If your personal data is processed, you are a data subject within the meaning of the GDPR and you therefore have the following rights over the data controller:
1. Right of access
You may demand confirmation from the data controller whether personal data relating to you is or will be processed by us.
2. Right of rectification
You have a right of rectification and/or completion over the data controller if the personal data processed concerning you are incorrect or incomplete.
3. Right of restriction of processing
You have the right to restrict data processing in cases where we are not yet allowed to erase your data due to legal retention obligations.
4. Right of erasure
You can demand that the data controller erases the personal data concerning you without delay, whereupon the data controller is obliged to act immediately provided that conditions pursuant to Art. 17 (1) GDPR are met:
a) The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.
b) You revoke your consent on which the processing was based pursuant to point a of Art. 6 (1) or point a of Art. 9 (2) GDPR, and there is no other legal basis for processing said data.
c) You file an objection against the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate reasons for such processing, or you file an objection against such processing pursuant to Art. 21 (2) GDPR.
d) The personal data concerning you have been processed unlawfully.
e) The erasure of personal data concerning you is necessary to fulfill a legal obligation under Union law or the law of the Member States to which the data controller is subject.
f) The personal data concerning you have been collected in relation to information society services offered pursuant to Art. 8 (1) GDPR.
5. Right to data portability
You have the right to receive the personal data concerning you and provided by you to the data controller, in a structured, commonly used and machine-readable format. In addition, you have the right to transmit this data to another data controller without obstruction by the data controller to whom the personal data was initially provided, subject to the condition that the processing is based on consent pursuant to point a of Art. 6 (1) GDPR or point a of Art. 9 (2) GDPR or is based on a contract pursuant to point b of Art. 6 (1) GDPR.
6. Right of objection
You have the right to object at any time, for reasons arising from your particular situation, to the processing of your personal data effected pursuant to points e or f of Art. 6 (1) GDPR.
Furthermore, you have the right to revoke your declaration of consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before said withdrawal.
7. Right to lodge a complaint with a supervisory authority
You have the right, to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.
The data protection supervisory authority responsible for us is:
Landesbeauftragter für Datenschutz und Informationsfreiheit Nordrhein-Westfalen [State Officer for Data Protection and Freedom of Information, North Rhine-Westphalia]
Postfach 20 04 44
Phone: 0049 (0)211/38424-0
Fax: 0049 (0)211/38424-10
Email address: firstname.lastname@example.org