordings, text file of the online meeting chat.
• When dialing in by phone: Information about the incoming and outgoing phone number, country name, start and end time. Additional connection data, such as the IP address of the device, may be stored if necessary.
• Text, audio, and video data: You may have the option of using the chat, question, or survey functions in an "online meeting." In this case, the text entries you make will be processed in order to display them in the "online meeting" and, if necessary, to log them. To enable the display of video and the playback of audio, the data from the microphone of your end device and from any video camera of the end device will be processed for the duration of the meeting. You can switch off or mute the camera or microphone yourself at any time using the "Zoom" applications. To participate in an "online meeting" or enter the "meeting room," you must at least provide your name.

12.3. Scope of processing

We use "Zoom" to conduct "online meetings." If we want to record "online meetings," we will inform you of this transparently in advance and, if necessary, ask for your consent. The fact that the meeting is being recorded will also be displayed in the Zoom app. If necessary for the purposes of recording the results of an online meeting, we will log the chat content. However, this will not usually be the case. In the case of webinars, we may also process questions asked by webinar participants for the purposes of recording and following up on webinars. If you are registered as a user with "Zoom," reports on "online meetings" (meeting metadata, telephone dial-in data, questions and answers in webinars, survey function in webinars) can be stored by "Zoom" for up to 12 months.

Automated decision-making within the meaning of Art. 22 GDPR is not used.

12.4. Legal basis for data processing

The legal basis for data processing when conducting "online meetings" is Art. 6 (1) (b) GDPR, insofar as the meetings are conducted within the framework of contractual relationships.

If no contractual relationship exists, the legal basis is Art. 6 (1) (f) GDPR. Here, too, our interest lies in the effective conduct of "online meetings."

12.5. Recipients / Disclosure of data

Personal data processed in connection with participation in "online meetings" will not be disclosed to third parties unless it is specifically intended for disclosure. Please note that, as with face-to-face meetings, content from "online meetings" is often used to communicate information to customers, interested parties, or third parties and is therefore intended for disclosure.

Other recipients: The provider of "Zoom" necessarily obtains knowledge of the above-mentioned data to the extent that this is provided for in our data processing agreement with "Zoom."

The above-mentioned data will be entered into our commercial systems, such as our CRM system "HubSpot," if the relevant consent has been obtained.

12.6. Data processing outside the European Union

Zoom is a service provided by a US-based provider. This means that personal data is also processed in a third country. We have concluded a data processing agreement with the provider of Zoom that complies with the requirements of Art. 28 GDPR.

An adequate level of data protection is guaranteed, on the one hand, by the conclusion of the so-called EU standard contractual clauses.

14.1. Scope of data processing

We use the search function "Algolia Instantsearch," address: 55 Rue d'Amsterdam, 75008 Paris, France, a search engine service provided by Algolia Inc. ("Algolia") to search and index our content on our website. When you use Algolia Instantsearch, your IP address and search query are transmitted to an Algolia server and stored there for statistical purposes for 90 days. Please note Algolia's terms of use and privacy policy .

14.2. Purpose of processing

Algolia Instantsearch is used to make it easier to find information on our website and to ensure user-friendliness.

14.3. Legal basis for data processing

The legal basis for data processing is Art. 6 (1) lit. f GDPR.

18.1. Facebook plugins (Like & Share button)

Plugins from the social network Facebook, provider Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA, are integrated into this website. You can recognize the Facebook plugins by the Facebook logo or the "Share" button on this website. An overview of the Facebook plugins can be found here: https://developers.facebook.com/docs/plugins/?locale=en_GB .

When you visit this website, the plugin establishes a direct connection between your browser and the Facebook server. Facebook receives the information that you have visited this website with your IP address. If you click the Facebook "Share" button while you are logged into your Facebook account, you can link the content of this website to your Facebook profile. This allows Facebook to associate your visit to this website with your user account. We would like to point out that, as the provider of these pages, we have no knowledge of the content of the data transmitted or how it is used by Facebook. For more information, please see Facebook's privacy policy at: https://de-de.facebook.com/privacy/explanation .

If you do not want Facebook to associate your visit to this website with your Facebook user account, please log out of your Facebook user account.

18.2. X Plugin

This website incorporates features of the X service. These features are provided by X Corp. at 865 FM 1209, Building 2, Bastrop, TX 78602, USA. By using X and the "Re-Tweet" function, the websites you visit are linked to your X account and made known to other users. Data is also transferred to X in the process. We would like to point out that, as the provider of the pages, we have no knowledge of the content of the data transmitted or its use by X. For more information, please refer to X's privacy policy at: https://x.com/en/privacy .

You can change your privacy settings on X in your account settings at https://x.com/settings/account .

18.3. LinkedIn Insight Tag

Our website uses the LinkedIn Insight Tag service provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland ("LinkedIn"). This enables us to collect and evaluate statistical data about your visit and use of our website. This makes it possible to show you interest-based and relevant offers, recommendations, and advertising on LinkedIn (retargeting). In addition, the effectiveness of advertisements is analyzed (conversion tracking). LinkedIn uses cookies, pixels, and JavaScript for this purpose.

The following cookies are set and read by LinkedIn:

• "lang" (session): Storage of language settings;
• "lidc" (24 hours): optimization of data center selection;
• "lissc" (1 year): cookie that ensures all cookies in the same browser use the same SameSite attribute;
• "bcookie" (365 days): prevention of misuse;
• "UserMathHistory" (30 days): usage analysis, synchronization of IDs with LinkedIn Ads;
• "li_gc" (180 days): storage of user consent;
• "AnalyticsSyncHistory" (30 days): storage for synchronization of information about LinkedIn members.

