Jenoptik Data Protection Center

Data protection is very important to the entire JENOPTIK AG. For this reason, we set strict standards throughout the Group for the handling of personal data, regardless of whether this belongs to interested parties, customers, service providers, suppliers, business partners or other persons. If you have any questions or concerns regarding data protection, please do not hesitate to contact us using the contact form or otherwise. We look forward to constructive exchange, criticism and good cooperation.

Name and address of the data controller and the data protection officer:

JENOPTIK AG
Carl-Zeiß Street 1
07743 Jena, Germany
represented by the Board of Directors:
Dr Stefan Traeger (Chairman), Dr. Prisca Havranek-Kosicek, Dr. Ralf Kuschnereit,
Registered in the Commercial Register at Jena District Court, HRB 200146
Sales tax identification number: DE 150524241

Data Protection Officer of JENOPTIK AG
Carl-Zeiß-Straße 1
07743 Jena
Germany
E-mail: data-protection@jenoptik.com

Under certain circumstances the controller might be a subsidiary company. Please use our overview to find your personal contact.

Social media buttons

No data-processing social media plugins from social networks are used on our website. Our website only contains buttons labelled with the social networks Twitter, Google+ and Facebook or their logos. The buttons are qualified links to the respective social networks. When you click on the button, you will be forwarded to the respective social network by means of a link. In addition, a link to the website you are visiting will be sent for the purpose of sharing on the social networks. Personal data of the user is not collected by the buttons or transmitted to the operators of the social networks.

Security of your personal data

JENOPTIK AG uses technical and organisational security measures to protect the personal data we collect from you against accidental or intentional manipulation, loss, destruction or against access by unauthorised persons. Our security measures are continuously improved in line with technological developments.

General information on data processing

1. scope of the processing of personal data

As a matter of principle, we only process personal data of our users insofar as this is necessary for the provision of a functional website as well as our contents and services. The processing of personal data of our users is regularly only carried out with the consent of the user. An exception applies in cases where the processing of data is permitted by legal regulations.

2. legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for processing operations involving personal data, Article 6 (1) lit. a of the EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data.

When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 (1) lit. b DSGVO serves as the legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual measures. If processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6 (1) c DSGVO serves as the legal basis. If processing is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 (1) lit. f DSGVO serves as the legal basis for the processing.

3. data deletion and storage period

The user's personal data will be deleted or blocked as soon as the purpose of the storage no longer applies. In addition, storage may take place if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which the person responsible is subject. The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a necessity for the continued storage of the data for the conclusion or fulfilment of a contract.

1. description and scope of data processing

Interested parties have the option to subscribe to a free newsletter. When registering for the newsletter, the data from the input mask is transmitted to us. These are

• Salutation
• First name
• Name
• E-mail address

whereby only the user's e-mail address is mandatory. The remaining information is voluntary when registering for the newsletter.

In addition, the following data will be collected during registration:

• IP address of the calling computer
• Date and time of entry and double opt-in registration
• Original form
• Language for newsletter

For the processing of the data, your consent is obtained in the web form during the registration process and reference is made to this data protection declaration. A confirmation email is sent to the email address entered by the user for the newsletter dispatch using the double opt-in procedure. This confirmation email is used to check whether the owner of the email address has authorised receipt of the newsletter.

The data will only be used for sending the newsletter.

2. legal basis for the data processing

The legal basis for the processing of data after registration for the newsletter by the user is Art. 6 para. 1 lit. a DSGVO if the user has given his consent.

3. purpose of the data processing

The collection of the user's email address is used to deliver the newsletter by email.
The collection of other personal data as part of the registration process serves to prevent misuse of the services or the e-mail address used.
The voluntary additional information is also used for personalised addressing within the scope of sending the newsletter.

4. duration of the storage

The personal data will be processed until revocation or objection and then blocked for further use. In order to comply with legal requirements, it may be necessary for your personal data to continue to be stored. This may also be necessary for the assertion, exercise and defense of legal claims.

5. possibility of objection and removal

The subscription to the newsletter can be cancelled by the user concerned at any time. For this purpose, a corresponding link can be found in each newsletter.

