9. Rights of the Data Subject
a) Right to confirmation: Every data subject has the right, as granted by the European directive and regulation maker, to request confirmation from the controller as to whether personal data concerning them is being processed. If a data subject wishes to exercise this right of confirmation, they can contact an employee of the controller at any time.
b) Right to access: Every person affected by the processing of personal data has the right, granted by the European directives and regulation maker, to receive, at any time and free of charge, information from the data controller about personal data stored about them and a copy of this information. Furthermore, the European directives and regulation maker has granted the data subject access to the following information:
the processing purposes
the categories of personal data being processed
the recipients or categories of recipients to whom the personal data have been or will still be disclosed, in particular recipients in third countries or international organisations
if possible, the planned duration for which the personal data will be stored, or, if this is not possible, the criteria for determining this duration
the existence of a right to correction or deletion of personal data concerning them or to restriction of processing by the controller or a right to object to such processing
the existence of a right to lodge a complaint with a supervisory authority
if the personal data are not collected from the data subject: all available information about the origin of the data
the existence of automated decision-making, including profiling, according to Article 22(1) and (4) of the GDPR, and - at least in these cases - meaningful information about the logic involved, as well as the significance and the potential impact of such processing on the data subject.
Furthermore, the data subject has the right to obtain information as to whether personal data has been transferred to a third country or an international organization. If this is the case, the data subject also has the right to obtain information about the appropriate guarantees in connection with the transfer.
If a data subject wishes to exercise this right to information, they can contact an employee of the controller at any time.
c) Right to rectification: Every person affected by the processing of personal data has the right granted by the European directives and regulation maker to demand the immediate correction of inaccurate personal data concerning them. Furthermore, the data subject has the right to request the completion of incomplete personal data - including by means of a supplementary statement - taking into account the purposes of the processing.
If a data subject wishes to exercise this right to rectification, they can contact an employee of the controller at any time.
d) Right to erasure (right to be forgotten) Every person affected by the processing of personal data has the right granted by the European directive and regulation maker to request the controller to immediately delete the personal data concerning them, provided that one of the following reasons applies and insofar as the processing is not necessary:
The personal data was collected or otherwise processed for such purposes for which it is no longer necessary.
The data subject withdraws their consent on which the processing was based according to Article 6 (1) (a) GDPR or Article 9 (2) (a) GDPR, and there is no other legal basis for the processing.
The data subject objects to the processing pursuant to Article 21 (1) GDPR, and there are no overriding legitimate reasons for processing, or the data subject objects to the processing pursuant to Article 21 (2) GDPR.
The personal data was processed unlawfully.
The deletion of personal data is necessary to fulfill a legal obligation under Union law or the law of the member states to which the controller is subject.
The personal data was collected in relation to offered services of the information society according to Article 8 (1) GDPR.
If one of the aforementioned reasons applies, and a data subject wishes to request the deletion of personal data stored by OB7 GmbH, they can contact an employee of the controller at any time. The OB7 GmbH employee will ensure that the request for deletion is complied with immediately.
If the personal data has been made public by OB7 GmbH and our company as the controller is obliged to delete personal data in accordance with Article 17 (1) GDPR, OB7 GmbH, taking into account available technology and implementation costs, will take appropriate measures, including technical ones, to inform other data processors who process the published personal data, that the data subject has requested the deletion of all links to these personal data or copies or replications of these personal data from these other data processors, provided that the processing is not necessary. The OB7 GmbH employee will arrange the necessary steps in individual cases.
e) Right to restriction of processing
Every person affected by the processing of personal data has the right, granted by the European directives and regulation maker, to request the controller to restrict the processing if one of the following conditions applies:
The accuracy of the personal data is contested by the data subject, for a period that enables the controller to verify the accuracy of the personal data.
The processing is unlawful, the data subject opposes the erasure of the personal data and instead requests the restriction of the use of the personal data.
The controller no longer needs the personal data for processing purposes, but the data subject needs them for the assertion, exercise or defense of legal claims.
