I. Preamble

AVM Computersysteme Vertriebs GmbH, for short: AVM (hereinafter, also "we") is responsible for its products and internet services. In the following we would like to inform you how personalized data are processed in the framework of our products.

Personalized data are erased as soon as possible, and never used or passed on for advertising purposes without your consent.

II. Responsible Authority / Data Protection Officer / Responsible Supervisory Authority

Responsible Authority

AVM Computersysteme Vertriebs GmbH

Alt-Moabit 95

10559 Berlin

Germany

Tel.: +49-30-3 99 76-0

Email: info@avm.de

Internet: en.avm.de

Data Protection Officer

AVM Computersysteme Vertriebs GmbH

Data protection officer

Alt-Moabit 95

10559 Berlin

Germany

Tel.: +49-30-3 99 76-2 57

Email: datenschutz@avm.de

Responsible Supervisory Authority

Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit)

Alt-Moabit 59–61

10555 Berlin

Germany

Tel.: +49-30-1 38 89-0

Fax: +49-30-2 15 50 50

Email: mailbox@datenschutz-berlin.de

Internet: datenschutz-berlin.de

III. General Principles / Information

1. Definitions

The definitions are in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter "General Data Protection Regulation" or "GDPR"). In particular, the definitions of Article 4 and Article 9 of the GDPR apply.

2. Legal Basis for Personal Data Processing

We collect and use the personalized data of our users in principle only insofar as this is necessary to render and provide our services and offers (including mobile apps).

Personalized data are collected and used for other purposes only

1. with the user's consent,
2. for the protection of legitimate interests, insofar as this is not overridden by the interests or fundamental rights of the persons affected that require the protection of personalized data. This also includes the transmission of data to authorities and/or courts.

Insofar as personalized data are processed on the basis of consent by the data subject, Article 6(1a) of the GDPR is the legal basis for such processing.

For the processing of personalized data for the performance of a contract to which the data subject is party, Article 6(1b) of the GDPR is the legal basis; this also applies for processing which is necessary for the implementation of pre-contractual measures.

If personalized data are processed for the purpose of compliance with legal obligations (such as, for example, retention periods stipulated by tax or commercial law, or information provided by authorities, etc.), Article 6(1c) of the GDPR is the legal basis.

For the case that vital interests of the data subject or another natural person necessitate the processing of personalized data, Article 6(1d) of the GDPR is the legal basis.

Should processing take place in order to protect a legitimate interest of our company or of a third party, and this interest is not overridden by the interests, fundamental rights, and basic freedoms of the data subject, Article 6(1f) of the GDPR is the legal basis for processing. This can be the case particularly:

• to guarantee the operation of your FRITZ! product
• to guarantee the IT security of your FRITZ! product
• to improve the quality and function of FRITZ! products

3. Obtaining Consent / Right of Revocation

Consent in accordance with Article 6(1a) of the GDPR is generally obtained electronically. The user consents by checking the checkbox in the corresponding field for the purpose of documenting that consent was granted (opt-in procedure). The contents of the consent form are logged electronically. The legality of processing on the basis of other legal grounds remains unaffected by this, particularly in accordance with Article 6(1f) of the GDPR.

Right of revocation: Please note that consent already granted can be revoked prospectively at any time – in full or in part; the legality of any processing that took place on the basis of consent up to the time consent was revoked remains unaffected. Please direct any revocation to the contact information for the responsible authority or the data protection officer listed under (II).

4. Possible Recipients of Personalized Data

In order to provide our services, we also employ service providers ("processors") to act on our behalf and upon our instructions in the framework of service provision.

We ensure that our service providers offer sufficient guarantees to implement appropriate technical and organizational measures in such a manner that processing will meet the requirements of the GDPR and ensure the protection of the rights of the data subject (cf. Article 28 of the GDPR).

Insofar as there is a transmission of personalized data to third parties and/or recipients, we ensure that this occurs only in accordance with the requirements of the GDPR (e.g., Article 6[4] of the GDPR) and only where there is a corresponding legal basis (e.g., Article 6[4] of the GDPR).