6. categories of recipients of personal data

We will only pass on your personal data to commissioned processors who are entrusted with the implementation of the newsletter dispatch. The transfer of your personal data will only take place in accordance with the applicable data protection regulations.
Furthermore, we will not transfer your personal data to other third parties without your or a legal permission.

7. processing of data in countries outside the European Economic Area

If we process data in third countries (countries outside the EU/EEA) or transfer it to companies in third countries, we only do so if we are authorised to do so. If there is no adequacy decision by the Commission for the third country concerned in accordance with Art. 45 of the GDPR, i.e. if there is no adequate level of data protection in the third country, we ensure by means of contractual provisions (EU standard contractual clauses on data protection) or other suitable guarantees within the meaning of Art. 46 of the GDPR that your privacy and your personal data are also protected in the company in the third country in an adequate manner provided for by law.

1. description and scope of data processing

When registering for an event, the following data will be transmitted to us from the input mask:

• Salutation
• Title
• First name
• Name
• Company
• E-mail address
• Code if applicable

whereby the field "Title" is a voluntary entry.

In addition, the following data will be collected during registration:

• IP address of the calling computer
• Date and time of entry and double opt-in registration
• Original form
• Language for mailings

For the processing of the data, your consent is obtained in the web form as part of the registration process and reference is made to this data protection notice. A confirmation email is sent to the email address entered by the user for the event registration using the double opt-in procedure. This confirmation email serves to check whether the owner of the email address has authorised the receipt of information/invitations to Jenoptik events.

We use the data exclusively to inform you by e-mail about upcoming events in the Jenoptik Group or to invite you.

2. legal basis for the data processing

The legal basis for the processing of data after registration by the user is Art. 6 para. 1 lit. a DSGVO if the user has given his consent.

3. purpose of the data processing

The collection of the user's e-mail address serves to inform or invite the user by e-mail about events in the Jenoptik Group.
The collection of other personal data as part of the registration process serves to prevent misuse of the services or the email address used. In addition, we need these for the overall invitation management. It is only necessary to enter a code if you have received it in advance from JENOPTIK AG.

4. duration of the storage

The personal data will be processed until revocation or objection and then blocked for further use. In order to comply with legal requirements, it may be necessary for your personal data to continue to be stored. This may also be necessary for the assertion, exercise and defense of legal claims.

5. possibility of objection and removal

The event registration can be cancelled by the user concerned at any time without giving reasons. For this purpose, a corresponding link can be found in each mailing.

6. categories of recipients of personal data

We will only pass on your personal data to commissioned processors who are entrusted with carrying out the mailings. The transfer of your personal data will only take place in accordance with the applicable data protection regulations. Furthermore, we will not transfer your personal data to other third parties without your or a legal permission.

7. processing of data in countries outside the European Economic Area

If we process data in third countries (countries outside the EU/EEA) or transfer it to companies in third countries, we only do so if we are authorised to do so. If there is no adequacy decision by the Commission for the third country concerned in accordance with Art. 45 of the GDPR, i.e. if there is no adequate level of data protection in the third country, we ensure by means of contractual provisions (EU standard contractual clauses on data protection) or other suitable guarantees within the meaning of Art. 46 of the GDPR that your privacy and your personal data are also protected in the company in the third country in an adequate manner provided for by law.

1. purpose and scope of the processing

We process your data for the purpose of initiating the contract, fulfilling the contract and to inform you about our products. In the context of this, we process the following data:

• Name
• Address
• E-mail address
• Telephone number
• Title
• Length of service
• Position in the company

In addition, data that you have stored on your business card/email signature can be processed.

2. legal basis of the processing

2.1 Initiation of the contract and performance of the contract

If we are seeking to enter into a contract or fulfil a contract, the processing of your personal data is based on Art. 6 I 1 lit. b) DS-GVO. After fulfilment of the contract, we process the data based on the legitimate interest to protect ourselves from legal claims or to assert them, according to Art. 6 I 1 lit.f) DS-GVO.

2.2 Advertising

If you wish to receive advertising from us, the processing of your personal data is based on your consent pursuant to Art. 6 I 1 lit. a) DS-GVO.

