Mobile App Privacy Policy

PRIVACY POLICY
v3.2
(effective as of 2021-10-27

1. General Provisions
(1) During the processing of natural person’s personal data in connection with the services
provided under the Portal available through the domains vcc.live and vcc.live/hu,
members of the VCC Live Group as data controllers shall act in accordance with this
Privacy Policy.
By using the Portal, you agree to the provisions of this Privacy Policy.
Members of the VCC Live Group form a group of enterprises as construed for the
purposes of the GDPR. The controlling undertaking shall be the undertaking that can
exert a dominant influence over the other undertakings by virtue, for example, of
ownership, financial participation or the rules which govern it or the power to have
personal data protection rules implemented. An undertaking which controls the
processing of personal data in undertakings affiliated to it should be regarded, together
with those undertakings, as a group of undertakings.

Members of the VCC Live Group:

Data of the controlling company:
Company name: VCC Live Group Zártkörűen Működő Részvénytársaság
Registered seat: 1117 Budapest, Október Huszonharmadika utca 8-10. Allee Corner Irodaház Bercsényi Tower 4. floor
Company register number: 01-10-141046
Mailing address: 1117 Budapest, Október Huszonharmadika utca 8-10. Allee Corner Irodaház Bercsényi Tower 4. floor
Electronic (e-mail) address: [email protected]
Tax ID: 24670023-2-43

Data of controlled companies:

Company name: VCC Live Hungary Korlátolt Felelősségű Társaság
Registered seat: 1117 Budapest, Október Huszonharmadika utca 8-10. Allee Corner Irodaház Bercsényi Tower 4. floor
Company register number: 01-09-735941
Mailing address: 1117 Budapest, Október Huszonharmadika utca 8-10. Allee Corner Irodaház Bercsényi Tower 4. floor
Electronic (e-mail) address: [email protected]
Tax ID: 13452696-2-43

Company name: VCC Live Germany GmbH
Registered seat: Gontardstraße 11, 10178 Berlin, Germany
Company register number: HRB 190017 B
Electronic (e-mail) address: [email protected]
Tax ID: DE277993151

Company name: VCC Live USA Inc.
Registered seat: State of Delaware, Centerville Road, Suite 400, City of Wilmington,
County of New Castle, Delaware 19808, USA
Electronic (e-mail) address: [email protected]

Center of activities: 1117 Budapest, Október Huszonharmadika utca 8-10. Allee Corner Irodaház Bercsényi Tower 4. floor

The representative of the VCC Live Group:
name: Tóth Szabolcs
email: [email protected]
phone: +36 1 999 7400

VCC Live Group’s Joint Data Protection Officer:
name: dr. Seres Rita
email: [email protected]
phone: +36 1 999 7400

(2) The objective of this Privacy Policyt is to establish the scope of the processed personal
data and the method of data processing, along with ensuring that the constitutional
principles of data protection and the requirements of data security are adhered to in
order to ensure respect for the privacy of natural persons.

(3) To achieve the goals set out in subsection (2), your personal data will be handled
confidentially, in line with the operational statutory provisions. We ensure their security
and take the technical and organizational measures and create the procedural rules
necessary to meet the pertinent statutory requirements and other recommendations.

(4) When processing personal data, we adhere to the requirements of the operational data
protection regulations, including individual industry regulations at all times. This
especially pertains to the requirements of the regulation (EU) 2016/679 of the
European Parliament and Council (General Data Protection Regulation, hereinafter:
GDPR).

2. Consent-based Data Processing
You are entitled to withdraw your consent to processing your data anytime. The withdrawal
of consent shall not affect the lawfulness of the data processing based on consent before its
withdrawal.
You may revoke your consent in one of the following ways:
● in case of newsletter by clicking on the unsubscribe link in the newsletter or by
sending a letter to [email protected]
● by sending a letter to [email protected]
● by post to the following address: VCC Live Group Zrt. 1117 Budapest, Október Huszonharmadika utca 8-10. Allee Corner Irodaház Bercsényi Tower 4. floor

3. Data Processing Activities
3.1 Newsletters

On our Portal, we offer the possibility to sign up to our newsletter. We only send you
newsletters if you have given your explicit consent to receive them by ticking the
corresponding box on the Portal.
If you opt in to our newsletter, we process the following data (processed data):
a) When subscribing to our newsletter, you have to disclose the following data:
● full name (optional)
● email address
b) If you subscribe to our newsletter services, in addition to the above, the following
data will be stored/processed in connection with you:
● the domain name you subscribed to our newsletter through
● date and time of subscription
● IP address

Purpose of Data Processing: To continuously inform you, as a user with a subscription to
our newsletter, about the latest news and information with regards to our services and to
prove the given consent.