5. Processing of Data in So-called "Third Countries"

In general, the processing of your personalized data takes place within the EU, or within the European Economic Area ("EEA").

Only in exceptional cases (e.g., in connection with the involvement of service providers to provide web analytic services) can it happen that information is transferred to so-called "third countries". "Third countries" are countries outside of the European Union and/or the Agreement on the European Economic Area, in which it cannot necessarily be assumed that the level of data protection is adequate according to the standards of the EU.

Insofar as the transmitted information also includes personalized data, we ensure before such a transfer that an adequate level of data protection is guaranteed in the given third country, or by the given recipient in the third country, or that you have provided your consent to such transfer, or there is another basis that permits such a transfer (e.g. Article 49 of the GDPR). An adequate data protection level can arise from what is called an "adequacy decision" by the European Commission or be guaranteed by application of the "EU standard contractual clauses". We are happy to provide you with further information on appropriate and suitable guarantees for adherence to an adequate level of data protection upon request; the contact information is provided at the beginning of this data protection statement.

6. Data Erasure and Storage Period

Personalized data on the data subject are erased or locked as soon as the purpose of processing has expired. Data are stored after the purpose of processing has expired only when this is provided for by the European or national legislator in EU regulations, laws or other directives to which our company is subject (e.g., to satisfy legal record-keeping requirements and/or when there are justified interests in storage, e.g., during the period of statutes of limitation for the purpose of legal defense against any claims). The data are also deleted or locked when a storage period prescribed by the relevant standards expires, unless there is a necessity for the further storage of the data for the conclusion of a contract of for other purposes.

7. Rights of the Data Subjects

The GDPR grants certain rights to data subjects affected by the processing of personalized data (rights of the data subject, especially Articles 12 through 22 of the GDPR). The individual rights of the data subjects are clarified in (VIII). If you would like to exercise one or more of these rights, you can contact us at any time. Please do so by using the contact information listed under (II).

IV. Data Processing on the Part of AVM and Data Transmission to AVM

1. FRITZ!OS

For product maintenance, to ensure operational safety, and for reasons of security, AVM provides your AVM FRITZ! products with regular updates to the operating software (FRITZ!OS). In order to determine the correct and/or necessary updates for your product, at regular intervals your FRITZ! product sends technical data to identify the device, the operating system used, the network provider of your line, and basic settings on the FRITZ! product, to AVM.

AVM saves the technical data on your product transmitted during the search for updates in order to be able to perform a targeted update. If your device is registered with MyFRITZ!Net (myfritz.net), these data are also used in order to display the configuration and properties of your device (see [V].)

You can disable the automatic search for updates under "Internet > Account Information > AVM Services". AVM recommends leaving the automatic search for updates enabled.

In the factory settings, your FRITZ! product is configured to notify you about available updates, and automatically install updates that AVM considers necessary for secure operation. You can change the settings of your FRITZ!OS at any time under "System > Update > Auto Update".

In order to improve your product, and to ensure safe operation on your line, your FRITZ! product will send technical diagnostics data to AVM as needed:

