Glossary

Definitions

‘Personal data’...

means any information relating to an identified or identifiable natural person (hereinafter referred to as ‘data subject’); an identifiable natural person is one who can be can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Examples of personal data include address data, names, telephone number, IP address, email address.

‘Special categories of personal data’...

describes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

Controller

... is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Processor

... is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.

Third party...

is a natural or legal person, public authority, agency or other body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

Employees

... within the meaning of the BDSG (new) are:

employees, including temporary agency workers in relation to the hirer,

persons employed for the purpose of their vocational training,

participants in services for participation in working life and in clarifications of professional aptitude or work trials (rehabilitation participants),

persons employed in recognised workshops for disabled persons,

volunteers who perform a service under the Youth Voluntary Service Act or the Federal Voluntary Service Act,

persons who, due to their economic dependence, are to be regarded as employee-like persons; these also include homeworkers and those treated as such,

applicants for employment and persons whose employment has ended, are considered employees

Processing

... describes any process or series of operations carried out with or without the help of automated procedures in connection with personal data, such as the collection, recording, organisation, sorting, storage, adaptation or alteration, reading, querying, use, disclosure by transmission, dissemination or any other form of provision, comparison or linking, restriction, erasure or destruction.

Profiling...

describes any kind of automated processing of personal data that consists of using that personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects relating to the work performance, economic situation, health, personal preferences, interests, reliability, behaviour, whereabouts or relocation of that natural person.

Pseudonymisation

... describes the processing of personal data in such a way that the personal data can no longer be assigned to a specific data subject without the use of additional information, provided that this additional information is stored separately and is subject to technical and organisational measures that ensure that the personal data is not assigned to an identified or identifiable natural person.

File system

... describes any structured collection of personal data accessible according to specific criteria, whether centralised, decentralised or organised according to functional or geographical considerations.

Description of the rights of data subjects

Right to confirmation and information (Art. 15, GDPR)

You have the right to request confirmation from us as to whether personal data concerning you is being processed.

You also have the right to request information from us at any time in writing about the personal data concerning you that we process, in accordance with Article 15 of the GDPR.

This right is limited by the exceptions of Section 34 of the German Federal Data Protection Act (BDSG), according to which the right to information does not apply in particular if the data is only stored due to legal storage regulations or for data protection and data protection control, the provision of information would require a disproportionate effort and a misuse of the data processing is prevented by suitable technical and organisational measures.

Right to rectification (Art. 16, GDPR)

You have the right, in accordance with Art. 16 GDPR, to demand that we correct your data without delay.

Right to erasure (right to be forgotten) (Art. 17, GDPR)

You have the right to demand that we delete the data concerning you under the conditions described in Art. 17 GDPR. These conditions are met in particular if the respective processing purpose has been achieved or otherwise ceases to apply, as well as if we should process your data unlawfully, you have withdrawn consent without the data processing being able to be continued on another legal basis, if you successfully object to the data processing and in cases of the existence of a deletion obligation based on Union law or the law of an EU member state to which we are subject.

This right is subject to the restrictions of Section 35 of the German Federal Data Protection Act (BDSG), according to which the right to erasure may be waived if, in the case of non-automated data processing, a disproportionately high effort is required for the erasure and your interest in the erasure is considered to be low.

Right to restriction of processing (Art. 18, GDPR)

In accordance with Art. 18 GDPR, you have the right to obtain from us the restriction of processing your personal data. This right exists in particular if the accuracy of the personal data is disputed, if you demand restricted processing instead of deletion under the conditions of a justified request for deletion. Furthermore, in the event that the data is no longer required for the purposes pursued by us, but you need the data to assert, exercise or defend legal claims, as well as if the success of an objection is still disputed.

Right to data portability (Art. 20, GDPR)

In accordance with Art. 20 GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller.

Right to object (Art. 21, GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on public interest or on the purposes of our legitimate interests. We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

If you object to the processing of your personal data for advertising purposes (e.g. in the case of commercial customers), we will in any case stop such processing.

Right to revoke consent under data protection law (Art. 7 para. 3, DSGVO)

You also have the right to revoke your consent at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

Automated decision in individual cases including profiling (Art. 22 DSGVO)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.