Privacy policy

The data controller within the meaning of the General Data Protection Regulation and other national data protection laws of the EU member states as well as other data protection provisions is the:

Kooperationsstelle EU der Wissenschaftsorganisationen (KoWi)
Genscherallee 2
D – 53113 Bonn

Tel.: +49-228-95997-0
E-Mail: Bonn(at)kowi.de
Website: www.kowi.de

You can contact the data protection officer at:

Kooperationsstelle EU der Wissenschaftsorganisationen

Dominik Maas

Genscherallee 2
D – 53113 Bonn

Tel.: +49-228-95997-13
E-Mail: dsb(at)kowi.de

a) Scope

As a matter of principle, we process your personal data only insofar as this is necessary for the provision of a functioning website as well as our content and services.

We process your personal data only on the basis of your consent. An exception applies in those cases where obtaining prior consent is not possible for objective reasons and the processing of your personal data is permitted by legal regulations.

b) Legal basis

Where we obtain your consent for the processing of personal data, Art. 6 (1) (a) of the General Data Protection Regulation (GDPR) serves as the legal basis.

When processing personal data that are required to fulfil a contract with you, Art. 6 (1) (b) GDPR serves as the legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual measures.

Insofar as the processing of personal data is necessary for the fulfilment of a legal obligation to which we are subject, Art. 6 (1) (c) GDPR serves as the legal basis.

In the event that your vital interests or those of another natural person make it necessary to process personal data, Art. 6 (1) (d) GDPR serves as the legal basis.

If the processing of your personal data is necessary to protect our legitimate interests or those of a third party, and your interests, fundamental rights and freedoms do not outweigh the aforesaid interests, Art. 6 (1) (f) GDPR serves as the legal basis.

c) Storage period

Your personal data will be deleted as soon as the purpose for their storage no longer applies. Storage may moreover take place if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which we are subject. In this case, your personal data will be blocked. Data will also be blocked or deleted when a storage period prescribed by the aforementioned standards expires, unless there is a need to continue to store the data for the conclusion or performance of a contract.

 

a) Provision and creation of log files

Each instance of access to the KoWi website is stored in a log file for a limited time with the following data:

• Date and time of the visit
• Request details and destination address
• Name of the retrieved file and amount of data transferred
• Notification as to whether the retrieval was successful

Data on the use of the website are stored for analytical purposes, which in turn serve the purpose of optimising the website. KoWi evaluates visitor data solely for statistical purposes. The usage data are stored exclusively in anonymised form. No IP addresses of the user or other data are stored which could enable the data to be assigned to a user.

This website uses the etracker web analytics service. There is a data processing contract between etracker GmbH, Hamburg, Germany, and KoWi. The etracker data protection signet indicates extended data protection compliance.

The data generated with etracker are processed and stored by etracker on behalf of the provider of this website exclusively in Germany and are therefore subject to strict German and European data protection laws and standards. etracker has been independently audited, certified and awarded the ePrivacyseal data protection seal of approval in this regard. You can find further information on data protection at etracker here.

Purpose: This data storage is necessary to enable the website to be delivered to your computer.

The legal basis for the processing is Art. 6 (1) (f) GDPR (legitimate interest).

Objection: The collection of data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the website. Objection is therefore not possible.

b) Technically necessary cookies

Cookies are used when you register for certain services (e.g. newsletter). These are not permanent cookies, which are stored as a text file on the hard drive of your computer.

Instead, a session cookie with a randomly generated session ID is written into the main memory of your computer. As soon as you close the browser window or call up another page, the session is deemed to have ended; the session cookie is then deleted.

Session cookies are used in our registration procedures only if the registration form comprises more than one page and the data already entered must be temporarily stored.
Permanent cookies are small text files, which are stored by the Internet browser on the user's terminal device.

By using the cookie of the Usercentrics Consent Management Platform (Usercentrics GmbH, Munich), your privacy settings as set in the consent banner can be saved beyond the current browser session.
Etracker also uses cookies for the statistical analysis of the use of this website. Etracker cookies do not contain any information that would enable the identification of a user.