• The options "Diagnostics data" and "Diagnostics and maintenance" are enabled during installation. In order to ensure the security and reliable operation of your product, we recommend leaving these settings enabled. However, you can change these options during installation. Both options can be changed individually after installation under "Internet > Account Information > AVM Services". For more information on this, see the "AVM Services" help page.
• With the "Diagnostics data" option, technical diagnostics data are transmitted by your FRITZ! product to AVM for analysis in specific cases of errors (error reports) or suspected abuse by third parties.
• With the "Diagnostics and maintenance" option, your FRITZ! product can be reached by AVM for diagnostics purposes. In individual cases, AVM can retrieve selected technical diagnostics data, as for error analysis or for the purpose of support. In individual cases, AVM can retrieve a summary of diagnostics data, as for error analysis or for the purpose of support. This summary can be viewed under "Internet > Account Information > AVM Services“. AVM records a random sample of FRITZ! products to collect statistically relevant data on quality, application scenarios, and ambient parameters. This information serves to detect technical problems, to guide useful further development, and to make qualitative improvements measurable. When the "Diagnostics and maintenance" option is enabled, a randomly selected, access-protected port is opened on the FRITZ! product for communication with the FRITZ! product with the sole purpose of transmitting diagnostics data.
• Diagnostics data do not include any names assigned by the customer. Insofar as diagnostics data must be logged and evaluated, we do so in anonymized form, that is, without any reference to the person of the user. This way you can benefit from optimizations implemented in updates or necessary adjustments by AVM. Examples of technical diagnostics data are quality and configuration parameters of the DSL, internet and Wi-Fi connections, basic performance parameters, and configurations of the FRITZ!OS operating system, as well as reports about errors or suspected abuse by third parties.
• In a Mesh system, the diagnostics and maintenance settings are automatically transmitted from the Mesh Master (FRITZ!Box hub) to the Mesh Repeaters (connected FRITZ! products). Please make any desired changes to the settings on the Mesh Master.
• If you entered an email address for status information on your FRITZ! product during installation of your FRITZ! product, AVM keeps a MyFRITZ! account for the email address saved for this purpose. For reasons of security, information on when this account was accessed by which devices, as well as information on the FRITZ! product registered with this account are saved in this account, so that you can view this information or have it sent to you by email (MyFRITZ! report) (see [V]).
• When you use the help, open the Tips & Tricks, open the user manual, register for a FRITZ! product newsletter, or use the Zack speed test at avm.de, your FRITZ! product transmits device-specific data, like, for instance, the FRITZ!Box model and provider name, the FRITZ!OS version number, regional settings and language, as well as information on the context of the user interface in which the help was accessed, in order to enable the context-sensitive display of contents appropriate to the product being used.
• When the "Sample HD sound" feature or the "AVM voice clip (HD)" entry in the telephone book (or the corresponding quick-dial entry) are used on your FRITZ!Fon, a connection will be established to the HD telephony test server at AVM. For this only the IP address of your FRITZ!Box for regular IP communication is transmitted. AVM does not process this information.
• In order to display the TV channel logos on cable connections, the FRITZ!Box periodically accesses list of available channel logos provided by AVM. For this only the IP address of your FRITZ!Box for regular internet communication is transmitted. No further processing takes place.
• The display of the local exchange for a telephone call on the FRITZ!Fon is realized completely on the FRITZ!Box, since the entire database of dialing prefixes is stored in the FRITZ!OS of your FRITZ!Box. This means that no data processing is performed by AVM.
• The "Caller Announcement" (voice ringtone) feature is used only if the "Voice" ringtone was enabled. By default the "Voice" ringtone is disabled. When the "Voice" ringtone (caller announcement) is enabled, the FRITZ!Box uses an AVM service to speech-synthesize the selected string of characters in the telephone book – unless this string has already been synthesized on the FRITZ!Box. The speech synthesis entails the transmission of only the relevant string to AVM. Additional data like the number called and time of the call are not transmitted. If the string of characters is not known to the AVM service, the "Polly" service from "Amazon Web Services (AWS)" is used by the AVM service exclusively for the speech synthesis of the string, and the result preserved for the future in the AVM service. Communication between AVM and AWS Polly is initiated by AVM – and only when the text is not already stored by AVM in synthesized form.

AWS Polly is provided by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855, Luxemburg. For more information, see https://aws.amazon.com/privacy/?nc1=f_pr and https://aws.amazon.com/polly/?nc=sn&loc=0. AVM uses only those Polly services operating in the EU.

If you send us voluntary feedback on DSL, Wi-Fi, VoIP or other services or technologies, your FRITZ!Box transmits any data entered voluntarily (for instance feedback, email address, postal code) as well as device-specific data, including DSL settings, FRITZ!Box model and provider name, FRITZ!OS version number, regional setting and language, in order to be able to analyze your feedback. These data are transmitted via email. Feedback is saved until it is no longer required for analysis, and evaluated anonymously.

