Data Security

Preambel

With the following privacy policy, we would like to inform you about which types of your personal data (hereinafter also referred to simply as "data") we process, for what purposes, and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and especially on our websites, in mobile applications, as well as within external online presences, such as our social media profiles (hereinafter collectively referred to as "online offering"). The terms used are not gender-specific.

Effective date: January 1, 2025

Responsible

Wolf Digital Services GbR
Susann and Thomas Wolf
Schiebestr. 29
04129 Leipzig, Germany
Authorized representatives: Susann Wolf, Thomas Wolf
E-mail adress: susi@atopimo.com

General information on data processing

Scope of Processing Personal Data

We generally process personal data only to the extent necessary to provide a functional website as well as our content and services. The processing of our users' personal data is regularly carried out only with the user’s consent. An exception applies in cases where data processing is permitted by legal regulations.

Legal basis for the processing of personal data

As far as we obtain the consent of the data subject for the processing of personal data, Article 6 (1) (a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data. When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Article 6 (1) (b) GDPR serves as the legal basis. This also applies to processing operations required for carrying out pre-contractual measures. Insofar as processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Article 6 (1) (c) GDPR serves as the legal basis. If processing is necessary to protect a legitimate interest of our company or a third party, and if the interests, fundamental rights, and freedoms of the data subject do not override the former interest, Article 6 (1) (f) GDPR serves as the legal basis for processing.

Deletion of Data and Storage Period

The user’s personal data will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may also occur if this has been provided for by European or national legislators in EU regulations, laws, or other legal provisions to which the controller is subject. Data will also be blocked or deleted when a storage period prescribed by the aforementioned regulations expires, unless further storage of the data is required for the conclusion or fulfillment of a contract.

Provision of the Website and Log File Creation

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected: • Browser type and version • Operating system used • Website from which you visit us (referrer URL) • Website you are currently visiting • Date and time of each access • Your IP address The data is also stored in the log files of our system. This data is not stored together with other personal data of the user. The legal basis for the temporary storage of the data and log files is Article 6 (1) (f) GDPR. Temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's device. For this purpose, the user's IP address must remain stored for the duration of the session. Storage in log files is done to ensure the functionality of the website. The data also helps us optimize the website and ensure the security of our IT systems. The data is not evaluated for marketing purposes in this context. These purposes also constitute our legitimate interest in data processing pursuant to Article 6 (1) (f) GDPR. Personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of data collection for the provision of the website, this is the case when the respective session ends. In the case of storage in log files, this is the case after no more than three months. The collection of data for the provision of the website and the storage of data in log files is essential for the operation of the website. Therefore, the user has no option to object.

Data Processing When Contacting Us via Email

It is possible to contact us via the provided email address. In this case, the personal data transmitted with the email will be stored. No data is passed on to third parties in this context. The data is used exclusively for processing the conversation. The legal basis for processing the data is Article 6 (1) (a) GDPR if the user has given consent. The legal basis for processing data transmitted in the course of sending an email is Article 6 (1) (f) GDPR. If the email contact aims to conclude a contract, the additional legal basis for processing is Article 6 (1) (b) GDPR. In the case of contact via email, this also constitutes the necessary legitimate interest in processing the data. The personal data will be deleted as soon as it is no longer required to achieve the purpose of its collection. For personal data sent by email, this is the case when the respective conversation with the user has ended. The conversation is deemed ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified. The user has the option to withdraw their consent to the processing of personal data at any time. If the user contacts us via email, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued. The user only needs to inform us of their objection to consent. All personal data stored during the course of contact will be deleted in this case.

Use of Cookies

Our website uses cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the user's computer system. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string that allows for the unique identification of the browser when the website is accessed again. We use cookies to make our website more user-friendly. Some elements of our website require that the calling browser can be identified even after a page change. The following data is stored and transmitted in the cookies: • Session ID • Duration The legal basis for processing personal data using cookies is Article 6 (1) (f) GDPR. The purpose of using cookies is to simplify website use for users. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognized even after a page change. We need cookies for the following applications: • Identification of the user session on the server and operation of the user's personal account. The user data collected through cookies is not used to create user profiles. These purposes also constitute our legitimate interest in processing personal data pursuant to Article 6 (1) (f) GDPR. Cookies are stored on the user's computer and transmitted to our site. Therefore, as a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Already stored cookies can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website in full.