Further information about cookies can be found at: https://www.linkedin.com/legal/l/cookie-table.

The legal basis for this data processing is your consent in accordance with Art. 6 (1) (a) GDPR. Access to and storage of information on the end device is then based on the implementing laws of the ePrivacy Directive of the EU member states, in Germany in accordance with § 25 (1) TDDDG.

If you are logged into LinkedIn while visiting our website, LinkedIn may link the information collected to your member account and use it for targeted advertising on LinkedIn. You can view your privacy settings on LinkedIn at the following link: https://www.linkedin.com/psettings/enhanced-advertising

We have concluded a data processing agreement with LinkedIn in accordance with Art. 28 GDPR. The data collected in this context may be transferred by LinkedIn Ireland Unlimited Company to LinkedIn Corporation in the USA. LinkedIn Corporation has joined the EU-US Data Privacy Framework, which is why the transfer in this case is based on the adequacy decision for the USA in accordance with Art. 45 GDPR.

For further information, please refer to LinkedIn's privacy policy:For more information about cookies, please visit: https://www.linkedin.com/legal/privacy-policy .

19.1. Right to information

You may request confirmation from the controller as to whether personal data concerning you is being processed by us.

If such processing is taking place, you may request the following information from the controller:

• the purposes for which the personal data is being processed;
• the categories of personal data being processed;
• the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
• the planned duration of storage of the personal data concerning you or, if specific information on this is not possible, criteria for determining the storage period;
• the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller or a right to object to such processing;
• the existence of a right to lodge a complaint with a supervisory authority;
• all available information on the origin of the data if the personal data is not collected from the data subject;
• the existence of automated decision-making, including profiling, pursuant to Art. 22 (1) and (4) GDPR and, at least in these cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You have the right to request information about whether the personal data concerning you is transferred to a third country or to an international organization. In this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

19.2. Right to rectification

You have the right to obtain from the controller the rectification and/or completion of your personal data if the personal data processed concerning you is inaccurate or incomplete. The controller shall carry out the rectification without delay.

19.3. Right to restriction of processing

You may request the restriction of the processing of personal data concerning you under the following conditions:

• if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;
• the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
• the controller no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise, or defense of legal claims; or
• you have objected to processing pursuant to Article 21(1) of the GDPR and it is not yet clear whether the legitimate grounds of the controller override your grounds.

If the processing of personal data concerning you has been restricted, such data may, with the exception of storage, only be processed with your consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

19.4. Right to erasure

Obligation to erase

You may request that the controller erase personal data concerning you without undue delay, and the controller is obliged to erase such data without undue delay if one of the following reasons applies:

1. The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
2. You withdraw your consent on which the processing was based in accordance with Art. 6 (1) (a) or Art. 9 (2) (a) GDPR, and there is no other legal basis for the processing.
3. You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR.
4. The personal data concerning you has been processed unlawfully.
5. The erasure of the personal data concerning you is necessary to comply with a legal obligation under Union or Member State law to which the controller is subject.
6. The personal data concerning you has been collected in relation to the offer of information society services pursuant to Art. 8 (1) GDPR.

Information to third parties

If the controller has made the personal data concerning you public and is obliged to erase it pursuant to Art. 17 (1) GDPR, the controller shall take reasonable steps, including technical measures, taking into account the available technology and implementation costs, to inform controllers who process the personal data that you, as the data subject, have requested them to delete all links to this personal data or copies or replications of this personal data.

Exceptions

The right to erasure does not apply if the processing is necessary

1. for exercising the right of freedom of expression and information;
2. for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
3. on grounds of public interest in the area of public health in accordance with Art. 9 (2) (h) and (i) and Art. 9 (3) GDPR;
4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89(1) GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
5. for the establishment, exercise or defense of legal claims.

19.5. Right to be informed

If you have asserted your right to rectification, erasure, or restriction of processing against the controller, the controller is obliged to notify all recipients to whom your personal data has been disclosed of this rectification, erasure, or restriction of processing, unless this proves impossible or involves disproportionate effort.

You have the right to be informed by the controller about these recipients.

19.6. Right to data portability

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used, and machine-readable format. You also have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where

• the processing is based on consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and
• the processing is carried out using automated means.

In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another controller, where technically feasible. The freedoms and rights of other persons must not be affected by this.

The right to data portability does not apply to the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

19.7. Right to object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions.

The controller shall no longer process the personal data concerning you unless the controller can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing purposes; this also applies to profiling insofar as it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

In connection with the use of information society services, you have the option of exercising your right to object by means of automated procedures using technical specifications, irrespective of Directive 2002/58/EC.

19.8. Right to revoke the data protection consent declaration

You have the right to revoke your data protection consent declaration at any time. The revocation of consent does not affect the legality of the processing carried out on the basis of the consent until revocation.

19.9. Automated decision-making in individual cases, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

1. is necessary for entering into, or performance of, a contract between you and the controller,
2. is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or
3. is based on your explicit consent.

However, these decisions may not be based on special categories of personal data pursuant to Art. 9 (1) GDPR, unless Art. 9 (2) (a) or (g) GDPR applies and appropriate measures have been taken to protect your rights and freedoms and your legitimate interests.

With regard to the cases referred to in (1) and (3), the controller shall take appropriate measures to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

19.10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 GDPR.