a. Right to be informed
You have the right at any time to receive without charge information about the data we hold about you. The type of information you have the right to be informed about is listed below. The information you request must be provided by us within one month.
(1) The purposes for which the personal data is processed;
(2)The categories of personal data being processed;
(3)The recipients or categories of recipients to whom your personal information has been or will be disclosed;
(4)The duration for which we intended to store your personal data or, if specific details on this point are not available, the criteria for establishing the duration;
(5) The existence of your right to the correction or deletion of your personal data and of your right to the restriction of processing by the data controller or your right to object to this processing;
(6) The existence of a right to complain to the supervisory authorities;
(7)All available information on the origin of the data if it has not been gathered from the data subject;
(8) The existence of an automated decision-making process including profiling as per art. 22 paras. 1 and 4 GDPR and – in such cases as a minimum – meaningful information regarding the logic involved and the consequences and intended outcomes of such processing for the data subject. We nonetheless point out that such decision-making processes are not used on our website.
(9)Whether your personal data is transferred to a non-EU country or to an international organisation. In this context you can also have the right to be informed as to the appropriate guarantees that under art. 46 GDPR have been put in place for the transfer of your data.
b. Right to correction
With regard to the personal data that we hold about, you have the right to the immediate correction or completion of any incorrect or incomplete data.
c. Right to deletion
Making a deletion claim
You have the right to the immediate deletion of your personal data, and we must immediately delete such data provided one of the following applies:
(1) The personal data held about you is no longer required for the purposes for which it was collected or has otherwise been processed.
(2) You revoke your consent on which the processing as per art. 6 I (a) was based and there is no other legal basis for the processing.
(3) Under art. 21 I GDPR you object to the processing of your data as collected by us on the basis of our disclosed legitimate interests (e.g. for Google Analytics purposes) and there are no legitimate grounds for processing that take precedence or under art. 21 II GDPR you object to the processing of your data for direct marketing purposes.
(4) Your personal data has been unlawfully processed by us, e.g. without your consent or without any legitimate interest on our part.
(5) The deletion of your personal data is required in order to comply with our legal obligations under EU or German law.
(6) The data has been collected with regard to a minor in the context of the services offered as part of the information society as per art. 8 GDPR.
If we have published your personal information and if we are bound under one of the aforementioned conditions to delete it, we will in an appropriate manner inform the companies on whose websites the data has been published of your request for the data to be deleted and we will explain that, as the data subject, you have requested the deletion of all links to this data and of all copies and duplicates.
There is no right to deletion where processing is required
(1) for exercise of the right to freedom of expression and information;
(2) for compliance with a legal obligation that under EU or German law requires that processing be carried out, e.g. as part of statutory retention periods for tax purposes or if we have been requested to carry out a task in the public interest or at the behest of the authorities;
(3) on public health grounds as per art. 9 II (h) and (i) as well as art. 9 III GDPR;
(4) for archiving, academic or historical research purposes that are in the public interest or for statistical purposes as per art. 89 (I) GDPR insofar as the right to deletion would be likely to jeopardise or significantly affect the aims of such processing;
(5) for the exercise of rights or the bringing of or defence against legal claims, e.g. in court proceedings.
d. Right to restriction of data processing
You have the right to the restriction of our processing of your data if one of the following conditions applies:
(1) You dispute the accuracy of your personal data, in which case we must restrict its processing for as long as is required for us to review the data concerned;
(2) Processing is unlawful and you have declined to have your data deleted and instead request that the use of your personal data be restricted;
(3) If we no longer require the personal data for the purposes for which it was being processed but you need the data for the bringing of claims or the exercise or defence of your rights;
(4) If you object to the processing of your personal data that we have collected on the basis of our disclosed legitimate interests (e.g. for Google Analytics purposes), provided our legitimate grounds do not outweigh your rights.
Where processing has been restricted on one of the above grounds, it may then, except for its storage, be processed only with your consent or for the bringing of claims or the defence or exercise of rights or for the protection of the rights of another natural or juristic person (such as a corporate entity under German law) or on the basis of significant public interest in the EU or one of its member states.
If you have imposed restrictions on the processing of your data, we will inform you if we intend to rescind the restrictions.
e. Obligation to notify
Where you have exercised your right to the correction, deletion or restriction of the processing of your data by us, we must notify all the parties to whom your personal data has been disclosed of the correction or deletion of your data or the restriction of its processing, unless such notification is impossible or would involve disproportionate effort or expense.
You have the right to be informed of the identity of these recipients.
f. Right to portability
You have the right to receive in a structured, current and machine-readable format the personal data that you have provided to us. You further have the right to transfer this data to another company without hindrance by us, provided
(1)the processing is based on consent under art. 6 (I) GDPR or on a contract as per Art. 6 I (b) GDPR and
(2)the data is processed with the aid of automated procedures.
In exercising this right you are also entitled where technically feasible to have your personal data transferred directly from us to another company but this must not affect the freedoms or rights of other persons.
The right to data portability does not apply to the processing of data required for tasks we are obliged to perform in the public interest or at the behest of the authorities.
g. Right to object
You have the right at any time to object, on grounds specific to your situation, to the processing of your personal data on the basis of art. 6 I (e) – necessary processing on the basis of public interest – or of (f) GDPR – processing on the basis of our disclosed legitimate interests (e.g. online marketing). This right also applies to profiling based on these provisions.
We will then cease to process your personal data unless we can prove compelling and legitimate grounds for the processing that outweigh your interests, rights and freedoms or unless the processing is for the bringing of claims or the exercise or defence of rights.
Where personal data is processed for direct marketing purposes, you have the right to object to such processing. This right also applies for any profiling connected to such direct marketing.
If you object to the processing of your data for direct marketing purposes, your data will no longer be used for this purpose.
In connection with the use of information society services, you can, regardless of directive 2002/58/EC, exercise your objection via automated processes for which technical specifications are used.
h. Right to revoke your declaration of consent under data protection law
You have the right at any time to revoke your declaration of consent under data protection law. If you do so, your revocation will not affect the lawfulness of the processing that has already been carried of the basis of your consent.
i. Contact person for rights of data subject
If we fail to facilitate the direct exercise of your rights in connection with the processing of your data, please contact us at datenschutz(at)testberlin.de or by post for the attention of the data protection officer at the address provided in the Company Information section.