Data protection

**Data protection declaration**

**1) Introduction and contact details of the controller**

1.1 Thank you for your interest in our website. In the following, we will inform you about how we handle your personal data when you use our website. Personal data is all data with which you can be personally identified.

1.2 The controller in charge of data processing on this website, within the meaning of the General Data Protection Regulation (GDPR), is Ursula Rohde, design-lichtschalter.com, David-Gilly-Str. 1, 14469 Potsdam, Deutschland, Tel.: 033195136212, E-Mail: info@design-lichtschalter.com. The controller of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

1.3 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to the controller). You can recognise an encrypted connection by the character string "https://" and the lock symbol in your browser line.

**2) Data collection when visiting our website**

When using our website for information purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the data that your browser transmits to the site server (so-called "server log files"). When you visit our website, we collect the following data, which is technically necessary for us to display the website to you:

- Our visited website

- Date and time at the time of access

- Amount of data sent in bytes

- Source/reference from which you reached the page

- Browser used

- Operating system used

- IP address used (if applicable: in anonymised form)

Processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. However, we reserve the right to check the server log files retrospectively if there are concrete indications of illegal use.

**3) Cookies**

We use cookies, i.e. small text files that are stored on your end device, to make visiting our website attractive and to enable the use of certain functions. Some of these cookies are automatically deleted after you close your browser (so-called "session cookies"), while others remain on your device for longer and enable page settings to be saved (so-called "persistent cookies"). In the latter case, you can find the storage period in the cookie settings overview of your web browser.

If personal data is also processed by individual cookies used by us, the processing is carried out in accordance with Art. 6 para. 1 lit. b GDPR either for the execution of the contract, in accordance with Art. 6 para. 1 lit. a GDPR in the case of consent given or in accordance with Art. 6 para. 1 lit. f GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the page visit.

You can set your browser so that you are informed about the setting of cookies and can decide individually whether to accept them or to exclude the acceptance of cookies for certain cases or in general.

Please note that if you do not accept cookies, the functionality of our website may be restricted.

**4) Making contact**

When you contact us (e.g. via contact form or email), personal data is processed exclusively for the purpose of processing and responding to your enquiry and only to the extent necessary for this purpose.

The legal basis for the processing of this data is our legitimate interest in responding to your request in accordance with Art. 6 para. 1 lit. f GDPR. If your contact is aimed at a contract, the additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR. Your data will be deleted if it can be inferred from the circumstances that the matter in question has been conclusively clarified and provided that there are no statutory retention obligations to the contrary.

**5) Processing of data when opening a customer account**

In accordance with Art. 6 para. 1 lit. b GDPR, personal data is collected and processed to the extent necessary if you provide it to us when opening a customer account. The data required to open an account can be found in the input mask of the corresponding form on our website.

You can delete your customer account at any time by sending a message to the above address of the controller. After deletion of your customer account, your data will be deleted, provided that all contracts concluded through it have been fully processed, there are no statutory retention periods to the contrary and we have no legitimate interest in further storage.

**6) Comment function**

As part of the comment function on this website, in addition to your comment, information about the time the comment was created and the commentator name you have chosen will be stored and published on this website. Furthermore, your IP address will be stored for security reasons in order to enable the author to be identified in the event of unlawful comments. Your e-mail address will be stored so that you can be contacted if a third party objects to your published content as unlawful.

The legal basis for the storage of your data is Art. 6 para. 1 lit. b and f GDPR. We reserve the right to delete comments if they are objected to as unlawful by third parties.

**7) Use of customer data for direct advertising**

In the event of an abandoned purchase with us before completing the order, we offer you the option of receiving a one-off email reminder of the contents of your virtual shopping basket. The only mandatory information for sending this reminder is your e-mail address. The provision of further data is voluntary and may be used to address you personally. We use the so-called double opt-in procedure for sending the e-mail to ensure that you only receive a notification if you have expressly confirmed your consent to this by activating a verification link sent to the e-mail address provided.

By activating the confirmation link, you give us your consent to use your personal data in accordance with Art. 6 para. 1 lit. a GDPR for sending a shopping basket reminder. We store your IP address entered by the Internet service provider (ISP) as well as the date and time of registration in order to be able to trace any possible misuse of your e-mail address at a later date. The data collected when you register for our e-mail notification service is used strictly for the intended purpose.