Purpose: Without the use of cookies, these functions cannot be offered on our website.

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest).

Objection: By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. If cookies are deactivated for our website, it may no longer be possible to use all its functions to their full extent.

c) YouTube

For the integration of videos, our site uses the provider YouTube. YouTube is operated by YouTube LLC with its main headquarters at 901 Cherry Avenue, San Bruno, CA 94066, USA. YouTube is represented by Google Inc. with headquarters at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

YouTube videos are integrated in extended data protection mode. No information about visitors to the website is stored by YouTube unless they watch the video. When you click on the video, your IP address will be transmitted to YouTube. If you are logged in to YouTube, this information will also be assigned to your user account. If you do not wish this to happen, log out of YouTube before watching the video.

Further information on data processing and notes on privacy at YouTube (Google) can be found at https://policies.google.com/privacy?hl=en.

Purpose: Uniform display of video content independent of your end device

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest)

Storage period: We will process your personal data only until the end of your visit to our website.

Objection: The processing of your personal data in the context of the integration of YouTube videos is required as soon as you click on the video. Objection is therefore not possible.

d) Twitter

Twitter components are integrated into our website. Twitter is a multilingual, publicly accessible microblogging service on which tweets, i.e. short messages, can be published and distributed. These short messages can be accessed by anyone, including people who are not registered with Twitter. However, the tweets are also displayed to the followers of the user in question. Followers are other Twitter users who follow a user's Tweets. Furthermore, Twitter makes it possible to address a broad audience via hashtags, links or retweets.

The operating company of Twitter is Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA.

The following personal data are processed as a result of the use:

• Browser type
• Date and time of the Tweet
• Internet address under which the Tweet button is located
• IP address
• Information about the operating system

By calling up our homepage, you can give your consent via the consent banner to the internet browser of your device to activate the display of the Twitter plugin, and, as a result, data may be transmitted to Twitter. Twitter will then become aware of the page you are currently visiting.

If you are logged in to Twitter at the same time, Twitter will recognise the specific page you are visiting. This information is collected by the Twitter component and assigned by Twitter to the Twitter account of the person concerned. If you click on one of the Twitter buttons integrated on our website, the data and information transmitted will be assigned to your personal Twitter user account and stored and processed by Twitter. If you do not want this to happen, log out of Twitter in advance.

The applicable privacy policy of Twitter is available at https://twitter.com/en/privacy.

Purpose: The display of our content on Twitter and the ability to redistribute that content

Legal basis: Consent, Art. 6 (1) (a) GDPR

Storage period: We will process your personal data only until the end of your visit to our website.

Objection: When visiting our homepage, you have the option to object to the processing of your personal data the by the Twitter plug-in or to revoke your consent at any time. You can do this via the consent banner (fingerprint icon at the bottom left of the homepage) under Marketing: Deactivate the “Twitter plugin” and save the updated settings.

 

e) Podigee

We use the hosting service Podigee to play podcast content. Podigee is offered by Podigee GmbH, Schlesische Straße 20, 10997 Berlin ("Podigee"). For this purpose, we have embedded a so-called widget from Podigee on our website, which enables the playback of audio content ("Podigee Web Player"). KoWi has concluded a data processing agreement with Podigee.

When using the Podigee web player, Podigee sets various cookies in your browser. The cookies are used to process meta/communication data (e.g. domain of the calling website). Podigee anonymizes IP addresses. Personal data is not collected when accessing the KoWi website.

At Podigee, data processing takes place by default via servers in Germany.

If Podigee processes your personal data in third countries, Podigee relies on the so-called standard contractual clauses of the European Commission. If Podigee processes data in a third country (i.e. outside the European Union, the European Economic Area) or if the processing takes place in the context of the use of third-party services or by disclosure or transmission of data to other persons, bodies or companies, this will only be done in accordance with the legal requirements.