3. duration of the storage

Your data will not be processed beyond the described use. As a rule, your data will be deleted as soon as it can no longer be used to assert or defend claims or we are no longer obliged to store the data (e.g. due to the AO).

4. categories of recipients

Within the Jenoptik Group, all companies receive access to your data. This can be any company affiliated with JENOPTIK AG in accordance with § 15 AktG. You can find a list under the following link.

Data is only passed on to recipients outside our company if regulations permit or require this or if we are otherwise authorised to pass on data. Under these conditions, recipients of personal data may be:

Contact management systems to better process your data and address you more personally. As well as Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft"). Contract management systems to catalogue and illustrate contracts. Supplier portals for better communication.

Public bodies and institutions, where there is a legal or regulatory obligation.

In rare individual cases of maintenance or for fault analysis, support partners of hardware or software may be used. The legally stipulated contractual regulations on purpose limitation and confidentiality as well as - if necessary - confidentiality obligations according to §203 StGB (German Penal Code) are concluded with these partners.

5. recipients outside the EEA

Microsoft may receive knowledge of the above data as part of the order processing in order to process it. All data traffic is encrypted (MTLS, TLS or SRTP). According to its own information, Microsoft processes the data primarily in the EU area. In the event that data is nevertheless processed in the USA, an appropriate level of data protection outside the EU / EEA is guaranteed by the EU standard contractual clauses we have concluded with Microsoft.
For more information, see Microsoft's privacy policy, available at: https://privacy.microsoft.com/de-de/privacystatement

You can apply to us at any time. You can find all information about vacancies or the application process at https://www.jenoptik.com/career-and-job-offers.

In the event of an application via our applicant portal, you will also find more detailed information there. In the case of unsolicited applications and when using the applicant portal, we process your data as follows.

Registration (creation of an account)

We use a career portal for an application. Registration is required to use the portal. The portal helps us to transmit your data to the HR department in encrypted form. If you send us a postal application, it will be recorded by the HR department. The following data is processed for an application and registration in the career portal:

• First name, last name
• Password
• E-mail address
• Country/region of residenc

The processing of the registration data enables you to complete, manage and modify your application documents.

Application procedure

When you apply to us, we process the data you provide in order to fill advertised vacancies and to select qualified applicants. Among other things, this includes the following data:

• First name, last name
• Date of birth
• Title
• Gender
• Address
• Telephone number
• E-mail address
• Images
• Value judgements/ testimonials
• Qualification data
• Other information included in CV etc.

Sensitive data such as religious or philosophical beliefs, memberships in a trade union or political party, health data or data on sexual life etc. may also be collected as part of the application. We recommend that, if possible, data of this kind should not be transmitted to us for processing.

Re-addressing and transmission

If you choose the option to be included in our talent pool, we will not collect any additional data from you. This is an extension of the processing. The data provided in the application process will then be stored longer for future positions, will be visible to a wider number of companies and companies may also approach you with vacancies.

Legal basis for the processing

Application procedure

Your details will be used for processing your application and deciding on the establishment of an employment relationship. The legal basis is Art. 88 DS-GVO in conjunction with. §26 BDSG.

Furthermore, your personal data may be processed insofar as this should be necessary for the defence of asserted legal claims against us arising from the application process. The legal basis for this is Art. 6 para. 1 sentence 1 lit. f DSGVO. The legitimate interest lies in the defence of possible legal claims and the proof that legal requirements (e.g. from the AGG) have been met.

Re-addressing and transmission
The processing of data within the scope of the talent pool is based on your consent pursuant to Art. 6 para. 1 p.1 lit. a DS-GVO.

Duration of storage

Registration and application procedure

Your application data will not be processed beyond the described use. Your personal data will be deleted after completion of the application procedure after six months at the latest, provided that no other legitimate interests on our part oppose deletion. Other legitimate interest in this sense is, for example, a duty to provide evidence in proceedings under the General Equal Treatment Act (AGG).

Account data will be deleted six months after account inactivity.

Re-addressing and transmission

In the event of consent to processing within the scope of the talent pool, your data will be stored for an additional six months.

