Privacy Statement
1. Name and address of the responsible body
The responsible body within the context of the EU General Data Protection Regulation (GDPR) and other national data privacy laws of the member states as well as other data privacy provisions is:
NOVO-TECH Trading GmbH & Co. KG
Siemensstrasse 31
06449 Aschersleben, Germany
Germany
Tel.: (0049) 34 73 / 2 25 03 - 0
E-mail: info@novo-tech.de
Website: www.novo-tech.de
2. Name and address of the Data Protection Officer
If you have any questions about data protection, please contact our data protection team at:
Tel.: 03473/22503-0
E-Mail: datenschutz@novo-tech.de
You can reach our company data protection officer at:
Herr Dr. Andreas Melzer
kelobit IT-Experts GmbH
Tel.: 0345/132553-80
E-Mail: dsb@kelobit.de
3. General information regarding data processing
3.1 Scope of personal data processing
In principle, we only process personal data belonging to our users to the extent that this is necessary to provide a functional website as well as our content and services. The personal data belonging to our users is usually only processed with the consent of the user. An exception to this may be made if it is not possible to obtain consent for factual reasons and legal stipulations permit the data to be processed.
3.2 Legal basis for personal data processing
If we need to obtain consent for the data subject in order to process the personal data, Article 6, Para. 1, lit a of the EU GDPR shall serve as the legal basis.
If processing personal data is required for executing a contract where the contractual party is the data subject, Art. 6 Para. 1 lit. b of the GDPR shall serve as the legal basis. This also applies to processing operations required for performing pre-contractual measures.
If processing personal data is required in order to fulfil a legal obligation of our company, Art. 6 Para. 1 lit. c of the GDPR shall serve as the legal basis.
In the event that the essential interests of the data subject or another natural person make the processing of personal data necessary, Art. 6 Para. 1 lit. d of the GDPR shall serve as the legal basis.
If the processing is required in order to protect a legitimate interest of our company or a third party and if the interests, fundamental rights and fundamental freedoms of the data subject do not override the initial interest, Art. 6 Para. 1, lit. f of the GDPR shall serve as the legal basis for the processing.
3.3 Data deletion and duration of storage
The personal data related to the data subject is deleted or blocked as soon as the reason for storing it no longer applies. Furthermore, data can be stored if this is envisaged by the European or national legislator in EU ordinances, laws or other regulations to which the responsible body is subject. Data can also be blocked or deleted if a storage period specified by the stated standards expires unless there is a requirement to continue to store the data in order to conclude or fulfil a contract.
4 Provision of the website and creation of log files
4.1 Description and scope of data processing
Each time our website is visited, our system automatically collects data and information belonging to the computer system of the visiting computer.
The following data is collected:
a. Information regarding the browser type and the used version
b. The user's operating system
c. The user's Internet service provider
d. The user's IP address
e. The date and time of the access
f. Websites from which the user's system accesses our website
g. Websites that the user's system visits via our system
The data is also stored in our system's log files. This data is not stored together with other personal data of the user.
4.2 Legal basis for data processing
The legal foundation for the temporary storage of data and log files is Art. 6 Para. 1 lit. f of the GDPR.
4.3 Purpose of data processing
The temporary storage of the IP address by the system is necessary in order to enable the website to be supplied to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.
Storage is performed in log files in order to ensure the functionality of the website. Furthermore, the data assists us to optimise the website and to ensure the security of our information technology systems. The data is not evaluated for marketing purposes within this context.
Our legitimate interest in data processing according to to Art. 6 Para 1 lit f of the GDPR also lies in these purposes.
4.4 Storage period
The data will be deleted when it is no longer necessary for the purposes for which it was stored. If the data is collected to make the website available, this takes place when the respective session is ended.
If the data is stored in log files, this takes place within seven days. It is possible to store the data beyond this point. In such a case, the IP addresses of the users are deleted or anonymised so that it is no longer possible to determine the visiting client.
4.5 Option of appeal and removal
The collected data required in order to make the website available and store the data in log files is absolutely essential for the operation of the website. Consequently, the user has no right to appeal this.
5 Use of cookies
5.1 Description and scope of data processing
Our website uses cookies. Cookies are text files that are stored in the Internet browser or in the user's computer system Internet browser. If a user visits a website, a cookie can be stored on the user's operating system. This cookie contains a characteristic string that allows the browser to be uniquely identified when the website is visited once again.
