PRIVATLIVSPOLITIK

Data protection has a high priority for us. With this data protection declaration we inform you which personal data (hereinafter also "data") are processed by us in relation to our internet presences (hereinafter "web pages") and which rights you are entitled to. The data protection declaration also implements our obligations under § 13 Telemediengesetz (TMG) and Article 13 of Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, on the free movement of data and on the repeal of Directive 95/46/EC (General Data Protection Regulation, GDPR).

By accessing or using the Service, you are consenting to the collection, use and disclosure of your information in accordance with this Privacy Policy. If you do not consent to the same, please do not access or use the Service.

We may modify this Privacy Policy at any time without any prior notice to you and will post the revised Privacy Policy on the Service. The revised Policy will be effective 180 days from when the revised Policy is posted in the Service and your continued access or use of the Service after such time will constitute your acceptance of the revised Privacy Policy. We therefore recommend that you periodically review this page.

1. Responsible person

Markus Perl

Hermann-Mayrhofer-Str. 3, 94036 Passau, Germany

E-Mail: contact gender-api.com

Our data protection officer, the IITR Datenschutz GmbH, Dr. Sebastian Kraska, can be contacted by email at email@iitr.de.

2. Definitions

The data protection declaration uses the following terms as defined in the General Data Protection Regulation:

• "personal data": any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
• "processing" any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
• "controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
• "processor" a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
• "recipient" a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;
• "third party" a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;
• "consent" of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
• "cross-border processing" either
  • processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or
  • processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.

3. Type, scope and purpose of processing, legal bases

3.1 Information we collect:

We will collect and process the following personal information about you:

• Customer data (name, gender, work address, e-mail, payment info);
• Content data (data of customers specifying names)
• Usage data (visited websites, access times, location etc.).
• Communication data (device information, IP addresses etc.).
• Contract data (contract text, payments)

3.2 How we collect your information:

We collect/receive information about you in the following manner:

• When a user fills up the registration form or otherwise submits personal information
• Interacts with the website
• From public sources

3.3 How we use your information:

We will use the information that we collect about you for the following purposes:

• Marketing/ Promotional
• Creating user account
• Processing payment
• Support
• Targeted advertising
• Manage customer order
• Manage user account
• Enforce T&C

If we want to use your information for any other purpose, we will ask you for consent and will use your information only on receiving your consent and then, only for the purpose(s) for which grant consent unless we are required to do otherwise by law.

3.4 How we share your information

We will not transfer your personal information to any third party without seeking your consent, except in limited circumstances as described below:

• Advertising services: Meta, Google, Microsoft Advertising and X, and only if you allowed the "Marketing" category in our cookie banner. Section 11 states for each of them what is transmitted and what they may do with it.
• Analytics: Matomo, which we host ourselves on our own server, so this data is not passed to a third party at all (see 11.5).
• Payment service providers and other processors we need in order to provide the service, as described in section 4.

We require such third party’s to use the personal information we transfer to them only for the purpose for which it was transferred and not to retain it for longer than is required for fulfilling the said purpose.

We may also disclose your personal information for the following: (1) to comply with applicable law, regulation, court order or other legal process; (2) to enforce your agreements with us, including this Privacy Policy; or (3) to respond to claims that your use of the Service violates any third-party rights. If the Service or our company is merged or acquired with another company, your information will be one of the assets that is transferred to the new owner.

3.5 Retention of your information

We will retain your personal information with us for 90 days to 4 years after user accounts remain idle or for as long as we need it to fulfill the purposes for which it was collected as detailed in this Privacy Policy. We may need to retain certain information for longer periods such as record-keeping / reporting in accordance with applicable law or for other legitimate reasons like enforcement of legal rights, fraud prevention, etc. Residual anonymous information and aggregate information, neither of which identifies you (directly or indirectly), may be stored indefinitely.