You may unsubscribe from our newsletter at any time, without restriction or justification, free
of charge as stated in section 2.

Legal Basis for Data Processing: Your prior, voluntary consent [GDPR Article 6. (1) a)]

Term of Data Processing: Until the withdrawal of your consent.

Data Processor: Hubspot – HubSpot Ireland Limited (address: 662880, Two Dockland
Central, Guild Street Dublin 1, Ireland, https://www.hubspot.com/, privacy policy:
https://legal.hubspot.com/product-privacy-policy). As part of the service provided by
Hubspot, personal data may be transferred to the USA. According to the relevant legislation,
the transfer of data to this third country is adequately guaranteed by the fact that VCC Live
has entered into standard contractual clauses with this service provider.

3.2 Applications for Job Adverts and Uploading CV-s under menu “Careers”

On our Portal, you may apply for open positions under the menu “Careers”. You can apply by disclosing the following data and by uploading your CV:
● full name
● e-mail address
● telephone number
● short text message, which may contain personal data.
Processed data:
● full name
● e-mail address
● telephone number
● short text message, which may contain personal data
● personal data in the CV
● IP address

Purpose of data processing: filling the advertised position, recruitment, employee
selection, evaluation of applications; if consent to storing the application data is granted
(registration to HR database), a further purpose shall be your information about job openings
matching your qualifications, skills and intentions; and to prove the given consent.

Legal basis for data processing:
● data processing is necessary in case of applying for the advertised job to take
steps at the request of the applicant before concluding the employment contract
[GDPR Article 6. (1) b)]
● Your prior and voluntary consent in case of registration to our HR database [GDPR
Article 6. (1) a)]

Term of data processing:
● If you are not selected for the position you applied for, or you decide to withdraw
your application before the applications are evaluated, the purpose of data
processing will cease to exist, and we delete your data and CV from our
database.
● If, at the time when you are being informed about the results of your application,
or at the time when you are withdrawing your application, or if you are registering
to our HR database, give your express consent to retain your application for 24
months and to receive information about job openings that match your
qualifications, we process your data and CV until you revoke your consent, but
we will delete them from our database after the expiration of 24 months at the
latest.
● If you are selected for the position, we will act in accordance with the rules of
processing our employees’ personal data, regarding which we will inform you
when establishing employment relationship.

Recipients of the data:
● The HR leader, HR team members, the leader of the concerned department and
the executive officer of the advertising company involved in the selection process
to the extent and duration absolutely necessary to carry out their tasks.
Data processor: MiniCRM Zrt. (address: 1075 Budapest, Madách Imre út 13-14.,
https://www.minicrm.hu/, privacy policy: https://www.minicrm.io/pp/)

3.3 Contacting Us through the Portal

3.3.1 On our Portal, you may initiate contact with us by disclosing certain data (Contact usand Book a Demo menu items). When filling out the contact form, we give you an opportunity to subscribe to our newsletter, as per point 3.1.

When contacting us, you have to disclose the following data:
● Name
● Telephone number
● Email address
● Number of operators
● Message

Processed data: name, telephone number, email address, personal data in the message, IP
address

Purpose of data processing: establishing contact, and to prove the given consent

Legal basis for data processing: Your prior, voluntary consent [GDPR Article 6. (1) a)]

Term of data processing: Until the withdrawal of your consent. In order to ensure that the
storage of personal data is limited to the necessary period of time, the controller shall delete
the personal data even without withdrawal of consent after 3 years from the date on which
they were provided.

In connection with your contacting, in addition to the above, the following data will be
processed by us:
● The country, where you stayed at the time of contacting us
● The address of the URL-s of VCC Live Group you have previously visited (up to a
100 sites)
● If you signed up to our newsletter during contacting us, the fact of the subscription
● The URL address of the referrer site, where you were redirected to the website of
VCC Live Group from.
Purpose of data processing: Preparation of a customized offer/cooperation
Legal basis for data processing: Your prior, voluntary consent [GDPR Article 6. (1) a)]
Term of data processing: Until the withdrawal of your consent. In order to ensure that the
storage of personal data is limited to the necessary period of time, the controller shall delete
the personal data even without withdrawal of consent after 3 years from the date on which
they were provided.

Data processor:
● Hubspot – HubSpot Ireland Limited (address: 662880, Two Dockland Central,
Guild Street Dublin 1, Ireland, https://www.hubspot.com/, privacy policy:
https://legal.hubspot.com/product-privacy-policy). As part of the service provided
by Hubspot, personal data may be transferred to the USA. According to the
relevant legislation, the transfer of data to this third country is adequately
guaranteed by the fact that VCC Live has entered into standard contractual
clauses with this service provider.

3.3.2 On the Portal, we also provide you with the opportunity to initiate contact with us for
partnership purposes by providing certain information (Become a Partner menu item).
When contacting us, you have to disclose the following data:
● Name
● Telephone number (optional)
● Email address
● Business sector
● Company name
● Message

Processed data: name, telephone neumber, email address, personal data in the message,
IP address

Purpose of data processing: establishing contact, and to prove the given consent

Legal basis for data processing: Your prior, voluntary consent [GDPR Article 6. (1) a)]

Term of data processing: Until the withdrawal of your consent. In order to ensure that the
storage of personal data is limited to the necessary period of time, the controller shall delete
the personal data even without withdrawal of consent after 3 years from the date on which
they were provided.

3.4 Use of Chat Application

You may initiate communication with the customer service staff by using the button “Live Chat” on the Portal.

The purpose of chat communication is to maintain customer relations and may involve personal data.

Processed data: personal data entered during chat communication, IP address

Purpose of data processing: initiating contact; providing general information with regards to questions you asked from us; and to prove the given consent

Legal basis for data processing: Your prior, voluntary consent [GDPR Article 6. (1) a)]

Term of data processing: Until the withdrawal of your consent; in order to ensure that thestorage of personal data is limited to the necessary period of time, the controller shall delete the personal data even without withdrawal of consent after 1 year from the date on which they were provided.

3.5 Cookies

We place an anonymous identification file (cookie) on your device, which in itself is not
suitable to identify you in any way. It is only suitable to recognize your device. No names,
e-mail addresses or any other personal information is necessary, as when the solution is
applied, you are not disclosing us any personal data. The exchange of data only happens
between the devices.

The aim of handling cookies is to find out more about your information use preferences, thus
being able to improve our services. It also aims to facilitate displaying customized pages and
marketing (advertisement) material to you based on your usage of the Portal.

You may block the placement of cookies on your device any time by adjusting your browser
settings. At the same time, please note that blocking cookies will cause certain services to
not work properly.

What kind of cookies are we using?
The cookies used on our website fall into the following categories:
A) Strictly Necessary
B) Preference
C) Statistics
D) Marketing
A detailed description of the cookies used can be found in the Cookie Policy
We regulary review our website with a cookie scanning tool to make the cookie list as
accurate as possible.

A) Strictly Necessary cookies
There are cookies that are essential for the operation of the Portal. These are the so-called
technically necessary cookies. We may use these cookies without your permission.
Data collection is anonymous.

B) Preference cookies
These cookies allow the website to remember information that changes the behavior or
appearance of the website, such as used language or region. Cookies that help customize
the user interface are used to store user preferences related to the service that are not
associated with other persistant identifiers, such as username. (For example, cookies for the
desired language, cookies the desired display of results when querying.) We are entitled to
use these cookies based on your consent.

C) Statistics cookies
These cookies help the website owners to understand how visitors use the website by
collecting and reporting information anonymously. Cookies used to increase performance
collect information about how you use the Portal. We are entitled to use these cookies based
on your consent.

We use Google Analytics cookies to better understand the behavior and characteristics of
our users: which subpages, how often and for how long have they been visited by them.
These cookies only identify your computer, the collection of data is anonymous. Details of
Google Analytics (Google Ireland Limited, Gordon House, Barrow Street 4, Dublin, Ireland)
data management practices can be found at this link.

We use web analytics services provided by Hotjar Ltd. (level 2 St. Julians Business Center,
3, Elia Zammit Street, St. Julians STJ 1000 Malta). Web analytics services also use cookies
to help analyze the use of online interfaces. Hotjar uses cookies and other technologies to
collect information about user behaviour and devices. We use it to anonymously examine
how well users are able to use the website. It allows us to develop our content so that it is
easier and even more understandable for visitors to connect with our services. For more
information on Hotjar’s data management practices, the scope of the data processed and
how to disable the cookie used by Hotjar, please visit Hotjar’s website.

We also use the lead identification service of Albacross (Albacross Nordic AB, Kunggatan
26, 111 35 Stockholm, Sweden). The personal information collected through the use of
cookies and used by Albacross is the IP address from which you visited the Portal and
technical information that allows Albacross to separate different visitors from the same IP
address. The purpose of data processing is to enable Albacross to improve its services on
our website (lead generation) by adding the data collected to their database of company
information. Another goal is to deliver targeted advertising to companies, and for this
purpose data will be transferred to third party data service providers. You may find
Albacross’s privacy policy on this website.

D) Marketing

These cookies are used to track visitors across websites. Targeted cookies allow you to
display ads that are relevant and interesting to a particular visitor. In addition, these cookies
allow you to connect to social media sites. Only your computer is identified, the data
collection is anonymous. We are entitled to use these cookies based on your consent.

Remarketing allows us to display ads to people who have previously visited our website.
The purpose of data processing is to display advertisements to previous users on Facebook
and Google.

The legal basis for data processing is the legitimate interest of VCC Live (direct marketing)
based on Article 6 (1) f) of the GDPR. Data subject has the right to object at any time to the
processing of personal data for remarketing purposes concerning him or her.

We use remarketing services, for example, the remarketing services of Google Ads to have
our customized advertisements reach you. You may block these cookies in the control panel
of your Google advertisement settings, as per the instructions thereof. For Google’s data
protection policy with regards to advertisements, click here.

We also use the lead identification service of Albacross (Albacross Nordic AB, Kunggatan
26, 111 35 Stockholm, Sweden). The personal information collected through the use of
cookies and used by Albacross is the IP address from which you visited the Portal and
technical information that allows Albacross to separate different visitors from the same IP
address. The purpose of data processing is to enable Albacross to improve its services on
our website (lead generation) by adding the data collected to their database of company
information. Another goal is to deliver targeted advertising to companies, and for this
purpose data will be transferred to third party data service providers. You may find
Albacross’s privacy policy on this link.

3.6 Use of Social Media Add-Ons (Facebook, Twitter, LinkedIn, Instagram)

On our Portal, these add-ons are blocked by default. The add-ons are only allowed if you
click on the respective button. By allowing the add-ons, you will create a connection with the
social media platform and you authorize disclosure of your data to the platforms
Facebook/Twitter/LinkedIn/Instagram (Facebook).

If you are logged in to your Facebook/Twitter/LinkedIn/Instagram account, the given social
media platform may link your visit to your account.

By clicking the corresponding button, your browser will transfer the pertinent information
directly to the given social media platform and store it there.

● Twitter’s server will record data about your activity on the Portal and links these data with your Twitter account. Upon using the button “re-tweet”, these data will
be available for Twitter users and/or published.
● When you are browsing on the Portal, through the integrating modules you build a direct datalink between your browser and Facebook’s server. Through this, Facebook receives the information that somebody from your IP address visited this Portal. If you are using these integrating modules (for example by clicking Like or Share, Comment, etc.) while you are logged in to your Facebook account, the relevant contents of the Portal will be linked to your Facebook profile. In such cases, Facebook will link your activities on the Portal to your Facebook account. The above also applies to Instagram.
● LinkedIn’s server will record data about your activity on the Portal and links these data with your LinkedIn account. Upon using the LinkedIn button Share, these data will be available for LinkedIn users and/or published.