Further information on the handling of your data can be found in the Podigee Privacy Policy, available at https://www.podigee.com/de/ueber-uns/datenschutz.

Purpose: Playing podcast content

Legal basis: Consent, Art. 6 (1) (a) GDPR, Art. 6 (1) (f) GDPR (legitimate interest)

Storage period: We will process your personal data only until the end of your visit to our website.

Objection: By means of the Consens banner, you can revoke your consent with effect for the future. In this case, you will no longer be able to use the Podigee player's offer.

 

Further information and possibilities of objection can be found in Podigee's privacy policy: https://www.podigee.com/de/about/privacy/.

 

You can use various services on our website. The collection of personal data for these services is only carried out to the extent that is technically necessary and as far as required for the provision of the services within the meaning of the statutes of our supporting association.

a) KoWi newsletter

We use the cloud solution CleverReach to send our newsletter. With CleverReach GmbH & Co. KG, a company based in Germany, we have concluded a data processing agreement (DPA).

When you register for our free newsletter, personal data is stored in the cloud, on a server within the EU. This includes the following data:

• name
• email address
• title and form of address (optional)
• organisation / organisation type
• state 

Your email address is required to send the newsletter. As we reserve the right to verify eligibility in accordance with our terms of use, you must provide your name and organisation details. Your consent to our terms of use (voluntary) will be stored. In addition, registration and activation data are stored. The purpose of the procedure is to validate your registration and, if necessary, to clear up any possible misuse of your personal data.

We use the double opt-in/ opt-out procedure in order to register or unsubscribe to our newsletter. This means that, once you register/ unsubscribe, we will send an email to the address you provided in which we will ask you to confirm that you wish to receive/ not to receive the newsletter. If you do not confirm your registration, your data will automatically be deleted after a specified time. We will not pass on your data to third parties. Any other use of your data for other purposes is excluded.

Purpose: Information on current research and funding policy developments

Legal basis: Art. 6 (1) (a) GDPR (consent)

Storage period: After you unsubscribe, your email address will be deactivated and permanently deleted after one month.

Revocation: You can cancel your registration at any time via the unsubscribe link at the end of each newsletter. After verification of your e-mail address, all data will then be deleted immediately and completely.

b) Establishing contact (e.g. consultation service as well as trainings/ seminars)

When you contact us, we will process the personal data that you give us by e-mail or telephone. We may process the following personal data in the course of contacting you:

• First name
• Last name
• Organisation/ organisation type
• Location
• Subject of the request/ the training/ the seminar
• Contact details (email address or telephone number)
• Request date
• Application documents sent by you

You can also contact us via an online tool for booking consultation appointments on the KoWi website, created and operated by KoWi. If you wish, the consultation can also be held via a video conferencing system of your choice. Trainings and seminars can also be provided by KoWi via a video conferencing tool. With your consent, we also use Zoom. Zoom is a service of Zoom Video Communications, Inc., USA. When using Zoom, the following data is processed:

• Meeting metadata (topic, description (optional), attendee IP addresses, device/hardware information, start, end and duration of the meeting)
• Audio and video data - if you enable microphone and/or camera
• Optional: first name, last name (profile picture)

Purpose: Processing your requests, advice and support in the context of your application. Implementation of the respective training/ seminar.

Legal basis: The provision of consultation and support services in the application process is a KoWi mandate derived from the statutes of the Association for the Promotion of European and International Cooperation in Science e.V. (Art. 6 (1) lit. f GDPR (legitimate interest in fulfilling the purpose of the association)). Another legal basis is the individually (verbally) concluded consulting contract (Art. 6 (1) lit. b GDPR). Furthermore, in certain cases, data processing may also be based on a consent given to KoWi (Art. 6 (1) lit. a GDPR). In principle, consent is required for the use of Zoom.