3.6 Your rights

Depending on the law that applies, you may have a right to access and rectify or erase your personal data or receive a copy of your personal data, restrict or object to the active processing of your data, ask us to share (port) your personal information to another entity, withdraw any consent you provided to us to process your data, a right to lodge a complaint with a statutory authority and such other rights as may be relevant under applicable laws. To exercise these rights, you can write to us at contact@gender-api.com. We will respond to your request in accordance with applicable law.

You may opt-out of direct marketing communications or the profiling we carry out for marketing purposes by clicking in the footer of our website on the "Cookie Settings" button and by changing your notification settings in your account.

Do note that if you do not allow us to collect or process the required personal information or withdraw the consent to process the same for the required purposes, you may not be able to access or use the services for which your information was sought.

3.7 The following categories of affected persons exist:

• Visitors to our websites (hereinafter also "users") and other interested parties;
• Customer of services (hereinafter also "customer"); further business partners.

4. Recipients of data, third countries

Data will only be passed on to third parties if this is necessary for the provision of our services. For payment processing, the data required in payment transactions (name, account or credit card data, e-mail address, purchase price) may be forwarded by us to a payment service provider and/or to a credit institution or PayPal commissioned with payment. Other categories of recipients are hosting providers, participants in the merchandise management and financial accounting system, external providers for customer service.

The transfer and disclosure of data to recipients, order processors or third parties shall only take place within the framework of the legal basis (see section 3 above) or if there is a more extensive legal obligation. Access to data for contractors was granted in strict compliance with Article 28 of the GDPR. Processing of data in a third country (outside the European Union (EU) or European Economic Area (EEA)) shall be carried out in accordance with Articles 44 to 50 of the GDPR. Processing takes place at a level of data protection that corresponds to the GDPR, in particular through guarantees given by contract processors, e.g. on the basis of special contractual obligations (standard contractual clauses).

5. Security

The security of your information is important to us and we will use reasonable security measures to prevent the loss, misuse or unauthorized alteration of your information under our control. However, given the inherent risks, we cannot guarantee absolute security and consequently, we cannot ensure or warrant the security of any information you transmit to us and you do so at your own risk.

6. California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)

Under California Civil Code Section 1798.83, Gender-API.com customers who are California residents may request information about the disclosure of your personal information by Gender-API.com to a third party for the third party's direct marketing purposes. If you would like to request more information, you may contact us here.

We do not sell your personal information for monetary consideration. Under the California Privacy Rights Act (CPRA), however, disclosing personal information for cross-context behavioural advertising counts as "sharing" whether or not money changes hands, and we do share in that sense: if you allow the "Marketing" category, the advertising tags described in section 11 transmit data to Meta, Google, Microsoft Advertising and X. Without that consent none of those tags is loaded and nothing is shared.

To opt out of this sharing, open the cookie settings and switch the "Marketing" category off. The footer link "Do not sell or share my personal information" opens that same dialog: there is no separate form to fill in and no request to file.

If your browser sends a "Global Privacy Control" signal, we treat it as an opt-out of sharing automatically, without you having to ask, and the marketing category stays switched off. If you afterwards choose "Accept all" yourself, that later decision overrides the signal.

7. Cookies

"Cookies" are small files that are stored on the user's computer with different information. They serve to establish the identity of the user and his device as well as to secure information provided by the user during the stay. In addition to temporary cookies ("session cookies", e.g. the contents of a shopping basket), which are deleted after leaving the web pages and closing the browser. Permanent cookies (e.g. last login, viewed websites) are not deleted after leaving the websites. In the case of so-called "Third-Party-Cookies" the cookies do not originate from the person responsible, but from a third party.

You can prevent cookies from being stored on your computer. You have the possibility to select the option in the settings of your browser that cookies are not allowed in general and related to certain pages. You can also delete existing cookies there. As a precaution, it is pointed out that the functions of our websites may be restricted if cookies are deactivated or removed.