If you receive assistance from AVM Support, our support may occasionally request that you supply support information to AVM. Under "FRITZ!Box Support" on the FRITZ!Box user interface you have the possibility of sending detailed support information, e.g. on a problem, to AVM at the push of a button. In response you are given a letter code which we ask you to provide for your case. Using the "Save support information" option you can also save and view the support information locally. AVM uses the submitted support information only for the resolution of support cases and error messages. Support information is deleted automatically no later than one year after the last access.

The legal basis for processing as stipulated in (IV[1]) is - unless otherwise specified - Article 6 (1a) of the GDPR.

2. FRITZ! Lab

In contrast to the information in Section IV(1), the "Terms of Use for FRITZ! Lab" and the following additions apply to FRITZ! Lab:

• The search for updates is always enabled. You may still elect to have these updates installed automatically (recommended). Deactivation is not possible in the Lab version.
• Diagnostics and maintenance are always enabled. This allows error reports to be transmitted to AVM and technical diagnostics data to be retrieved by AVM if required. Device-specific metadata is also transmitted to AVM when certain AVM pages (e.g. online help, Zack speed test) are called up. Deactivation is not possible in the Lab version.
• If your FRITZ!Box is registered with MyFRITZ!Net, the MyFRITZ! direct connection is always enabled for easier and faster access to MyFRITZ!Net functions in the Lab. Deactivation is not possible in the Lab version.

The legal basis for processing as stipulated in (IV[2]) is - unless otherwise specified - Article 6 (1b) of the GDPR in conjunction with the "Terms of Use for FRITZ! Lab".

Note that, for technical reasons, the settings shown above may be retained when switching from one version of FRITZ! Lab to FRITZ!OS (release). The settings can be adjusted manually in FRITZ!OS (release).

V. AVM Services and Apps

1. MyFRITZ!Net (myfritz.net)

Users must register and set up a personal account in order to use the MyFRITZ!Net (myfritz.net) service available online. This account is set up when you enter an email address for status information on your FRITZ!Box during installation, or when you register your FRITZ!Box with MyFRITZ!Net at a later point in time. Then AVM keeps a MyFRITZ! account for the email address saved here. In the context of registration and setting up a user account, we collect and save the following personal data, but do not pass them on to third parties: the user's email address, password, information on the devices that have been used to access this account (device fingerprint, operating system, browser and browser version), IP addresses of the last 10 login attempts (the IP addresses of earlier attempts are deleted), the optional individualized text (shown in the subject line of your email for security), and possible status information on your email inbox if messages bounce back from your email provider. In addition, for every FRITZ!Box assigned to the MyFRITZ! account, AVM saves technical data for identification (for instance, device address [MAC address], FRITZ!Box name and the like) as well as the username of the local user on the FRITZ!Box so that this information can be pre-allocated when MyFRITZ! internet access is configured.

Your passwords are saved only in hashed form and can be neither viewed nor recalculated by AVM. The data transmitted during registration are erased if registration is not concluded within 48 hours by clicking on the confirmation link. In the case of irregularities in your MyFRITZ! account or anomalies or peculiarities with one of the devices registered there, AVM can contact the email address saved with the account.

Registration of the user serves to restrict and control access to the contents and services that we offer only to registered users on our MyFRITZ!Net web pages.

The legal bases for processing data for the purpose of registration and account administration and account use are Article 6 (1b) of the GDPR and Article 6(1f) of the GDPR, since registration is simultaneously for the purpose of restricting and/or controlling access and for the protection of contents and information we developed.

The data transmitted during registration are erased if registration is not concluded within 48 hours by clicking on the confirmation link.

As a user you have the option to terminate or delete your registration with MyFRITZ!Net at any time under "Account Settings > Delete Account". The data stored about you in MyFRITZ!Net can be modified at any time. If you delete your account with MyFRITZ! all of the data associated with the account will be erased.

AVM saves the technical data on your product transmitted during the search for updates in order to be able to perform a targeted update (see [VI]). If your device is registered with MyFRITZ!Net, these data are also used in order to display the configuration and properties of your device or send them by email.

MyFRITZ!Net can send email to the email address assigned to the MyFRITZ! account. These emails contain the individualized text specified for the MyFRITZ! account, if such a text was configured.

MyFRITZ!Net regularly sends a MyFRITZ! report about the FRITZ! products registered with the MyFRITZ! account. This function can be enabled and disabled.

For your security, MyFRITZ!Net notifies you by email about new devices registering with the MyFRITZ! account.

AVM reserves the right to contact the user of the MyFRITZ! account by email in the case of anomalies with the MyFRITZ! account or one of the devices registered with it.

The MyFRITZ!Net website uses "Google reCAPTCHA" (hereinafter "reCAPTCHA"). This software is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland ("Google").

It serves to protect MyFRITZ!Net and its users from misuse through automatic spying and from spam.

For more information on Google reCAPTCHA and on Google's privacy policy, go to the following links: policies.google.com/privacy?hl=en and google.com/recaptcha/intro/android.html.

For statistical evaluation of the usage of the MyFRITZ!Net web pages we use Matomo Web Analytics. This service analyzes only navigation to and usage of the MyFRITZ!Net websites. Any other websites you visited remain unknown to us, and are neither saved nor tracked.

No cookies are used for this process and the requesting IP address is anonymized for transmission.

To simplify communication with your FRITZ!Box registered with MyFRITZ!Net, AVM operates a dynamic DNS (DynDNS) server. For this your FRITZ! product transmits its IP address to the DynDNS server, which saves only the IP address of your FRITZ!Box that is currently valid in the constant subdomain. Outdated IP address are deleted immediately.

If you configure MyFRITZ!Net access on a device connected to a FRITZ!Box registered with MyFRITZ!Net, you allow access to this device (via the opened ports) from the internet under a subdomain of the constant subdomain belonging to myfritz.net. The device name of the device is used as the subdomain. Example: Fileserver1.drfh40jierq5we2rtz.myfritz.net – if your device is called Fileserver1.

When you open the link to the AVM Newsletter from MyFRITZ!Net, for your convenience, the email address of your MyFRITZ! account is automatically pre-allocated to receive the AVM Newsletter and thus transmitted to AVM.

You can change this email address for receiving the AVM Newsletter. For data protection information regarding the AVM Newsletter, see the privacy policy on our web pages at https://en.avm.de/privacy-policy/.

If your FRITZ!Box is registered with MyFRITZ!Net, you can enable the MyFRITZ! direct connection to MyFRITZ!Net. The MyFRITZ! direct connection is disabled by default. The MyFRITZ! direct connection allows you to receive information on this FRITZ!Box and connected devices in real time on MyFRITZ!Net. This requires a login with your MyFRITZ! account. Third persons cannot view this information. You can also configure settings for this FRITZ!Box directly on MyFRITZ!Net (e.g. install an available update). The MyFRITZ! direct connection is generally maintained permanently, with the relevant data being transmitted to AVM and processed exclusively by AVM. AVM does not forward these data to third parties and uses them exclusively to prepare your personal view on MyFRITZ!Net and to secure the operability of the systems.

2. FRITZ!Apps

FRITZ!Apps offer you additional functions for your FRITZ! product, some at home, and some from on the go. In order to use your app, data required in order to register with the FRITZ!Box are stored in the app and transmitted, usually in encrypted form, for communication with the FRITZ!Box.

In FRITZ!Apps, the personalized data of the contacts available on the device, from your FRITZ!Box telephone books, and from linked telephone books, are used only within the FRITZ!App to fulfill the functions offered there. Contacts and telephone books can contain, for instance, telephone numbers, names, email addresses, and additional personal data. These data will not be passed on to AVM nor to any third parties.

After they have been configured on a FRITZ!Box, FRITZ!Apps automatically use this function to be notified by the FRITZ!Box about new events. This communication takes place from the FRITZ!Box via AVM directly to the notification service for Android devices provided by Google, or for iOS devices provided by Apple, via the battery conserving transmission deployed in many apps. In the context of regular internet communication the IP addresses of your FRITZ!Box and of the device are used. Communication takes place in encrypted form. Over this route the FRITZ!Box transmits the events of the FRITZ!Box so that they can be processed and displayed in the app. For this, supplementary user data like telephone numbers, email addresses or names are transmitted end-to-end in encrypted form; these can be decrypted only by your FRITZ!Box and the apps registered with it.

To improve the functionality, user friendliness, and security of your FRITZ!Apps, AVM receives certain information about the use of your FRITZ!Apps. For this the FRITZ!Apps use Google Analytics, Google Firebase, and Google Fabric, web analytics services from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Irland; "Google") and App Analytics von Apple Inc. (One Apple Park Way, CA 95014, USA; "Apple").

For this purpose the FRITZ!Apps transfer to these services anonymized information about the use of the FRITZ!App and any errors that occur. In case of errors, precise details about register codes and device information are sent in order to facilitate maintenance of the FRITZ!Apps. You may reject the recording of this anonymized data and their processing by disabling this option at any time. The generated information is sent in anonymized form to a Google or Apple server and saved there. On this basis the usage of the app will be analyzed and listed in aggregated and anonymized reports on app activities for AVM.

If required by law, or if third parties process the data on Google's or Apple's behalf, Google or Apple can transmit these data to third parties where necessary.

The Google Analytics Option "anonymizeIp" is used in FRITZ!Apps to guarantee the anonymized collection of IP addresses (also known as IP masking). In the course of this IP anonymization your IP address is shortened before transmission within the member states of the EU or to other states party to the Agreement on the European Economic Area. Only in exceptional cases is the complete IP address transmitted to a Google server in the US and shortened there.

For more information, see https://policies.google.com/privacy?hl=en (general information on Google Analytics and data privacy) and at fabric.io/terms.

If you use the microphone or the camera of your smartphone for certain FRITZ!Apps, such as for audio transmission, or to record a photograph or video, the contents will be used only in the app; for transmissions over networks (for instance, by telephone) directly into your home network or via the internet, your data will not be transmitted to AVM. Depending on the configuration, the data are transmitted in the internet in encrypted or non-encrypted form. The FRITZ!App Fon transmits voice data in the home network without encryption.

If you send us voluntary feedback from the FRITZ!Apps, your app transfers specific diagnostics data so that we can analyze your feedback. Transmission takes place using the app you selected for sending (in encrypted or non-encrypted form). Feedback is saved until it is no longer required for analysis.

VI. Data Transfer to Third Parties

In accordance with its intended use, the product connects with one or more telecommunications service providers (for services like internet access, TV, and telephony). The corresponding interfaces of the providers and/or the services they render are operated through the product, and the data necessary for these services are exchanged with the given provider. Your FRITZ!Box may communicate with your service provider for the provisioning, updating and maintenance of your FRITZ!Box. The kind and purpose of such data transmission and data processing are explained in the documentation supplied by your provider.

If you enable the services of other service providers in your FRITZ!Box through optional (voluntary) configurations, the data required for these interfaces will be exchanged with the service provider. Such services may include push mail (email dispatch via SMTP), DynDNS, online storage (WebDAV), online contacts, online address book, Domain Name Server (DNS), certificate from letsencrypt.org, time server (NTP), messages (RSS feed), podcasts and web radio. For such uses, service-specific addresses and parameters, and in some cases a user name and password, are required by the given service and entered by the user. These are saved in encrypted form in the FRITZ!Box. These data are neither evaluated nor transferred outside of communication with these services. Communication with the services is encrypted whenever possible (depending on the configuration). Every time you connect to the internet for DynDNS service, your FRITZ!Box transmits the current public IP address and the entered login data at regular intervals. If you use the option "Use certificate from letsencrypt.org (recommended)" for MyFRITZ! access to your FRITZ!Box from the internet, the FRITZ!Box has an SSL certificate issued by the letsencrypt.org certificate authority for your MyFRITZ! address (subdomain from myfritz.net). For this the transmission of the IP address and the MyFRITZ! address of the FRITZ!Box is required. During certification, a port on the FRITZ!Box is opened briefly so that letsencrypt.org can check that the MyFRITZ! address is legitimate. The certificate is renewed at regular intervals in the same way.

Like most certification authorities, letsencrypt.org publishes a list of all of the certificates it issues, and thus also the MyFRITZ! addresses certified there. The privacy policy of letsencrypt.org is presented at letsencrypt.org/privacy. This option is effective only for FRITZ!Box products with MyFRITZ! access from the internet configured and can be disabled under "Internet > MyFRITZ! Account".

VII. Rights of the Data Subjects

According to the GDPR, the user is entitled in particular to the following data subject rights:

1. Right to information (Article 15 of the GDPR)

You have the right to request information about whether or not we process personalized data pertaining to you. If personalized data pertaining to you are processed by our company, you are entitled to information about

• the purposes of processing
• the categories of personalized data (kind of data) that are processed
• the recipients or categories of recipients to whom your data were disclosed or are to be disclosed; this is the case especially when data were disclosed or are to be disclosed to recipients in third countries outside the purview of the GDPR
• the planned duration of storage, to the extent this is possible; if the duration of storage cannot be given, in any case the criteria for determining the duration of storage (e.g. legal retention periods or the like) must be communicated
• your right to rectification and erasure of the data pertaining to you, including the right to restrict processing and/or the right to revoke consent (on this, see also the subsequent clauses)
• the existence of the right to lodge an appeal with a supervisory authority
• the source of the data, if the personalized data were not collected from you directly.

Further, you are entitled to information about whether your personalized data are the object of automated decisions in the sense of Article 22 of the GDPR, and, if this is the case, which decision criteria are the basis for such an automated decision (logic) or what effects and consequences the automated decision can have for you.

If personalized data are transmitted to a third country outside the purview of the GDPR, you are entitled to information about whether, and if so, on the basis of which guarantees, an adequate level of protection is ensured by the data recipient in the third country in accordance with Articles 45 and 46 of the GDPR.

You have the right to request a copy of your personalized data. We always provide copies of data in electronic form unless you request otherwise. The first copy is free of charge; for additional copies, reasonable compensation can be requested. The copy is provided as long as the rights and freedoms of other persons are not compromised through the transmission of the copied data.

2. Right to Rectification (Article 16 of the GDPR)

You have the right to request that we rectify your data, should these be incorrect, inaccurate and/or incomplete; the right to rectification includes the right to complete your data by adding supplementary clarifications or information. A rectification and/or supplement must take place immediately – that is, without undue delay.

3. Right to Erasure (Article 17 of the GDPR)

You have the right to request that we erase your personalized data, insofar as

• the personalized data are no longer required for the purposes for which they were collected and processed
• data processing takes place on the basis of consent you granted and you have rescinded your consent, insofar as there is no other legal basis for data processing
• You entered an objection to data processing in accordance with Article 21 of the GDPR and there are no overriding reasons for further processing
• You entered an objection to data processing for the purpose of direct advertising in accordance with Article 21(2) of the GDPR
• Your personalized data were processed illegally
• the data in question concern a child, and were collected in relation to information society services in accordance with Article 8(1) of the GDPR.

There is no right to the erasure of personalized data insofar as

• the rights to freedom of expression and to knowledge are in conflict with the request for erasure
• the processing of personalized data (i) in order to fulfill a legal obligation (e.g. legal retention periods), (ii) in order to fulfill public duties and interests in accordance with EU law and/or the law of the member states (this also includes interests in the area of public health) or (iii) for the purposes of archiving or research
• the personalized data are required for the assertion, exercise or defense of legal claims.

The erasure must take place immediately – that is, without undue delay. If personalized data have been made public by us (e.g. in the internet), we are responsible, in the framework of what is technically possible and reasonable, for informing third-party processors about the erasure request, including the deletion of links, copies and or replicates.

4. Right to Restriction of Processing (Article 18 of the GDPR)

You have the right to have the processing of your personalized data restricted in the following cases:

• If you have contested the accuracy of your personalized data, you can request that your data not be used for other purposes for the duration of the accuracy check and insofar restricted.
• In the case of illegal data processing you can request the restriction of data use in accordance with Article 18 of the GDPR rather than data erasure according to Article 17(1d) of the GDPR.
• If you need your personalized data for the assertion, exercise or defense of legal claims, but your personalized data are otherwise no longer required, you can request that we restrict processing to the above mentioned purpose of legal proceedings.
• If you entered an objection to data processing in accordance with Article 21(1) of the GDPR and it has not yet been decided whether our interests in processing override your interests, you can request that your data not be used for other purposes for the duration of the review and insofar be restricted.

Personalized data, the processing of which was restricted upon your request, may still be processed – subject to storage – only (i) with our consent, (ii) for the assertion, exercise or defense of legal claims, (iii) to protect the rights of other natural persons or entities, or (iv) for reasons of substantial public interest. You will be notified in advance if a processing restriction is lifted.

5. Right to Data Portability (Article 20 of the GDPR)

Subject to the following provisions, you have the right to receive the data pertaining to you in a commonly used, machine-readable format. The right to data portability includes the right to transmission of the data to another controller; upon request we will thus – insofar as it is technically possible – transmit data directly to a controller you specify or will specify in the future. The right to data portability applies only for the data provided by you and assumes that the data are processed on the basis of consent or for performance of a contract, and is executed using automated methods. The right to data portability in accordance with Article 20 of the GDPR does not affect the right to data erasure in accordance with Article 17 of the GDPR. The data are transmitted only if the rights and freedoms of other persons can not be compromised through the data transmission.

6. Right to Object (Article 21 of the GDPR)

In the case of processing of personalized data in order to fulfill a task carried out in the public interest (Article 6[1e] of the GDPR) or for the purpose of pursuing legitimate interests (Article 6[1f] of the GDPR), you can object prospectively to the processing of personalized data pertaining to you at any time. In the case of an objection we have to refrain from any further processing of your data for the above mentioned reasons, unless

• there are compelling and legitimate reasons for processing which override your interests, rights and freedoms, or
• the processing is required for the assertion, exercise or defense of legal claims.

You can object prospectively to the use of your data for the purpose of direct advertising at any time; this is also true for any profiling associated with the direct advertising. In the case of an objection we have to refrain from any further processing of your data for the purpose of direct advertising.

7. Prohibition of Automated Decisions/Profiling (Article 22 of the GDPR) [if relevant]

Decisions that can have legal consequences for you or considerably compromise you may not be based exclusively on the automated processing of personal data – including profiling. This does not apply insofar as the automated decision

• is required to conclude or fulfill a contract with you,
• is permitted on the basis of legal provisions of the EU or of member states, insofar as these legal provisions contain adequate measures to safeguard the rights and freedoms and the legitimate interests of your person, or
• takes place with your express consent.

Decisions based exclusively on the automated processing of special categories of personal data are generally prohibited, unless Article 22(4) of the GDPR applies in connection with Article 9(2a or g) of the GDPR, and adequate measures were taken to safeguard the rights and freedoms and the legitimate interests of your person.

8. Legal Protections / Right to Petition a Supervisory Authority

In the case of complaints you can address the responsible supervisory authority of the EU or the member states at any time. The supervisory authority named in (II) is responsible for our company.

 

Status February 2024