We use cookies to make our website more user-friendly. Some elements of our website require that the visiting browser continues to be identified after a page change.
In doing so, the cookies store and transfer the following data:
a. Language settings
b. Items in a shopping cart
c. Log-in information
We also use cookies on our website that enable an analysis of user surfing behaviour.
The following data can be transmitted in this way:
a. Entered search teams
b. Frequency of site visits
c. Use of website functions
The user data collected in this way is pseudonymised via means of technical measures. Consequently, it is no longer possible to allocate the data to the visiting user. The data is not stored together with other personal data belonging to the user.
When visiting our website, the users are notified about the use of cookies for analysis purposes and directed to this data privacy statement by means of information banner. In this context, a notification as to how the storage of cookies can be prevented in the browser settings is also provided.
5.2 Data processing legal basis
The legal basis for personal data processing when using cookies is Art. 6 Para. 1 lit. f of the GDPR.
The legal basis for personal data processing when using technically required cookies is Art. 6 Para. 1 lit. f of the GDPR.
The legal basis for personal data processing when using cookies for analysis purposes with user consent is Art. 6 Para. 1 lit. a of the GDPR.
5.3 Purpose of data processing
The purpose of using technically required cookies is to simplify the use of the website for the users. Some features of our website cannot be offered without cookies. For these pages, it is necessary that the browser is recognised, even after a page change.
We require cookies for the following applications:
a. Shopping cart
b. Assumption of language settings
c. Remembering search terms
The user data collected via the technically required cookies is not used to create user profiles.
The purpose of analysis cookies is to improve the quality of our website and its contents. The analysis cookies help us to learn how our website is used and enable us to constantly optimise our Internet presence.
Our legitimate interest in personal data processing according to to Art. 6 Para 1 lit f of the GDPR also lies in these purposes.
5.4 Duration of storage, option of appeal and removal
Cookies are stored on the user's computer, from where they are transferred to our page. Therefore you, as a user, also have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your Internet browser. Cookies that have already been stored can be deleted at all times. This can also be performed automatically. If cookies are deactivated for our website, you may not be able to fully use all of the functions of the website.
The transmission of Flash cookies cannot be prevented via the browser settings. This must be done in the Flash Player settings.
6 Newsletter
6.1 Description and scope of data processing
Our Internet site offers users the chance to subscribe to a free newsletter. In doing so, the data provided to us on the entry screen will be transmitted to us in order to register for the newsletter.
Furthermore, the following data is collected during registration:
a. IP address of the visiting computer
b. Date and time of the registration
Your consent for the data to be process is obtained within the framework of the registration process and you will be notified of this data privacy statement.
If you purchase goods or services on our website and, in doing so, store your address, this can then be used to send the newsletter. In such a situation, only direct advertising for similar goods and services from our company will be sent via the newsletter.
Nothing in association with the data processed in order to send the newsletter will be forwarded to third parties. The data is exclusively used to send the newsletter.
6.2 Data processing legal basis
The legal basis for personal data processing following user registration for the newsletter with user consent is Art. 6 Para. 1 lit. a of the GDPR.
The legal basis for the supply of the newsletter following the sale of goods or services is Section 7, Para. 3 of the German Unfair Competition Act (UWG).
6.3 Purpose of data processing
The user's e-mail address is recorded in order to be able to deliver the newsletter.
The recording of other personal data within the context of the registration process is performed in order to prevent misuse of the services of the used e-mail address.
6.4 Storage period
The data will be deleted when it is no longer necessary for the purposes for which it was stored. Consequently, the user's e-mail address is stored for as long as the subscription of the newsletter is active.
Other personal data collected within the context of the registration process is usually deleted following a period of seven days.
6.5 Option of appeal and removal
The affected user can cancel the subscription to the newsletter at any time. For this purpose, each newsletter contains a respective link.
This also enables a withdrawal of consent for the storage of personal data recorded during the registration process.
7 Registration
7.1 Description and scope of data processing
On our website, we offer users the opportunity to register by providing personal data. In doing so, the data is provided in an entry screen, transferred to us and stored. The data is not forwarded to third parties. The following data is collected within the context of the registration process:
Furthermore, the following data is stored at the time of registration:
a. The user's IP address
b. Date and time of the registration
Consent to process this data is obtained from the user within the framework of the registration process.