The cookie settings dialog holds the complete and always current list of the cookies and browser storage entries used on our web pages, grouped by category and stating the provider, purpose and lifetime of each. That list is the authoritative one and this policy does not duplicate it. The entries which are strictly necessary, and which are therefore not subject to a category choice, are: PHPSESSID (7 days), which keeps you signed in and ties your actions to your session; DI (365 days, HttpOnly), by which we recognise a device you have already confirmed so that two-factor login is not repeated on every visit; asw (until you close the browser), which remembers the settings you chose in our accessibility widget; darkMode, which records that you dismissed the dark-mode notice; and the entries in which the decision you make in the cookie banner is stored. Beyond these, attrFt (2 years, HttpOnly) records which campaign first brought you to our web pages so that a later signup can be attributed to it; it is written only if you allowed the "Marketing" category, which our server verifies before setting it.

8. Record of your cookie decisions

Article 7 (1) GDPR requires us to be able to demonstrate that consent was given. We therefore keep a record of every cookie decision made on our web pages, whether it allows or refuses a category. The legal basis for this record is not your consent but Art. 6 (1) (c) GDPR, compliance with a legal obligation. That is why a decision is recorded even if you refuse everything, and why a withdrawal is recorded as well.

The record contains:

• a randomly generated consent ID, which is kept only in your own browser's local storage and which contains no information about you;
• which cookie categories you allowed and which you refused;
• whether the decision came from the cookie banner, from the cookie settings dialog, or from an automatic "Global Privacy Control" signal sent by your browser;
• a reference to a stored snapshot of the exact wording that was shown to you at that moment;
• the date and time of the decision;
• the path of the page you were on, without the query string;
• a one-way hash of your IP address, calculated together with a secret value held on our server; the IP address itself is never stored;
• the user agent string sent by your browser;
• and, only if you were signed in to a Gender-API.com account at that moment, the ID of that account.

A decision remains valid for 365 days; after that the banner asks you again. The hashed IP address and the user agent string are erased after 180 days. A decision that has been replaced by a later one is kept until the end of the third calendar year after it was replaced (the German statutory limitation period, §§ 195, 199 BGB) and is then deleted. The decision currently in force is kept for as long as it is in force. Database backups extend these periods: an entry can still be contained in a backup after it has been deleted from the live database. Backups are retained for a maximum of 30 days and are then overwritten. An erasure request is carried out immediately in the live system; in backups it takes effect at the latest when they are overwritten.

If your browser sends a "Global Privacy Control" signal, we honour it as a refusal of the marketing category without asking you; if you afterwards choose "Accept all" yourself, that later decision overrides the signal.

If you were not signed in when you made the decision, the consent ID is the only key to your record. It is shown in the small print of the cookie settings dialog, which you can open with the "Edit cookie settings here" button above, and it exists nowhere except in your browser. If you send it to us at contact@gender-api.com, we can tell you which decisions were recorded under it and which wording was shown to you each time. If you clear your browser storage, the ID is gone and we can no longer locate the record: it holds no name, no e-mail address and no IP address, so we have no other means of identifying you. We state this plainly, because it is the consequence of keeping the record free of data that identifies you. If you were signed in to a Gender-API.com account, we can find your decisions by that account instead, so you can exercise the rights described in section 14 without the consent ID.

On request we erase the identifying fields of the record, that is the hashed IP address and the user agent string. The decisions themselves are retained for the periods stated above on the basis of Art. 17 (3) (e) GDPR, because they are the proof of consent or refusal that may be required for the establishment, exercise or defence of legal claims. The record is not passed on to anyone outside our company.

9. Newsletter

When registering for the newsletter, your e-mail address will be used for our own advertising purposes (sending e-mails) until you unsubscribe from the newsletter. You can unsubscribe at any time. If necessary, you have expressly given us the following consent and we have recorded the consent. We are obliged to keep the content of the consent available at all times. You can revoke your consent at any time with effect for the future. Repetition of the consent text for the newsletter:

"Subscribe to our developer newsletter for useful tips, news and resources. You may unsubscribe from these communications at any time."

