Under Chapter III (Articles 15–22) of the GDPR, you have comprehensive rights regarding your personal data.
You have the right to:
Right of Access (Art. 15 GDPR): You have the right to request access to your personal data and obtain a copy of the information we hold about you to confirm that it is being lawfully processed.
Right to Rectification (Art. 16 GDPR): You may request the immediate correction of incomplete or inaccurate personal data we hold about you, though we may need to verify the accuracy of any new data provided.
Right to Erasure (Art. 17 GDPR): You have the right to request the deletion or removal of your personal data where there is no valid legal reason or overriding legitimate ground for us to continue processing it, such as following a successful objection or where deletion is mandated by law. Note that statutory retention duties under German commercial and tax law (§ 147 AO, § 257 HGB) may restrict immediate erasure where applicable.
Right to Object (Art. 21 GDPR): You may object at any time to the processing of your personal data where we rely on legitimate interests under Art. 6(1)(f) GDPR, including profiling. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests. You also possess an absolute right to object to direct marketing communications at any time.
Right to Data Portability (Art. 20 GDPR): You may request the transfer of your personal data to you or a third party in a structured, commonly used, machine-readable format, applicable to automated data processed based on consent or contract performance.
Right to Withdraw Consent (Art. 7(3) GDPR): Where processing relies on your consent under Art. 6(1)(a) GDPR, you may withdraw it at any time. This will not affect the lawfulness of any processing conducted prior to your withdrawal. If you withdraw consent, we may not be able to provide certain services to you.
Right to Restriction of Processing (Art. 18 GDPR): You have the right to ask us to suspend processing your personal data if you contest its accuracy, if our use is unlawful but you oppose deletion, if you need us to hold it for legal claims, or pending verification of overriding legitimate grounds after an objection.
No Fee Required: You will not have to pay a fee to access your personal data or exercise any rights. Under Art. 12(5) GDPR, we may charge a reasonable administrative fee or refuse to comply if your request is manifestly unfounded, repetitive, or excessive.
Identity Verification: Pursuant to Art. 12(6) GDPR, we may request specific information to confirm your identity before executing your request as a security measure to prevent unauthorized disclosure.
Response Timeframe: Under Art. 12(3) GDPR, we respond to all legitimate requests within one month. This period may be extended by up to two additional months for complex or numerous requests, and we will notify you within the initial month if an extension is necessary.
Request restriction of processing of your personal data under Art. 18 GDPR. This enables you to ask us to suspend the processing of your personal data in one of the following scenarios:
- If you want us to establish the data's accuracy;
- Where our use of the data is unlawful but you do not want us to erase it;
- Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
- You have objected to our use of your data under Art. 21(1) GDPR but we need to verify whether we have overriding legitimate grounds to use it.
If you wish to exercise any of the rights set out above, please contact us.
No fee usually required
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, under Art. 12(5) GDPR, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights) pursuant to Art. 12(6) GDPR. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
Time limit to respond
We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