7.2 Data processing legal basis
The legal basis for personal data processing with user consent is Art. 6 Para. 1 lit. a of the GDPR.
If registration serves to fulfil a contract, the contractual party of which is the user or if it serves to implement pre-contractual measures, the additional legal basis for the processing of data is Art. 6, Para 1, lit. b of the GDPR.
7.3 Purpose of data processing
Registering the user is necessary to provide certain contents and services on our website.
Registering the user is necessary to fulfil a contract with the user or to implement pre-contractual measures.
7.4 Storage period
The data will be deleted when it is no longer necessary for the purposes for which it was stored.
This is the case for data gathered during the registration process if registration is cancelled or modified on our website.
This is the case for the fulfilment of a contract or implementation of pre-contractual measures during the registration process if the data is no longer required to implement the contract. After the contract ends, it may also be necessary to continue to store the contractual partner's personal data in order to fulfil contractual or statutory obligations.
7.5 Option of appeal and removal
As a user, you can cancel the registration at any time. You can arrange for the data stored about you to be modified at any time.
If the data is required to fulfil a contract or to implement pre-contractual measures, early deletion of the data is only possible to the extent that no contractual or statutory obligations oppose such deletion.
8 Contact form and e-mail contact
8.1 Description and scope of data processing
A contact form is available on our website for the purposes of making contact electronically. If a user utilises this option, the data provided in the entry screen is transmitted to us and stored. This data includes:
Furthermore, the following data is stored at the time when the message was sent:
a. The user's IP address
b. Date and time of the registration
Your consent for the data to be processed is obtained within the framework of the sending process and you will be notified of this data privacy statement.
Alternatively, contact can be made via the provided e-mail address. In this case, the user's personal data provided with the e-mail will be stored.
Nothing in this context will be forwarded to third parties. The data is exclusively used to process the conversation.
8.2 Legal basis for data processing
The legal basis for personal data processing with user consent is Art. 6 Para. 1 lit. a of the GDPR.
The legal basis for personal data processing provided when sending an e-mail is Art. 6 Para. 1 lit. f of the GDPR. If the objective of the e-mail contact is the conclusion of a contract, the additional legal basis for processing is Art. 6 Para. 1 lit. b of the GDPR.
8.3 Purpose of data processing
The only reason we process of personal data from the entry screen is to assume contact. A legitimate interest in the processing of data is also included in the event of e-mail contact.
Other personal data processed during the sending process serves to prevent misuse of the contact form and to ensure the security of our information technology systems.
8.4 Storage period
The data will be deleted when it is no longer necessary for the purposes for which it was stored. Personal data contained in the entry screen, contact form and such data sent via e-mail is deleted when the respective communication with the user has ended. The communication is ended when it can be inferred from the circumstances that the relevant facts have been finally clarified.
Any additional personal data collected during the sending process will be deleted after a period of no longer than seven days.
8.5 Option of appeal and removal
The user may withdraw their consent for the processing of personal data at any time. If the user contacts us by e-mail, they may object to the storage of their personal data at any time. In such a case, communication cannot continue.
In this case, all personal data stored in the course of communication will be deleted.
9 Web analysis via Matomo (formerly PIWIK)
9.1 Scope of personal data processing
We use the open-source software tool Matomo (formerly PIWIK) on our website in order to analyse the surfing behaviour of our users. The software places a cookie on the user's computer (see above for further information concerning cookies). If individual pages of our website are visited, the following data is stored:
a. Two bytes of the IP address belonging to the user's system.
b. The visited website
c. The website from which they accessed the visited website (referrer)
d. The sub-pages visited from the visited website
e. The duration of the visit to the website
f. The frequency of visit to the website
In doing so, the software only runs on our website servers. This personal data of the user is only saved there. The data is not forwarded to third parties.
The software is configured in such a way that the IP addresses are not fully stored; 2 bytes of the IP address are hidden (e.g.: 192.168.xxx.xxx). This method ensures that it is no longer possible to allocate the abbreviated IP address to the visiting computer.
9.2 Legal basis for personal data processing
The legal basis for the processing of the user's personal data is Art. 6 Para. 1 lit. f of the GDPR.
9.3 Purpose of data processing
Processing the personal data of the users allows us to analyse the surfing behaviour of our users. By evaluating the obtained data, we are in a position to compile information regarding the use of the individual components of our website. This assists us in continually improving our website and its user-friendliness. Our legitimate interest in data processing according to to Art. 6 Para 1 lit f of the GDPR also lies in these purposes. The anonymisation of the IP address sufficiently takes the users' interest in the protection of their personal data into consideration.
9.4 Storage period
The data is deleted as soon it is not longer required for our records.
9.5 Option of appeal and removal
Cookies are stored on the user's computer, from where they are transferred to our page. Therefore you, as a user, also have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your Internet browser. Cookies that have already been stored can be deleted at all times. This can also be performed automatically. If cookies are deactivated for our website, you may not be able to fully use all of the functions of the website.
10 Data privacy statement for the use of Google Analytics
This website uses the functions of Google Analytics, a web analytics service. The provider is Google Inc. 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. Google Analytics uses so-called "cookies". They are text files that are stored on your computer and allow an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there.
However, if IP anonymisation is active on this website, your IP address will first be abbreviated by Google within member states of the European Union or in other treaty states which are part of the Agreement on the European Economic Area. The full IP address is only transferred to a Google server in the USA and abbreviated there in exceptional circumstances. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports concerning website activities and to provide further services related to the use of the website and Internet to the website operator. The IP address transmitted by your browser within the context of Google Analytics will not be merged with other data from Google.
You can prevent cookies from being stored by adjusting your browser settings accordingly. However, we would like to point out that you may not be able to fully use all of the functions of this website in this case. You can also prevent Google from collecting the data created by the cookie and relating to your use of the website (incl. your IP address) as well as the processing of this data by Google by downloading and installing the browser plug-in which is available via the following link: http://tools.google.com/dlpage/gaoptout?hl=de
We would like to point out that the "gat._anonymizeIp();" code was added to Google Analytics on this website in order to ensure an anonymised collection of IP addresses (so-called IP masking).
11 Data privacy statement for the use of Google AdWords and Remarketing
We use the "Remarketing" and "Similar Target Groups" functions offered by Google AdWords on this website. In doing so, we differentiate between users who have already visited our website and those who are visiting us for the first time. We evaluate the data in anonymised form and use it to optimise our Internet presence. Third parties such as Google use this information to display target group-oriented online advertisements. Once you have visited our website, you will also receive customised advertising banners from us when you are on other websites as a result. In order to do so, cookies are stored and read on your computer.
You can prevent cookies from being stored by adjusting your browser settings accordingly. However, we would like to point out that you may not be able to fully use all of the functions of this website in this case. You can also prevent Google from collecting the data created by the cookie and relating to your use of the website (incl. your IP address) as well as the processing of this data by Google by downloading and installing the browser plug-in which is available via the following link: http://tools.google.com/dlpage/gaoptout?hl=de
You can also deactivate the use of cookies by Google by visiting advertising specifications. Alternatively, you can deactivate the use of cookies by third parties by visiting the deactivation page of the network advertising initiative.
12 Server log files
The website provider automatically collects and stores information in so-called server log files that your browser automatically transmits to us. These include:
- Browser type / browser version
- Utilised operating system
- Referrer URL
- Host name of the visiting computer
- Time of the server request
This data cannot be allocated to certain persons. This data will not be merged with other data sources. We reserve the right to retrospectively examine this data if we become aware of concrete indication of unlawful use.
13 DATA PRIVACY INFORMATION FOR THE MEGAWOOD® APP:
NOVO-TECH Trading GmbH & Co. KG (hereinafter called NOVO-TECH Trading) is delighted about your use of this app as well as your interest in our company as well as our products and services. We place great emphasis on protecting your data and we want you to feel safe when using the app. We will subsequently explain to you the information that we at NOVO-TECH Trading collect during your visit to the app and how this information is used.
13.1 Personal data
NOVO-TECH Trading does not use the app to collect any personal data belonging to the respective users. The system only registers the type of end device used by the customer and the retrieval / use of the respective services.
13.2 Use of app tracking
We use tracking software to determine the usage frequency and the number of users of our app. The obtained data is exclusively used in anonymised and summarised form for statistical purposes and in order to further develop the app.
13.3 Camera function
The app requires access rights to the system camera. This is only to provide the live view. No images are saved without your consent.
14 Rights of the data subject
The following list contains all of the rights of the data subjects according to the GDPR. Rights that are not relevant for the company's own website do not have to be stated. Therefore, the list may be shortened.
If your personal data is processed, you are considered by the GDPR to be the data subject and you are entitled to the following rights with regard to the responsible body:
14.1 Right to access
You can contact the responsible body to request confirmation of whether personal data concerning you is processed by us.
If such processing does take place, you can request information on the following from the responsible body:
a. the purposes for which the personal data is being processed;
b. the categories of personal data which are processed;
c. the recipients or categories of recipients to whom the personal data concerning you was or shall be disclosed;
d. the planned duration of storage of the personal data concerning you or, if specific information cannot be provided on this matter, criteria for defining the duration of storage;
e. the existence of a right to correct or delete the personal data concerning you, a right to restrict processing by the responsible body and a right to object to such processing;
f. the existence of a right to lodge a complaint with a supervisory authority;
g. all of the available information about the origin of the data if the personal data was not collected from the data subject;
h. the existence of an automated decision-making; including profiling according to Art. 22, Paras. 1 and 4 of the GDPR and – at least in these cases – meaningful information about the logic involved as well as the significance and the envisaged consequences of such processing for the data subject.
You are entitled to the right to request information about whether the personal data concerning you is transferred to a third country or an international organisation. In this context, you can request to be informed of the appropriate safeguards according to Art. 46 of the GDPR in connection with such transmission.
This right to information may be restricted insofar as it is expected to make the realisation of research and statistical purposes impossible or severely limits it and this restriction is necessary for the fulfilment of the research or statistical purpose.
14.2 Right to correction
You have a right to correction and/or completion with regard to the responsible body provided that the processed personal data concerning you is incorrect or incomplete. The responsible body must correct the data without delay.
Your right to correction may be restricted insofar as it is expected to make the realisation of research and statistical purposes impossible or severely limits it and this restriction is necessary for the fulfilment of the research or statistical purpose.
14.3 Right to processing restriction
You can request that processing of the personal data concerning is restricted under the following conditions:
a. if you dispute the accuracy of the personal data concerning you for a period that enables the responsible body to check the accuracy of the personal data;
b. if processing is unlawful and you refuse deletion of the personal data and instead request restriction in the use of your personal data;
c. the responsible body no longer needs the personal data for the purposes of processing but you require it in order to establish, exercise or defend legal claims or
d. if you have objected to processing according to Art. 21, Para. 1 of the GDPR and it has not yet been determined whether the legitimate reasons of the responsible body take priority over your reasons.
If processing of the personal data concerning you is restricted, this data may – with the exception of storage – only be processed with your consent, for the enforcement, exercise or defence of legal claims, for the protection of rights of another natural or legal person or for reasons of important public interest of the Union or of a member state.
If the processing restriction was not implemented in accordance with the aforementioned conditions, you shall be informed by the responsible body before the restriction is removed.
Your right to processing restriction may be restricted insofar as it is expected to make the realisation of research and statistical purposes impossible or severely limits it and this restriction is necessary for the fulfilment of the research or statistical purpose.
14.4 Right to deletion
a) Obligation to delete
You can contact the responsible body in order to request that the personal data concerning you be deleted immediately and the responsible body is obliged to delete this data immediately if one of the following reasons apply:
a. The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
b. You withdraw your consent on which the processing according to Art. 6, Para. 1, lit. a or Art. 9, Para. 2, lit. a of the GDPR was based and there are no other legal grounds for processing.
c. You object to processing according to Art. 21, Para. 1 of the GDPR and there are no other overriding legitimate reasons for processing or you object to processing according to Art. 21, Para. 2 of the GDPR.
d. The personal data concerning you was processed unlawfully.
e. Deletion of the personal data concerning you is required to fulfil a legal obligation under union law or the law of the member states to which the responsible body is subject.
f. The personal data concerning you was collected in relation to the offered information society services according to Art. 8, Para. 1 of the GDPR.
g. Information to third parties
If the responsible body has made the personal data concerning you public and is obliged to delete it according to Art. 17, Para. 1 of the GDPR, the responsible body shall, whilst taking the available technology and the associated implementation costs into account, take appropriate measures, including those of a technical nature, to inform other persons responsible for processing the personal data that you, as the data subject, have requested the deletion of all links to this personal data or to copies or replications of this personal data.
c) Exceptions
The right to deletion does not exist if processing is necessary
a. to exercise the right to freedom of expression and information;
b. to fulfil a legal obligation which requires processing according to union or member state law to which the responsible body is subject, to perform a task carried out in the public interest or to exercise official authority vested in the responsible body;
c. for reasons of public interest in the area of public health according to Art. 9, Para. 2, lit. h and i, as well as Art. 9, Para. 3 of the GDPR;
d. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes according to Art. 89, Para. 1 of the GDPR if the right mentioned under a) is likely to render impossible or seriously impair the achievement of the objectives of such processing or
e. for the enforcement, exercise or defence of legal claims.
