Data protection

1. purposes of the processing of personal data

In order to provide you with user-friendly, efficient and secure internet services, we rely on the processing of your personal data. We process your personal data in order to

• to provide the services requested by you, in particular to purchase tickets for lottery products of the German Lotto and Totoblock and other organizers, to store, manage and statistically evaluate corresponding tickets, to notify you of winnings from the drawing of a lottery and to provide other services associated with these services.
• ensure that our websites and apps are presented to you in the most effective and interesting way possible (e.g. by storing display preferences on our website or in our app).
• fulfill our obligations arising from any contracts concluded between you and us.
• enable you to participate in interactive offers.
• to inform you about changes to our services.
• to inform you about the products offered and brokered by our brokerage partners and similar offers, such as current information about special draws and jackpots, by means of push messages, e-mails or text messages.
  

2. processing of personal data

2.1 Informational use of our website and apps

If you only use our websites and apps for informational purposes, i.e. if you do not log in, register or transmit other information, we process the data - so-called log files - that your browser transmits to us to enable you to visit the website/app. These are

• IP-Adress
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status/HTTP status code
• Amount of data transferred in each case
  
• Website / app from which the request comes
  
• Browser
  
• Operating system and its interface
  
• Language and version of the browser software or mobile device.
  

This data processing serves our interest in enabling the website/app to be delivered to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session. We store the IP address for four weeks so that we can pursue legal violations in the event of data security deficiencies or problems with user interference. At the end of the four-week retention period, the IP addresses are deleted immediately. Otherwise, the data is deleted from our system when the respective session has ended. The collection of data for the provision of the website is absolutely necessary for the operation of the website. The legal basis for this is Art. 6 para. 1 lit. f GDPR.

2.2 Usage and gaming brokerage agreement

(1) To conclude a gaming brokerage contract, you must register and set up a gaming account. To do this, you also accept the terms of use. We process the personal data required for the execution of the gaming brokerage contract, in particular

• your first and last name,
• your birth name,
• your birth name,
• your birth place,
• your address,
• your e-Mail-Adress,
  
• your IBAN and
  
• if applicable, your cell phone number ("account data").
  

(2) As a commercial gaming broker, we are legally obliged to check the account data provided by you in accordance with the provisions of the Player and Youth Protection Act and the Money Laundering Act. For this purpose, we will compare your account data with the databases maintained by Schufa Holding AG, Kormoranweg 5, 65201 Wiesbaden ("Schufa").
‍
(3) After entering your e-mail address in the form, but before submitting the form, the e-mail address will be verified by an e-mail verification service. This verification includes a check of your e-mail address for technical or syntactical correctness (in other words: whether the e-mail address has been spelled correctly and whether the mailbox exists at all). Email addresses that the system classifies as invalid or risky are rejected.
‍
This service is provided by the processor EMAILABLE LLC, a US company based at 485 Underhill Blvd, Syosset, NY 11791, United States. Further details on data processing can be found in the privacy policy of EMAILABLE, LLC: https://emailable.com/privacy-policy/

Your email address will only be transmitted to the processor for the purpose of immediate verification, processed on a server located in Germany, stored in the account for 30 days and then automatically deleted. Your email address will not be processed or used in any other way by the processor.

The legal basis for the processing of data for the purpose of email verification is your implied consent by entering your data in the form (Art. 6 para. 1 lit. a GDPR). We as Next Lotto GmbH have concluded an order processing contract (AVV) with the above-mentioned provider. You can find a sample version here: https://emailable.com/data-processing-agreement/

(4) In order to activate your gaming account, we must also verify your identity, Section 6a (2) sentence 2 GlüStV. For this purpose, we will compare the data you provide with the databases maintained by Schufa Holding AG, Kormoranweg 5, 65201 Wiesbaden ("Schufa"). In doing so, we will

• through the "SCHUFA Identity Check Premium" procedure in conjunction with the "SCHUFA Account Number Check plus IBAN" procedure and a subsequent 1-cent bank transfer or
• using the "ID Ident" procedure from Insic GmbH in conjunction with biometric facial recognition and Liveness Check from Insic GmbH or
• through the "Nect Ident" procedure in conjunction with the "Nect Wallet" app or
• using the "Nect Ident" procedure in conjunction with the online ID function of the German ID card (eID) from NECT GmbH, Großer Burstah 21, 20457 Hamburg.

With Insic GmbH's "Ausweis Ident" process, you upload pictures of the front and back of your ID card or passport. The data from your ID documents is processed automatically and checked to ensure that you are of legal age. If the check is positive, the next step is to compare the image on your ID document with a live image of you. A live image of your face is taken via a webcam or the camera on your smartphone, which is then compared and matched with your biometric features on your ID documents. For a 1-cent transfer, we will transfer an amount of one cent to the bank account you have specified. In the purpose of the transfer, you will find an activation code that you can enter to activate your gaming account in our app. After successful identification and verification of all other account data, we will activate your game account for participation in the game.
‍
With the "Nect Ident" process, you record a video of the front and back of your ID document within the Nect Wallet app. If you use the eID function here, you will be asked for your personal six-digit PIN after your ID document has been recorded. Your ID document data is automatically checked to ensure that you are of legal age. If the query is positive, the next step is to create a live recording of your face via a "selfie video" using a webcam or the camera on your smartphone, which is then compared and matched with your biometric features on your ID documents. You can find more information on the use and management of personal data in the Data protection of Nect GmbH.
‍
(5) When registering, you must choose a password in addition to your name and e-mail address. Alternatively, you can register using a single sign-on (SSO) procedure such as your Apple ID. If you use a single sign-on procedure, you must still enter your name when registering. You can find detailed information on the SSO procedure from the relevant provider.
‍
(6) You can purchase your gaming ticket by paying by credit card, direct debit or other payment methods approved by us in the future. We will disclose your credit card information to the service provider Adyen, Rokin 49, 1012 KS, Amsterdam, Netherlands, in order to process your payments.

(7) After accepting your game brokerage order and payment of the stake and fees, we will forward your ticket to the lottery organizer. In doing so, we may process your whereabouts and reject your brokerage order if you are located in a country or federal state whose laws do not permit participation in the lottery.

(8) Our company regularly checks your creditworthiness when concluding contracts and, in certain cases where there is a legitimate interest, also for existing customers. For this purpose, we work together with Creditreform Boniversum GmbH, Hammfelddamm 13, 41460 Neuss, from whom we receive the necessary data. For this purpose, we transmit your name and contact details to Creditreform Boniversum GmbH. The information pursuant to Art. 14 of the EU General Data Protection Regulation on the data processing taking place at Creditreform Boniversum GmbH can be found here: https://www.boniversum.de/eu-dsgvo/informationen-nach-eu-dsgvo-fuer-verbraucher or here.
‍
You can object to data processing in accordance with Art. 21 (1) GDPR. You can send your objection in writing to Creditreform Boniversum GmbH, Hammfelddamm 13, 41460 Neuss or by e-mail to selbstauskunft@boniversum.de. Creditreform Boniversum GmbH, Hammfelddamm 13, 41460 Neuss, Germany, is responsible within the meaning of Art. 4 No. 7 EU GDPR.

(9) The following statements on the associated processing of personal data are relevant for prize payouts: An appointed trustee holds the game receipts and asserts prize claims against the lottery organizers, see Section 19 (1) No. 3 GlüStV. Winnings from a lottery are paid out by the respective lottery organizer exclusively to a trust account of the trustee; only the trustee is entitled to claim the winnings from the respective lottery organizer. We will disclose the personal data required to collect the winnings, i.e. in particular your name, your contact details, the prize amount and any proof of identity, to the trustee for this purpose.

(10) You can view an overview of the current balance of your gaming account and the calculated winning amount in our app in the profile area under "Credit balance or booking overview". You can use these credits as funds for future wagers or request a payout of the balance (in full or in part) to the payout account we have on file for you at any time. We process wagering limits as personal data in order to limit losses. You can set such wagering and loss limits in your player account on the website and in the app. For example, you can set daily and weekly limits that do not exceed a monthly limit set by you. We set certain limits for stakes via your player account in order to ensure the overriding goal of "loss limitation". You can find more information on this in our T&Cs. You can reduce the betting limits in your player account at any time with immediate effect. An increase in the gaming limit, on the other hand, only comes into effect after a waiting period of seven days. We will confirm any changes to the betting limit by e-mail and provide our customer service team with the relevant information. So that we can implement your and our betting limits, we automatically check before each bet whether it is within the limit and then approve it.

(11) If the sum of the balance of your gaming account and the amount of winnings to be paid out exceeds a total of EUR 250.00, the trustee will pay out the entitled amount of winnings to the bank account deposited in your gaming account. We will only transfer winnings in excess of EUR 2,500.00 to you if you provide us with (1.) a copy of a valid identification document (e.g. federal identity card or passport) in which your name and date of birth match the details registered with us at the time of the payout request and (2.) a written instruction stating a bank account held at a domestic credit institution to which the amount of money is to be transferred. If the identification document provided by you does not match the registered details of the gaming account, you must prove to us by other means that you are the holder of the gaming account. If the account for the withdrawal request differs from the account deposited in the gaming account, you must present a written confirmation from the account-holding bank that identifies you as the account holder. If you have not provided proof of your entitlement within a period of three months in accordance with sentences 1 to 3 above, your winnings will be forfeited and the trustee must repay the winning amount to the lottery organizer.
‍
(12) The legal basis for the processing of your personal data is Article 6(1)(b) GDPR and thus the performance of our existing user and match-finding contract with you. The processing of the listed personal data is necessary so that we can fulfill the contract with you. Insofar as we are obliged by law as a commercial gaming broker to check your details or to transmit them to the supervisory authorities, the legal basis for this data processing is Art. 6 para. 1 lit. c GDPR.

We store your personal data during the term of the contract and beyond until the respective purposes for processing your personal data have been achieved. It may be necessary to process your personal data even after the contract has been executed so that we can defend ourselves in the event of legal disputes or provide evidence to supervisory authorities. According to the provisions of the Interstate Treaty on Gambling, we must store your personal data for 5 years after closing your player account, Section 6g (1) GlüStV.

We will close orphaned player accounts from which no game referrals have been made if six months have passed since the last registration in our app or on the website.

2.3 Use of our apps

(1) When the apps are downloaded, the necessary information is transmitted to the respective app store, in particular the user name, email address and customer number of your account in the respective app store, the time of the download, payment information and the individual device identification number. However, we have no influence on this data processing.
‍
(2) Notifications within our apps are sent to the respective end device via the server of the respective provider, i.e. the Apple Push Notification Service (APNS) for iOS and Google Cloud Messaging for Android. We do not know the identity of the end device and the user; the operators of the app stores only send us a randomly generated number (so-called push token), which enables the operator of the app store to forward the message to a specific end device.

(3) For advertising purposes, we use the so-called "Advertising Identifier" (IDFA). The IDFA is a unique, but non-personalized and non-permanent identification number for a specific device, which is provided by iOS. The data collected with the IDFA is not linked to other device-related information. We use the IDFA to provide you with personalized advertising and to evaluate your usage. If you activate the "No ad tracking" option in the iOS settings under "Privacy" - "Advertising", we can only take the following measures: Measuring your interaction with banners by counting the number of times a banner is displayed without you clicking on it ("frequency capping"), click rate, determining unique usage ("unique user") as well as security measures, fraud prevention and troubleshooting. You can delete the IDFA at any time in the device settings ("Reset Ad ID"), in which case a new IDFA will be created that will not be merged with the data collected previously. We would like to point out that you may not be able to use all the functions of our app if you restrict the use of IDFA.

(4) We create user profiles using pseudonyms for the purposes of advertising, market research and the needs-based design of our website. The data will not be merged with other personal data. Nevertheless, you can object to the use of your data by deactivating the "News" notification and/or the notifications about jackpot alerts, draw numbers, odds and closing dates that are preset for the respective products (e.g. LOTTO 6aus49) in the "Notifications" menu item of our app settings.

(5) We also use the following analysis services in our apps:

• CleverTap: CleverTap Private Limited (Formerly known as WizRocket Technologies Private Limited) 1901, 19th Floor, DLH Park, Ramlal Compound, S. V. Road, Goregaon (West), Mumbai - 400062, Maharashtra, India is a web analytics and engagement service,(https://clevertap.com/). The service enables us to better understand the function and use of our mobile offers [iOS from version 5.9.2] on your device. This software uses certain user data, in particular sessions, screen views, buttons pressed and other app interactions.
• Adjust: adjust is a web analysis service of adjust GmbH, Saarbrücker Str. 36, 10405 Berlin. (http://www.adjust.com/). The service enables us to track advertising campaigns. Adjust anonymizes all personal data used for the analysis immediately after collection. Further information on data processing by Adjust can be found in the provider's privacy policy at https://www.adjust.com/privacy_policy/.
• Apptimize: Apptimize is a web analytics service provided by Apptimize, Inc, 111 Independence Drive, Menlo Park, CA 94025 (http://apptimize.com). The service enables us to optimize the user interface through so-called A/B testing. This involves dividing users into two or more groups who are shown different versions of our services (e.g. different button colors); the evaluation of the different user behavior helps us to better understand your needs and preferences.

(6) We also use the following analysis services on our websites:

• Google Analytics
  Our website uses Google Analytics, a web analytics service provided by Google Inc ("Google"). Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. However, if IP anonymization is activated on this website, your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services related to website activity and internet usage to the website operator.
  
  The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.
  
  You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website.
  ‍
  In addition, you can deactivate the analysis by Google Analytics on our and other websites via the following link: http://tools.google.com/dlpage/gaoptout?hl=de.
  
  Google Analytics is used in accordance with the conditions agreed between the German data protection authorities and Google. Information from the third-party provider: Google Dublin, Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 436 1001. Terms of use: http://www.google.com/analytics/terms/de.html, overview of data protection: http://www.google.com/intl/de/analytics/learn/privacy.html, as well as the privacy policy: http://www.google.de/intl/de/policies/privacy.
• Google Ads
  Google Ads is an online advertising program of Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.Google Ads enables us to display advertisements in the Google search engine or on third-party websites when the user enters certain search terms on Google (keyword targeting). Furthermore, targeted advertisements can be displayed based on the user data available at Google (e.g. location data and interests) (target group targeting). As the website operator, we can evaluate this data quantitatively, for example by analyzing which search terms led to the display of our advertisements and how many advertisements led to corresponding clicks.the so-called Google Ads Identifier is only used if the user of the Clever Lotto or Lotto Scanner app explicitly agrees and releases it. If the user objects to its use by the system, the Google Ads Identifier is anonymized by iOS and Android. It is therefore no longer possible to draw conclusions about an individual person and the use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG. The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://policies.google.com/privacy/frameworks and https://privacy.google.com/businesses/controllerterms/mccs/.
• Google Sign In
  The website operator uses Google Sign In, which is a login management tool of Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland, which is essentially required to provide a login option for users of the Clever Lotto and Lotto Scanner app. Next Lotto requires this customer information, among other things, to display the daily statistics on stakes, winnings and losses, which Next Lotto GmbH is obliged to provide as a state-licensed lottery broker. the use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG. The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://policies.google.com/privacy/frameworks and https://privacy.google.com/businesses/controllerterms/mccs/.
• Google Firebase and Firebase Cloud Messaging
  Our website/app uses Google Firebase (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, "Google"). This service also processes personal data, among other things. This usually involves "instance IDs", which are provided with a time stamp. These IDs are assigned to a specific user and allow different events or processes to be linked. This data does not allow us to draw any conclusions about the specific user. We do not personalize the data. We process this aggregated data to analyze and optimize user behavior, for example by evaluating crash reports, and Google also uses the advertising ID of the end device for Firebase Analytics. You can restrict the use of the advertising ID in the device settings of your mobile device.For Android: Settings > Google > Ads > Reset advertising IDFor iOS: Settings > Privacy > Advertising > No ad trackingFirebase Cloud Messaging is used to transmit push messages or so-called in-app messages (messages that are displayed within the respective app). A pseudonymized push reference is assigned to the end device, which serves as the destination for the push messages or in-app messages. This function can be deactivated and reactivated at any time in the settings of the end device. You can view the privacy policy here: https://firebase.google.com/support/privacy/Wir use servers located within the EU wherever possible. However, it cannot be ruled out that data may also be transferred to the USA. The legal basis for the use of Google Firebase and Firebase Cloud Messaging is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG. Consent can be revoked at any time.
• Adjust
  Our app uses the tools of the service provider Adjust GmbH, Germany, with whom we have concluded a contract data processing agreement. essentially, we use the data collected for billing purposes, which are essential for Next Lotto GmbH and are therefore a technical necessity. you can view Adjust GmbH's privacy policy in detail here:https://www.adjust.com/terms/privacy-policy/Ohne Consent to tracking (can be revoked at any time via your cell phone settings), only anonymous data is stored at Adjust.
• Microsoft Appcenter
  In our app, we use the Microsoft App Center, which is operated by Microsoft CorporationOne Microsoft Way, Redmond, WA 98052-6399, USA, to receive crash and diagnostic data as well as evaluations of the use of the Clever Lotto app and Lotto Scanner app. In addition to the actual error report, this includes the country code, language used, manufacturer, version of the mobile device's operating system, the installed version of the app and the date and time of the event that occurred (error or app crash). This data is used exclusively to analyze any problems and app crashes that may have occurred. According to the Microsoft App Center, the analysis data is temporarily stored for 90 days. you can find detailed information at: https://docs.microsoft.com/de-de/appcenter/sdk/data-collected#diagnostics

Data processed by the aforementioned analysis services will be anonymized immediately and not linked to personal data. You can revoke your consent to data processing in accordance with Art. 6 para. 1 lit. a GDPR at any time with effect for the future by sending an e-mail to support@cleverlotto.de. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

2.4 Use of our forum

(1) We have set up a forum for our users to exchange opinions. The forum can be accessed on our website at http://support.cleverlotto.de and in our app under the menu item "Settings" "Ideas and suggestions".

(2) Our forum is accessible without the need to register. To be able to actively participate, you must identify yourself by entering your e-mail address and a user name of your choice. There is no obligation to use a clear name; pseudonymous use is possible.

(3) By using our forum, you consent to the processing of your user name and email address as well as the information you provide. The legal basis is Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time with effect for the future by sending an email to support@cleverlotto.de. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

(4) If you delete your account, your public statements will remain visible to all readers, but your account will no longer be accessible and will be marked "anonymous" in the forum. All other data will be deleted.

3. Newsletter subscription

(1) With your consent, you can subscribe to our newsletter, with which we inform you about our current interesting offers.

(2) We use the so-called double opt-in procedure to subscribe to our newsletter. This means that after you have registered, we will send you an email to the email address you have provided, in which we ask you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 24 hours, we will delete your e-mail address immediately. In addition, we store the IP addresses used and the times of registration and confirmation. The purpose of this procedure is to be able to prove your registration and, if necessary, to clarify any possible misuse of your personal data.

(3) The only mandatory information for sending the newsletter is your e-mail address. The provision of further, separately marked data is voluntary and is used to address you personally. After your confirmation, we will save your email address for the purpose of sending you the newsletter. The legal basis is Art. 6 para. 1 sentence 1 lit. a GDPR. You can revoke your consent to receive the newsletter at any time and unsubscribe from the newsletter. You can declare your revocation by clicking on the link provided in every newsletter e-mail or by sending an e-mail to support@cleverlotto.de.

(4) With your voluntary and informed consent to receive the newsletter, you also consent to the analysis of your user behavior. For this analysis, the emails sent contain so-called web beacons or tracking pixels, which are one-pixel image files stored on our website. For the evaluations, we link the data mentioned in § 3 and the web beacons with your e-mail address and an individual ID. Links received in the newsletter may also contain this ID. The data is only collected in pseudonymized form, i.e. the IDs are not linked to your other personal data, and direct personal identification is excluded. You can object to this tracking at any time by clicking on the separate link provided in each email or by informing us via another contact channel. The information will be stored for as long as you are subscribed to the newsletter. After you unsubscribe, we store the data purely statistically and anonymously.

4. Integration of YouTube videos

(1) In our app and on our website, we may also embed YouTube videos that are stored on http://www.YouTube.com and can be played directly from our website. The provider of the video platform is Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin, Ireland. These videos are integrated in "extended data protection mode", i.e. personal data is only transferred to YouTube/Google when you play the videos. In advance, you give your voluntary and informed consent to the disclosure of your personal data to YouTube/Google in accordance with Art. 6 para. 1 lit. a GDPR by clicking and thus agree to the establishment of a connection to the platform and the associated data transfer. You can withdraw your consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
‍
(2) By playing a video, YouTube receives the information that you have accessed our website. This data transfer takes place regardless of whether you have an account with YouTube or Google. If you are logged in to Google, your data will be assigned directly to your account. If you do not wish this to happen, you must log out before activating the button. YouTube stores your data as usage profiles and uses them for purposes including advertising, market research and the needs-based design of its website.

(3) Personal data is generally transmitted to a Google server in the USA and stored there. However, due to the activation of IP anonymization "_anonymizeIp()", Google's IP address will be shortened beforehand within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. We would like to point out that it cannot be guaranteed that data processing takes place at the same level of protection as within the EU. To the best of our knowledge, there is therefore a risk that you will find it difficult to enforce your rights as a data subject and that state security authorities will have disproportionate access to data. There is also a lack of data protection supervision. We expressly point this out.

5. Disclosure of data to third parties

(1) In addition to the recipients of your personal data already mentioned - Schufa Holding, trustees, etc. - which we involve for the execution of the contract and for the implementation of legal obligations, other recipients of your personal data may be considered.

(2) If we use external service providers to process your data, we will select them carefully, commission them in writing, bind them to our instructions and monitor them regularly. The service providers will not pass this data on to third parties. These service providers generally process personal data on our behalf in accordance with our instructions pursuant to Art. 28 GDPR. We remain responsible for the processing of personal data.

(3) Otherwise, we will not pass on your personal data to third parties unless you have consented to the transfer of data or we are entitled or obliged to pass on data due to legal provisions and/or official or court orders. In particular, this may involve providing information for the purposes of criminal prosecution, averting danger or enforcing intellectual property rights.

6. Data security

The transmission of information via the Internet is never completely secure, so we cannot guarantee the security of data transmitted to our website via the Internet. Nevertheless, we use various technical measures to protect your personal data from loss, misuse or unauthorized access by third parties and constantly adapt them to the current state of the art, so that all information that you transmit to us is stored on servers within the European Union. In addition, all data exchanged between us and our respective intermediary partner is encrypted using SSL technology.

7. Third party websites

Our platform may contain links to websites of affiliated companies and other third parties. After clicking on the link, we have no influence on the transfer of data to third parties and the processing of data by third parties. We assume no responsibility for these third parties and/or their websites. If these websites have their own privacy policies, we recommend that you read them carefully before using the websites.

8. Your rights in relation to your data

When processing personal data, the General Data Protection Regulation (GDPR) grants you certain rights:

(1) Right to information (Art. 15 GDPR): You can request confirmation as to whether we are processing personal data concerning you. If this is the case, you can also request information about this data and the information specified in Art. 15 GDPR.

(2) Right to rectification and erasure (Art. 16 and 17 GDPR): You may request the rectification of inaccurate personal data concerning you and the completion of incomplete personal data. You can also request that personal data concerning you be deleted immediately if one of the reasons stated in Art. 17 GDPR applies, e.g. if this data is no longer required for the purposes pursued.

(3) Right to restriction of processing (Art. 18 GDPR): You have the right to request the restriction of processing if one of the conditions specified in Art. 18 GDPR applies, e.g. if you have objected to the processing of your data, for the duration of any review.

(4) Right to data portability (Art. 20 GDPR): Under the conditions set out in Art. 20 GDPR, you may also request that we transfer the personal data concerning you to you or to a third party in a structured, commonly used and machine-readable format.

(5) Right to object (Art. 21 GDPR): If we collect personal data concerning you on the basis of Art. 6(1)(f) GDPR (data processing to protect legitimate interests), you may have the right to object to the processing of this data. In this case, we will no longer process the data concerned unless we are permitted to process it for another legal reason, there are compelling legitimate grounds for processing that outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.

(6) Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): If you are of the opinion that we are violating data protection regulations, you can also lodge a complaint with the competent supervisory authority. You can assert this right to lodge a complaint in particular with a supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement.