GDPR

2. What rights do you have with regard to your data? (Data subject rights)

You are entitled to so-called data subject rights, i.e. rights that you can exercise as a data subject in individual cases and assert against the controller. These rights are essentially regulated in the GDPR in Art. 12 - 23. The most important regulations are listed here:

2.1. right to information in accordance with Art. 15 GDPR

You have the right to information about the stored and archived personal data concerning you.

2.2. right to rectification in accordance with Art. 16 GDPR

If you discover that incorrect personal data concerning you is being processed, you can request rectification. Incomplete data must be completed, taking into account the purpose of the processing.

2.3. right to erasure in accordance with Art. 17 GDPR

You have the right to request the erasure of your data if certain grounds for erasure apply. This may be the case, for example, if they are no longer required for the purpose for which they were originally collected or processed.

The implementation of this right is not possible if further processing is necessary

• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation;
• for reasons of public interest or
• for the establishment, exercise or defense of legal claims

is necessary.

2.4. right to restriction of processing in accordance with Art. 18 GDPR

You have the right to request the restriction of the processing of your personal data if

• the accuracy of the data is disputed by you
• the processing is unlawful but you oppose the erasure of the data
• we no longer need the data, but you need it for the establishment, exercise or defense of legal claims, or
• You have objected to the processing pursuant to Art. 21 GDPR

This means that although your data will not be deleted, it will be marked in order to restrict its further processing or use.

2.5. possibly a right to data portability in accordance with Art. 20 GDPR

You have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller.

2.6. a right to object in accordance with Art. 21 GDPR

In principle, you also have a general right to object to lawful data processing that is in the public interest, in the exercise of official authority or on the basis of a legitimate interest.

In particular, you have a right to object to the processing of your data in connection with direct advertising in accordance with Art. 21 (1) and (2) GDPR if this is based on a balancing of interests.

2.7 Rights in the event of consent, Art. 7 GDPR

If the processing of your data is based on consent, you have the right to withdraw this consent for the future at any time. The legality of the data processing carried out until the revocation remains unaffected by the revocation.

2.8 Restrictions

There may be restrictions on the above-mentioned rights in accordance with Art. 23 GDPR and special legal regulations (e.g. §§ 34 - 37 BDSG n. F.).

2.9. assertion of your rights

To exercise your rights, it is sufficient to send a declaration to the controller named under point 1 and to express your request accordingly.

You can submit this declaration in writing / by e-mail / fax without giving reasons.

2.9.1 Right to lodge a complaint with a supervisory authority, Art. 77 GDPR

In addition, in the event of violations of data protection regulations, you as the data subject have the right to lodge a complaint with a supervisory authority for data protection, in particular in the Member State of your habitual residence, place of work or place of the alleged violation. The right to lodge a complaint is without prejudice to any other administrative or judicial remedies.

The competent supervisory authority for data protection issues for the controller is
Thuringian State Commissioner for Data Protection and Freedom of Information
Häßlerstraße 8, 99096 Erfurt

Telephone: 0361 57-3112900
Fax: 0361 57-3112904

E-mail: poststelle@datenschutz.thueringen.de
Web: www.tlfdi.de

2.9.2 Right to effective judicial remedy against us as controller or processor, Art. 79 GDPR

You have the right to take legal action if you believe that we are not processing your personal data in accordance with the GDPR.

For example, you can bring actions for damages, injunctive relief or declaratory relief, including actions for access, rectification or erasure of individual data records. If you are of the opinion that processors against whom we have made a claim have committed a breach of duty in terms of data protection law, you are also entitled to the aforementioned rights directly against the processor.

As the data subject, you have the choice of filing your complaint at the location of a branch of the data processor or at your own place of residence.

3. General processing framework

3.1. contact via the internet

Personal data is processed when you access our website. This is necessary in order to provide your browser with the requested information (text and images of the respective page). The connection data generated in the process (including your IP address) is logged for a maximum of 60 days. The purpose of logging is to ensure the IT security of the web server.

If you contact us via our contact form, we will receive your message as an e-mail (see point 3.3). The information you have entered in the fields is transmitted to the web server in encrypted form. Collection by the person responsible is also encrypted.

3.2. telephone contact

When you call or attempt to call us, your telephone number, if you have not suppressed it, the time and duration of the call will be stored for a certain period of time on the telecommunications system used (usually a telephone) (the last 30 - 50 calls).

Beyond this, we do not initially store this and other data unless you expressly request this (e.g. to make further contact or to fulfill your request).

We may also process your voice message in our telephone system if we are unable to answer the call personally (answering machine).

Furthermore, the connection data (including the call content only if the answering machine is used) is stored or logged centrally in the telephone system for a maximum of 90 days.

Voice messages are deleted immediately after completion.

3.3. contact by e-mail

If you contact us by e-mail, your e-mail will be stored on our mail server and assigned to the relevant department in accordance with the purpose of fulfilling the tasks and powers of the controller and processed there.

The storage period is determined by the specific processing framework.

3.4. contact with letters

Your letters are opened centrally by us.

Your letters are then scanned by us and entered into our document management system (DMS). In addition, the letter is stored in paper form in the registry for the duration of the retention period for reasons of proof.

They are then assigned to the relevant department in accordance with their intended purpose in order to fulfill the tasks and powers of the person responsible and processed there.

The retention period is determined by the specific processing framework.

3.5. contact by fax

If you contact us by fax, the same procedure is followed as in point 3.4.

The transmitted fax number is stored in our telecommunications system (fax machine) for system-related reasons and is included as a header on the printout.

3.6. reply

If you are contacted in writing, you may receive additional information about the handling of your data within the special processing framework.