You have the option to unsubscribe from the shopping basket reminders at any time by sending a message to the person responsible named at the beginning. After unsubscribing, your e-mail address will be deleted immediately from our mailing list set up for this purpose, unless you have expressly consented to further use of your data or there is a legally permitted use of data beyond this, about which we inform you in this declaration.

**8) Data processing for order processing**

**8.1 Transmission of image files for order processing by email**

On our website, we offer our customers the option of ordering the personalisation of products by sending image files by email. The transmitted image motif serves as a template for the personalisation of the selected product.

The customer can send us one or more image files from the memory of the end device used via the e-mail address provided on the website. We collect, store and use the transmitted files exclusively for the production of the personalised product in accordance with the respective service description on our website. If the transmitted image files are passed on to specialised service providers for the production and processing of the order, we will expressly inform you of this in the following paragraphs. No further forwarding will take place. If the transmitted files or digital motifs contain personal data, in particular images of identifiable persons, all processing operations mentioned are carried out exclusively for the purpose of processing your online order in accordance with Art. 6 para. 1 lit. b GDPR.

After the final processing of the order, the transmitted image files are automatically and completely deleted.

**8.2 Forwarding of data for delivery and payment purposes**

Insofar as this is necessary for contract processing for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6 para. 1 lit. b GDPR. If we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we process the contact data (name, address, e-mail address) provided when ordering in accordance with Art. 6 para. 1 lit. c GDPR. This is done in order to inform you personally by suitable means of communication (e.g. by post or e-mail) about upcoming updates within the legally prescribed period as part of our statutory information obligations. Your contact details will be used strictly for the purpose of notifying you of updates owed by us and will only be processed to the extent necessary for the respective information.

**8.3 Cooperation with external service providers for order processing**

To process your order, we work with external shipping partners to deliver your order. In doing so, we transmit your name and your delivery address and, if necessary for delivery, your telephone number to a shipping partner selected by us exclusively for the purpose of delivering the goods in accordance with Art. 6 para. 1 lit. b GDPR.

**8.4 Forwarding of personal data to the shipping service provider Deutsche Post AG**

We use Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany, as our transport service provider. Before the goods are delivered, we will pass on your e-mail address and/or telephone number to the provider in accordance with Art. 6 para. 1 lit. a GDPR in order to coordinate a delivery date or to enable a delivery notification, provided that you have given your express consent to this during the ordering process. Otherwise, we will only pass on the name of the recipient and the delivery address to the provider for the purpose of delivery in accordance with Art. 6 para. 1 lit. b GDPR. The information will only be passed on if this is necessary for the delivery of the goods. Prior coordination of the delivery date with the provider or notification of delivery is not possible in this case.

Consent can be revoked at any time for the future by contacting the controller named above or the provider.

**8.5 DHL**

We use the following provider as our transport service provider: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany. Before delivering the goods, we will pass on your e-mail address and/or telephone number to the provider in accordance with Art. 6 para. 1 lit. a GDPR in order to coordinate a delivery date or to enable a delivery notification, provided that you have given your express consent to this during the ordering process. Otherwise, we will only pass on the name of the recipient and the delivery address to the provider for the purpose of delivery in accordance with Art. 6 para. 1 lit. b GDPR. The information will only be passed on if this is necessary for the delivery of goods. In this case, prior coordination of the delivery date with the provider or notification of delivery is not possible. Consent can be withdrawn at any time with effect for the future from the controller named above or from the provider.

**8.6 Use of payment service providers (payment services) - Komfortkasse**

Online payment methods from the following provider are available on this website: LTC Information Services GmbH, Business Tower, Seligenstädter Str. 107, 63073 Offenbach am Main. If you select a payment method of the provider for which you make an advance payment (e.g. credit card payment), the payment data you provide during the ordering process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be passed on to the provider in accordance with Art. 6 para. 1 lit. b GDPR. Your data will only be passed on for the purpose of payment processing with the provider and only to the extent that this is necessary.

- Mollie**

Online payment methods from the following provider are available on this website: Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, The Netherlands. If you select a payment method of the provider for which you make an advance payment (e.g. credit card payment), your payment data provided during the ordering process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be passed on to the provider in accordance with Art. 6 para. 1 lit. b GDPR. Your data will only be passed on for the purpose of payment processing with the provider and only to the extent that this is necessary.

- PayPal**

**8.7 PayPal (Europe) S.a.r.l. et Cie, S.C.A.**

Online payment methods from the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. If you select a payment method of the provider for which you pay in advance (e.g. credit card payment), your payment data provided during the ordering process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be passed on to the provider in accordance with Art. 6 para. 1 lit. b GDPR. Your data will only be passed on for the purpose of payment processing with the provider and only to the extent that this is necessary.

When selecting a payment method for which the provider makes advance payment (e.g. invoice or instalment purchase or direct debit), you will also be asked to provide certain personal data (first and last name, street, house number, postcode, city, date of birth, e-mail address, telephone number, possibly data on an alternative means of payment) during the order process.

In order to safeguard our legitimate interest in determining the solvency of our customers, this data is forwarded by us to the provider for the purpose of a credit check in accordance with Art. 6 para. 1 lit. f GDPR. On the basis of the personal data provided by you and other data (such as shopping basket, invoice amount, order history, payment experience), the provider checks whether the payment option you have selected can be granted with regard to payment and/or bad debt risks.

The credit report may contain probability values (so-called score values). If score values are included in the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. The calculation of the score values includes, but is not limited to, address data.

You can object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may still be authorised to process your personal data if this is necessary for contractual payment processing.

**9) Web analysis services**

**9.1 Google Analytics 4**

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). Google Analytics 4 enables us to analyse your use of our website.

By default, cookies are set by Google Analytics 4 when you visit the website. These cookies are small text blocks that are stored on your end device and collect certain information, including your IP address. However, the IP address is truncated by Google to prevent it from being directly linked to a specific person.

The information collected by Google Analytics, including your IP address, is transferred to Google servers and processed there, whereby transfers to Google LLC in the USA are also possible. Google uses this information on our behalf to analyse your use of the website, to compile reports on website activity and to provide other services relating to website activity and internet usage. The abbreviated IP address transmitted by Google Analytics will not be merged with other Google data.

The data collected as part of the use of Google Analytics 4 is stored for two months and then deleted. All processing described, including the setting of cookies on your end device, is only carried out with your express consent in accordance with Art. 6 para. 1 lit. a GDPR. Without your consent, Google Analytics 4 will not be used during your visit to our website. You can revoke your consent at any time for the future by deactivating this service via the "cookie consent tool" provided on the website.

We have concluded an order processing contract with Google, which ensures the protection of the data of our website visitors and prohibits unauthorised disclosure to third parties. For the transfer of data to the USA, Google relies on standard contractual clauses of the European Commission to ensure compliance with the European level of data protection.

For further legal information on Google Analytics 4, including a copy of the aforementioned standard contractual clauses, please visit https://policies.google.com/privacy?hl=de&gl=de and https://policies.google.com/technologies/partner-sites.

**Demographic characteristics**

Google Analytics 4 uses the "Demographics" function to compile statistics on the age, gender and interests of site visitors. This data is generated by analysing advertising and information from third-party providers. The collected data cannot be assigned to a specific person and is deleted after a storage period of two months.

**Google Signals**

Google Signals enables the creation of cross-device reports. If you have activated personalised ads and linked your devices to your Google account, Google can analyse your usage behaviour across devices and compile statistics. We do not receive any personal data, only aggregated statistics. You can stop the cross-device analysis by deactivating the "Personalised advertising" function in the settings of your Google account (instructions: https://support.google.com/ads/answer/2662922?hl=de). You can find more information about Google Signals at https://support.google.com/analytics/answer/7532985?hl=de.

**UserIDs**

Google Analytics 4 can use the "UserIDs" function to analyse activities across devices. This assumes that you have consented to the use of Google Analytics 4 and have created an account on this website. Your activities are analysed across devices, including conversions.