The registration is made by the so-called double opt-in procedure. After registering, you will be asked by e-mail to confirm your subscription to the newsletter. The registration is logged for evidence purposes, in this case usage data (time of registration and confirmation, IP address) is processed. The legal basis for this is your consent in accordance with Article 6 paragraph 1 letter a, Article 7 GDPR in connection with § 7 UWG; logging is based on legal requirements (Article 6 paragraph 1 letter c GDPR) and to protect our legitimate interests (Article 6 paragraph 1 letter f GDPR).

We use the services of Amazon Web Service, Inc. to send the newsletter, for which purpose your email address, usage and communication data will also be processed by this provider. The service provider is employed on the basis of our legitimate interests (Article 6 paragraph 1 letter f GDPR) and an order processing contract (Article 28 paragraph 3 sentence 1 GDPR).

You can revoke your consent to receive the newsletter at any time by clicking the "Unsubscribe" link at the end of the newsletter or by sending us an email about the withdrawal. Even after revocation, email addresses can remain stored for up to three years to protect our legitimate interests in order to be able to prove our consent for the newsletters sent until revocation.

10. Contact form

Should you send us questions via the contact form, we will collect the data entered on the form, including the contact details you provide, to answer your question and any follow-up questions. We do not share this information without your permission. We will, therefore, process any data you enter onto the contact form only with your consent per Art. 6 (1)(a) GDPR. You may revoke your consent at any time. An informal email making this request is sufficient. The data processed before we receive your request may still be legally processed. We will retain the data you provide on the contact form until you request its deletion, revoke your consent for its storage, or the purpose for its storage no longer pertains (e.g. after fulfilling your request). Any mandatory statutory provisions, especially those regarding mandatory data retention periods, remain unaffected by this provision.

11. Social Media And Analytics

This section describes our own pages in social networks and the advertising and analytics tags we run on our web pages. The legal bases differ and are stated for each service. The advertising tags described in 11.1, 11.4, 11.6 and 11.7 are loaded only if you allowed the "Marketing" category in our cookie banner, and Matomo (11.5) only if you allowed the "Analytics" category: their legal basis is your consent under Art. 6 (1) (a) and Art. 7 GDPR, which you can withdraw at any time in the cookie settings. Until you give that consent, none of them is loaded and no data is sent to the provider concerned.

11.1 Meta Pixel (Facebook Pixel)

If you allowed the "Marketing" category, we use the Meta Pixel (pixel ID 275510673807631), a conversion measurement tool of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). The pixel script is loaded from connect.facebook.net and reports your page views and the actions you complete on our web pages, in particular a signup, so that we can measure across devices (mobile phones, tablets and desktop computers) which of our advertisements on Facebook and Instagram led to them, and how effective those advertisements are.

For this purpose your IP address, information about your browser and the events described above are transmitted to Meta, and Meta stores the identifier _fbp in your browser for three months. Meta processes this data for its own purposes as well and can combine it with an existing Facebook or Instagram account, in order to build usage, interest and relationship profiles, to evaluate your use of our web pages against the advertisements shown to you, and to select advertising for you. We have no influence on that further processing and no access to the data held by Meta.

The legal basis is your consent under Art. 6 (1) (a) and Art. 7 GDPR, which you give through the "Marketing" category of our cookie banner and can withdraw at any time in the cookie settings. Without that consent the pixel is not loaded at all. For the purpose and scope of the processing by Meta and for your rights and settings, please refer to the Meta privacy policy.

11.2 Our pages in Social Networks

In addition, we are features in social networks and platforms with our own pages, where we offer information on our company and contact information. When we collect data, this is done to response to inquiries and for further correspondence with users and customers. The processing is based on Article 6(1)(a) and (b) GDPR. Please note the Terms and Conditions and the data guidelines of the respective networks and platforms, and of their operators, when accessing them.

11.3 Google tag (gtag.js) and Google Consent Mode

We do not use a Google Tag Manager container. The only Google tag on our web pages is the Google tag (gtag.js), loaded from googletagmanager.com, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). It serves the Google Ads conversion measurement described in 11.4 and nothing else. It is loaded only if you allowed the "Marketing" category; before that, and if you refuse, it makes no request to Google.

Independently of whether the tag itself is loaded, we set Google's Consent Mode v2 signals on every page. They start as denied for advertising storage, advertising user data and ad personalisation, and are set to granted only once you allow the "Marketing" category; if you withdraw that consent, they are set back to denied. These signals are values inside our own page and contain no information about you. We operate no Google Analytics property, so the signal for analytics storage always remains denied.

11.4 Google Ads Conversion Tracking

If you allowed the "Marketing" category, we use Google Ads conversion tracking (conversion ID AW-974173053), an online advertising service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). It lets us recognise that a visitor who reached our web pages through one of our Google advertisements later completed an action there, such as a signup, and it reports the total number of such conversions to us. We do not receive from it any information that would allow us to identify an individual visitor.

For this purpose the Google tag stores the identifier _gcl_au (three months) in your browser and mirrors the same Google Ads attribution data in your browser's local storage as _gcl_ls. On Google's own domain doubleclick.net, Google may additionally set IDE (13 months) and test_cookie (one day). Your IP address and information about your browser are transmitted to Google in the process, and Google may use the data to measure the performance of advertisements and to show you our advertisements on other websites.

The legal basis is your consent under Art. 6 (1) (a) and Art. 7 GDPR, which you give through the "Marketing" category of our cookie banner and can withdraw at any time in the cookie settings. Further information can be found in the Google privacy policy.

11.5 Matomo

Our website uses Matomo (www.matomo.org), an open-source, self-hosted software, to collect usage data for this website. Your IP address will be anonymized immediately after processing and before storage. Matomo stores cookies on your end device, allowing an analysis of the use of our website by you. The data collected this way is stored exclusively on our server. These data are:

• Anonymized IP addresses
• Device information
• The website from which the user has accessed the website (referrer)
• The subpages accessed from the website
• Date and the time spent on the website
• The frequency with which the website is accessed
• The main language of the browser
• User-agent of the browser

For this purpose Matomo stores the following in your browser: _pk_id.* (13 months), which recognises a returning visitor so that the same person is not counted twice, _pk_ses.* (30 minutes), which groups the pages you open into a single visit, and _pk_ref (6 months), which remembers which website referred you. Matomo is loaded only if you allowed the "Analytics" category; the legal basis is your consent under Art. 6 (1) (a) and Art. 7 GDPR, which you can withdraw at any time in the cookie settings.

11.6 X Conversion Tracking Pixel (formerly Twitter)

If you allowed the "Marketing" category, we use the X conversion tracking pixel (pixel ID oejox) of X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland ("X"), which is the controller for visitors in the European Union, the EFTA States and the United Kingdom. The pixel script is loaded from static.ads-twitter.com and reports your page views and the actions you complete on our web pages, in particular a signup, so that we can measure across devices which of our advertisements on X led to them, and how effective those advertisements are.

For this purpose your IP address, information about your browser and the events described above are transmitted to X, and X stores the identifier personalization_id in your browser for two years. X processes this data for its own purposes as well and can combine it with an existing X account, in order to build usage and interest profiles, to evaluate your use of our web pages against the advertisements shown to you, and to select advertising for you. We have no influence on that further processing and no access to the data held by X.

The legal basis is your consent under Art. 6 (1) (a) and Art. 7 GDPR, which you give through the "Marketing" category of our cookie banner and can withdraw at any time in the cookie settings. Without that consent the pixel is not loaded at all. For the purpose and scope of the processing by X and for your rights and settings, please refer to the X privacy policy.

11.7 Microsoft Advertising Conversion Tracking (Bing)

With your consent we use the Universal Event Tracking tag (UET tag ID 343267573) of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland ("Microsoft"). The tag is loaded from bat.bing.com and reports which of our pages you open and which actions you complete on them, in particular a signup, so that we can measure the effectiveness of our advertising in the Microsoft advertising network (Bing). For this purpose Microsoft stores the identifiers _uetsid (1 day) and _uetvid (13 months) in your browser, mirrors both of them in your browser's local storage, and may set the Microsoft-wide identifier MUID on bing.com (13 months). Your IP address and information about your browser are transmitted to Microsoft in the process, and Microsoft may combine this data with data of its own, including an existing Microsoft account. The legal basis is your consent under Art. 6 (1) (a) and Art. 7 GDPR, which you give through the "Marketing" category of our cookie banner and can withdraw at any time in the cookie settings. For the purpose and scope of the processing by Microsoft and for your rights, please refer to the Microsoft privacy statement.

12. Google reCAPTCHA

The demo form on our home page is protected against automated abuse by reCAPTCHA, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). reCAPTCHA is not loaded when the page opens: it is requested only when you actively start using the form, and it is then requested for every visitor, whether or not the "Functional" category was allowed. What the category decides is only how the check is carried out: if it is allowed, the check runs invisibly in the background; if it is not, you are asked to solve a visible puzzle instead. In both cases your IP address, information about your browser and your interaction with the form are transmitted to Google, which uses them to distinguish a human from a script. Google may set the cookie _GRECAPTCHA on google.com for this purpose, with a lifetime of six months.

For the invisible check, the legal basis is your consent under Art. 6 (1) (a) and Art. 7 GDPR, which you can withdraw at any time in the cookie settings. Where you have not allowed the category, the check is carried out on the basis of our legitimate interest in protecting the form against automated abuse, Art. 6 (1) (f) GDPR. Further information can be found in the Google privacy policy.

13. Server log files

The website provider automatically collects and stores information that your browser automatically transmits to us in "server log files". These are:

• Browser type and browser version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address

These data will not be combined with data from other sources. The basis for data processing is Art. 6 (1) (f) GDPR, which allows processing that is necessary for the purposes of our legitimate interests. Our legitimate interest here is the technically secure and stable operation of our web pages, the detection and investigation of faults, and protection against attacks and misuse.

14. Rights

Depending on the law that applies, you may have a right to access and rectify or erase your personal data or receive a copy of your personal data, restrict or object to the active processing of your data, ask us to share (port) your personal information to another entity, withdraw any consent you provided to us to process your data, a right to lodge a complaint with a statutory authority and such other rights as may be relevant under applicable laws. To exercise these rights, you can write to us at contact@gender-api.com. We will respond to your request in accordance with applicable law.

• You have the right to request information from us about whether and to what extent we process your data.
• If we process your data that is incomplete or incorrect, you can demand the correction or completion of it from us at any time.
• You can request the deletion of your data from us if we process it unlawfully or if the processing disproportionately interferes with your legitimate protection interests. Please note that there may be reasons that prevent immediate deletion, for example, statutory retention obligations. Regardless of your exercise of the right to erasure, we will promptly and completely delete your data as long as no relevant contractual or legal retention obligations oppose it.
• You can demand from us that we provide you with the data you have provided to us in a structured, commonly used, and machine-readable format, and that you can transmit this data to another controller without hindrance from us, provided that: We process this data based on your revocable consent or for the fulfillment of a contract between us, and this processing is carried out by automated means.
• If you believe that we are violating German or European data protection law in processing your data, we ask you to contact us to clarify any questions. Of course, you also have the right to contact the supervisory authority responsible for you, the respective State Office for Data Protection Supervision.
• You can request the restriction of the processing of your data from us if: You dispute the accuracy of the data, for a period allowing us to verify its accuracy; The data processing is unlawful, but you refuse deletion and instead demand a restriction of data usage; We no longer need the data for the intended purpose, but you still need the data to assert or defend legal claims; You have objected to the processing of the data.
• If we process your data based on legitimate interests, you can object to this data processing at any time; this also applies to profiling based on these provisions. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the assertion, exercise, or defense of legal claims. You can object to the processing of your data for the purpose of direct advertising at any time without giving reasons.