When contacting KoWi in the context of its activities as National Contact Point ERC, we also refer to the Privacy Policy of the National Contact Point ERC. The NCP ERC is operated jointly by KoWi and the EU Office of the BMBF. Personal data are processed under joint controllership (Art. 26 GDPR).

Storage period: Your personal data will be deleted or blocked by us as soon as the purpose of storage and processing no longer applies, provided that there is no legal obligation to store them for longer or in case of a legitimate interest of KoWi, or consent to longer storage has been given. Concerning application documents, the purpose of storage usually ceases to apply with completion of the support and review process, i.e. with the start of the funding.

When using Zoom: If you are logged in with a Zoom account, reports on online meetings (meeting metadata, telephone data, Q&A, survey function) may also be stored by Zoom for a longer period of time.

Objection: You can object to the processing of your personal data in the context of establishing contact at any time with effect for the future. In this case, however, we may not be able to process your request further. All personal data stored in the course of establishing contact with us will be deleted or blocked in this case, unless legal retention periods prevent this.

Data processing outside the European Union: Zoom is a service offered by a provider from the USA. It is not yet possible to configure Zoom so that all the above data are processed exclusively in data centres within the EU / EEA. The meeting metadata listed above will continue to be processed in data centres in the USA. The transfer of this data to the USA takes place on the basis of a data processing contract which we have concluded with Zoom and which complies with the requirements of Art. 28 GDPR. 

An adequate level of data protection is guaranteed, on the one hand, by the conclusion of the EU standard contractual clauses (SCC). As additional safeguards, we have also configured our Zoom to only use data centres in the EU, EEA or secure third countries such as Canada or Japan for the conduct of online meetings. In addition, online consultations are always protected by end-to-end encryption.

Further information on data processing when using Zoom can be found at here and here. Please note that this is an external website operated by Zoom Video Communications, Inc. under its own responsibility and that personal data is processed when you visit it.

c) Job portal & MSCA Matchmaker

On our website we offer the option to publish job advertisements. In addition, you can use the MSCA Matchmaker to find partners/fellows for participation in the MSCA programme. KoWi provides the platform on its website and processes the relevant personal data for this purpose.

The following data will be collected by the institution and/or the point of contact issuing the call for applications:

• first name, last name and email address of the contact person
• if applicable, first and last name of the EU relations officer
• institution and department
• website
• information on the position/project idea
• for MSCA Matchmaker: relevant call for proposals

Purpose: information about job vacancies/project opportunities in our field of activity

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest).

Storage period: until the end of the period in question, unless you give us a different date

Objection: You can object to the processing of your personal data at any time with effect for the future. In this case, the publication of the advertisement and your personal data will be deleted or blocked promptly.

d) Lists of EU liaison officers

With our lists of EU liaison officers we aim to put EU liaison officers in Germany in touch with each other. Therefore we will process your personal data if you send it to us for publication as contact point of a higher education institution or a departmental research institution in the field of EU research funding.

We will process the following personal data for the EU liaison officer lists:

• First name, last name
• Business address
• Business e-mail address & phone number, fax if applicable
• Institution, department
• Function
• Website

Inclusion in an list of EU liaison officers will also give you the opportunity, subject to your consent, to regularly receive background information on EU research funding (KoWi background information). For this purpose, we will store your data in a database.

Purpose: Information on networking opportunities in the field of EU research funding as well as research and funding policy developments (KoWi background information)

Legal basis: Art. 6 (1) (a) GDPR (consent)

Storage period: Until you withdraw your consent

Objection: You can revoke your consent to the publication of your personal data in the list of EU relations officers at any time with effect for the future. In this case, we will also delete your personal data in our database.

a) General organisation and registration

On our website you can register for our events by providing personal data. The data are entered in an online form, transmitted to us and stored. For certain events, we also use the services of InterMediaSolution GmbH, Munich and Idloom, Brussels. For these events, where necessary, we will provide additional privacy notices at the time of registration.

The following data will be collected:

• First name, last name
• Organisation
• Email address
• Date and time of registration
• Title, department, additional contact details if applicable (optional)
• Further event-specific information (voluntary, subject to consent)

We also use LamaPoll (Lamano GmbH & Co. KG, Berlin) to receive feedback on events and to conduct surveys. Participation in all surveys is voluntary.

The following personal data will be processed for this purpose:

• First name, last name
• Email address
• Organisation

Purpose: Event organisation and implementation, the necessity of collecting information on the organisation additionally arises from our statutes.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest), for chargeable events Art. 6 (1) (b) GDPR (contractual basis) or Art. 6 (1) (a) GDPR (consent of the user) for all voluntary details

Storage period and disclosure: If you transmit data to us in the context of registering for an event, these data will be used exclusively for the corresponding event and deleted after expiry of the statutory retention periods. The data will in any case be kept until the end of the event, its follow-up or until consent is revoked. These data will be passed on to third parties (e.g. co-organisers, list of participants) only with your express consent.

Objection: You can revoke your registration or ask for the stored data to be changed at any time. Insofar as to do so is not prevented by contractual or legal obligations, your data will be deleted promptly upon revocation. However, participation in the event will then no longer be possible.

b) Online meetings

In order to carry out online seminars and video conferences (hereinafter: online meetings) we use Zoom. Zoom is a service of Zoom Video Communications, Inc, USA (https://zoom.us).

The scope of the data processed in the context of using Zoom depends in part on the information you yourself provide before or when participating in the online meeting. You can therefore decide as a participant whether you want to take part in the chat or share your microphone or camera. However, you must at least provide your name.

The following personal data may be processed:

• Participant data: First name, last name, e-mail address, organisation, password (if "Single-Sign-On" is not used), profile picture (optional)
• Text, audio and video data (if you share the camera or microphone or use the chat/question/survey function); for follow-up purposes, we may also process questions asked in the chat.
• Meeting metadata (topic, description (optional), participant IP addresses, device/hardware information, start, end and duration of the meeting)
• For telephone dial-in: Information on the incoming and outgoing call number, country name, start and end time, further connection data if necessary
• For recordings (optional) Mp4 of all video and audio recordings and presentations, M4A of all audio recordings, text file of all in the meeting, chats, audio transcript file; if, in exceptional circumstances, we wish to record an online meeting, we will tell you in advance and ask for your consent. The Zoom app will also tell you if a meeting is being recorded.

Purpose: Organisation, implementation and follow-up of online meetings. Any other use of your data for other purposes is excluded.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest), for chargeable events Art. 6 (1) (b) GDPR (contractual basis) or Art. 6 (1) (a) GDPR (consent of the user) for all voluntary details

Storage period and disclosure of data: Your personal data will be deleted or blocked by us as soon as the purpose of storage and processing no longer applies, provided that there is no legal obligation to store them for a longer period.
If you are logged in with a Zoom account, online meeting reports (meeting metadata, phone dial-in data, questions and answers, survey function) can be stored by Zoom for up to one month.
Personal data processed in connection with participation in online meetings will as a matter of principle not be passed on to third parties. The provider of Zoom necessarily acquires knowledge of the above-mentioned data insofar as this is provided for in the context of our data processing contract with Zoom.

Objection: You can revoke the processing of your data at any time with effect for the future. Insofar as to do so is not prevented by contractual or legal obligations, your data will be deleted promptly upon revocation. However, participation in the event will then no longer be possible.

Data processing outside the European Union: Zoom is a service offered by a provider from the USA. It is not yet possible to configure Zoom so that all the above data are processed exclusively in data centres within the EU / EEA. The meeting metadata listed above will continue to be processed in data centres in the USA. The transfer of this data to the USA takes place on the basis of a data processing contract which we have concluded with Zoom and which complies with the requirements of Art. 28 GDPR.  

An adequate level of data protection is guaranteed, on the one hand, by the conclusion of the EU standard contractual clauses (SCC). As additional safeguards, we have also configured our Zoom to only use data centres in the EU, EEA or secure third countries such as Canada or Japan for the conduct of online meetings.

Further information on data processing when using Zoom can be found at https://zoom.us/privacy/ and https://zoom.us/privacy/#_Toc44414848. Please note that this is an external website operated by Zoom Video Communications, Inc. under its own responsibility and that personal data are processed when you visit it.

 

a) Applications

For the purpose of processing application procedures, we collect and process your personal data that we receive from you by mail or e-mail in the course of contacting you or your application, or that you send us via our LinkedIn company profile.

This may include the following information (you determine the exact scope yourself when submitting the documents):

• Contact details (name, address, telephone number, e-mail address)
• Nationality, date and place of birth
• Information on education, qualification and further training
• Other CV-related information with which you provide us
• Gender
• Photo of the applicant
• Special categories of personal data, such as - where necessary - details of a severe disability, if you inform us of this.

Purpose: Your personal data will be processed for the purpose of considering your application in the selection process and decisions on whom to appoint to the position for which you have applied.

The legal basis for the processing is Art. 88 GDPR in conjunction with § 26 BDSG as well as Art. 6 (1) (b) DSGVO for the initiation or implementation of contractual relationships. Furthermore, we may process personal data from you if this is necessary for the fulfillment of legal obligations (Art. 6 (1) (c) GDPR) or for the defense of asserted legal claims against us. The legal basis for this is Art. 6 (1) (f) GDPR. If you give us express consent to process personal data for specific purposes, the lawfulness of this processing is based on your consent pursuant to Art. 6 (1) (a) GDPR. Consent given can be revoked at any time, with effect for the future. Insofar as the processing concerns voluntarily provided special categories of personal data (e.g. nationality, health data), we base the processing on your consent within the meaning of Art. 6 (1) (a) in conjunction with Art. 9 (2) (a) GDPR.

Recipients: We only pass on your personal data within our company to those areas and persons who need this data to fulfill contractual and legal obligations or to implement our legitimate interests.

Otherwise, data is only passed on to recipients outside the company if this is permitted or required by law, if the transfer is necessary to fulfill legal obligations or if we have your consent.

Necessity: The provision of personal data in the context of application processes takes place on a voluntary basis. You are not obliged to provide information about your personal data. However, please note that these are required for the decision on an application or the conclusion of a contract relating to an employment relationship with us. We recommend that you only provide personal data as part of your application that is required to complete the application.

Storage period: If an employment or internship contract is concluded with you, the transmitted data will be stored in accordance with Art. 88 GDPR in conjunction with § 26 BDSG in compliance with the statutory provisions in order to be able to ensure the processing of the employment relationship. Your data will then be transferred to the personnel file, insofar as this is necessary and permissible.

If no employment or internship contract is concluded, we will keep your data for up to six months after the end of the application process (e.g. notification of the rejection decision) for the purpose of answering questions in connection with your application. Thereafter, the data you have submitted will be deleted, unless other legitimate interests on our part (e.g. a duty to provide evidence in proceedings under the General Act Equal Treatment (AGG)) conflict with the deletion. In the event that you have consented to a longer storage of your personal data, we will store it in accordance with your declaration of consent.

Objection: The processing of your personal data within the scope of the application procedure is absolutely necessary for the establishment of the employment relationship. In this context, there is therefore no possibility to object. If the processing of your personal data is based on consent, you have the option to revoke your consent at any time or to ask for the stored data to be amended. Insofar as to do so is not prevented by contractual or legal obligations, your data will be deleted promptly upon revocation.

For an overview of your other rights, please refer to subchapter 8 of this privacy statement.

b) Mentoring

Our EU mentoring programme is carried in collegial small groups who exchange ideas in a self-organised manner under professional guidance over the course of a year and take part in an accompanying seminar programme. The prerequisite for participation is an application with a CV and accompanying information on the motivation to take part. For this purpose, we will process the following personal data:

• Contact details (name, address, institution, telephone number, e-mail address)
• Information on education, qualification, motivation and further training
• Other CV-related information with which you provide us

Purpose: Your personal data will be processed for the purpose of considering your application in the selection process. The data submitted in the application will be used exclusively to process your registration and participation.

The legal basis for the processing is Art. 6 (1) (a) DSGVO (consent)

Storage period and disclosure: If you participate in the KoWi Mentoring, we will store your data at least until the end of the programme. Your data will be passed on (e.g. to co-organisers, list of participants) or stored for longer periods for networking purposes only with your express consent.
If you are not selected for the KoWi Mentoring programme, we will retain your data for up to six months for the purpose of answering questions in connection with your application. Thereafter, the data you have submitted will be deleted unless other legitimate interests on our part conflict with the deletion.

Objection: The processing of your personal data is mandatory in the context of the application procedure and for participation in the programme. In this respect, there is no possibility of objection. If the processing of your personal data is based on consent, you have the option to revoke your consent at any time or to ask for the stored data to be amended. Insofar as to do so is not prevented by contractual or legal obligations, your data will be deleted immediately upon revocation.

 

As a "data subject" within the meaning of the DSGVO, you have the following rights:

a) Right of access

You have the right to obtain confirmation from us as to whether or not personal data concerning you are being processed. Where that is the case you may obtain access to the personal data and the following information:

• the purposes of the processing;
• the categories of personal data concerned;
• the recipients or categories of recipient to whom the personal data have been or will be disclosed;
• the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
• the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
• the right to lodge a complaint with a supervisory authority;
• where the personal data are not collected directly from you, any available information as to their source;
• the existence of automated decision-making, including profiling, referred to in Art. 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

Where personal data are transferred to a third country or to an international organisation, you have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.

We will provide you with a copy of the personal data undergoing processing. Unless otherwise requested from, the information will be provided in a commonly used electronic form.

b) Right to rectification  

In case the personal data concerning you is inaccurate or incomplete you have the right to obtain rectification or completion from us without undue delay .

c) Right to erasure ("right to be forgotten")

You have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the following grounds applies and the processing is not necessary according to Art. 17 para. 3 GDPR

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• you withdraw consent on which the processing is based according to point (a) of Art. 6(1), or point (a) and there is no other legal ground for the processing;
• your object to the processing pursuant to Art. 21(1); there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2);
• the personal data have been unlawfully processed;
• the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which we are subject;
• the personal data have been collected in relation to the offer of information society services referred to in Art. 8(1).

Where we have made the personal data public and are obliged pursuant to paragraph 1 to erase the personal data, we, taking account of available technology and the cost of implementation, will take reasonable steps, including technical measures, to inform other organisations which are processing the personal data that you have requested the erasure of any links to, or copy or replication of, those personal data.

d) Right to restriction of processing

 You have the right to obtain the restriction of processing from us where one of the following applies:

• you contest the accuracy of the personal data for a period enabling us to verify the accuracy of the personal data;
• the processing is unlawful and you oppose the erasure of the personal data; instead you request the restriction of their use;
• we no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims;
• you have objected to processing pursuant to Art. 21(1) pending the verification whether our legitimate override yours.

e) Notification obligation and right to be informed

We will communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed about those recipients upon request.

f) Right to data portability

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from us, where:

• the processing is based on consent pursuant to point (a) of Art. 6(1) or on a contract pursuant to point (b) of Art. 6(1); and
• the processing is carried out by automated means.

In exercising your right to data portability pursuant to paragraph 1, you have the right to have the personal data transmitted directly from us to another entity (controller), where technically feasible.

The right to data portability will not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

g) Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Art. 6(1). We will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

You may exercise your right to object, in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, by automated means using technical specifications

h) Right to lodge a complaint with a supervisory authority

If you consider that the processing of personal data relating to you infringes the GDPR, you will have the right – without prejudice to any other administrative or judicial remedy – to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

i) Right to revoke

You have the right to revoke your consent to the processing of your personal data at any time.