**9.2 PayPal Marketing Solutions**

This website uses the web analytics service of PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. The service collects and stores pseudonymised visitor data using cookies and comparable technologies such as tracking pixels, web beacons and algorithms for reading end device and browser information. This includes information about the end device used, such as the IP address and browser information. This data is used for statistical analyses of usage behaviour on the website in order to create pseudonymised usage profiles. This enables, among other things, the analysis of movement patterns (heat maps), which show the duration of page visits and interactions with page content (e.g. text input, scrolling, clicks and mouse-overs). Pseudonymisation generally excludes the possibility of direct personal identification, and your personal data is not merged with clear data collected in any other way.

This processing, including the reading or storage of information on the end device, only takes place if you have given your express consent in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on the website.

An order processing contract has been concluded with the provider to ensure the protection of the data of site visitors and to prohibit unauthorised disclosure to third parties.

**9.3 Google Tag Manager**

This website uses the "Google Tag Manager", a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager provides a technical basis for bundling various web applications, including tracking and analysis services, and for calibrating, controlling and linking them to conditions via a standardised user interface. The Google Tag Manager itself does not store or read any information on user devices. However, when you access a page, your IP address is transmitted to Google and may be stored there, with possible transmission to Google LLC servers in the USA.

This processing only takes place if you have given your express consent in accordance with Art. 6 para. 1 lit. a GDPR. Without this consent, the Google Tag Manager will not be used during your visit to the website. You can revoke your consent at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on the website.

An order processing contract has been concluded with the provider to ensure the protection of the data of site visitors and to prohibit unauthorised disclosure to third parties. For the transfer of data to the USA, the provider relies on standard contractual clauses of the European Commission to ensure compliance with the European level of data protection.

**10) Retargeting/remarketing and conversion tracking**

**10.1 Google Ads Remarketing**

This website uses the functions of Google Ads Remarketing to advertise the website in Google search results and on third-party websites. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). Google sets a cookie in the browser of your end device, which automatically enables interest-based advertising by means of a pseudonymous cookie ID and based on the pages you visit.

Any further data processing will only take place if you have consented to Google linking your internet and app browsing history to your Google account. If you are logged in to Google while visiting our website, Google will use your data together with Google Analytics data to create target group lists for cross-device remarketing. Your personal data is temporarily linked by Google with Google Analytics data in order to create target groups. As part of the use of Google Ads Remarketing, personal data may be transmitted to the servers of Google LLC. in the USA.

You can permanently object to the setting of cookies by Google Ads Remarketing by downloading and installing the [Google browser plug-in available here](https://support.google.com/ads/answer/7395996).

Further information and the privacy policy regarding advertising and Google can be found [here](https://www.google.com/policies/technologies/ads/).

This processing will only take place if you have given your express consent in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on the website.

**10.2 Google Ads conversion tracking**

This website uses conversion tracking from Google Ads, an online advertising programme from Google Ireland Limited. Conversion tracking is used to measure the effectiveness of advertising measures.

A conversion cookie is set when a user clicks on an Ads advert placed by Google. These cookies are not used for personal identification and generally lose their validity after 30 days. If the user visits certain pages of our website and the cookie has not yet expired, Google and we can recognise that the user has clicked on the ad and has been redirected to this page.

The information collected using the conversion cookie is used to generate conversion statistics for Google Ads customers. Customers are informed of the total number of users who have clicked on their advert, but no information that can be used to personally identify users.

When using Google Ads, personal data may also be transmitted to the servers of Google LLC. in the USA.

You can permanently object to the setting of cookies by Google Ads Conversion Tracking by downloading and installing [this browser plug-in from Google](https://support.google.com/ads/answer/7395996).

Further information and the privacy policy regarding Google Ads Conversion Tracking can be found [here](https://policies.google.com/technologies/partner-sites).

You can permanently object to the setting of cookies by Google Ads Conversion Tracking by downloading and installing the [browser plug-in from Google](https://www.google.com/settings/ads/plugin?hl=de).

Google Ads uses a customer matching function to target users whose data has been obtained in the context of business or business-like relationships in a more interest-based way. For this purpose, one or more files with aggregated customer data, in particular e-mail addresses and telephone numbers, are transmitted electronically to Google. Google does not have access to clear data, but encrypts the information automatically using a special algorithm. The encrypted information can only be used by Google to allocate it to existing Google accounts that the data subjects have set up. This enables personalised advertising via all Google services linked to the respective Google account.

Customer data is only transmitted to Google if you have given us your express consent to do so in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke this consent at any time with effect for the future.

Further information on Google's data protection measures in relation to the customer matching function can be found [here](https://support.google.com/google-ads/answer/6334160?hl=de&ref_topic=10550182), and Google's privacy policy can be viewed [here](https://www.google.de/policies/privacy/).

**Google Marketing Platform:**

The website uses the online marketing tool Google Marketing Platform (GMP) of the operator Google Ireland Limited. GMP uses cookies to place relevant adverts for users, to improve campaign performance reports or to prevent a user from seeing the same adverts more than once. Google uses a cookie ID to record which adverts are displayed in which browser and can thus prevent them from being displayed more than once. In addition, GMP can use cookie IDs to record so-called conversions that relate to ad requests. This is the case, for example, when a user sees a GMP advert and later visits the advertiser's website using the same browser and makes a purchase via this website. According to Google, GMP cookies do not contain any personal information.

**Google Marketing Platform (GMP):**

Due to the marketing tools used, your browser automatically establishes a direct connection with the Google server. We have no influence on the scope and further use of the data collected by Google through the use of this tool and therefore inform you according to our level of knowledge as follows:

By integrating GMP, Google receives the information that you have accessed the corresponding part of our website or clicked on an advert from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, it is possible that the provider will find out your IP address and store it. When using GMP, personal data may also be transmitted to the servers of Google LLC. in the USA.

All processing described above, in particular the setting of cookies for reading information on the terminal device used, will only take place if you have given us your express consent to do so in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future by deactivating this service in the "cookie consent tool" provided on the website.

The privacy policy of GMP by Google can be found [here](https://www.google.de/policies/privacy/).

**Site functionalities:**

**11.1 Youtube:**

This website uses plugins to display and play videos from the provider Google Ireland Limited. Data may also be transmitted to Google LLC, USA. When you access a page on our website that contains such a plugin, your browser establishes a direct connection to the provider's servers in order to load the plugin. Certain information, including your IP address, is transmitted to the provider.

If playback of embedded videos is started via the plugin, the provider also uses cookies to collect information about user behaviour, compile playback statistics and prevent abusive behaviour. If you are logged into a user account with the provider during your visit to the site, your data will be assigned directly to your account when you click on a video. If you do not wish your data to be associated with your account, you must log out before clicking the play button.

All of the aforementioned processing, in particular the setting of cookies for reading information on the end device used, will only take place if you have given us your express consent to do so in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future by deactivating this service via the "cookie consent tool" provided on the website.

For the transfer of data to the USA, the provider relies on standard contractual clauses of the European Commission, which are intended to ensure compliance with the European level of data protection.

**11.2 ShopVote graphics:**

Graphic elements of the provider Blickreif GmbH are integrated on our website to display external customer ratings and/or an externally awarded quality label. When you call up a page of our website that contains such graphic elements, your browser establishes a direct connection to the provider's servers in order to load the elements properly. In the process, certain browser information, including your IP address, is transmitted to the provider. If personal data is also processed in the process, this is done in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in the optimal marketing of our offer and the appealing design of our website.

**11.3 Google reCAPTCHA:**

On this website, we use the CAPTCHA service of the provider Google Ireland Limited. Data may also be transmitted to Google LLC, USA. The provider uses "Google Fonts", i.e. fonts downloaded from the Internet by Google, for the visual design of the Captcha window. No information other than that already transmitted to Google via the reCAPTCHA functionality is processed.

The service checks whether an input is made by a natural person or abusively by machine and automated processing, and blocks spam, DDoS attacks and similar automated malicious access. To ensure that an action is carried out by a human and not by an automated bot, the service collects the IP address of the end device used, identification data of the browser and operating system type used as well as the date and duration of the visit and transmits these to the provider's servers for evaluation.

The legal basis is our legitimate interest in determining individual responsibility on the Internet and avoiding misuse and spam in accordance with Art. 6 para. 1 lit. f GDPR.

We have concluded an order processing contract with the provider, which ensures the protection of the data of our website visitors and prohibits unauthorised disclosure to third parties.

**12) Tools and other**

**12.1 Lexoffice:**

We use the cloud-based accounting software service of the provider Haufe-Lexware GmbH & Co. KG. The provider processes incoming and outgoing invoices and, where applicable, our company's bank transactions in order to automatically record invoices, match them to the transactions and create the financial accounts from this in a semi-automated process. If personal data is also processed in this process, the processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in the efficient organisation and documentation of our business transactions.

**12.2 Cookie consent tool:**

This website uses a so-called "cookie consent tool" to obtain effective user consent for cookies and cookie-based applications that require consent. The tool is displayed to users when they access the page in the form of an interactive user interface on which consent for certain cookies and/or cookie-based applications can be given by ticking a box. By using the tool, all cookies/services requiring consent are only loaded if the respective user gives their consent by ticking the relevant box. This ensures that such cookies are only set on the user's end device if consent has been granted.

The tool sets technically necessary cookies to save your cookie preferences. Personal user data is not processed in this process. If, in individual cases, personal data (such as the IP address) is processed for the purpose of storing, assigning or logging cookie settings, this is done in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in legally compliant, user-specific and user-friendly consent management for cookies and thus in a legally compliant design of our website.

Another legal basis for the processing is Art. 6 para. 1 lit. c GDPR. As the controller, we are subject to the legal obligation to make the use of technically unnecessary cookies dependent on the respective user consent.

We have concluded an order processing contract with the provider, which ensures the protection of the data of our website visitors and prohibits unauthorised disclosure to third parties.

Further information about the operator and the setting options of the cookie consent tool can be found directly in the corresponding user interface on our website.

**13) Rights of the data subject**

**13.1 Rights of the data subject:**

The applicable data protection law grants you the following data subject rights (information and intervention rights) vis-à-vis the controller with regard to the processing of your personal data, whereby reference is made to the legal basis stated for the respective exercise requirements:

- Right of access pursuant to Art. 15 GDPR;

- Right to rectification pursuant to Art. 16 GDPR;

- Right to erasure pursuant to Art. 17 GDPR;

- Right to restriction of processing pursuant to Art. 18 GDPR;

- Right to information pursuant to Art. 19 GDPR;

- Right to data portability pursuant to Art. 20 GDPR;

- Right to withdraw consent granted pursuant to Art. 7 para. 3 GDPR;

- Right to lodge a complaint pursuant to Art. 77 GDPR.

**13.2 Right to object:**

If we process your personal data as part of a balancing of interests on the basis of our overriding legitimate interest, you have the right to object to this processing at any time with effect for the future on grounds relating to your particular situation.

If you exercise your right to object, we will stop processing the data concerned. However, we reserve the right to continue processing if we can demonstrate compelling legitimate grounds for the processing which override your interests, fundamental rights and freedoms, or if the processing serves the establishment, exercise or defence of legal claims.

If we process your personal data for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for the purpose of such marketing. You can exercise your objection as described above.

If you exercise your right to object, we will stop processing the data concerned for direct marketing purposes.

**14) Duration of storage of personal data:**

The duration of the storage of personal data is determined by the respective legal basis, the purpose of processing and - if applicable - additionally by the respective statutory retention period (e.g. retention periods under commercial and tax law).

- If processing is based on express consent in accordance with Art. 6 para. 1 lit. a GDPR, the data concerned will be stored until you withdraw your consent.

- If there are statutory retention periods for data that is processed within the scope of legal or similar obligations on the basis of Art. 6 para. 1 lit. b GDPR, this data will be routinely deleted after the retention periods have expired, provided that it is no longer required for contract fulfilment or contract initiation and/or we no longer have a legitimate interest in further storage.

- In the case of processing on the basis of Art. 6 para. 1 lit. f GDPR, this data is stored until you exercise your right to object in accordance with Art. 21 para. 1 GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

- In the case of processing for the purpose of direct marketing on the basis of Art. 6 para. 1 lit. f GDPR, this data will be stored until you exercise your right to object in accordance with Art. 21 para. 2 GDPR.

Unless otherwise stated in the other information in this declaration on specific processing situations, stored personal data will be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.