1. NAME AND ADDRESS OF THE DATA CONTROLLER IN CHARGE OF THE PROCESSING

Data controller in the meaning of the General Data Protection Regulation is:

projekt0708 GmbH

Managing Directors: Michael Scheffler, Dirk Jäckel, Matthias Grün

Address: Leopoldstraße 37a, 80802 München
Telephone: +49 (89) 46 13 23 - 27
Fax: +49 (89) 46 13 23 - 28
E-Mail: info@projekt0708.com

2.  Name And ADDRESS OF THE DATA PROTECTION OFFICER

The Data Protection Officer responsible for the processing is: secudor GmbH

Name: Joachim Hader
Address: Am Schulhof 1, 91757 Treuchtlingen
Telephone: +49 151 538 727 50
E-Mail: datenschutz@projekt0708.com

3. USE OF COOKIES

The Internet pages of projekt0708 GmbH use cookies. Cookies are data which are stored by the Internet browser on the computer system of the user. The cookies can be transmitted to a page when it is called up and thus enable the user to be identified. Cookies help to simplify use of Internet pages by the user. 

It is possible to object to the setting of cookies at any time by changing the settings in the Internet browser accordingly. Cookies that have been placed can be deleted. Please note that if cookies are deactivated, it is possible that not all functions of our website can be used to the full extent.

4. Creation of log files

Every time the website is called up, projekt0708 GmbH collects data and information by means of an automated system. These are stored in the log files of the server. 

The following data may be collected:

(1) Information about the browser type and the version used

(2) The user's operating system

(3) The user's Internet service provider

(4) The IP address of the user

(5) Date and time of access

(6) Websites from which the user's system accesses our website (referrers)

(7) Websites that are called up by the user's system via our website

The processing of the data serves the purpose of delivering the contents of our Internet site, to guarantee the functionality of our information technology systems and to optimise our Internet site. The data of the log files are always stored separately from other personal data of users.

5. Registration on our internet page

If the data subject takes advantage of the possibility to register on the Internet site of the controller by providing personal data, the data will be communicated to the data controller in the relevant input mask. The data will be stored by the data controller solely for the purpose of internal use.

Upon registration, the IP address of the user and the date and time of registration are stored. This serves to prevent abuse of services. The data will not be passed on to third parties. An exception is made if there is a legal obligation to pass on data.

The data have to be registered for the contents or services to be provided. Registered persons have the possibility at any time to have the stored data deleted or changed. Data subjects can obtain information about the personal data stored that relates to them at any time.

6. Newsletter

If the newsletter of our company is subscribed to, the data in the respective input mask will be transmitted to the data controller responsible for processing. 

When subscribing to the newsletter, the IP address of the user as well as the date and time of registration are stored. This serves to prevent abuse of the services or the e-mail address of the data subject. The data will not be passed on to third parties. An exception is made if there is a legal obligation to pass on data.

The data are used exclusively for sending the newsletter. Subscription to the newsletter can be cancelled by the data subject at any time. Consent to the storage of personal data may also be revoked at any time. A corresponding link is provided for in every newsletter for this purpose. 

7. POSSIBILITIES TO INITIATE CONTACT

On the website of projekt0708 GmbH there is a contact form that can be used for the purpose of initiating electronic contact. Alternatively, it is possible to contact us via the e-mail address. If the data subject contacts the data controller in charge of the processing via one of these channels, the personal data transmitted by the data subject will be stored automatically. Storage is performed solely for the purpose of processing or contacting the data subject. The data will not be passed on to third parties.

8. Routine deletion and blocking of personal data

The data controller responsible for the processing will process and store personal data relating to the data subject only for as long as necessary to achieve the purpose of storage. In addition, data may be stored for as long as this is provided for by European or national lawmakers in Union regulations, laws or other provisions to which the data controller responsible for processing is subject. 

As soon as the purpose of storage ceases to apply or a storage period stipulated in the aforementioned regulations expires, personal data are routinely blocked or deleted.

9. RIGHTS OF THE DATA SUBJECT

If your personal data is processed, you are deemed to be the data subject within the meaning of the GDPR and you are entitled to the following rights vis-à-vis the data controller:

9.1 Right to information

You can request confirmation from the data controller as to whether personal data concerning you are being processed by us. 