Use of Google Analytics

We use the Google Analytics component on our website. Google Analytics is a web analysis service operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Web analysis involves the collection, gathering, and evaluation of data on the behavior of users on our website. A web analysis service collects, among other things, data on the website from which a user has accessed a website, which subpages are accessed, and how often and for how long a subpage is viewed. We use the "_gat._anonymizeIp" extension for Google Analytics. This extension shortens and anonymizes the IP address of the user by Google if access is from a member state of the European Union or another contracting state of the Agreement on the European Economic Area. By shortening the IP address, it is no longer possible to assign it to a specific person. Google Analytics places a cookie on the user’s computer. By placing the cookie, Google is enabled to analyze the use of our website. Each time a subpage of this website is called up, the browser is automatically prompted to transmit data to Google for the purpose of online analysis. As part of this process, Google gains knowledge of user data such as the shortened IP address, which helps Google determine the origin of the visitors. Through the cookie, personal data such as access time, location, and frequency of visits are stored. Each time our website is visited, this data, including the IP address, is transmitted to and stored by Google in the USA. Google may share this data with third parties. The legal basis for the data processing is Article 6 (1) (f) GDPR and § 15 (3) German Telemedia Act (TMG). The purpose of using Google Analytics is to analyze visitor traffic on our website. Google uses the collected data to evaluate the use of our website, compile reports on website activities, and provide other services related to website and internet usage. This enables us to further optimize our website for users. These purposes also constitute our legitimate interest in data processing under Article 6 (1) (f) GDPR. Data stored by Google Analytics is automatically deleted by us after 26 months. Users can prevent the storage of cookies via browser settings and thereby permanently object to cookie storage. In addition, a cookie already set by Google Analytics can be deleted at any time via the browser or other software programs. Furthermore, users can object to data collection by Google Analytics and prevent it by installing a browser add-on available at: https://tools.google.com/dlpage/gaoptout. After installation, this browser add-on informs Google Analytics that no data on website visits may be transmitted to Google. The installation of the browser add-on is considered an objection. If the user's system is deleted, formatted, or reinstalled, the browser add-on must be reinstalled to disable Google Analytics again. Further information and Google’s current privacy policy can be found at https://www.google.de/intl/de/policies/privacy/ and http://www.google.com/analytics/terms/de.html. More detailed information about Google Analytics is available at https://www.google.com/intl/de_de/analytics/. Google is certified under the EU-US Privacy Shield.

Use of Google Tag Manager

This website uses the Google Tag Manager by Google. This service allows website tags to be managed through an interface. The Google Tag Manager only implements tags, meaning no cookies are used, and no personal data is collected. The Google Tag Manager triggers other tags, which may collect data. However, the Google Tag Manager does not access this data. If a deactivation has been made at the domain or cookie level, it remains in place for all tracking tags implemented with the Google Tag Manager.

Data Processing in the Social Web (Instagram, Facebook)

1. Meta Social Plugins

We use social plugins ("Plugins") of the social networks facebook.com and instagram.com, operated by Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"), based on our legitimate interests (interest in the analysis, optimization, and economic operation of our online offerings within the meaning of Art. 6 para. 1 lit. f. GDPR). The plugins can display interaction elements or content (e.g., videos, graphics, or text posts) and are marked with one of the platform logos. The list and appearance of the Meta Social Plugins can be viewed here: https://developers.facebook.com/docs/plugins/. Meta has submitted to the EU-US Privacy Shield. When a user accesses a function of this online offering that contains such a plugin, their device establishes a direct connection with Meta's servers. The content of the plugin is transmitted directly from Meta to the user's device and integrated into the online offering. In the process, user profiles may be created based on the processed data. We have no influence on the scope of the data Meta collects through this plugin and thus inform users according to our knowledge. By integrating the plugins, Meta receives the information that a user has accessed the corresponding page of the online offering. If the user is logged in to a Meta platform, Meta can assign the visit to their Meta account. If users interact with the plugins, for example, by pressing the like button or posting a comment, the relevant information is transmitted directly from their device to Meta and stored there. Even if a user is not a member of Meta platforms, it is still possible that Meta learns and stores their IP address. According to Meta, only an anonymized IP address is stored in Germany. The purpose and scope of data collection, as well as further processing and use of the data by Meta, and the associated rights and settings for user privacy protection, can be found in Meta's privacy policy: https://www.facebook.com/about/privacy/. If a user is a Meta platform member and does not want Meta to collect data about them via this online offering and link it with their stored membership data at Meta, they must log out of Meta before using our online offering and delete their cookies. Further settings and objections to the use of data for advertising purposes are possible within the Facebook profile settings: https://www.facebook.com/settings?tab=ads or via the US page http://www.aboutads.info/choices/ or the EU page http://www.youronlinechoices.com/. The settings are platform-independent, meaning they apply to all devices such as desktops or mobile devices.

2. Meta Pixel

Within our online offering, the so-called "Meta Pixel" of the social networks Facebook and Instagram is used based on our legitimate interests in analysis, optimization, and economic operation of our online offering and for these purposes. Meta has submitted to the EU-US Privacy Shield. With the help of the Meta Pixel, Meta can determine the visitors of our online offering as a target group for the display of advertisements (so-called "Facebook/Instagram Ads"). Accordingly, we use Meta Pixel to only display the Facebook/Instagram Ads we have placed to Meta users who have shown interest in our online offering or who have certain characteristics (e.g., interests in specific topics or products determined by the websites visited) that we transmit to Meta (so-called "Custom Audiences"). With the help of Meta Pixel, we also want to ensure that our Facebook/Instagram Ads correspond to the potential interests of users and are not perceived as annoying. With the help of Meta Pixel, we can further track the effectiveness of the advertisements for statistical and market research purposes, by seeing if users were redirected to our website after clicking on an advertisement (so-called "Conversion"). The processing of data by Meta is carried out within the framework of Meta's data usage policy. Accordingly, general information about Meta Ads is available in Meta's data usage policy: https://www.facebook.com/policy.php. Special information and details about the Meta Pixel and its functionality can be found in Facebook's help section: https://www.facebook.com/business/help/651294705016616. You can object to the collection by Meta Pixel and the use of your data for displaying Facebook/Instagram Ads. To set which types of advertisements you want to see within Facebook/Instagram, you can visit the page set up by Meta and follow the instructions for setting usage-based ads: https://www.facebook.com/settings?tab=ads. The settings are platform-independent, meaning they are applied to all devices, such as desktop computers or mobile devices. You can also object to the use of cookies for reach measurement and advertising purposes via the Network Advertising Initiative opt-out page (http://optout.networkadvertising.org/) and additionally the US website (http://www.aboutads.info/choices) or the European website (http://www.youronlinechoices.com/uk/your-ad-choices/).

Data Processing in Countries Outside the European Economic Area

If we process data in third countries (countries outside the EU/EEA) or transfer it to companies in third countries, we do so only if we are authorized by you or by law. If there is no adequacy decision by the Commission pursuant to Art. 45 GDPR for the affected third country, meaning no adequate level of data protection exists in that country, we ensure, through contractual arrangements (EU standard contractual clauses for data protection) or other appropriate guarantees within the meaning of Art. 46 GDPR, that your privacy and personal data are protected in an appropriate and legally required manner even within the company in the third country.

Data Processing When Using Atopi.Mo

1. Data Processing Upon Registration of a User Profile

To use Atopi.Mo, creating a user profile is mandatory. Multiple user profiles can be created. To create a user profile, the following information is required in the settings section: name, gender (male, female, diverse), year and month of birth, and information about whether the user is the person themselves or someone else, such as a child. Any name or nickname can be used, although if a report is to be generated later, it is recommended to use the real name. This data is necessary to provide health assessments, for example, fever thresholds vary based on the person’s age. For babies, different general guidelines apply than for adults. Additionally, this data will be used as header information in the event a report is generated. Each user profile receives a randomly generated user ID (UUID). This user ID, gender, and year of birth are retrieved and processed for internal analysis to improve the user experience of Atopi.Mo. Deleting a user profile is possible at any time in the settings area by using the trash icon below the name and is solely the responsibility of the user. When the user profile is deleted, all diary data is irretrievably lost. The restoration of user data after successful deletion is not possible.