14.5 Right to information
If you have asserted your right to correction, deletion or restriction of processing with regard to the responsible body, this person is obliged to inform all the recipients to whom the personal data concerning you was disclosed of this correction or deletion of data or of the processing restriction unless doing so proves to be impossible or would involve a disproportionate amount of effort.
You are entitled to receive information about these recipients from the responsible body.
14.6 Right to data transmissibility
You have the right to receive the personal data concerning you that you provided to the responsible body in a structured, common and machine-readable format. You also have the right to transfer this data to another responsible body without hindrance from the responsible body to whom the personal data was provided as long as
a. processing is based on consent according to Art. 6, Para. 1, lit. a of the GDPR or Art. 9, Para. 2, lit. a of the GDPR or on a contract according to Art. 6, Para. 1, lit. b of the GDPR and
b. processing is carried out by automated means.
In exercising this right, you also have the right to have the personal data concerning you transferred directly from one responsible body to another where technically feasible. The freedoms and rights of others must not be adversely affected by this.
The right to data transmissibility does not apply to the processing of personal data which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the responsible body.
14.7 Right to objection
For reasons relating to your particular situation, you have the right to object at any time to the processing of the personal data concerning you based on Art. 6, Para. 1, lit. e or f of the GDPR; this also applies to profiling based on these provisions.
The responsible body shall no longer process the personal data concerning you unless they can demonstrate compelling and legitimate grounds for processing which outweigh your interests, rights and freedoms, or if processing serves to enforce, exercise or defend legal claims.
If the personal data concerning you is processed for the purpose of carrying out direct advertising, you have the right at any time to object to processing of the personal data concerning you for the purposes of such advertising; this also applies to profiling if it is in conjunction with such direct advertising.
If you object to processing for the purposes of direct advertising, the personal data concerning you shall no longer be processed for these purposes.
In connection with the use of information society services – notwithstanding Directive 2002/58/EC – you can exercise your right of objection by automated means where technical specifications are used.
For reasons relating to your particular situation, you have the right to object at any time to the processing of the personal data concerning you for scientific or historical research purposes or for statistical purposes according to Art. 89, Para. 1 of the GDPR.
Your right to objection may be restricted insofar as it is expected to make the realisation of research and statistical purposes impossible or severely limits it and this restriction is necessary for the fulfilment of the research or statistical purpose.
14.8 Right to withdrawal of the declaration of consent
You have the right to revoke your declaration of consent under data protection legislation at any time. Revocation of consent does not affect the lawfulness of processing carried out based on consent up until it was revoked.
14.9 Automated decision on a case-by-case basis, including profiling
You have the right to not be subjected to a decision based solely on automated processing – including profiling – which has legal implications for you or significantly affects you in another way. This does not apply if the decision
a. is required to conclude or fulfil a contract between you and the responsible body;
b. is permissible based on union or member state legislation to which the responsible body is subject and this legislation contains appropriate measures to protect your rights and freedoms as well as your legitimate interests or
c. is made with your express consent.
However, these decisions may not be based on specific categories of personal data according to Art. 9, Para. 1 of the GDPR if as Art. 9, Para. 2, lit. a or g does not apply and appropriate measures were taken to protect rights and freedoms as well as your legitimate interests.
With regard to the cases mentioned in (1) and (3), the responsible body shall take appropriate measures to protect rights and freedoms as well as your legitimate interests, which at least includes the responsible body's right to request someone's intervention, present their own point of view and contest the decision.
14.10 Right to make a complaint with a supervisory authority
Regardless of another administrative or judicial legal remedy, you have the right to lodge complaints with a supervisory authority, particularly in the member state where your place of residence, your workplace or the place of the suspected violation is located if you believe that the processing of the personal data concerning you is in violation of the GDPR.
The supervisory authority with whom the complaint was lodged informs the complainant of the status and results of the complaint, including the possibility to appeal according to Art. 78 of the GDPR.
Aschersleben, 30.6.2020