The data subject has objected to the processing in accordance with Art. 21 Para. 1 GDPR, and it is not yet clear whether the legitimate reasons of the controller outweigh those of the data subject.
If one of the above conditions is met and a data subject wishes to request the restriction of personal data stored by OB7 GmbH, they can contact an employee of the data controller at any time. The OB7 GmbH employee will arrange for the processing to be restricted.
f) Right to data portability Every individual affected by the processing of personal data has the right granted by the European directive and regulation maker to receive their personal data, which they have provided to a controller, in a structured, common, and machine-readable format. They also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data has been provided, provided that the processing is based on consent pursuant to Art. 6 Para. 1 letter a GDPR or Art. 9 Para. 2 letter a GDPR or on a contract pursuant to Art. 6 Para. 1 letter b GDPR and the processing is done using automated procedures, provided that the processing is not necessary for the performance of a task that is in the public interest or carried out in the exercise of public authority transferred to the controller.
Furthermore, in exercising their right to data portability in accordance with Art. 20 para. 1 GDPR, the individual has the right to have personal data transferred directly from one controller to another controller, insofar as this is technically feasible and as long as this does not infringe upon the rights and freedoms of other people.
In order to assert the right to data transferability, the data subject can contact an OB7 GmbH employee at any time.
g) Right to object Every individual affected by the processing of personal data has the right granted by the European directive and regulation maker, for reasons arising from their particular situation, to object at any time to the processing of personal data concerning them that is carried out on the basis of Art. 6 para. 1 letters e or f GDPR. This also applies to profiling based on these provisions.
OB7 GmbH no longer processes the personal data in the event of an objection unless we can demonstrate compelling legitimate reasons for the processing that outweigh the interests, rights, and freedoms of the data subject, or the processing is for the assertion, exercise, or defense of legal claims.
If OB7 GmbH processes personal data to conduct direct advertising, the individual has the right to object at any time to the processing of personal data for the purpose of such advertising. This also applies to profiling insofar as it is connected with such direct advertising. If the individual objects to processing for direct advertising purposes by OB7 GmbH, OB7 GmbH will no longer process the personal data for these purposes.
Furthermore, the data subject has the right, for reasons arising from his/her particular situation, to object to the processing of personal data concerning him/her, which is carried out at OB7 GmbH for scientific or historical research purposes or for statistical purposes in accordance with Art. 89 Para. 1 GDPR, unless such processing is necessary for the performance of a task in the public interest.
To exercise the right of objection, the data subject can directly contact any employee of OB7 GmbH or another employee. The data subject is also free to exercise their right of objection in connection with the use of Information Society Services, irrespective of Directive 2002/58/EC, using automated procedures that use technical specifications.
h) Automated decisions in individual cases including profiling Every person subject to the processing of personal data has the right granted by the European Directive and Regulation to not be subject to a decision based exclusively on automated processing, including profiling, that has legal effect on him/her or significantly affects him/her in a similar manner, unless the decision (1) is necessary for concluding or fulfilling a contract between the data subject and the controller, or (2) is permissible due to Union or Member State legal regulations to which the controller is subject, and these legal regulations contain appropriate measures to safeguard the rights, freedoms, and legitimate interests of the data subject, or (3) is done with the explicit consent of the data subject.
If the decision (1) is necessary for concluding or fulfilling a contract between the data subject and the controller, or (2) is done with the explicit consent of the data subject, OB7 GmbH takes appropriate measures to safeguard the rights, freedoms, and legitimate interests of the data subject, including, at minimum, the right to obtain human intervention from the controller, express one's point of view, and contest the decision.
If the data subject wishes to exercise rights concerning automated decisions, he or she can contact an employee of the controller responsible for the processing at any time.
i) Right to withdraw data protection consent Every person subject to the processing of personal data has the right granted by the European Directive and Regulation to revoke consent to the processing of personal data at any time.
If the data subject wishes to assert their right to withdraw consent, they can contact an employee of the controller responsible for the processing at any time.