Recipient categories

Applicant portal and application procedure

Within the Jenoptik Group, access to your applicant data is granted to the companies to which you apply for a position. This can be any company affiliated with JENOPTIK AG in accordance with § 15 AktG. You can find a list under the following link.

Data is only passed on to recipients outside our company if regulations permit or require this or if we are otherwise authorised to pass on data. Under these conditions, recipients of personal data may be:

Dow Jones & Company Inc. (4300 U.S. Route 1 North Monmouth Junction, NJ 08852)

Public bodies and institutions, where there is a legal or regulatory obligation.

In rare individual cases of maintenance or for fault analysis, support partners of hardware or software may be used. The legally stipulated contractual regulations on purpose limitation and confidentiality as well as - if necessary - confidentiality obligations according to §203 StGB (German Penal Code) are concluded with these partners.

Re-addressing and transmission

If you have consented to processing within the scope of the talent pool or have selected "worldwide" or "national" for your profile visibility, all companies affiliated with the JENOPTIK AG Group may become recipients of your data in accordance with § 15 AktG. You can find a list under the following link.

Recipients outside the EEA

For the purposes of risk management and sanctions list screening, your personal data from the application will be shared with Dow Jones & Company Inc. (4300 U.S. Route 1 North Monmouth Junction, NJ 08852). In the absence of an adequacy decision by the Commission pursuant to Article 45 of the GDPR, we ensure an appropriate and adequate level of security for your personal data through contractual arrangements (namely the EU standard contractual clauses).

General notes

The video conference is conducted via Microsoft Teams. With regard to data processing by the provider, you as a participant should be aware that the other participants will see your first and last name. This also applies to all other personal data that you disclose during the chat or conversation. Activation of the web cam is optional for each participant. A recording of the video conference is not planned.

Microsoft Teams is kept on European servers by the IT service provider and their sub-service providers in accordance with the contract. However, Microsoft Teams can access the servers in Germany in the event of disruptions and malfunctions from so-called third countries, such as the USA, in order to carry out maintenance work. In insecure third countries, especially in the USA, there is no level of data protection comparable to the requirements of the General Data Protection Regulation. It is therefore possible that government agencies access personal data without us or you knowing about it. Effective enforcement of your rights is unlikely to be possible in the US and other third countries.

If you participate in the video conference, you thereby declare your consent to a possible transfer of data to third countries such as the USA.
You have the right to withdraw/terminate your consent to data transfer at any time by leaving the meeting. Please note that we have no information on any existing data processing by teams, for example by creating an account.

For more information on how your data is processed, please visit https://privacy.microsoft.com.

In order to participate in a video conference with us with the most data protection-friendly settings possible, we have the following recommendations for you:

• Ensure that no unauthorised person attends the online meeting;
• Read and familiarise yourself with the privacy notice
• If you have any queries, contact a contact person at an early stage and ask;
• If documents are already sent in advance: Check all documents for completeness;
• Eliminate all sources of interference or distraction;
• Remove all objects that convey information (e.g. (family) pictures or medicines on the desk, posters or charts on the wall, etc.);
• Switch off computer notifications or close programmes that send notifications (e.g. Outlook);
• If another programme is used by third parties (clients, business partners, etc.): Familiarise yourself with the programme and its essential functions (switching camera and microphone on/off, screen sharing, blurr function, etc.);
• If a breach of rules or a data protection breach is identified: Immediately inform the moderator;
• Avoid and prevent information from being disclosed to unauthorised persons;
• If the screen is shared: It is best to share only a section of the screen (even file icons can contain information).

Legal basis of the processing (Art. 13 para. 1 lit. c) DSGVO)

Purpose and legal basis of the processing

In order to conduct online meetings, telephone and/or video conferences and/or webinars, workshops or similar (hereinafter collectively "Meetings"), we use "Teams", a software of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft").
The legal basis for the processing of data to conduct online meetings using the aforementioned tool is our legitimate interest in the effective conduct of meetings pursuant to Art. 6 (1) lit. f DSGVO. Insofar as the online meetings are conducted within the framework of existing contractual relationships with you, the legal basis is Art. 6 para. 1 lit. b DSGVO.

It cannot be ruled out that meetings initiated by third parties are held using a tool other than the one provided by JENOPTIK (e.g. Zoom).
These tools are not covered by this declaration.

Scope of the processing

We collect and process different types of personal data about you, depending on the legitimate interest or contractual obligations.

During a meeting, the following data may be processed:

• Participant details: if applicable, display name, first name, last name, telephone number, e-mail address, password (encrypted for authentication), profile picture (optional), department/team;
• metadata: Meeting topic and description, IP address, participant phone number, type of device/software (Windows/Mac/Linux/Web/iOS/Android Phone/Windows Phone), time of last participant activity, number of chat and channel messages, number of meetings attended, duration of audio, video and screen sharing time;
• For chat, or channel message use: text data for display and logging if necessary;

In case of exchange of files: the personal data contained in the files;

• When using audio: Recording data of the microphone;
• For video use: Recording data of the video camera;
• For recordings: Audio, video and screen sharing for storage in the Cloud / Microsoft Stream;
• For telephone use: incoming and outgoing call numbers, country name, start and end time, possibly further connection data such as the IP address of the device.

You are invited to an online meeting by e-mail with an invitation link and/or a calendar date. If you have a Microsoft account, you can also be invited to a meeting on an ad-hoc basis. In this case, your first name, last name and e-mail address will be processed. The same applies if a webinar or so-called broadcast is held. In this case, prior registration and/or activation may be necessary.

To participate in an online meeting, you must at least provide information on your name and - in the case of participation by telephone - your telephone number. In the latter case, we will inform you of this possibility of anonymous participation in the course of the invitation. You can deactivate the transmission via microphone and camera at any time via the corresponding settings. We only record meetings with your consent and prior notification. If the chat function is used in an online meeting, the content of the chat messages, the date and time and the participants are logged and stored. Microsoft stores and uses the metadata to enable us to analyse and report on the use of Teams and to provide technical support.

Recipients or category of recipients of the personal data (Art. 13 para. 1 lit. e) DSGVO)

Within our company, those departments that need your data to process the above-mentioned purposes will receive access to it. Processors (Art. 28 DSGVO) and other service providers used by us may also receive data for these purposes. These are companies in the IT services category.

Data will only be passed on to recipients outside our company if regulations permit or require this or if we are otherwise authorised to pass on data. Under these conditions, recipients of personal data may be:

• Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft").
• Public bodies and institutions, where there is a legal or regulatory obligation.
• In rare individual cases of maintenance or for fault analysis, support partners of hardware or software may be used. The legally stipulated contractual regulations on purpose limitation and confidentiality are concluded with these partners.

Transfer to third countries (Art. 13 para. 1 lit. f) DSGVO)

Microsoft may receive knowledge of the above data as part of the order processing in order to process it. All data traffic is encrypted (MTLS, TLS or SRTP). According to its own information, Microsoft processes the data primarily in the EU area. In the event that data is nevertheless processed in the USA, an appropriate level of data protection outside the EU / EEA is guaranteed by the EU standard contractual clauses we have concluded with Microsoft.
For more information, see Microsoft's privacy policy, available at: https://privacy.microsoft.com/de-de/privacystatement

Storage period (Art. 13 para. 2 lit. a) DSGV0)

Your personal data will only be stored for as long as required for the purposes set out in (Section II.) or until you object to the use of the personal data.
We only store your data beyond this period if there are still outstanding obligations from the contractual relationship or legal requirements. These include, among others, the tax and commercial law retention and documentation obligations.

If your personal data is processed, you as the data subject have the following rights vis-à-vis the data controller. To exercise your rights below, please contact the data protection officer responsible for the data controller.

1. right to information

You can request confirmation from us as to whether personal data relating to you is being processed by us. If such processing is taking place, you can request information from us about the following:

(1) the purposes for which the personal data are processed;

(2) the categories of personal data which are processed;

(3) the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed;

(4) the planned duration of the storage of the personal data relating to you or, if specific information on this is not possible, criteria for determining the storage duration;

(5) the existence of a right to rectify or erase personal data concerning you, a right to have processing restricted by the controller or a right to object to such processing;

(6) the existence of a right of appeal to a supervisory authority;

(7) any available information on the origin of the data if the personal data are not collected from the data subject;

(8) the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR and, at least in these cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.

You have the right to request information on whether personal data concerning you is transferred to a third country or to an international organisation. In this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 of the GDPR in connection with the transfer.

2. right of rectification

You have a right of rectification and/or completion vis-à-vis the controller if the personal data processed concerning you are inaccurate or incomplete. The controller shall carry out the rectification without undue delay.

3. right to restriction of processing

You may request the restriction of the processing of personal data concerning you under the following conditions:

(1) if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;

(2) the processing is unlawful and you object to the erasure of the personal data and request instead the restriction of the use of the personal data;

(3) the controller no longer needs the personal data for the purposes of processing but you need them for the establishment, exercise or defence of legal claims; or

(4) if you have objected to the processing pursuant to Art. 21 (1) DSGVO and it has not yet been determined whether the legitimate grounds of the controller override your grounds.

Where the processing of personal data relating to you has been restricted, those data may be processed, with the exception of their storage, only with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of substantial public interest of the Union or of a Member State.

If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

4. right to erasure

a) Obligation to delete

You may request the controller to erase the personal data concerning you without delay and the controller is obliged to erase this data without delay if one of the following reasons applies:

(1) The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.

(2) You revoke your consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) DSGVO and there is no other legal basis for the processing.

(3) You object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR.

(4) The personal data concerning you have been processed unlawfully.

(5) The deletion of personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.

(6) The personal data concerning you was collected in relation to information society services offered pursuant to Art. 8(1) DSGVO.

b) Information to third parties

If the controller has made the personal data concerning you public and is obliged to erase it pursuant to Article 17(1) of the GDPR, it shall take reasonable steps, including technical measures, having regard to the available technology and the cost of implementation, to inform data controllers which process the personal data that you, as the data subject, have requested that they erase all links to, or copies or replications of, that personal data.

c) Exceptions

The right to erasure does not exist insofar as the processing is necessary

(1) to exercise the right to freedom of expression and information;

(2) for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(3) for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) and Art. 9(3) DSGVO;

(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the GDPR, where the right referred to in Section (a) is likely to render impossible or seriously prejudice the achievement of the purposes of such processing; or

(5) to assert, exercise or defend legal claims.

5. right to information

If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to communicate this rectification or erasure of the data or restriction of processing to all recipients to whom the personal data concerning you have been disclosed, unless this proves impossible or involves a disproportionate effort.

You have the right to be informed of these recipients by the controller.

6. right to data portability

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data has been provided, provided that

(1) the processing is based on consent pursuant to Art. 6 para. 1 lit. a DSGVO or Art. 9 para. 2 lit. a DSGVO or on a contract pursuant to Art. 6 para. 1 lit. b DSGVO and

(2) the processing is carried out with the aid of automated procedures.

In exercising this right, you also have the right to have the personal data concerning you transferred directly from one controller to another controller, insofar as this is technically feasible. This must not affect the freedoms and rights of other persons.

The right to data portability shall not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. right of objection

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data relating to you which is carried out on the basis of Article 6(1)(e) or (f) DSGVO; this also applies to profiling based on these provisions.

The controller shall no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

If the personal data concerning you is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling, insofar as it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

You have the possibility, in connection with the use of information society services, notwithstanding Directive 2002/58/EC, to exercise your right to object by means of automated procedures using technical specifications.

8. right to revoke the declaration of consent under data protection law

You have the right to revoke your declaration of consent under data protection law at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

9. automated decision in individual cases including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

(1) is necessary for the conclusion or performance of a contract between you and the controller,

(2) is authorised by Union or Member State legislation to which the controller is subject and that legislation contains adequate measures to safeguard your rights and freedoms and your legitimate interests; or

(3) is done with your express consent.

However, these decisions must not be based on special categories of personal data pursuant to Art. 9(1) of the GDPR, unless Art. 9(2)(a) or (g) applies and appropriate measures have been taken to protect the rights and freedoms and your legitimate interests.

The user is not subjected to any such automated decision in individual cases, including profiling, when using our website.

10. right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority (you can find the competent supervisory authority here), in particular in the Member State of your residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR.