Privacy Notice

This is the translation of our privacy policy. The original text in German is available from here: Datenschutzerklärung. The German document is deemed valid in case of differences between the original and the translation.

Data processing by our company

When using the website www.codeandweb.com, its functionalities, your contact and an inquiry, you transmit personal data to us, which we process for the purpose of handling your inquiries. This data will be treated by us only strictly for the intended purpose within the framework of data protection laws.

Data controller in the sense of the data protection laws:

CodeAndWeb GmbH
Saalbaustraße 61
89233 Neu-Ulm
Represented by: Andreas Löw

General information on data processing

Umfang der Verarbeitung personenbezogener Daten im Allgemeinen

We collect and utilise our users' personal data only insofar as this is necessary for provision of an operational site and of our content and services.

The respective legal basis for the processing of personal data results from the General Data Protection Regulation (GDPR), Article 6 para. 1a – f GDPR.

With the consent of the data subject, Art. 6 para. 1a GDPR serves as a legal basis.

Art. 6 para. 1b GDPR is the legal basis for the processing of personal data for the performance of a contract to which the data subject is a party or for processing operations in pre-contractual measures.

If processing is necessary to fulfil a legal obligation of the data controller, Art. 6 Para. 1c GDPR serves as a legal basis.

If the processing is necessary in the vital interests of the data subject or another natural person, Art. 6 para. 1d GDPR serves as a legal basis.

Where processing is necessary for the performance of a task, which is in the public interest or is carried out in the exercise of official authority conferred on the controller, the legal basis is Art. 6 para. 1e GDPR.

If processing is necessary to safeguard a legitimate interest of our company and if the interests, fundamental freedoms or rights of the data subject do not prevail, the legal basis is Art. 6 para. 1f GDPR.

When you contact us, we collect personal data. This data is stored by us partly due to legal regulations, it is partly necessary for the conclusion of a contract. If you wish to conclude a contract with us, you must provide us with your data so that we can provide our services to you. In addition, we are required by law to keep records for tax and commercial law reasons, which we must comply with. Otherwise, we may not be able to provide our services to you.

Before providing your personal data, you are welcome to contact your respective contact person in our company to find out whether we need your data for the conclusion of a contract and/or our legal storage obligations and what consequences it will have if you do not make the data available to us.

Data erasure and storage duration

We store your personal data as long as this is necessary for the fulfilment of the purpose or storage is prescribed by law, Art 6 Para. 1c GDPR. If the purpose for the storage of personal data is no longer given, this data will be deleted after 6 months, or the processing will be restricted, unless there is a necessity for further storage of the data for the conclusion of a contract or performance of a contract. Further storage only takes place if this has been provided for by the European or national legislator.

SSL or TLS Encryption

For security reasons and to protect your confidential data, we use SSL or TLS encryption throughout the website. This encryption means that confidential data, such as enquiries or orders that you transmit to us, cannot be viewed by third parties. You can recognise an encrypted connection by the browser's address line changing from "http://" to "https://" and a green lock symbol being displayed in the address line.

Automatic data processing when accessing the website www.codeandweb.com

IP-Adresse

1. Description and scope of data processing

When this page is called up, requests are sent to the server, which has to answer them. For this purpose, your IP address must be collected and processed in order to be able to answer the corresponding server enquiries.

The legal basis for processing is your consent under Art. 6 para. 1f GDPR.

3. The purpose of data processing

The purpose of processing your IP address is the functionality of the website and the provision of technical retrieval facilities.

4. Legitimate interest

The legitimate interest in the temporary storage of the IP address lies in the fact that the functionality and provision of the technical accessibility of the website is not possible without this.

5. Duration of storage

The data will be deleted as soon as the further storage is no longer necessary due to the purpose being achieved. When collecting the data for the provision of the website, this is the case when the retrieval process is completed.

6. Recipient of personal data

The IP address is handled by the following hosting providers on behalf of the client on the basis of an order processing agreement in accordance with Art. 28 para. 2, para.4 GDPR:

Hetzner Online GmbH
Industriestraße 25
91710 Gunzenhausen
Deutschland

Cloudflare, Inc.
101 Townsend St,
San Francisco, CA 94107
USA

Hosting & CDN

1. Description and scope of data processing

We use the services of our hosting service provider for the technical production of the website and its accessibility as well as its technical maintenance. This includes the provision of storage and database services as well as their maintenance and support.

Cloudflare is used to speed up access to our web page from all location in the world and to protect our web page from attacks. Web pages cached by Coudflare can contain personal data.

The legal basis for processing is your consent under Art. 6 para. 1f GDPR.

3. The purpose of data processing

The purpose of the processing is the production of the online offer as well as the recognition of malfunctions and attempts to break in.

4. Legitimate interest

The legitimate interest in commissioning the hosting service provider is the external technical competence and the provision of a functional and uncompromised technical website environment.

5. Recipients of personal data and data categories:

The following hosting provisos are provided in the order on the basis of an order processing agreement in accordance with Art. 28 para. 2, para.4 GDPR:

Hetzner Online GmbH
Industriestraße 25
91710 Gunzenhausen
Deutschland

Cloudflare, Inc.
101 Townsend St,
San Francisco, CA 94107
USA

Affected data categories are:

  • User data
  • Communications data
  • Contact data
  • Contract data

Server log files

1. Description and scope of data processing

The IP addresses collected when this page is called up are also stored in server log files in order to detect technical faults and/or attempts to manipulate or break into the server structure and to make them correctable.

In addition, the hosting provider of this website automatically collects, stores and processes information in so-called server log files, which are automatically transmitted by your browser.

This information is:

  • Browser type and browser version
  • Operating system used
  • Referrer URL
  • Host name of the accessing computer
  • Time of the server request

However, this information is not merged with other data sources.

The legal basis for processing is your consent under Art. 6 para. 1f GDPR.

3. The purpose of data processing

The purpose of processing your IP address and the above information is to detect malfunctions and attempted intrusions.

4. Legitimate interest

The legitimate interest in the processing of the IP address and the above information is the provision of a functional and uncompromised technical website environment.

5. Duration of storage

The data will be deleted within 7 days.

6. Recipient of personal data

The IP address and the above information will be processed by the following hosting provider on behalf of an order processing agreement according to Art. 28 para. 2, para.4 GDPR:

Hetzner Online GmbH
Industriestraße 25
91710 Gunzenhausen
Deutschland

Cloudflare, Inc.
101 Townsend St,
San Francisco, CA 94107
USA

Use of cookies

1. Description and scope of data processing

The website www.codeandweb.com uses "cookies". Cookies are text files which are stored in the memory and/or on a data carrier of the device you use to visit the site and which are processed by your Internet browser according to the settings stored there. We use a cookie to determine when you log in to your customer account.

The content of these cookies is:

CookieInhaltDauerZweck
caw-loginAccess token, encryptedSessionGrants access to the license manager
Technically necessary, person-related.
discountDiscount state,
Expiry date
1 yearDisplay of the discount banner and the discount, not person-related.
The date is rounded to the beginning of the day and thus cannot be matched to a single person.
themeName of the selected theme1 yearStore user's selected UI theme (dark/light/auto)

The legal basis for processing is your consent under Art. 6 para. 1b and Art. 6 para. 1f GDPR.

3. The purpose of data processing

These cookies contain technical information for the provision of website functionalities within the framework of the order and customer account process. This enables the technical implementation of the purchasing and customer account process.

4. Entitled interest pursuant to Art. 6 para. 1f GDPR

Our legitimate interest lies in providing a technical environment that maps an online purchasing process for our customers and users. The cookies used only contain technical data and product information which technically represent the conclusion of an online purchase by our customers at the initiative of our customers.

Duration of storage, revocation and elimination options

Most cookies used on this site are so-called "session cookies". These are automatically deleted from the browser cache / memory at the end of your visit to the website and/or when you close your browser, provided you have activated this function in your browser.

The permanent cookies that we use are automatically deleted after their storage period has expired.

Please check the settings of your internet browser (e.g. Firefox, Internet Explorer, Edge, Chrome, Opera, Safari). Your Internet browser also gives you the option of regulating the handling of cookies or deactivating them completely. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all of the website's features in full.

Processing of personal data via contact form and support form

1. Description and scope of data processing

There is a contact form on our website which is only for electronic contact. We only process your personal data to the extent that you provide it to us when you contact us.

For enquiries via the contact form (help button) the following data will be processed:

  • Name
  • Email address
  • Enquiry

For enquiries via the support form (support pages) the following data will be processed:

  • E-mail address
  • Product
  • Operating system
  • Framework
  • Importance
  • Title
  • Enquiry

The name is used for personal contact during the processing of your enquiry.

When simply entering the data in the forms, no data is yet transmitted to us; this is only done after the "send message" button has been pressed.

The following data is also stored at the time the message is sent:

  • Date and time of enquiry

The legal basis for the processing of personal data for processing and answering your enquiries is Art. 6 para. 1f GDPR. The legal basis for the processing of personal data used for the preparation and/or implementation of a contractual relationship is Art. 6 para. 1b) GDPR.

3. The purpose of data processing

The processing of personal data via the contact form serves the sole purpose of establishing contact and enabling the company to address the customer informatively at the customer's initiative. Depending on the intention and content of your inquiry, the purpose can also be the initiation and/or execution of a contractual relationship; in this case, the purpose is also the maintenance of the customer relationship.

4. Legitimate interest

The legitimate interest in data processing lies in the possibility to process your request and to be able to answer you according to your request. The data collected will be processed on the basis of a request made by you. This processing is also in your interest in order to be able to respond to your request according to your expectations.

5. Duration of storage

The data is deleted within 6 months after it is no longer necessary to achieve the purpose of its collection or after no further legal storage obligations (e.g. 10 years according to AO (Fiscal Code), 6 years according to HGB (German Commercial Code)) apply. This is the case when the conversation with the user is finished, for your data entered in the contact form. The conversation is terminated when the circumstances indicate that the matter in question has been finally resolved.

6. Recipient of personal data

The IP address and the above information will be processed by the following hosting provider on behalf of an order processing agreement according to Art. 28 para. 2, para.4 GDPR:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany

Processing of personal data via e-mail

1. Description and scope of data processing

Depending on the content of your email, personal data will be processed for enquiries by email:

This is, in any case, your email address, date and time as well as the content of the message. In addition, depending on the content of your email, the following personal data can, for example, be processed:

  • First name, surname
  • Phone Number
  • Customer number
  • Payment data
  • Contract data

The data will be used exclusively for the processing of the conversation and/or the execution and/or initiation of a contractual relationship.

On the basis of the user's express request via email, the legal basis for the processing of the data is Art. 6 para. 1f GDPR. If the establishment of contact by email also aims at the conclusion and/or the execution of a contract, then additional legal basis for the processing is Art. 6 para. 1b) GDPR.

3. The purpose of data processing

The processing of personal data via the email contact form serves the sole purpose of establishing contact and enabling the company to address the customer informatively at the customer's initiative. Depending on the intention and content of your enquiry, the purpose may also be the initiation and/or execution of a contractual relationship.

4. Legitimate interest

The legitimate interest in data processing lies in the possibility to process your request and to be able to answer you according to your request. The data collected will be processed on the basis of a request made by you. This processing is also in your interest in order to be able to respond to your request according to your expectations.

5. Duration of storage

The data is deleted within 2 months after it is no longer necessary to achieve the purpose of its collection or after no further legal storage obligations (e.g. 10 years according to AO (German Fiscal Code), 6 years according HGB (German Commercial Code)) apply. For your email, this is the case when the conversation with the user is finished. The conversation is terminated when the circumstances indicate that the matter in question has been finally resolved.

Processing of personal data via telephone

1. Description and scope of data processing

Depending on the content of the call, personal data will be processed for telephone enquiries:

Depending on the information you provide during the telephone call, this may also contain the following personal data:

  • First name, surname
  • Phone Number
  • Customer number
  • Payment data
  • Contract data

The data will be used exclusively for the processing of the conversation and/or the execution and/or initiation of a contractual relationship.

On the basis of the user's express request via e-mail, the legal basis for the processing of the data is Art. 6 Para. 1f GDPR. If the establishment of contact by e-mail also aims at the conclusion and/or the execution of a contract, then additional legal basis for the processing is Art. 6 Abs. 1b) GDPR.

3. The purpose of data processing

The processing of personal data via the contact form serves the sole purpose of establishing contact and enabling the company to address the customer informatively at the customer's initiative. Depending on the intention and content of your enquiry, the purpose may also be the initiation and/or execution of a contractual relationship.

4. Legitimate interest

The legitimate interest in data processing lies in the possibility to process your request and to be able to answer you according to your request. The data collected will be processed on the basis of a request made by you. This processing is also in your interest in order to be able to respond to your request according to your expectations.

5. Duration of storage

The data is deleted within 6 months after it is no longer necessary to achieve the purpose of its collection or after no further legal storage obligations (e.g. 10 years according to AO (German Fiscal Code), 6 years according HGB (German Commercial Code)) apply. For your email, this is the case when the conversation with the user is finished. The conversation is terminated when the circumstances indicate that the matter in question has been finally resolved.

Newsletter

1. Description and scope of data processing

If you would like to receive our newsletter, we require a valid email address as well as information which allows us to verify that you are the owner of the email address provided and that you agree to receive this newsletter. No additional data is collected or will only be collected on a voluntary basis. We only use this data to send the requested information and do not pass it on to third parties.

We will, therefore, process any data you enter onto the contact form only with your consent per Art. 6 para. 1a GDPR. You can revoke consent to the storage of your data and email address as well as their use for sending the newsletter at any time, e.g. through the "unsubscribe" link in the newsletter. The data processed before we receive your request may still be legally processed.

The data provided when registering for the newsletter will be used to distribute the newsletter until such time as you cancel your subscription, when said data will be deleted. Data we have stored for other purposes (e.g. email addresses for the members area) remains unaffected.

This website uses MailJet to send newsletters. The provider is Mailjet (SAS Mailjet, 30 Rue Blondel, 75002 Paris, FRANCE)

MailJet is a service with which the dispatch of newsletters can be organised and analysed. The data you provide in order to subscribe to our newsletter will be stored on MailJet servers.

If you do not want your use of the newsletter to be analysed by MailJet, you will have to unsubscribe from the newsletter. We provide a link to do this in every newsletter we send. Furthermore, you can also directly unsubscribe from the newsletter on the website.

The click analysis is deactivated with us.

Detailed information about the functions of MailJet can be found in the following link: www.mailjet.com.

Data processing is based on your consent (Art. 6 para. 1a GDPR). You may revoke your consent at any time. The data processed before we receive your request may still be legally processed.

3. Storage duration

The data provided when registering for the newsletter will be used to distribute the newsletter until such time as you cancel your subscription, when said data will be deleted from our servers and those of MailJet. Data stored by us for other purposes (e.g. email addresses for registration remain unaffected by this).

4. Recipient of personal data

The data is processed by the following dispatch service providers on behalf of the customer on the basis of an order processing agreement in accordance with Art. 28 para. 2, para.4 GDPR:

  • Name
  • Email address

The data is processed by the following dispatch service providers on behalf of the customer on the basis of an order processing agreement in accordance with Art. 28 para. 2, para.4 GDPR:

SAS Mailjet
30 Rue Blondel
75002, Paris
FRANCE

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany

Categories of data:

  • Order data
  • Product specification
  • Address data

YouTube videos

1. Description and scope of data processing

Our website uses content and services of the YouTube page operated by Google. The operator of the pages is YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA.

We use YouTube exclusively to optimise our online offer and to give you as a user a better and more appealing surfing experience. When integrating this service, it is necessary that your IP address is transmitted to the operator of the service (Google). Since without your IP address, the content cannot be sent to your browser. The services can also set cookies on the user's device. These cookies may contain, among other things, technical information about your browser and operating system, referring websites, the time of your visit and other information about the use of our online offer.

Further information about the handling of user data can be found in YouTube's privacy policy: https://www.google.de/intl/de/policies/privacy.

The legal basis for data processing is Art. 6 para. 1f GDPR.

3. The purpose of data processing

The purpose of data processing is to enable an appealing presentation of our online offer.

4. Legitimate interest

Our legitimate interest in data processing arises from the purpose of providing an appealing online offer and to provide you with appealing content on our websites.

5. Duration of storage

The duration of the storage of the data at YouTube results from the YouTube data protection references: https://www.google.de/intl/de/policies/privacy. The duration of the storage of cookies depends on your browser settings. You can change these yourself at any time.

Analysis within the software products (TexturePacker, SpriteIlluminator, PhysicsEditor, BabelEdit)

1. Description and scope of data processing

Our software products are constantly being further developed. We collect statistics on the use of our products and the systems on which they are used in order to be able to make targeted improvements too often.

Data to be transmitted

  • Randomly generated ID
  • License status: Trial, Single user, Volume license (not: license key)
  • Operating system and version
  • Number of processor cores
  • Product version
  • Settings (e.g. TexturePacker: Pack setting)
  • Data formats / frameworks used

The collection of the data will not be activated until you have given your consent at the start of the program.

User data is only collected anonymously/pseudonymised. For this a random user ID is generated, which is stored in the settings. There is no link to an existing customer account/license.

The legal basis for data processing is Art. 6 para. 1a GDPR.

3. The purpose of data processing

Analysis of the product functions used to further develop the software.

4. Duration of storage

The analysis data is stored for up to 12 months.

5. Revocation and removal options

You can revoke the transmission of the data at the start of the program. At a later point in time, you can subsequently activate or deactivate data transmission in the software settings (Preferences).

Vimeo Videos

1. Description and Scope of Data Processing

Our website uses content and services from the video portal Vimeo. The operator of the pages is Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA.

We use Vimeo solely to optimize our online offerings and provide you, the user, with a better and more appealing browsing experience. When integrating this service, it is necessary for your IP address to be transferred to the operator of the service (Vimeo Inc.). Without your IP address, the content cannot be sent to your browser. The services can also set cookies on the user's device. These cookies can store technical information about your browser and operating system, referring websites, visit time, and other information about the use of our online services.

We operate Vimeo in "Do Not Track" mode.

Data transmission to the USA is based on the standard contractual clauses of the EU Commission and, according to Vimeo, on "legitimate business interests". For details, please visit: https://vimeo.com/privacy.

Further information on the handling of user data can be found in Vimeo's privacy policy at: https://vimeo.com/privacy.

The legal basis for data processing is Art. 6 Para. 1 lit. f) GDPR.

3. Purpose of Data Processing

The purpose of data processing is to enable an appealing presentation of our online offer.

4. Legitimate Interest

Our legitimate interest in data processing arises from the purpose of offering an appealing online service and providing appealing content on our websites.

5. Duration of Storage

The duration of data storage at Vimeo is based on Vimeo's privacy notices: https://vimeo.com/privacy. The duration of cookie storage depends on your browser settings. You can change these at any time yourself.

Processing of personal data when sending license keys / information

1. Description and scope of data processing

We send the license keys and other information relevant for the purchased product, such as a warning before the license expires, by email to the email address you have provided.

The data will be used exclusively for the processing of the conversation and/or the execution and/or initiation of a contractual relationship.

The legal basis for processing is your consent under Art. 6 para. 1b GDPR for the execution of the contract.

3. The purpose of data processing

The purpose is the execution of a contractual relationship, in particular for proper licensing and its support.

4. Duration of storage

The data is deleted within 6 months after it is no longer necessary to achieve the purpose of its collection or after no further legal storage obligations (e.g. 10 years according to AO (German Fiscal Code), 6 years according to HGB (German Commercial Code)).

Processing of (personal) data when using BabelEdit's suggestion, pre-translate or ConsistencyAI feature

1. Description and scope of data processing

BabelEdit includes pre-translation and a translation suggestion feature, which can be enabled in the application. Both functions submit the text strings of the primary language to a 3rd party web service (e.g., Google Translate) for translation.

BabelEdit 5 and newer contains ConsistencyAI. This submits translation text to OpenAI to process it using their GPT-4 language model to find consistency issues.

CodeAndWeb sends the texts to the service without adding information that might reveal the users's identity.

The source text and translation result is stored on CodeAndWeb's servers for caching purposes.

CodeAndWeb keeps track of the translation credits used by a BabelEdit installation using the license key (registered mode) or a hashed computer id (trial mode).

The legal basis for processing is your consent under Art. 6 para. 1b GDPR for the execution of the contract.

3. The purpose of data processing

The purpose is the execution of a contractual relationship, particularly for proper licensing and support.

4. Recipient of personal data

The personal data of the user is stored on CodeAndWeb's servers – see hosting for details.

The text to be translated is transmitted to a 3rd party translation service and cached on the servers of CodeAndWeb:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany

CodeAndWeb does not send personal data beyond the text to be translated and has no control over the personal data contained within the text itself. Therefore, it is strictly not permitted to include any personally identifiable data within the texts processed by BabelEdit when using the PreTranslate, Suggestions, or ConsistencyAI features.

Primary language texts may be sent to the following third-party services for translation. We strongly recommend reviewing their privacy policies for detailed information.

Google LLC („Google“)
Amphitheatre Parkway
Mountain View
CA 94043
USA

Google Privacy Policy

Microsoft Corporation
One Microsoft Way
Redmond, WA 98052
USA

Microsoft Azure Legal Information

DeepL GmbH
Maarweg 165
50825 Cologne
Germany

DeepL Privacy Policy

OpenAI, LLC
3180 18th St.
San Francisco
CA 94110
USA

OpenAI Privacy Policy

5. Duration of storage

The data stored on CodeAndWeb's servers is deleted within 6 months after it is no longer necessary to achieve the purpose of its collection or after no further legal storage obligations (e.g. 10 years according to AO (German Fiscal Code), 6 years according to HGB (German Commercial Code)).

Rights of the data subject

If your personal data is processed, you are the data subject within the meaning of the General Data Protection Regulation. Therefore, you have the following rights regarding the data controller.

To exercise your rights towards us as the data subject, please contact us at the following email address: support@codeandweb.com

1. Right to information - Art. 15 GDPR

You have the right to request confirmation from us as to whether we are processing personal data relating to you.

If such processing exists, you have a right of access to this personal data and to the following information:

the purposes for processing the personal data; the categories of personal data being processed; the recipients or categories of recipients to whom your personal data has been or will be disclosed; where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; the existence of a right of rectification or deletion of your personal data or of a restriction on processing by the data controller or of a right to oppose such processing; the existence of a right of appeal to a supervisory authority; any available information on the origin of the data if the personal data has not been collected from the person concerned; the existence of automated decision-making, including profiling, in accordance with Art. 22 Para. 1 and 4 of the GDPR and – at least in these cases – meaningful information on the logic involved and the scope and intended effects of such processing for the data subject.

You have the right to request information regarding whether your personal information will be transmitted to a third-party country or an international organisation. In this respect, you can request the appropriate guarantees in accordance with Art. 46 of the GDPR in connection with the transmission.

2. The right to rectification - Art. 16 GDPR

You have the right to request that the data controller correct and/or complete the data concerning you immediately if the personal data processed is incorrect or incomplete.

3. The right to deletion - Art. 17 GDPR

Deletion obligation:

You have the right to request the immediate deletion of your personal data at any time, provided that one of the following reasons is given:

  • the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
  • you have revoked your consent to the processing of your personal data in accordance with Art. 6 para. 1a or Art. 9 para. 2a GDPR and there is no other legal basis for processing;
  • you have objected pursuant to Art. 21 para. 1, GDPR, and there are no overriding legitimate grounds for processing, or you submit an objection according to Art. 21 para. 2 GDPR against processing;
  • the personal data concerning you has been unlawfully processed;
  • the personal data concerning you must be deleted for compliance with a legal obligation under Union or Member State law to which the data controller is subject;
  • the personal data concerning you has been collected in relation to services offered by information society services pursuant to Art. 8 para. 1 GDPR.

Exceptions: The right to erasure does not exist insofar as processing is necessary

  • to exercise your rights to freedom of expression and information;
  • for the performance of a legal obligation required for processing under the law of the Union or of the Member States to which the data controller is subject or for the performance of a task in the public interest or in the exercise of official authority conferred to the data controller;
  • on grounds of public interest in the field of public health in accordance with Article 9 para. 2h and 2i and Article 9 para. 3;
  • for archiving purposes in the interest of public, scientific or historical research purposes or for statistical purposes in accordance with Art. 89 para. 1 GDPR, to the extent that the law referred to in a) is likely to render impossible or seriously prejudicial the attainment of the objectives of such processing; or
  • to assert, exercise or defend legal claims.

4. The right to restriction of processing - Art. 18 GDPR

You have the right to request the restriction of your personal data under the following conditions:

  • you contest the accuracy of your personal data for a period that enables the data controller to verify the accuracy of the personal data;
  • the processing is unlawful, and you oppose the erasure of the personal data and request the restriction of its use instead;
  • the data controller no longer needs the personal data for processing purposes, but it is required by you for the establishment, exercise or defence of legal claims or
  • you have objected to processing pursuant to Art. 21 para. 1 GDPR and it is not yet clear whether the legitimate reasons of the data controller outweigh your reasons.

Where processing of the personal data that concerns you has been restricted, such data – apart from being stored – may be processed only with your consent or for the purpose of asserting, exercising or defending rights or protecting the rights of another natural or legal person or on the grounds of an important public interest of the Union or of a Member State.

If the processing restriction has been made in accordance with the above conditions, you will be informed by the data controller before the restriction is lifted.

5. Right to information - Art. 19 GDPR

If you have exercised your right to have the data controller correct, delete or limit the processing, we are obliged to inform all recipients to whom the personal data that concerns you has been disclosed of this correction or deletion of the data or restriction on processing, unless this proves impossible or involves a disproportionate effort.

You also have the right to be informed of these recipients.

6. The right to data portability - Art. 20 GDPR

You have the right to obtain your personal data that you have provided to the data controller in a structured, commonly used and machine-readable format. In addition, you have the right to transmit this data to another data controller without hindrance from the data controller to which the personal data has been provided, insofar as

  1. the processing on a consent according to. Art. 6 para. 1a GDPR or Art. 9 para. 2a GDPR or on a contract pursuant to Art. 6 para. 1b GDPR and
  2. processing is carried out using automated methods.

In exercising this right to data transferability, you also have the right to obtain that your personal data relating to you are transmitted directly from one data controller to another, where technically feasible.

7. Right of objection - Art. 21 GDPR

Pursuant to the law, you have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning you, which may be processed on the basis of Art. 6 para. 1e or f GDPR; the same applies to profiling based on these provisions.

The data controller will no longer process the personal data that concerns you, unless they can prove compelling legitimate reasons for the processing, which outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims. If the personal data that concerns you is being processed for direct marketing purposes, you have the right to object at any time to the processing of the personal data that concerns you for the purpose of such marketing; this also applies to profiling, insofar as it is associated with such direct marketing.

If you object to processing your data for direct marketing purposes, your personal data twill no longer be processed for these purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

You have the right at any time to revoke your data protection declaration of consent. The revocation of consent shall not affect the legality of any processing undertaken on the basis of this consent before its withdrawal.

9. Right of appeal to a supervisory authority - Art. 77 GDPR

Without prejudice to any other administrative or judicial remedy, you have the right of appeal to a supervisory authority, in particular in the Member State where you reside, work or where the infringement is suspected, if you believe that the processing of personal data that concerns you is in contravention of GDPR.

As the complainant, the supervisory authority to which you lodge your complaint must inform you of the status and the results of the complaint, including the possibility of a legal remedy under Art. 78 GDPR.

This data protection information is updated at regular intervals.

Gültig ab: 17. Juli 2021/07/17