2. Data Processing When Using the Asthma Diary

Entering Data into the Asthma Diary

To use the asthma diary of Atopi.Mo, the following data can be entered: name (selection of the previously created user profile), date, time, and peak flow. For symptom tracking, the severity of the following symptoms can be recorded as "none," "slight," "moderate," or "severe": coughing, shortness of breath, wheezing, and complaints during exertion. Additionally, it can be recorded whether symptoms occurred at night. If this field is activated, a query appears asking whether Salbutamol was administered, and if so, how often (1x, 2-5x, >6x). "Other symptoms" can also be recorded. If this field is activated, a query appears for the name and severity of the symptoms. Multiple symptoms can be added (Plus symbol) or removed after entry (Minus symbol). Furthermore, the influence of environmental factors on health can be tracked: pollen, infections, and vacation. Additionally, the query appears whether a doctor was consulted and, if so, whether it was a pediatrician, emergency room visit, or a hospital stay. The medication for the day can also be entered: Salbutamol, corticosteroids, antibiotics, and other medications. When Salbutamol is selected, the query appears asking how often (1x, 2-5x, >6x) it was administered. For "other medications," two free text fields appear where the name and dosage of the additional medication can be entered. Multiple medications can be added (Plus symbol) or removed after entry (Minus symbol). Except for the date and time, none of the fields are mandatory. To fully utilize Atopi.Mo, it is recommended to enter the aforementioned data daily. If data entry in the "Asthma" input mask is incorrect, it can be edited, saved, or deleted at any time in the calendar section for the respective day.

Use of Data from the Asthma Diary

The data entered into the asthma diary appears in the navigation sections Calendar, Progress, and Report in different representations. In the calendar overview, the data is saved for each day to allow later editing. The progress overview displays a graphical overview of the entered peak flow values, allowing users to visually track the development. The system automatically detects if a new maximum peak flow value has been entered and asks the user if the new best value should be saved in the "Max PF" input mask. To create the progress curve, a user and a time period must first be selected for which the progress should be displayed. The graphs showing the development of relative and absolute peak flow values are then automatically generated. Two colored lines clearly indicate how the asthma is classified (>80% stable/green level, 60-80% in need of treatment/yellow level, <60% in need of immediate medical attention/red level), and the personal asthma action plan can be applied. Both generated graphs can be saved locally on the device outside of Atopi.Mo by clicking "Save Diagram." The output is in JPG format. In the report section, a comprehensive PDF report can be generated to be presented during a doctor's visit. The report contains all data entered in the "Asthma" input mask for the respective selected time period and user.

Deletion of Data in the Asthma Diary

Deletion of all data entered via the "Asthma" input mask is possible at any time and is solely the responsibility of the app user. Deleting an individual data record is permanent and irreversible. The data will no longer be usable in the calendar, progress, and report functions. Data restoration from the asthma diary after successful deletion is not possible.

Entering Data into the Calendar Function

If a record exists for the respective day in the asthma diary, all the entered data from the asthma diary can be viewed, edited, or deleted here.

Use of Data in the Calendar Function

New or edited data entered in the calendar function overwrites the original entry in the asthma diary. This may result in new progress and report data. The original data will be overwritten.

Deletion of Data in the Calendar Function

After selecting the respective day, individual or all entered data for the day can be manually deleted by the user at any time by clicking on the respective field or disabling the toggle. The deleted data cannot be restored after successful deletion.