If such processing has taken place, you can request information from the data controller on the following:

1. the purposes for which the personal data are processed
2. the categories of personal data which are processed;
3. the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed;
4. the planned duration of storage of the personal data relating to you or, if it is not possible to provide specific details, criteria for determining the duration of storage;
5. the existence of a right of rectification or erasure of personal data concerning you, a right to have the processing limited by the data controller or a right to object to such processing; 
6. the existence of a right of appeal to a supervisory authority;
7. any information available as to the origin of the data when the personal data are not collected from the data subject;
8. the existence of automated decision-making, including profiling, in accordance with Art. 22 (1) and (4) of the GDPR and, at least in these cases, useful information on the logic involved and the scope and intended impact of such processing on the data subject.

You have the right to request information as to whether the personal data concerning you are transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate guarantees in connection with the transmission in accordance with Art. 46 of the GDPR.

9.2 Right to rectification 

You have the right to have the data controller rectify and/or integrate any personal data processed concerning you if these data are incorrect or incomplete. The data controller will perform the correction without delay.

9.3 Right to restrict processing

If the following conditions are met, you may request that the processing of personal data concerning you be restricted:

1. if you dispute the accuracy of the personal data concerning you for a period of time which enables the data controller to verify the accuracy of the personal data
2. the processing is unlawful and you object to the deletion of the personal data and instead request the restriction of the use of the personal data;
3. the data controller no longer needs the personal data for the purposes of the processing, but you need the data in order to assert, exercise or defend legal claims; or
4. if you have lodged an objection to the processing pursuant to Art. 21 (1) of the GDPR and it is not yet clear whether the legitimate reasons of the data controller outweigh your reasons.

If the processing of personal data relating to you has been restricted, such data - apart from being stored - may be processed only with your consent or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person or on grounds of an important public interest of the Union or a Member State.

If the restriction on processing has been restricted in accordance with the above conditions, you will be informed by the data controller before the restriction is lifted.

9.4 Right to erasure

9.4.1. You may request the data controller to delete personal data concerning you without undue delay, and the data controller is obligated to delete such data without undue delay if one of the following reasons applies:

1. The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed
2. You revoke your consent on which the processing was based in accordance with Art. 6 (1) (a) or Art. 9 (2) (a) of the GDPR and there is no other legal basis for the processing. 
3. You object to the processing pursuant to Art. 21 (1) of the GDPR and there are no overriding legitimate reasons for the processing, or you object to the processing pursuant to Art. 21 (2) of the GDPR. 
4. The personal data concerning you have been processed unlawfully. 
5. The deletion of personal data concerning you is necessary to comply with a legal obligation under Union law or the law of the Member States to which the data controller is subject. 
6. The personal data concerning you have been collected in relation to information society services provided, in accordance with Art. 8 (1) of the GDPR.

9.4.2. If the data controller has made the personal data concerning you public and is obligated to delete these data pursuant to Art. 17 (1) of the GDPR, he shall take reasonable measures, including technical measures, while taking into account the available technology and costs of implementation, to inform data controllers who process the personal data that you, in your capacity as data subject, have requested them to delete all links to these personal data or copies or replications of these personal data. 

9.4.3. The right of deletion does not apply whenever the processing is necessary

1. to exercise the right to freedom of expression and information
2. to comply with a legal obligation requiring processing under Union or national law of the Member States to which the data controller is subject or to perform a task carried out in the public interest or in the exercise of official authority vested in the data controller;
3. for reasons of public interest in the field of public health pursuant to Art. 9 (2) (h) and (i) and Art. 9 (3) of the GDPR;
4. for archiving, scientific or historical research purposes in the public interest or for statistical purposes pursuant to Art. 89 (1) of the GDPR if the right referred to in section 1 is likely to render impossible or seriously hamper the attainment of the objectives of such processing, or
5. to assert, exercise or defend legal claims.

9.5 Right to be informed

If you have exercised the right to rectify, erase or limit the processing, the data controller is obligated to notify all recipients to whom the personal data concerning you have been disclosed of this rectification, erasure or limitation of processing, unless this proves impossible or involves a disproportionate effort.

You have the right to be informed of these recipients by the data controller.

9.6 Right to data portability

You have the right to receive the personal data concerning you that you have provided to the data controller in a structured, common and machine-readable format. You also have the right to have this data communicated to another controller without interference from the data controller to whom the personal data have been made available, provided that

1. the processing is based on a consent pursuant to Art. 6 (1) (a) of the GDPR or Art. 9 (2) (a) of the GDPR or on a contractual agreement pursuant to Art. 6 (1) (b) of the GDPR and
2. the processing is performed using automated procedures.

In exercising this right, you are furthermore entitled to have the personal data concerning you transferred directly from one data controller to another data controller to the extent that this is technically feasible. The freedoms and rights of other persons must not be affected by this.

The right to data transferability shall not apply to processing of personal data which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.

9.7 Right to object

You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you which is carried out pursuant to Article 6 (1) (e) or (f) of the GDPR, including profiling based on these provisions. 

The data controller will no longer process the personal data concerning you unless he or she can demonstrate compelling legitimate reasons for processing such which outweigh your interests, rights and freedoms, or unless the processing is for the purpose of asserting, exercising or defending legal claims.

Whenever personal data relating to you are processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data relating to you for the purpose of such marketing, including profiling, insofar as this processing involves such direct marketing.

If you object to processing for the purposes of direct marketing, the personal data concerning you will no longer be processed for such purposes.

You have the possibility to exercise your right of objection in relation to the use of information society services, without prejudice to Directive 2002/58/EC, by means of automated procedures using technical specifications.

9.8 Right of revocation of the declaration of consent under data protection law

You have the right to revoke your data protection declaration of consent at any time. Revocation of your consent does not affect the legality of the processing that has taken place on the basis of your consent up until revocation.

9.9 Automated decision in individual cases including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects on you or significantly affects you in a similar way. This shall not apply if the decision 

1. is necessary for the conclusion or fulfilment of a contractual agreement between you and the data controller
2. is authorised by Union or national legal provisions to which the data controller is subject and such legal provisions provide for appropriate measures to safeguard your rights and freedoms and your legitimate interests; or
   • is made with your express consent.

However, these decisions may not be based on special categories of personal data in accordance with Art. 9 (1) of the GDPR, unless Art. 9 (2) (a) or (g) applies and appropriate measures have been taken to protect rights and freedoms and your legitimate interests.

With regard to the cases referred to in (a) and (c), the data controller will take appropriate measures to safeguard the rights and freedoms and your legitimate interests, which shall include at least the right to obtain the intervention of a person from the domain of the data controller, to express your point of view and to contest the decision.

9.10 Right of appeal to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State in which you are resident, your place of employment or the place where the alleged infringement occurred, if you believe that the processing of personal data relating to you is in breach of the GDPR. 

The supervisory authority to which the complaint has been lodged will inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Art. 78 of the GDPR.

10. Transfer of data to third parties

We will not pass on your personal data to external third parties without your consent. However, under § 4a of the German Data Privacy Act (BDSG), you agree that we may pass on your personal data to service providers (who may also be located abroad) who process or manage these data on our behalf and for our purposes. 

11. Legal basis of the processing

If we obtain the consent of the data subject for the processing of personal data, Art. 6 (1) (a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis for such.

In the processing of personal data which are necessary for the performance of a contractual agreement to which the data subject is a party, Art. 6 (1) (b) of the GDPR serves as the legal basis. This also applies to processing operations necessary for the performance of pre-contractual measures.

If the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 (1) (c) of the GDPR serves as the legal basis.

In the event that vital interests of the data subject or another natural person make it necessary to process personal data, Art. 6 (1) (d) of the GDPR serves as the legal basis.

If the processing is necessary to safeguard a legitimate interest of our company or of a third party and if the interests, fundamental rights or freedoms of the data subject do not outweigh the former interest, Art. 6 (1) (f) of the GDPR serves as the legal basis for the processing. The legitimate interest of our company is the conduct of our business.

12. Duration of storage of personal data

Personal data are stored for the duration of the respective legal period of retention. After expiry of the period, the data are routinely deleted, unless such data are necessary for the initiation or fulfilment of a contractual agreement.