Further information with regards to the scope and purpose of data collection, further processing of your data by Facebook/Twitter/LinkedIn/Instagram, your rights to the protection of your personal data are available in the privacy statement of Facebook/Twitter/LinkedIn/Instagram:
https://www.facebook.com/policy.php
https://twitter.com/privacy
https://www.linkedin.com/legal/privacy-policy
https://help.instagram.com/519522125107875

3.7 Log Files

To allow the use of the services and technical operation of the Portal, along with statistical purposes, the system automatically logs the following data:
● dynamic or static IP address of your device
● depending on your device settings, the type of your browser and operating
system
● your activities associated with the website
● date and time of the activity

Term of data processing: 90 days from recording the data

Purpose of data processing: On one hand, the use of these data serves technical purposes, such as analysis and a subsequent examination of secure operation of servers.
On the other hand, these data are used for creating visitor statistics and to analyze user
preferences to improve our services.

Legal basis of data processing: the service provider’s legitimate interest [GDPR Article 6.
(1) f)]
The above data are not suitable to identify you and they are not linked to other personal
data.

Any personal data associated with you may be processed by us for purposes other than the purposes specified above – especially to improve the efficiency of services or for market research – provided that we have specified the purpose of data processing in advance and have your consent.

These data may not be linked to your identification information and may not be disclosed to third parties without your consent.

Prior to using the Portal and during that, we allow you to familiarize with the types of data processed by us and the purposes of such data processing, including processing of data not directly linked to you.

3.8 E-Book
VCC Live publishes usable content from time to time in the form of an e-book, which is available to everyone and can be downloaded for free from VCC Live’s website.
Processed data: first name, last name, email address
Purpose of data processing: making the e-book available, and to prove the given consent
Legal basis for data processing: Your prior, voluntary consent [GDPR Article 6 (1) a)].
Term of data processing: until the withdrawal of your consent, but 10 working days at most

3.9 Webinar
VCC Live publishes usable content on its website from time to time in the form of webinars (both live and on-demand), which are available to all and free of charge.
Processed data: first name, last name, email addres
Purpose of data processing: making the webinar available
Legal basis for data processing: Your prior, voluntary consent [GDPR Article 6 (1) a)].
Term of data processing: until the withdrawal of your consent, but 1 year at the latest

3.10. LinkedIn Lead Gen Forms

3.10.1. Usable contents
VCC Live publishes usable contents (e.g. in the form of an e-book, video, etc.) which is available to all LinkedIn members free of charge by filling in the LinkedIn Lead Gen Forms web form.

Processed data: first name, last name, email address
Purpose of data processing: making the contents available and to prove the given consent
Legal basis for data processing: Your prior, voluntary consent [GDPR Article 6 (1) a)].
Term of data processing: until the withdrawal of your consent, but for a maximum of 10
working days.
Information about your rights and settings for the protection of your personal data can be
found in LinkedIn’s privacy statement, which is available at the following link: link , link.

3.10.2. Newsletters

By filling in the LinkedIn Lead Gen Forms web form, you will be given the opportunity to subscribe to the VCC Live newsletter. We will only send you a newsletter if you give us your explicit consent to send you a newsletter by ticking the box on the form.

Processed data: first name, last name, email address

Purpose of Data Processing: To continuously inform you, as a user with a subscription to
our newsletter, about the latest news and information with regards to our services and to
prove the given consent.

You may unsubscribe from our newsletter at any time, without restriction or justification, free of charge as stated in section 2 of this Privacy Policy.

Legal Basis for Data Processing: Your prior, voluntary consent [GDPR Article 6. (1) a)]
Term of Data Processing: Until the withdrawal of your consent.

Information about your rights and settings for the protection of your personal data can be found in LinkedIn’s privacy statement, which is available at the following link: link , link.

3.10.3. Contacting for direct marketing purposes

Processed data: first name, last name, email address

Purpose of Data Processing: Contacting for direct marketing purposes

Legal basis of data processing: the service provider’s legitimate interest [GDPR Article 6.
(1) f)]

The balancing test, which can be requested at [email protected], includes a demonstration that
we have adequately identified our legitimate interests and, on this basis, we will carry out the
processing in a way that does not constitute a disproportionate restriction on your interests,
rights and freedoms.

Term of Data Processing: 1 year from the date of acquisition of the data.

You have the right to object to the processing of your personal data for direct marketing purposes, whether with regard to initial or further processing, at any time and free of charge, under the conditions set in section 6.4 of this Privacy Policy.

Data Processor: Hubspot – HubSpot Ireland Limited (address: 662880, Two Dockland Central, Guild Street Dublin 1, Ireland, https://www.hubspot.com/,

Information about the further processing and use of your data by LinkedIn, your rights and
settings for the protection of your personal data can be found in LinkedIn’s privacy
statement, which is available at the following [link.]https://legal.hubspot.com/privacy-policy)

As part of the service provided by Hubspot, personal data may be transferred to the USA.
According to the relevant legislation, the transfer of data to this third country is adequately
guaranteed by the fact that VCC Live has entered into standard contractual clauses with this
service provider.

4. Information and Contact Details of Data Processors

Information on data processors used by us is available in point 3.
During our data processing activities, in addition to what’s established in point 3, we use the following data processors:
● Data of the server service provider: Vultr Holdings Corporation (319 Clematis
Street Suite 900, West Palm Beach, FL 33401, USA)

We reserve the right to use further data processors other than the ones listed above,
provided that we publish such data processors’ names and addresses until, but the latest at
the time of the start of data processing.

5. Contacting for direct marketing purposes

5.1 Contacting the visitor of the Portal

Purpose of data processing: contacting for direct marketing purposes
Legal basis of data processing: GDPR Article 6. (1) f) [the processing is necessary for the
leigtimate interest of VCC Live]

Processed data: name, email address, telephone number, number of employees, number of agents, job title, country

Source of processed data: personal data provided by the data subejct on the Portal

(Contact, Book Demo, E-Book, Webinar, subscribing to newsletter)

Term of data processing: 1 year from the date of acquisition of the data.

Data processor: Hubspot – HubSpot Ireland Limited (address: 662880, Two Dockland Central, Guild Street Dublin 1, Ireland, https://www.hubspot.com/,

As part of the service provided by Hubspot, personal data may be transferred to the USA.
According to the relevant legislation, the transfer of data to this third country is adequately
guaranteed by the fact that VCC Live has entered into standard contractual clauses with this
service provider.

Interest balance test

The balancing test, which can be requested at [email protected], includes a demonstration that
we have adequately identified our legitimate interests and, on this basis, we will carry out the
processing in a way that does not constitute a disproportionate restriction on your interests,
rights and freedoms.

The data subject has the right to object to this processing based on legitimate interest, as set out in point 7.4 of present Privacy Policy.

Profiling

Definition: Profilig means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

VCC Live has a legitimate interest in profiling in order to provide you with offers tailored to your needs and interests. Personalised offers are sent to the data subject by email. If the data subject has consented to the use of marketing cookies on our website and initiates a contact with us by providing personal data (Contact, Book Demo, E-book, Webinar, newsletter subscription), we will assign points to the data subject’s activities on our website through the software of our data processer, as part of profiling, which will allow us to easily determine the quality of the data subject’s potential subscribers. If, as a result of the
profiling, we conclude that the data subject is a potential subscriber, we will contact the data subject via email.

We have carried out a data protection impact assessment in connection with the profiling, which concluded, among other things, that the severity and likelihood of potential risks (e.g. unauthorised access to data, loss of data) are negligible. Measures are in place to ensurethat the data subject’s data are kept secure. The provision of personal data by the data subject is not mandatory, but is necessary to initiate the contact (Contact, Book Demo, E-book, Webinar, newsletter subscription), in caseof failure to provide the data, the contact cannot be established. The data subject has the right to object at any time, free of charge, to the processing of personal data concerning him or her for the above purposes.

6. Persons with right to access personal data
Our own employees, agents, and other contributors who need to have access to such data
to fulfill their professional duties or the tasks assigned to them. We shall ensure that
individuals who have access to the data processed by us adhere to the provisions of this
privacy policy and to the requirements of the applicable legislation at all times.

7. Your Rights with regards to Data Processing
The service provider will inform you without undue delay, but in any case within one month of
receipt of the request about the actions taken concerning the request about the rights of the
data subject. If necessary, taking into account the complexity and number of requests , the
deadline may be extended by two further months.

The service provider provides you the actions taken in connection with data subject rights
free of charge, however where requests from a data subject are manifestly unfounded or
excessive, in particular because of their repetitive character, the service provider may either
charge a reasonable fee taking into account the administrative costs of providing the
information or communication or taking the action requested, or refuse to act on the request.

7.1 Right to Access

(1) You are entitled to receive feedback from us whether processing of your personal data
is in progress, and if this is the case, you are entitled to access to your personal data
and the following information:
a) purpose of data processing:
b) data categories of the affected personal data
c) recipients your personal data are or will be disclosed to, especially
recipients in third countries or international organizations
d) the term of retaining data, or if not possible, the factors of establishment of
this term
e) your right to request corrections, deletion or restriction of processing of
your personal data and your right to object against processing of such
personal data;
f) the right to submit a complaint to a supervisory authority;
g) if your personal data have not been obtained from you, all available
information with regards to their sources

(2) The copy of the personal data forming the subject of data processing shall be disclosed
to you. For further copies requested by you, we charge a reasonable fee, based on our
administrative costs. If the request was submitted electronically, we disclose the
information in a widely used electronic format, except requested otherwise.

7.2 Right to Erasure (‘right to be forgotten’)

(1) You shall have the right to obtain from the service provider the erasure of personal
data concerning you without undue delay and the service provider shall have the
obligation to erase personal data without undue delay where one of the following
grounds applies:
a) the personal data are no longer necessary in relation to the purposes for
which they were collected or otherwise processed,
b) you withdraw your consent on which the processing is based and there is
no other legal ground for processing
c) you object to the processing pursuant to GDPR Article 21. (1) and there
are no overriding legitimate grounds for the processing, or you object to
the processing pursuant to GDPR Article 21. (2);
d) the personal data have been unlawfully processed,
e) the personal data have to be erased for compliance with a legal obligation
in European Union or Member State law to which the service provider is
subject.

7.3 Right to Rectification

(1) Upon your request, we correct your personal data without undue delay.
(2) If accurate and correct or supplementary data is not available, we base our
correction/supplement on your supplementary statement.

7.4 Right to Object

(1) You may object anytime against processing your personal data on grounds relating to
your particular situation, if
a) processing or transmission of personal data is necessary to protect our or
third parties’ legitimate interests only, except where data processing is
mandatory;
b) your personal data are used or transmitted for direct marketing purposes;
or
c) in any other cases defined by law.
(2) We examine your objection and suspend data processing without delay, but within 15
days from submission of the request at the latest, and we inform you about the results
in writing.

If the objection is justified, we shall cease processing your data, including further data
collection and data transmission, and block such data. We also shall inform all parties
the respective personal data were transmitted to earlier about the objection and the
measures taken. These entities shall take action to enforce the right to objection.

If you do not agree with our decision, or, if we fail to fulfill the above obligations within
the 15 days deadline, you may submit your redress request to the competent court
within 30 days from receipt of the decision or from the last day of the above deadline.

7.5 Right to Restriction of Data Processing

(1) We will restrict data processing, if one of the following circumstances exist:
a) You challenge the accuracy of the personal data;
b) Data processing is unlawful, and you object to the deletion of your data,
instead, you request the restriction of processing thereof;
c) We no longer need your personal data for data processing, but you
request those for submission, representation or protection of your legal
claims, or
d) You have objected to data processing
(2) Except for storage, if data processing falls under restrictions, the affected personal
data may only be processed with your consent, for submission, representation or
protection of legal claims or to protect the rights of third parties (natural persons or
legal entities), or if in the interest of the European Union or any member state.

7.6 Right to Data Portability

You shall have the right to receive the personal data concerning you, which you have
provided to us, in a structured, commonly used, and machine-readable format – if this is
technically feasible -, and have the right to transmit those data to another controller without
hindrance from us, if data processing is based on your consent or a respective agreement,
and processing is carried out by automated means.

You shall also have the right to have the personal data transmitted directly from one
controller to another, where technically feasible.

Your rights under this point 7 may be restricted to safeguard the State’s internal or external
security, including purposes of home defence, public security, crime prevention and
-prosecution, law enforcement, to protect the economic- or financial interests of the State, to
prevent and investigate disciplinary- and ethical offenses committed on the job or omission
of employment law- and health and safety obligations – always including oversight and
supervision –, and to protect your or third party rights.

8. Legal Redress

If you experience an infringement of your rights, you may request remedy from:
a) the competent supervisory authority in the member state

• Contact details of supervisory authorities of the member states are available here:
  https://edpb.europa.eu/about-edpb/board/members_en
  b) the competent court with jurisdiction over your place of residence or temporary address.