Creation and Export of a Progress Curve

To generate a progress curve, data for the respective selected time must be entered in the asthma diary. Without this data, the creation of the progress curve is not possible. The curve is created temporarily during runtime. After creating the progress curve, the user has the option to save the diagrams for the relative or absolute peak flow locally on their device. The data is stored unencrypted in the device's "Pictures" folder as a JPG file for further use by the user. The saved image contains the user profile name, the selected time period of the progress curve, and the curve itself. Without exporting the curve, no diagram will be permanently saved on the device.

Deletion of the Progress Curve

The progress curve itself is an automatically generated part of Atopi.Mo and cannot be deleted by the user. However, deleting the entries in the asthma diary will also remove the entries in the progress curve. After saving the progress curve outside of Atopi.Mo, the user alone is responsible for the file.

Creation and Export of the Report

To generate a report, data for the respective selected time must be entered in the asthma diary. Without this data, a blank report is generated. After creating the report, the user has the option to save an automatically generated PDF containing all the entered data from the asthma diary locally on their device. The data is stored unencrypted in the device's "Documents" folder as a PDF file for further use by the user. The saved file contains all the information from the user profile, the selected report time period, and all the data from the asthma diary.

Deletion of the Report

The report itself is an automatically generated part of Atopi.Mo and cannot be deleted. However, deleting the entries in the asthma diary will also remove the entries in the report. After saving the report outside of Atopi.Mo, the user alone is responsible for the file.

Entering the Maximum Peak Flow

For the calculation of the progress curve, the currently valid maximum peak flow value for the user can be manually entered in the "Max PF" section. First, the respective user profile must be selected, after which the maximum value and a "valid from" date can be entered. If a daily peak flow value is entered that exceeds the previous maximum, this can be defined as the new maximum with the user's consent. A history of the maximum peak flow values can be viewed under the "Max PF" tab.

Use of Maximum Peak Flow Data

For automatic calculations of the progress curve and report to be performed, a maximum peak flow must be entered. This can either be manually entered or automatically saved by entering data in the "Asthma" input mask. Without specifying the maximum peak flow, the calculations cannot be performed, and no stage recommendations for the use of the asthma action plan can be made. However, documentation of symptoms and absolute peak flow values is still possible.

Deletion of Maximum Peak Flow Data

Deleting the maximum peak flow entries is always possible and solely the responsibility of the app user, as the data is stored only locally on the respective device. The deletion of the best values and the validity date can be done by selecting the respective user profile with the designated button (trash icon). Deleting this data will restrict the use of the progress and report functions. Restoration of maximum peak flow data after successful deletion is possible in the sense that manual entries can always be made, including retroactively. Restoration by the app provider is not possible.

3. Data Processing in the Fever Diary

Entering Data into the Fever Diary

To use the Atopi.Mo fever diary, the following data can be entered: Name (select the pre-existing user profile), date, time, and temperature. Additionally, the location where the body temperature was measured (measurement site) can be recorded: ear, armpit, and rectal. If the fields for Ibuprofen or Paracetamol are activated, a prompt will appear asking for the dose administered. In the "other medications" section, two text fields appear where the name and dosage of additional medication can be entered. As many medications as needed can be added (Plus symbol) or removed after entry (Minus symbol). Except for the date and time, none of the mentioned fields are mandatory. However, to use Atopi.Mo to its full extent, it is recommended to provide the above data daily. In case of incorrect entry in the "Fever" input mask, the data can be edited, saved, or deleted at any time in the "Calendar" section for the respective day.

Use of Data from the Fever Diary

The data entered in the fever diary will appear in the navigation points Calendar, History, and Report in different formats. In the calendar overview, the data is saved by day to allow later editing. In the history overview, the user will be presented with a graphical overview of the entered fever values to visually track the development. To generate the fever curve, a user and a time period must first be selected for which the history will be shown. The graphics showing the development of fever values are then automatically generated. Three colored lines will quickly show the user how the fever should be classified (38°C yellow level, 39°C yellow level, 40°C red level). The generated graphic can be saved locally on the device, outside of Atopi.Mo, by clicking "Save Chart." The output is in JPG format. In the report section, a comprehensive PDF report can be created to present during a doctor’s visit. The report includes all data entered in the "Fever" input mask for the selected user and time period.

Deletion of Data in the Fever Diary

The deletion of all data entered through the "Fever" input mask is always possible and is solely the responsibility of the app user. Deleting an individual data record is permanent and irreversible. The data will no longer be usable in the Calendar, History, and Report functions. Data recovery after successful deletion is not possible.

Entry in the Calendar Function

If there is an entry in the fever diary for the respective day, all entered data from the fever diary can be viewed, edited, or deleted here.

Use of Data in the Calendar Function

Data newly entered or edited in the calendar function will overwrite the original entry in the fever diary. This may result in new history and report data. The original data will be overwritten.

Deletion of Data in the Calendar Function

After selecting the respective day, individual or all entered data for the day can be manually deleted by clicking the respective field or deactivating the toggle. The deleted data cannot be restored after successful deletion.

Creation and Export of a Fever Curve

To generate a fever curve, data must be entered in the fever diary for the selected time. Without this data, it is not possible to create the fever curve. The curve is created temporarily for the selected duration. After the fever curve is created, the user has the option to save the charts of the fever progression locally on their device. The data is saved unencrypted in the device’s image folder as a JPG file for further use by the user. The saved image contains the user profile name, the selected time period for the curve, and the fever curve itself. Without exporting the curve, no diagram will be permanently stored on the device.

Deletion of the Fever Curve

The fever curve function itself is an automatically generated part of Atopi.Mo and cannot be deleted directly. However, by deleting entries in the fever diary, the corresponding entries in the fever curve will also disappear. After the fever curve is saved outside of Atopi.Mo, the responsibility for the file rests solely with the user.

Creation and Export of the Report

To generate a report, data must be entered in the fever diary for the respective time. Without this data, an empty report will be created. After creating the report, the user can save the automatically generated PDF, containing all the entered data from the fever diary, locally on their device. The data is saved unencrypted in the device’s documents folder as a PDF file for further use by the user. The saved file contains all details from the user profile, the selected period for the reports, and all data from the fever diary. The PDF export is particularly useful for preparing for doctor’s visits and is an important user benefit of Atopi.Mo.

Deletion of the Report

The report itself is an automatically generated part of Atopi.Mo and cannot be deleted directly. However, by deleting entries in the fever diary, the entries in the report will also disappear. After the report is saved outside of Atopi.Mo, the responsibility for the file rests solely with the user.

Rights of the Data Subject

If personal data is processed by you, you are the data subject under the GDPR, and you have the following rights against the data controller:

1. Right of Access

You can request confirmation from the data controller whether personal data concerning you is being processed. If such processing is taking place, you may request the following information from the data controller: (1) the purposes for which the personal data is being processed; (2) the categories of personal data being processed; (3) the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed; (4) the planned duration of storage of your personal data, or if specific details on this are not possible, the criteria used to determine the storage period; (5) the existence of the right to rectification or erasure of your personal data, the right to restriction of processing by the data controller, or the right to object to such processing; (6) the existence of the right to lodge a complaint with a supervisory authority; (7) all available information about the source of the data if the personal data was not collected from the data subject; (8) the existence of automated decision-making, including profiling, under Article 22(1) and (4) of the GDPR, and – at least in these cases – meaningful information about the logic involved, as well as the significance and the consequences of such processing for the data subject. You have the right to ask whether your personal data is being transferred to a third country or an international organization. In this context, you can request information about the appropriate safeguards under Article 46 of the GDPR in relation to the transfer.

2. Right to Rectification

You have the right to request rectification and/or completion of personal data concerning you if the processed data is incorrect or incomplete. The data controller must make the correction without delay.

3. Right to Restriction of Processing

You may request the restriction of processing of personal data concerning you under the following conditions: (1) if you contest the accuracy of the personal data concerning you for a period that enables the data controller to verify the accuracy of the personal data; (2) the processing is unlawful, and you object to the erasure of the personal data and instead request the restriction of its use; (3) the data controller no longer needs the personal data for processing purposes, but you require the data for the establishment, exercise, or defense of legal claims; or (4) if you have objected to processing under Article 21(1) of the GDPR, and it is not yet clear whether the legitimate grounds of the data controller override your interests. If the processing of personal data concerning you has been restricted, such data – apart from its storage – may only be processed with your consent, or for the establishment, exercise, or defense of legal claims, or to protect the rights of another natural or legal person, or for reasons of substantial public interest of the Union or of a member state. If the restriction of processing has been imposed as per the above conditions, the data controller will notify you before the restriction is lifted.

4. Right to Erasure

a) Obligation to Erase

You may request the data controller to erase personal data concerning you without delay, and the data controller is obliged to erase this data without delay, if one of the following reasons applies: (1) the personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed; (2) you withdraw your consent on which the processing is based under Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing; (3) you object to the processing under Article 21(1) of the GDPR, and there are no overriding legitimate grounds for the processing, or you object to the processing under Article 21(2) of the GDPR; (4) the personal data concerning you has been unlawfully processed; (5) the erasure of personal data concerning you is necessary for compliance with a legal obligation under Union law or the law of a member state to which the data controller is subject; (6) the personal data concerning you was collected in relation to the offering of information society services under Article 8(1) of the GDPR.

b) Information to Third Parties

If the data controller has made personal data concerning you public and is obliged to erase it under Article 17(1) of the GDPR, the data controller, considering the available technology and the cost of implementation, will take reasonable steps, including technical measures, to inform data controllers who process the personal data, that you, as the data subject, have requested the deletion of all links to or copies or replications of that personal data.

c) Exceptions

The right to erasure does not apply if processing is necessary (1) for the exercise of the right to freedom of expression and information; (2) for compliance with a legal obligation that requires processing under Union or Member State law to which the data controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller; (3) for reasons of public interest in the area of public health under Article 9(2)(h) and (i) and Article 9(3) of the GDPR; (4) for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes under Article 89(1) of the GDPR, insofar as the right under paragraph a) is likely to make it impossible or seriously impair the achievement of the objectives of that processing; or (5) for the establishment, exercise, or defense of legal claims.

5. Right to Notification

If you have asserted your right to rectification, erasure, or restriction of processing to the data controller, the controller is obliged to inform all recipients to whom your personal data has been disclosed about the rectification, erasure, or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right to be informed by the data controller about these recipients.

6. Right to Data Portability

You have the right to receive the personal data concerning you that you have provided to the data controller, in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that (1) the processing is based on consent under Article 6(1)(a) or Article 9(2)(a) of the GDPR, or on a contract under Article 6(1)(b) of the GDPR, and (2) the processing is carried out by automated means. In exercising this right, you also have the right to request that the personal data concerning you be transmitted directly from one controller to another, where technically feasible. The rights and freedoms of other persons must not be adversely affected. The right to data portability does not apply to processing of personal data which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to Object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you, which is based on Article 6(1)(e) or (f) of the GDPR, including profiling based on those provisions. The data controller shall no longer process the personal data unless they demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims. If your personal data is being processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing, including profiling to the extent that it is related to such direct marketing. If you object to the processing for direct marketing purposes, your personal data will no longer be processed for such purposes. You also have the option to exercise your right to object in connection with the use of information society services – notwithstanding Directive 2002/58/EC – through automated means using technical specifications.

8. Right to Withdraw Consent to Data Processing

You have the right to withdraw your data protection consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before the withdrawal.

9. Automated Decision-Making in Individual Cases, Including Profiling

You have the right not to be subjected to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision (1) is necessary for the conclusion or performance of a contract between you and the controller, (2) is based on Union or Member State laws to which the controller is subject and those laws provide for suitable measures to safeguard your rights and freedoms as well as your legitimate interests, or (3) is based on your explicit consent. However, such decisions may not be based on special categories of personal data under Article 9(1) of the GDPR, unless Article 9(2)(a) or (g) applies and suitable measures to protect the rights and freedoms as well as your legitimate interests are in place. For cases under (1) and (3), the data controller will implement appropriate measures to protect your rights and freedoms, including at least the right to obtain human intervention on the part of the controller, to express your point of view, and to contest the decision.

10. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work, or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR. The supervisory authority to which the complaint has been submitted shall inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR.