Data and Privacy Protection Declaration according to the GDPR

Data protection declaration according to the GDPR

The protection of personal data is important to us. Therefore, the processing of personal data is carried out in accordance with the applicable European and national legislation.

You can of course revoke your declaration of consent at any time with effect for the future. Please contact the person responsible for this in accordance with § 1.The following declaration provides an overview of what type of data is collected, how this data is used and passed on, what security measures we take to protect your data and how and how you can obtain information about the information given to us.

Legal basis for processing personal data

Insofar as we obtain the consent of the person concerned for the processing of personal data, Article 6 (1) sentence 1 lit. a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.

Article 6 (1) sentence b) GDPR serves as the legal basis for the processing of personal data required to fulfill a contract to which the data subject is a party. This also applies to processing operations that are necessary to carry out pre-contractual measures.

Insofar as processing of personal data is necessary to fulfill a legal obligation to which we are subject, Article 6 (1) sentence 1 lit. c) GDPR serves as the legal basis.

If the processing is necessary to protect a legitimate interest of our company or a third party and if the interests, fundamental rights and fundamental freedoms of the data subject do not outweigh the first interest, Article 6 Paragraph 1 Clause 1 Letter f) GDPR serves as the legal basis for the processing .

Data Erasure and Storage Duration

The personal data of the person concerned will be deleted or blocked as soon as the purpose of storage no longer applies. Storage can also take place if this has been provided for by European or national legislators in EU regulations, laws or other regulations to which we are subject. The data will also be blocked or deleted if a storage period prescribed by the standards mentioned expires, unless there is a need for further storage of the data for the conclusion or fulfillment of a contract.

§ 1 The person responsible and the data protection officer

(1) Name and address of the person responsible

The person responsible within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is:

Hotel blauer Karpfen
Gerhart Maier eK
Dachauer Str. 1
85764 Oberschleißheim
Germany
Phone: +49 (89) 3157150
Email: info@hotel-blauer-karpfen.de
Website: WWW.hotel-blauer-karpfen.de

(2) Name and address of the data protection officer

The data protection officer of the person responsible is:

Akwiso
Dieter Grohmann
Beethovenstr. 23
87435 Kempten
Germany
Phone: +49 (831)51247030
Email: info@akwiso.de
Website: www.akwiso.de

§ 2 Definitions

The data protection declaration is based on the terms used by the European legislator when issuing the EU General Data Protection Regulation (hereinafter referred to as "GDPR"). The data protection declaration should be easy to read and understand. To ensure this, the most important terms are explained below:

• Personal datais all information that relates to an identified or identifiable natural person (hereinafter referred to as "data subject"). A natural person is considered to be identifiable if, directly or indirectly, in particular by means of assignment to an identifier such as a name, an identification number, location data, an online identifier or to one or more special features, the expression of the physical, physiological, genetic, psychological, economic, cultural or social identity of this natural person can be identified.
• Data subjectis any identified or identifiable natural person whose personal data is processed by the data controller.
• is any process carried out with or without the help of automated processes or any such series of processes in connection with personal data such as collecting, recording, organizing, organizing, storing, adapting or changing, reading out, querying, using, Disclosure by transmission, distribution or any other form of making available, matching or linking, restricting, deleting or destroying.
• is any type of automated processing of personal data that consists of using this personal data to evaluate certain personal aspects relating to a natural person, in particular aspects related to work performance, economic situation, health, personal preferences analyze or predict that natural person's interests, reliability, conduct, whereabouts or relocation.
• is the processing of personal data in such a way that the personal data can no longer be assigned to a specific data subject without the use of additional information, provided that this additional information is stored separately and is subject to technical and organizational measures that ensure that the personal data is not assigned to an identified or identifiable natural person.
• The person responsible or responsible for processingis the natural or legal person, authority, institution or other body that alone or jointly with others decides on the purposes and means of processing personal data. If the purposes and means of this processing are specified by Union law or the law of the Member States, the person responsible or the specific criteria for his naming can be provided for by Union law or the law of the Member States.
• is a natural or legal person, authority, institution or other body that processes personal data on behalf of the person responsible.
• is a natural or legal person, public authority, agency or other body to which personal data is disclosed, regardless of whether it is a third party or not. However, authorities that may receive personal data in the context of a specific investigation mandate under Union or Member State law are not considered recipients.
• is a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct responsibility of the controller or the processor, are authorized to process the personal data.
• is any expression of will voluntarily given by the data subject in an informed manner and unequivocally for the specific case in the form of a declaration or other clear confirmatory action with which the data subject indicates that they agree to the processing of their personal data .

§ 3 Provision of the website and creation of log files

1. If you only use the website for informational purposes, i.e. if you do not register or otherwise provide us with information, we automatically collect the following data and information from the computer system of the accessing computer each time the website is accessed:

• The user's IP address is stored in the log files for 7 days and then made anonymous
• Google Analytics is currently installed on your homepage, the IP addresses are anonymized there. i.e. Details such as search engines used, language and version of the browser software, contents of the calls etc. are recorded, but without a clear IP address. If you wish, Google Analytics can be removed, then these points will no longer apply
• In addition to the tracking cookies, technically necessary cookies are also set on the website itself, but their term ends at the end of the session or after two days at the latest. Only technical information such as e.g. B. stored active /inactive states of technical elements.

1. The legal basis for the temporary storage of the log files is Art. 6 (1) sentence lit. f) GDPR.
2. The temporary storage of the IP address by the system is necessary in order to

• to enable delivery of the website to the user's computer. For this purpose, the IP address of the user must remain stored for the duration of the session.
• to optimize the content of our website and the advertising for it
• to ensure the functionality of our information technology systems and the technology of our website
• Provide law enforcement authorities with the information necessary for law enforcement in the event of a cyber attack

For these purposes, there is also our legitimate interest in data processing in accordance with Article 6 Paragraph 1 Sentence 1 Letter f) GDPR.

1. The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected - in this case at the end of the usage process
2. The collection of the data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the website, which is why there is no possibility of objection.

§ 4 Use of cookies

1. This website uses so-called cookies. Cookies are small text files that, as soon as you visit a website, are sent from a web server to your browser and are stored locally on your end device (PC, notebook, tablet, smartphone, etc.) and are stored on your computer and the user (i.e. us) provide certain information. Cookies are used to make the website more customer-friendly and safer, in particular to collect usage-related information, such as frequency of use and number of users of the pages and behavior of page use. Cookies do not damage the computer and do not contain viruses.

This cookie contains a characteristic character string (so-called cookie ID) that enables the browser to be clearly identified when the website is called up again.

1. Cookies remain stored even when the browser session is ended and can be called up again when you visit the site again. However, cookies are stored on your computer and transmitted to our site. Therefore, you also have full control over the use of cookies. If you do not want data to be collected via cookies, you can set your browser via the menu under "Settings" so that you are informed about the setting of cookies or generally exclude the setting of cookies or delete cookies individually. However, it is pointed out that the functionality of this website may be restricted if cookies are deactivated. As far as session cookies are concerned, they will be automatically deleted anyway after leaving the website.

§ 5 Transfer of personal data to third parties

• Embedding YouTube videos

1. We have integrated YouTube videos into our online offer, which are stored onhttp://www.YouTube.comand can be played directly from our website. [These are all included in "extended data protection mode", i. H. that no data about you as a user will be transmitted to YouTube if you do not play the videos. The data mentioned in paragraph 2 will only be transmitted when you play the videos. We have no influence on this data transmission.By visiting the website, YouTube receives the information that you have accessed the corresponding subpage of our website.

The following data is transmitted here

• Device-specific information, such as the hardware used; the version of the operating system; unique device identifier and cellular network information including your phone number.
• Log data in the form of server logs. These include, among other things, details of how the Services were used, such as search queries; IP address; hardware settings; browser type; browser language; date and time of your request; page of origin; Cookies that can be used to uniquely identify your browser or Google account
• Location Information. Information about your actual location may be collected by Google. This includes, for example, your IP address, your WLAN access points or mobile phone masts

This occurs regardless of whether YouTube provides a user account through which you are logged in or whether there is no user account. If you are logged in to Google, your data will be assigned directly to your account.

1. The legal basis for the processing of users' personal data is Article 6 Paragraph 1 Clause 1 Letter f) GDPR .Google also processes your personal data in the USA.
2. The integration of the videos serves to make the website clearer for the user and to increase the search engine ranking of the website on Google. YouTube stores your data as user profiles and uses them for the purposes of advertising, market research and/or the needs-based design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website.
3. If you do not wish to be associated with your profile on YouTube, you must log out before activating the button.
4. You have the right to object to the creation of these user profiles, whereby you must contact YouTube to exercise this right.
5. Further information on the purpose and scope of the data collection and its processing by YouTube can be found in the data protection declaration. There you will also find further information on your rights and setting options to protect your privacy:https://www.google.de/intl/de/policies/privacy.

1. Google funds are used

(1) This site uses so-called web fonts provided by Google for the uniform display of fonts. When you call up a page, your browser loads the required web fonts into your browser cache in order to display text and fonts correctly. When you visit our website, requests are sent from your browser to the Google server. The following data is logged by Google:

• IP address
• Browser information (name, version)
• website
• operating system of the user
• User's screen resolution
• Language settings of the browser or the operating system of the user
• font file

This takes place regardless of whether Google provides a user account through which you are logged in or whether there is no user account. If you are logged in to Google, your data will be assigned directly to your account.Google Web Fonts are used in the interest of a uniform and appealing presentation of our online offering. This represents a legitimate interest within the meaning of Article 6 (1) sentence 1 lit. f GDPR.

(2) The legal basis for the processing of personal data is Article 6 Paragraph 1 Letter S.1 f) GDPR. Google also processes your personal data in the USA.

(3) Google stores your data as usage profiles and uses them for advertising, market research and/or needs-based design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to find out about your activities on our website.

(4) You have the right to object to the creation of these user profiles, whereby you must contact Google to exercise this right.

(5) Further information on the purpose and scope of the data collection and its processing by the plug-in provider can be found in the provider's data protection declaration. There you will also find further information on your rights in this regard and setting options to protect your privacy:http://www.google.de/intl/de/policies/privacy.

1. Links to external websites

This website contains links to external sites. We are responsible for our own content. We have no influence on the content of external links and are therefore not responsible for it. In particular, we do not adopt their content as our own. If you are directed to an external site, the data protection declaration provided there applies. If you notice illegal activities or content on this site, you are welcome to point it out to us. In this case we will check the content and react accordingly (notice and take down procedure).

§ 6 contact form and e-mail contact

1. There is a contact form on our website which can be used to contact us electronically. If you take advantage of this option, the data entered in the input mask will be transmitted to us and saved. These dates are:

• name and adress
• IP address of the user
• Date and time of registration

Your consent will be obtained for the processing of the data during the sending process and reference will be made to this data protection declaration.

Alternatively, you can contact us via the email address provided. In this case, the personal data transmitted with the e-mail will be saved.

Insofar as this concerns information on communication channels (e.g. e-mail address, telephone number), you also agree that we may also contact you via this communication channel in order to answer your request.

In this context, the data will not be passed on to third parties. The data will only be used to process the conversation.

1. The legal basis for the processing of the data is Article 6 Paragraph 1 Clause a) GDPR if the user has given his consent. The legal basis for the processing of the data transmitted in the course of sending an e-mail is Article 6 Paragraph 1 Clause 1 Letter f) GDPR. If the e-mail contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 Para. 1S. 1 lit. b) GDPR.
2. The processing of the personal data from the input mask serves us solely to process the contact. Of course, we will only use the data from your e-mail inquiries for the purpose for which you made them available to us when contacting us. If contact is made by e-mail, the required legitimate interest in processing the data also lies in answering it. The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.
3. The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. For the personal data from the input mask of the contact form and those sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is over when it can be inferred from the circumstances that the facts in question have been finally clarified. The additional personal data collected during the sending process will be deleted after a period of seven days at the latest.
4. You have the option to revoke your consent to the processing of your personal data at any time. If you contact us by email, you can object to the storage of your personal data at any time. In such a case, the conversation cannot be continued. Regarding the revocation of the consent/objection to the storage, we ask you to contact the person responsible or the data protection officer according to § 1 via e-mail or post. All personal data that was saved in the course of making contact will be deleted in this case.

§ 7 Web analysis by Google Analytics (with pseudonymization)

We use the service of Google Inc. (Google Inc., 1600 Amphitheater Parkway Mountain View, CA 94043, USA) on our website to analyze the surfing behavior of our users. The software sets a cookie on your computer (for cookies see § 4 [CF1]). If individual pages of our website are called up, the following data is stored:

• Two bytes of the IP address of the user's calling system
• The accessed website
• entry pages, exit pages,
• The length of stay on the website and the abandonment rate
• The frequency of visits to the website
• Country of origin and regional origin, language, browser, operating system, screen resolution, use of Flash or Java
• used search engines and used search terms

The information generated by the cookie about the use of this website by users is usually transmitted to a Google server in the USA and stored there. This website uses Google Analytics with the extension "_anonymizeIp()". The software is set in such a way that the IP addresses are not saved in full, but only in an abbreviated form. In this way, it is no longer possible to assign the shortened IP address to the calling computer. Only in exceptional cases will the full IP address be sent to a Google server in the USA and shortened there. However, the IP address transmitted by your browser as part of Google Analytics is not merged with other Google data. [CF2]

The legal basis for the processing of personal data is Article 6 Paragraph 1 Clause 1 Letter a) GDPR. For the exceptional cases in which personal data is transferred to the USA.

Google will use this information on our behalf to evaluate your use of the website and to compile reports on website activity. By evaluating the data obtained, we are able to compile information about the use of the individual components of our website. This helps us to constantly improve our website and its user-friendliness.

The data will be deleted as soon as they are no longer required for our recording purposes. In our case, this is the case after x months [CF3].

The cookies used are stored on your computer and transmitted to our site. If you do not agree to the collection and analysis of usage data, you can prevent this by setting your browser software accordingly by deactivating or restricting the use of cookies. Cookies that have already been saved can be deleted at any time. In this case, however, you may not be able to use all the functions of this website to their full extent. You can also prevent Google from collecting the data generated by the cookie and related to your use of the website (including your IP address) and from processing this data by Google by downloading the browser plug-in available under the following link and install. The current link is: http://tools.google.com/dlpage/gaoptout?hl=de.You have the option to revoke your consent to the processing of personal data at any time. If you contact us by email, you can object to the storage of your personal data at any time. Regarding the revocation of the consent/objection to the storage, we ask you to contact the person responsible according to § 1 via e-mail or post.

If you visit our website with your mobile device, you can also object to its use here by deactivating Google Analytics by clicking on the following link: <a href="javascript:gaOptout()">Deactivate Google Analytics</a> . In this case, a cookie is set in your browser, which tells Google to prevent tracking. [CF4]

The controller is Google Ireland Ltd., Gordon House, 4 Barrow Street, Dublin, Ireland, Fax: +353 (1) 436 1001. For more information, see the Terms of Use at www.google.com/analytics/terms/de.html, in the overview of data protection at www.google.com/intl/de/analytics/learn/privacy.html and in the data protection declaration at www.google.de/intl/de/policies /privacy.

[CF1]Please see which § contains the cookie policy. These may also have to be adjusted, ie with regard to the technically unnecessary cookies, reference must now also be made to the legal basis Article 6 Paragraph 1 lit.

[CF2]Only if the anonymized version is used, which we recommend.

[CF3]Please check how long you have stopped recording. We recommend a maximum of 18 months of recording.

[CF4]Applies only to the app, since no consent solution is technically feasible at the moment. However, it must be constantly checked whether this does not result in technical innovations.

§ 8 Social Media Plugins

1.Facebook

1. Social plugins from the social network Facebook (Facebook, 1601 South California Avenue, Palo Alto, CA 94304, USA) are used on these pages. This plugin allows you to bookmark these pages and share them with other social network participants. You can recognize this plugin by the Facebook logo or the typical “Like button”. You can find an overview of the Facebook plugins at http://developers.facebook.com/docs/plugins/.
2. We use the so-called two-click solution. This means that when you visit our site, no personal data is initially passed on to Facebook. We give you the opportunity to communicate directly with Facebook using the button. Facebook only receives the information that you have accessed the corresponding website of our online offer if you click on the marked field and thereby activate it.

The data is passed on regardless of whether you have a Facebook account and are logged in there.

• If you click the Facebook "Like" button while you are logged into your Facebook account, the content of these pages can also be linked to the Facebook profile. In this case, Facebook can also assign the visit to these pages to your user account. If you press the activated button and e.g. If you link the page, for example, Facebook also stores this information in your user account and shares it publicly with your contacts. We recommend that you log out regularly after using a social network, but especially before activating the button, as this way you can avoid being assigned to your profile.
• If you are not a member of Facebook or have logged out of Facebook before visiting this page, there is still the possibility that Facebook will find out your IP address and save it. If you do not want Facebook to record your visit to our pages on your Facebook user account, you must log out of Facebook before visiting our website or may not activate the plugin.

The following data is generally transmitted to Facebook:

• Browser-related data such as IP address, browser type, operating system, time and date of the request, website visited.
• User ID (with registered Facebook account)

According to information provided by Facebook in Germany, the IP addresses are made anonymous immediately after collection. By activating the plugin, your personal data will be transmitted to Facebook and stored in the USA. Since Facebook uses cookies in particular to collect data, we recommend that you delete all cookies in your browser's security settings before clicking on the grayed-out box.

1. We have no influence on the collected data and data processing procedures, nor are we aware of the full extent of the data collection, the purposes of the processing, the storage periods. We also have no information on the deletion of the data collected by Facebook.
2. Facebook stores the data collected about you as usage profiles and uses them for advertising, market research and/or needs-based design of its website. Such an evaluation is carried out in particular (also for users who are not logged in) to display needs-based advertising and to inform other users of the social network about your activities on our website. With the plugins we offer you the opportunity to interact with social networks and other users, so that we can improve our offer and make it more interesting for you as a user.
3. The legal basis for using the plugins isArticle6Paragraph1Clause 1 Letter a GDPR.
4. You have the right to object to the creation of these user profiles, although you must contact Facebook to exercise this right.
5. Settings and objections to the use of data for advertising purposes are possible within the Facebook profile settings at https://www.facebook.com/settings?tap=ads. Further information on the purpose and scope of the data collection and its processing as well as on your respective rights by and towards Facebook can be foundathttp://www.facebook.com/policy.php,http://www.facebook.com/help/186325668085084,http://www.facebook.com/about/privacy/your-info-on-other#applicationsandhttp://www.facebook.com/about/privacy/your-info#everyoneinfo.
6. We use the so-called two-click solution. This means that when you visit our site, no personal data is initially passed on to Google. We give you the opportunity to communicate directly with Google via the button. Only if you click on the marked field and thereby activate it will Google receive the information that you have accessed the corresponding website of our online offer.

If you click the "+1 button" while you are logged into your Google account, the content of these pages can also be linked to the Google profile. In this case, Google can also assign the visit to these pages to your user account. If you press the activated button and e.g. If you link the page, for example, Google also stores this information in your user account and shares it publicly with your contacts. We recommend that you log out regularly after using a social network, but especially before activating the button, as this way you can avoid being assigned to your profile.

The following data is generally transmitted to Google:

• Device-specific information, such as the hardware used; the version of the operating system; unique device identifier and cellular network information including your phone number.
• Log data in the form of server logs. These include, among other things, details of how the Services were used, such as search queries; IP address; hardware settings; browser type; browser language; date and time of your request; page of origin; Cookies that can be used to uniquely identify your browser or Google account
• Location Information. Information about your actual location may be collected by Google. This includes, for example, your IP address, your WLAN access points or mobile phone masts
• Further information on the data collected by Google, INC can be found under the following link: https://policies.google.com/privacy?hl=de&gl=de

By activating the plugin, your personal data will be transmitted to Google and stored in the USA. Since Google uses cookies in particular to collect data, we recommend that you delete all cookies in your browser's security settings before clicking on the grayed-out box.

1. We have no influence on the collected data and data processing procedures, nor are we aware of the full extent of the data collection, the purposes of the processing, the storage periods. We also have no information on the deletion of the data collected by Facebook.
2. Google stores the data collected about you as usage profiles and uses these for the purposes of advertising, market research and/or the needs-based design of its website and, if necessary, for passing it on to partner companies. Such an evaluation is carried out in particular (also for users who are not logged in) to display needs-based advertising and to inform other users of the social network about your activities on our website. With the plugins we offer you the opportunity to interact with social networks and other users, so that we can improve our offer and make it more interesting for you as a user.
3. The legal basis for the use of the plugins isArticle6Paragraph1Sentence 1 lit. f GDPR.
4. You have the right to object to the creation of these user profiles, although you must contact Google to exercise this right.
5. Further information on the purpose and scope of the data collection and its processing as well as on your respective rights by and vis-à-vis Google can be foundathttps://www.google.com/policies/privacy/partners/?hl=de.

§ 9 Newsletter

1. If you purchase goods or services from us and provide your e-mail address, this can subsequently be used by us to send a newsletter. In such a case, only direct advertising for our own similar goods or services will be sent via the newsletter.The legal basis for sending the newsletter is Art. 7 Para. 3 UWG.
2. To avoid abusive or incorrect email information, we use the so-called double opt-in procedure. This means that we will send you an e-mail to the e-mail address provided, in which we ask you to confirm that the e-mail address is correct. If you do not confirm your information within [24 hours], your information will be blocked and automatically deleted after one month. In addition, we store the IP addresses you use and the times of registration and confirmation.
3. The collection of the user's e-mail address serves to deliver the newsletter. The collection of other personal data as part of the confirmation process in accordance with paragraph 2 serves to prevent misuse of the services or the email address used.
4. The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. The user's e-mail address will therefore be stored for as long as you do not revoke the receipt of the newsletter.
5. You can unsubscribe from receiving our e-mails at any time by clicking on the " Unsubscribe from newsletter" field in our newsletter binder or by sending us a text message (e-mail, letter or fax) to the contact details given in the imprint, from which it becomes apparent that you no longer wish to receive our promotional emails.

§ 10 Rights of the data subject

If personal data is processed by you, you are the data subject within the meaning of the GDPR and you have the following rights vis-à-vis the person responsible:

1. right to information,
2. Right to Rectification
3. right to restriction of processing,
4. Right to Erasure
5. right to information
6. Right to data portability.
7. Right to object to processing
8. Right to withdraw consent under data protection law
9. Right not to use an automated decision
10. Right to lodge a complaint with a supervisory authority

1. Right to information

1. You can request confirmation from the person responsible as to whether personal data relating to you is being processed by us. If such processing is present, you can request free information from the person responsible at any time about the personal data stored about you and about the following information:

• the purposes for which the personal data are processed;
• the categories of personal data being processed;
• the recipients or categories of recipients to whom your personal data has been or will be disclosed;
• the planned duration of the storage of the personal data concerning you or, if specific information on this is not possible, criteria for determining the storage duration;
• the existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the person responsible or a right to object to this processing;
• the existence of a right of appeal to a supervisory authority;
• all available information about the origin of the data if the personal data are not collected from the data subject;
• the existence of automated decision-making including profiling in accordance with Art. 22 Para. 1 and 4 GDPR and - at least in these cases - meaningful information about the logic involved as well as the scope and intended effects of such processing for the data subject.

1. You have the right to request information as to whether your personal data is being transmitted to a third country or to an international organization. In this context, you can request to be informed of the appropriate guarantees pursuant to Art. 46 GDPR in connection with the transmission.

2. Right to Rectification

You have the right to immediate correction and/or completion from the person responsible if the processed personal data concerning you is incorrect or incomplete.

3. Right to restriction of processing

1. Under the following conditions, you can request the person responsible to immediately restrict the processing of your personal data:

• if you contest the accuracy of the personal data concerning you for a period that enables the person responsible to check the accuracy of the personal data;
• the processing is unlawful and you refuse to delete the personal data and instead request that the use of the personal data be restricted;
• the person responsible no longer needs the personal data for the purposes of processing, but you need them to assert, exercise or defend legal claims, or
• if you have lodged an objection to the processing pursuant to Art. 21 Para. 1 GDPR and it has not yet been determined whether the legitimate reasons of the person responsible outweigh your reasons.

1. If the processing of the personal data concerning you has been restricted, this data - apart from its storage - may only be used with your consent or to assert, exercise or defend legal claims or to protect the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State are processed. If the restriction of processing has been restricted according to the above conditions, you will be informed by the person responsible before the restriction is lifted.

4. Right to erasure

1. You can request the person responsible to delete the personal data concerning you immediately if one of the following reasons applies:

• The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.
• You revoke your consent on which the processing was based pursuant to Article 6(1)(a) or Article 9(2)(a) GDPR and there is no other legal basis for the processing.
• You object to the processing in accordance with Article 21 (1) GDPR and there are no overriding legitimate reasons for the processing, or you object to the processing in accordance with Article 21 (2) GDPR.
• The personal data concerning you