PERSONAL DATA PROTECTION POLICY (as of November 2025)

 

I.                   Name and address of the data controller

 

The data controller within the meaning of the Personal Data Protection Regulation and other national data protection laws in force in the Member States, as well as other provisions for the protection of personal data, is:

 

Romanowscy GmbH

Am Feldweg 2a, 02923 Hähnichen OT Spree

Germany

Phone number: +49 15216966938

E-mail: biuro@szkolenianiemcy.pl
Website: www.szkolenianiemcy.pl

 

II.                 General information regarding the processing of personal data

1.        Scope of personal data processing

We generally process our users' personal data only when necessary to provide a functional website, our content, and our services. We generally only process our users' personal data after obtaining their consent. An exception to this is when obtaining such consent in advance is not actually possible and data processing is permitted by applicable law.

2.        Legal basis for processing personal data

If we obtain the data subject's consent to the processing of his or her personal data, the legal basis for processing is Article 6(1)(a) of the EU General Data Protection Regulation (GDPR).

 

Article 6(1)(b) of the GDPR provides the legal basis for the processing of personal data necessary for the performance of a contract to which the data subject is a party. It also applies to processing operations necessary to carry out pre-contractual measures.

 

If the processing of personal data is necessary to comply with a legal obligation to which our company is subject, the legal basis for processing is Article 6(1)(c) of the GDPR.

 

Where the vital interests of the data subject or another natural person require the processing of personal data, the legal basis for processing is Article 6(1)(d) of the GDPR.

 

If data processing is necessary to safeguard the legitimate interests of our company or a third party and if the interests, fundamental rights and fundamental freedoms of the data subject do not outweigh the first-mentioned interest, the legal basis for data processing is Article 6(1)(f) GDPR.

3.        Data deletion and storage time

The data subject's data will be deleted or blocked as soon as the purpose for which it is stored no longer applies. Storage may also take place if this has been stipulated by European or national legislators in EU regulations, laws or other provisions to which the controller is subject. Data will also be blocked or deleted when the storage period specified in the aforementioned regulations expires, unless continued storage is necessary for concluding or fulfilling a contract.

 

4.        Transfer of data to third parties

Fulfilling our contractual obligations towards you may require us to transfer your data to third parties.

 

We only share your personal data with third parties when

(1)   you have given your express consent within the meaning of Article 6(1)(1)(a) of the GDPR;

 

(2)   this is legally permissible and, pursuant to Article 6(1)(1)(b) GDPR, necessary for the performance of a contract with you;

 

(3)   In accordance with Article 6(1)(1)(c) of the GDPR, there is a legal obligation to transfer your personal data to third parties. The following recipients are particularly relevant:

 

a)      public entities, offices and supervisory bodies,

b)      Criminal law enforcement authorities, such as the police, prosecutors, and courts. Personal data may be transferred to criminal law enforcement authorities or, if necessary, to injured third parties, if this serves to clarify unlawful use of our website or is necessary to assert rights. However, this will only occur if there are specific indications of unlawful or inappropriate behavior. Data may also be transferred to fulfill the terms of use or other agreements. Furthermore, we are legally obligated to provide information to certain public entities upon request. These include criminal law enforcement authorities, bodies responsible for prosecuting offenses punishable by fines, and tax authorities.

 

(4)   the disclosure of the data is necessary for the purposes of the legitimate interests pursued by the company pursuant to Article 6 (1) sentence 1 letter f) GDPR or for the establishment, exercise or defence of legal claims, and there is no basis to assume that you have an overriding legitimate interest in not disclosing your data.

 

5.        Transfer of data to external service providers

Sometimes, to provide our services, we need to use third-party service providers with whom we have contractual obligations, for example, for domain hosting or for servicing and maintaining the software used on our website, as well as to provide the features available on our website. In these cases, we share information with these companies or individuals to enable them to continue their work. These third-party service providers are carefully selected and vetted by us to ensure they adhere to our contractual guidelines. These third-party service providers are permitted to process data only for the purposes specified by us and in accordance with our instructions.

 

6.        Transfer of data to third countries

 

As part of our business relationships, your personal data may be transferred or disclosed to third parties. These may also be located outside the European Economic Area (EEA), i.e., in third countries. Such processing takes place solely for the purpose of fulfilling contractual and business obligations and maintaining our business relationship with you (the legal basis is Art. 6, Para. 1, Letter b or Letter f, in each case in conjunction with Art. 44 et seq. GDPR). We will provide you with details regarding data transfer at the appropriate points below.

 

In the case of certain third countries, the European Commission issues an adequacy decision that meets EEA standards (a list of such countries and a copy of the adequacy decisions can be found here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en ). In other third countries to which personal data may be transferred, uniformly high standards of personal data protection do not always apply due to the lack of appropriate legal provisions. In such cases, we ensure adequate data protection. This is possible through binding company regulations, the European Commission's standard contractual clauses for the protection of personal data pursuant to Article 46 paragraph 1, 2 lit. c) GDPR (the 2021 standard contractual clauses are available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0915&locale-en ), certificates and recognised codes of conduct.

 

 

III.                 Providing the website and creating log files

1.        Description and scope of data processing

Each time you visit our website, our system automatically collects data and information from the computer system communicating with it.

The following data is collected:

(1)   information about the type of browser and its version used;

(2)   user's operating system;

(3)   user's IP address;

(4)   date and time of access;

(5)   websites from which your system accesses our website;

(6)   websites that were called up by the user's system via our websites.

This data is also stored in our system's log files. This does not include user IP addresses or other data that can be used to assign the data to a user. This data is not stored together with other personal data about the user.

2.        Legal basis for data processing

The legal basis for temporary data storage is Article 6(1)(f) of the GDPR.

3.        Purpose of data processing

The temporary storage of the IP address by the system is necessary to provide the website to the user's computer. For this purpose, the user's IP address must be stored for the duration of the session.

 

The purposes described also constitute our legitimate interest in data processing within the meaning of Article 6(1)(f) of the GDPR.

4.        Storage period

Data will be deleted as soon as it is no longer needed for the purposes for which it was collected. In the case of data collection to provide a website, this happens at the end of the session.

 

 

 

5.        The right to object and request the deletion of data

The collection of data to provide the website and the storage of data in log files are necessary for the operation of the website. Therefore, the user has no right of objection.

 

 IV.              Use of cookies

1.      Description and scope of data processing

 

Our website does not use cookies.

2.      Detailed information about the analytical services and programs used

 

(1)     Google Tag Manager

Our website uses Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

 

Google Tag Manager is used for the technical management of so-called "tags"—small pieces of code used on our website for analysis and marketing purposes (e.g., to integrate Google Analytics or other services). Tag Manager allows you to centrally integrate, change, and deactivate such code snippets without having to directly modify the website's source code.

 

Google Tag Manager itself does not process any website visitor data. It does not use cookies or access personal information. This tool's function is limited to managing and executing other services—so-called tags. However, these tags may, under certain circumstances, collect data when activated. This usage data relates solely to the use and functionality of Tag Manager itself—not to personal data or the content of an individual tag. The information collected in this way is for statistical evaluation (benchmarking) and does not contain data that could allow conclusions to be drawn about individual users or our website.

 

Please note that when using Google Tag Manager, under certain circumstances, technical information may be transferred to Google servers in third countries, in particular the USA. For such data transfer, Google relies on the EU-US Data Privacy Framework and the so-called standard contractual clauses pursuant to Article 46(2) and (3) of the GDPR. These clauses have been approved by the European Commission and are intended to ensure that a level of data protection comparable to European data protection is maintained even when data is processed in third countries. Detailed information on this topic can be found here: https://support.google.com/tagmanager/answer/9323295?hl=en .

 

 

The integration and use of Google Tag Manager are based on your explicit consent in accordance with Article 6(1)(a) of the GDPR, insofar as this is necessary for the implementation and execution of tags that process personal data (e.g., analysis and marketing tools). You can withdraw your consent at any time with effect for the future. Furthermore, we have a legitimate interest within the meaning of Article 6(1)(f) of the GDPR in being able to manage behavioral tracking and marketing tools efficiently, user-friendly, and technically reliable. This interest does not conflict with compliance with data protection guidelines. However, we only use Google Tag Manager if we have valid consent to the respective purpose.

 

You can find extensive information about Google Tag Manager here:

https://marketingplatform.google.com/about/tag-manager/

 

and in Google's privacy policy:

https://policies.google.com/privacy?hl=pl​

 

(2)   Facebook

 

We use selected Facebook tools (Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland [“Meta”]) on our website to provide you with targeted information and advertising about our products and services.

 

To the extent that personal data is collected via integrated Facebook components or our Facebook page and transferred to Facebook, this is done under joint responsibility with Facebook. Any further processing of the data is solely the responsibility of Facebook. Detailed information on joint responsibility can be found in the publicly available Meta Agreement.

With the help of Facebook tools—in particular, Facebook Pixel, plug-ins (e.g., the "Like" button), and application programming interfaces—we can optimize our offers and target them to selected users who show interest in our services. Facebook uses so-called "event data" (e.g., page views, purchases) to analyze and personalize the delivery of ads. This allows us, among other things, to analyze campaigns and provide a better user experience.

 

Depending on the tool, personal data such as name , address, phone number, or IP address may be transferred. Before transmission, this data is secured using hashing. The transferred data is compared with existing data on Facebook but is not passed on to third parties without your express consent. After the comparison, the contact data will be deleted, as stated by Facebook.

Facebook stores data on servers located around the world, including in the United States. Personal data is transferred based on the EU-US Data Privacy Frameworks and the EU's Standard Contractual Clauses pursuant to Article 46 of the GDPR. These "Standard Contractual Clauses" (SCCs) are model clauses issued by the European Commission and are intended to ensure that, even when personal data is transferred to third countries—for example, the United States—a level of protection comparable to European data protection is maintained.

 

Through the combination of the EU-US Data Privacy Framework and standard contractual clauses, Facebook commits to maintaining the European level of data protection when processing your relevant personal data – even when this data is stored, processed or managed outside the EU, in particular in the USA.

 

The standard contractual clauses are based on an implementing decision of the European Commission. You can find the decision and the applicable standard contractual clauses here, among other places: https://commission.europa.eu/publications/standard-contractual-clauses-international-transfers_en . Facebook's applicable data processing terms, which also refer to the standard contractual clauses, can be found at the following link: https://www.facebook.com/legal/terms/dataprocessing .

 

If you would like to learn more about data processing by Facebook, we recommend the official Facebook privacy policy, available at:
https://www.facebook.com/privacy/policy/ .

 

You can exercise your rights to access, rectify, delete, and transfer your data at any time. Deleting your data stored by Facebook is only possible by deleting your Facebook account. You can also disable or delete cookies in your browser.

Data processing is based on your consent (Article 6(1)(a) GDPR). In specific cases, there may be a legitimate interest in effective customer communication (Article 6(1)(f) GDPR). However, these tools are only used with your consent.

 

(3)   Instagram

 

Our website integrates features of the social media platform Instagram. The provider is Instagram LLC, 1601 Willow Rd, Menlo Park, CA 94025, USA, a subsidiary of Meta Platforms Inc. (Facebook). Integrating content from Instagram allows us to display photos, videos, or buttons directly on our website. When you access a page with Instagram features, data is transferred to Instagram, stored, and processed there.

 

Instagram uses the same systems as Facebook for this purpose, so your data is processed within the Meta group of companies. This includes information about the page you accessed, your device, interactions, any purchases, ads you viewed, and the date/time of use. Data is also collected through your Instagram account; if you are logged in, the data collected may be more extensive. This information is transferred to Meta via cookies or similar technologies.

 

Meta distinguishes between customer data (e.g., name, address, phone number, IP address – transmitted in encrypted form) and event data (user behavior). Both types of data can be combined and compared with existing information.

 

This data may be stored worldwide, particularly on servers in the USA. Instagram shares information within the Meta Group and with external partners. The storage period and location of the data are in accordance with Instagram's internal guidelines.

You can manage your data or permanently delete your account in your Instagram settings. When you delete your account, your own content (e.g., photos, status updates) will be deleted; content from other users related to you will be retained. You can manage and delete cookies at any time in your browser; however, this may limit the functionality of Instagram content.

The legal basis under Article 6(1)(a) GDPR is your consent, if granted. Processing is also partially based on our legitimate interest (Article 6(1)(f) GDPR) in the appropriate presentation of content and effective communication. Social media elements are only used after consent has been granted.

 

Instagram also processes data in the USA and adheres to the EU-US Data Privacy Framework. Additionally, standard contractual clauses pursuant to Article 46(2) and (3) of the GDPR are used to ensure an adequate level of data protection. Details can be found here: European Commission – Standard Contractual Clauses .

 

Further information can be found in Instagram's privacy policy: https://privacycenter.instagram.com/policy/ .

 

 

(4)   TikTok

 

Our website is integrated with the social network TikTok. TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland ("TikTok"), is responsible for users in the European Economic Area. This integration serves to share TikTok videos directly on our website and enable interaction.

 

When you play or interact with videos on TikTok, TikTok collects information about your user behavior and your end device, including:

• IP address;
• browser type and version;
• operating system;
• approximate location;
• further technical information.

 

Cookies and similar technologies are used for this purpose. If you have your own TikTok account, TikTok may also process profile data (e.g., name, date of birth, email address), as well as information about your interactions with other TikTok users.

 

The data storage period and location are in accordance with TikTok's internal guidelines and applicable legal regulations. Data may also be processed in the USA and other non-EU countries. Specific storage periods are not currently known to us.

 

You can adjust your privacy preferences in your TikTok account. Regardless, you can restrict data collection through browser cookie settings—even without a TikTok account. However, this may limit the functionality of the TikTok website and content.

 

The legal basis for data processing is your consent (Article 6(1)(a) GDPR). Processing may also be based on our legitimate interest (Article 6(1)(f) GDPR) to provide user-friendly content and enable communication. Social media elements are only used with your consent.

 

TikTok also processes personal data in the USA. For transfers to third countries, TikTok uses standard contractual clauses pursuant to Article 46(2) and (3) of the GDPR, which ensure an adequate level of data protection. You can find them here: European Commission – standard contractual clauses .

 

For more information, please see TikTok's Privacy Policy and general information about TikTok .

 

 

(5)   Youtube

 

Our website integrates videos from the YouTube platform . The provider is YouTube LLC , 901 Cherry Ave., San Bruno, CA 94066, USA. Google Ireland Limited , Gordon House, Barrow Street, Dublin 4, Ireland, is responsible for processing personal data within the European Economic Area.

 

We use YouTube videos to provide you with multimedia content directly on our website and to design our online offerings attractively. This serves both to present our services user-friendly and to optimize our content for easy discovery and user engagement.

 

When you visit a page with an integrated YouTube video, an automatic connection to the YouTube/Google servers is established. Depending on your browser and account configuration, the following data is transmitted to YouTube/Google:

• your IP address;
• the requested URL of the page you are visiting;
• technical information (browser type, version, operating system, screen resolution, internet provider);
• date and time of access;
• possibly location data (in the case of mobile devices);
• interaction data (e.g. videos played, playback position, likes, comments).

If you are logged in to your Google or YouTube account, this data can be assigned directly to your profile. YouTube uses cookies or comparable technologies (e.g., local storage, pixels) to analyze your user behavior, display personalized advertising, and create statistics.

 

Data processing may also take place on servers in the USA . YouTube/Google actively implements the EU-US Data Privacy Framework , which is designed to ensure the secure transfer of personal data from the EU to the USA. Google also uses standard contractual clauses approved by the European Commission (Article 46 of the GDPR) to ensure an adequate level of data protection also outside the EU.

The storage period depends on the type of data being stored. Some cookies are deleted after the end of the session, while others remain stored for months or years. You can manually delete cookies or block them in your browser settings at any time.

The integration of YouTube videos is based solely on your consent pursuant to Article 6(1)(a) of the GDPR. You can withdraw your consent at any time with future effect by adjusting the appropriate settings in our cookie banner or in your browser.

Regardless of whether you consent, you can block cookies from being saved in your browser, delete existing cookies, or use add-ons to block trackers. If you're logged into your Google account, you can manually delete the data stored there at any time or set it to automatically delete it in your settings.

For more information about the processing of your data by YouTube/Google and about your rights and the possibility of adjusting settings to protect your privacy, please refer to Google's privacy policy: https://policies.google.com/privacy .

 

V.                   Contact form and email contact

1.             Description and scope of data processing

Our website provides a contact form for electronic contact. If you use the contact form, the data entered in the input mask will be transmitted to us and stored.

 

When using the contact form, you can enter the following data via the input mask:

(1)   name and surname;

(2)   email address;

(3)   phone number;

(4)   personal data that the user enters in the "Your message" field;

(5)   result of the control question.

 

In order to use the contact form, information regarding points 1 to 3 and 5 is required.

When sending the contact form, the following data is additionally saved:

·         date and time of form submission.

Before sending a message, we will ask for your consent to process your data, with reference to this privacy policy.

 

Alternatively, you can contact us via the provided e-mail address: biuro@szkolenianiemcy.pl.

 

This data is not shared with third parties. It is used solely for the purpose of processing your inquiry.

2.        Legal basis for data processing

The legal basis for data processing is the user's consent, in accordance with Article 6(1)(a) of the GDPR.

 

The legal basis for processing the data you provide to us when sending an email is Article 6(1)(f) of the GDPR. If contact via email is for the purpose of initiating or concluding a contract, the additional legal basis for processing personal data is Article 6(1)(b) of the GDPR.

 

3.        Purpose of data processing

The processing of personal data from the contact form serves the purpose of establishing contact with potential customers. Furthermore, the data is used to prepare an initial offer for the customer. If the user has consented, the data processing also serves to send advertising and informational materials about our products.

 

The remaining personal data processed during the shipping process are used to prevent misuse of the contact form and to ensure the security of our IT systems.

4.        Storage period

Data will be deleted as soon as it is no longer required for the purposes for which it was collected, and its deletion is not precluded by any statutory retention obligations. If the data is not deleted because it is required for other, legally permissible purposes, its processing will be restricted, i.e., the data will be blocked and will not be processed for other purposes. This applies, among other things, to data that we are required to retain for commercial, tax, or legal reasons.

 

Personal data additionally processed during the sending process of the contact form are deleted after a 7-day period at the latest, provided there are no commercial, tax or legal obligations to store them.

 

5.      The right to object and request the deletion of data

You have the right to withdraw your consent to the processing of your personal data at any time. This withdrawal can be made by sending an email to biuro@szkolenianiemcy.pl. In this case, communication will no longer be continued, and we will not be able to send you offers or informational materials.

 

In order to exercise other rights of the data subject, please contact us at the following e-mail address: biuro@szkolenianiemcy.pl.

 

Any personal data collected in connection with establishing contact will be deleted upon receipt of the objection.

VI.               Using Microsoft 365

We use Microsoft 365 to effectively shape our business processes and improve communication. Microsoft 365 is a collection of cloud-based services and programs provided by Microsoft Corporation.

1.        Data processing by Microsoft 365:

(1)     Types of data processed

When using Microsoft 365, personal data such as name, email address, communication content and documents may be processed.

 

(2)     Purpose of data processing

The data is used to enable Microsoft 365 features such as email communication, calendaring, data storage and sharing, and online collaboration.

 

(3)     Legal basis

Data processing is carried out on the basis of our legitimate interests (Article 6 (1) (f) GDPR) in the efficient and secure operation of our business and, where necessary, for the performance of a contract (Article 6 (1) (b) GDPR).

 

 

(4)     Data transfer

Microsoft may transfer data to countries outside the EU. However, Microsoft ensures that data is protected in accordance with EU standards, including through the use of standard contractual clauses.

 

2.      Microsoft 365 usage data retention period

Data processed through Microsoft 365 is retained for as long as necessary for the specific purposes for which it was collected or as required by law.

 

(1)     Emails and communication data :

We generally store emails and other communication data processed via Microsoft 365 for the duration of the business or contractual relationship and in accordance with the statutory retention periods, which are generally between 6 and 10 years.

 

(2)     Documents and files

Documents and files generated and stored via Microsoft 365 are retained for the duration of the project or contractual relationship and in accordance with statutory retention periods. Upon project or contract termination, this data will be archived or deleted, in accordance with internal guidelines and legal requirements.

 

(3)     Calendar entries and tasks :

Calendar entries and tasks are stored for the duration of the respective purpose. After the respective purpose has expired, or at your request, the data will be deleted, provided this does not conflict with statutory retention periods.

 

(4)     User accounts

We retain data processed in connection with Microsoft 365 user accounts for as long as the user account is active. If a user account is deleted, the data associated with it is deleted within 30 days, unless legally required retention periods require longer retention.

 

(5)     Backups and security

Data contained in backup and security copies may be retained for a limited period of time in accordance with Microsoft's internal backup guidelines. These guidelines are based on data protection best practices and regulatory requirements.

On July 10, 2023, the European Commission adopted an adequacy decision for the transfer of personal data to the United States (the Data Privacy Framework). This decision confirms that US companies included on the certification list, which includes Microsoft Corporation, have a level of data protection comparable to that of the EU.

Microsoft is committed to protecting your data in accordance with EU data protection standards, including standard contractual clauses for international data transfers. For more information about Microsoft's data processing and retention practices, please see the Microsoft Privacy Policy .

Further information : For further information about data processing by Microsoft, please see the Microsoft Privacy Policy .

VII. Data subject rights

In order to exercise your rights as a data subject, please write to the following address: biuro@szkolenianiemcy.pl.

If your personal data are processed, you are a data subject within the meaning of the GDPR and you have the following rights towards the controller:

1.        The right to obtain information

You may ask the data controller for information as to whether we process your personal data.

In the event of such processing, you may request the following information from the data controller:

(1)     the purposes for which personal data are processed;

 

(2)     categories of personal data processed;

 

(3)     recipients or categories of recipients to whom your personal data have been or will be disclosed;

 

(4)     the planned period for which your personal data will be stored or, if it is not possible to provide specific information in this respect, the criteria for determining the storage period;

 

(5)     the existence of the right to rectification or deletion of your personal data, the right to limit the processing of your data by the controller or the right to object to such processing;

 

(6)     the existence of the right to lodge a complaint with a supervisory authority;

 

(7)     any available information regarding the origin of the data, if the personal data were not obtained from the data subject;

 

(8)     the use of automated decision-making, including profiling, in accordance with Article 22(1) and (4) of the GDPR and – at least in such cases – meaningful information about the principles governing such decision-making and the significance and envisaged consequences of such processing for the data subject.

You have the right to obtain information about whether your personal data is being transferred to third countries or international organizations. Therefore, you may request information about the appropriate safeguards under Article 46 of the GDPR taken in connection with such transfer.

 

2.        Right to rectification

You have the right to request that the controller rectify or supplement your personal data if the data being processed is inaccurate or incomplete. The controller is obligated to rectify it immediately.

 

3.        The right to restrict data processing

You may request the restriction of the processing of your personal data under the following conditions:

(1)     if you question the accuracy of your personal data – for a period enabling the controller to check the accuracy of such data;

 

(2)     the processing is unlawful and you oppose the deletion of your personal data and request the restriction of their use instead;

 

(3)     the controller no longer needs the personal data for processing purposes, but you need them to establish, pursue or defend legal claims, or

 

(4)     if you have objected to processing pursuant to Article 21(1) of the GDPR and it has not yet been determined whether the legitimate grounds of the controller override the grounds for your objection.

If the processing of your personal data has been restricted, such personal data may be processed – with the exception of their storage – only with your consent or for the establishment, exercise or defence of legal claims, or to protect the rights of another natural or legal person, or for important reasons of public interest of the Union or a Member State.

If processing has been restricted in accordance with the above conditions, the controller will inform you before lifting the restriction.

4.        The right to delete data

You may request the controller to immediately delete your personal data, and the controller is obliged to delete your personal data without undue delay if one of the following circumstances applies:

(1)     your personal data are no longer necessary for the purposes for which they were collected or otherwise processed;

 

(2)     you withdraw consent on which the processing was based pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) of the GDPR, and there is no other legal ground for the processing;

 

(3)     you object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR;

 

(4)     your personal data were processed unlawfully;

 

(5)     the deletion of your personal data is necessary to comply with a legal obligation under Union law or the law of a Member State to which the controller is subject;

 

(6)     the personal data concerning you were collected in connection with the provision of information society services referred to in Article 8(1) of the GDPR.

 

5.        Information for third parties

If the controller has made your personal data public and is obliged to erase them under Article 17(1) of the GDPR, the controller shall take reasonable steps, including using technical means, taking into account available technology and the costs of implementation, to inform controllers processing the personal data that you, as the data subject, have requested that they erase all links to, or copies or replications of, this personal data.

 

6.        Exceptions

The right to delete data does not apply when their processing is necessary

(1)     in order to exercise the right to freedom of expression and obtain information;

 

(2)     for compliance with a legal obligation which requires processing under Union law or the law of a Member State to which the data controller is subject, or for the performance of a task in the public interest or for the performance of public administration tasks assigned to the data controller;

 

(3)     for reasons of public interest in the protection of public health, pursuant to Article 9(2)(h) and (i) and Article 9(3) of the GDPR;

 

(4)     for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the GDPR, provided that the right indicated in paragraph a) is likely to make it impossible or significantly more difficult to achieve the purposes of such processing, or

 

(5)     for the establishment, exercise or defense of legal claims.

 

7.        Right to information

If you have exercised your right to rectification, erasure or restriction of processing of your data vis-à-vis the data controller, the controller is obliged to inform all recipients to whom your data has been made available about the rectification, erasure or restriction of processing, unless this proves impossible or involves a disproportionate effort.

You have the right to request information from the data controller about who the recipient of the data was.

8.      The right to data portability

You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, standard commercial format suitable for automated processing. You also have the right to transmit this data to another controller without any hindrance from the controller to which you have provided the data, provided

(1)     the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) or on a contract pursuant to Article 6(1)(b) of the GDPR, and

 

(2)     processing is carried out in an automated manner.

In exercising this right, you also have the right to request that your personal data be transmitted directly from the controller to another controller, where technically feasible. This must not adversely affect the rights and freedoms of third parties.

The right to data portability does not apply to processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

 

9.      The right to object

You have the right to object at any time – for reasons relating to your particular situation – to the processing of your personal data based on Article 6(1)(e) or (f) of the GDPR, including profiling based on these provisions.

The Controller is no longer permitted to process your personal data unless it demonstrates compelling legitimate grounds for processing that override your interests, rights and freedoms, or unless the processing serves to establish, pursue or defend legal claims.

If your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, your personal data will no longer be processed for such purposes.

You have the possibility, in connection with the use of information society services and without prejudice to Directive 2002/58/EC, to exercise your right to object by automated means using technical specifications.

 

10.  The right to withdraw consent to the processing of personal data

You have the right to withdraw your consent to the processing of your personal data at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

 

11.  Automated decision-making in individual cases, including profiling

You have the right not to be subject to a decision based solely on automated data processing (including profiling) that produces legal effects concerning you or significantly affects you in a similar manner. This does not apply if the decision

(1)     is necessary for the conclusion or performance of a contract between you and the controller;

 

(2)     is permitted by the law of the Union or the Member States to which the controller is subject, which contains appropriate measures to protect your rights and freedoms and legitimate interests, or

 

(3)     is issued with your express consent.

However, these decisions cannot be based on special categories of personal data under Article 9(1) GDPR if Article 9(2)(a) or (g) GDPR does not apply and appropriate measures have not been implemented to protect your rights and freedoms and legitimate interests.

In the cases referred to in points 1 and 3, the controller shall take appropriate measures to protect your rights and freedoms and legitimate interests, which include at least the right to obtain the intervention of a person responsible, to present your own position and to challenge the decision.

 

12.  The right to lodge a complaint with the supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you believe that the processing of personal data relating to you infringes the GDPR.

The supervisory authority to which the complaint has been lodged shall inform the complainant of the progress and results of the complaint, including the possibility of seeking a judicial remedy under Article 78 of the GDPR.