PRIVACY NOTICE

We are delighted that you are interested in our online shop. Protecting your privacy is important to us. Below, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), we inform you about which personal data we process, for what purposes, on what legal basis and for how long.

The controller within the meaning of the GDPR is:

NIMAX GmbH
Otto-Lilienthal-Str. 9
86899 Landsberg am Lech
Germany

Further contact details can be found in our legal notice.

Data protection officer: You can contact our data protection officer at [email protected] or at the postal address above, marked ‘For the attention of the data protection officer’.

Server log files. You can visit our website without providing any personal information. Each time the website is accessed, the web server automatically stores a server log file. It contains, for example, the name of the requested file, your IP address, the date and time of access, the volume of data transferred, the browser type and the requesting provider (access data). We process these data to ensure the trouble-free and secure operation of the website and to improve our services. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the correct presentation and the security of our services. The access data are erased no later than seven days after the end of your visit, unless they are needed for longer to investigate a specific security incident.

Hosting. Keyweb AG, Neuwerkstraße 45/46, 99084 Erfurt, Germany, operates on our behalf the servers on which this website and the data collected in our forms are processed. As a processor pursuant to Art. 28 GDPR, it is bound by our instructions and has its registered office in Germany. The legal basis is Art. 6(1)(b) and (f) GDPR.

Cloudflare. To protect the website and deliver it faster, we use the content delivery network and security functions of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. In doing so, data traffic between your browser and our servers is routed via Cloudflare’s network. This enables Cloudflare to detect and fend off attacks (e.g. DDoS attacks or bots). In particular, the IP address, the time and the requested content are processed. For this purpose, Cloudflare may set a technically necessary cookie (__cf_bm, storage period 30 minutes). The legal basis is Art. 6(1)(f) GDPR and, for the cookie, Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Our legitimate interest lies in the secure and fast operation of the website. We have concluded a data processing agreement with Cloudflare. For transfers to the USA, see Section 11. Further information: Cloudflare’s privacy policy.

We collect personal data when you provide them to us when placing an order, opening a customer account or contacting us (e.g. via the contact form, by e-mail or by telephone). Mandatory fields are marked as such. Without this information, we cannot conclude the contract, open the account or process your enquiry. You can see which data are collected in the respective input forms.

We use these data to perform the contract and to process your enquiries (Art. 6(1)(b) GDPR).

Storage period. Once the contract has been fully performed or your customer account has been deleted, we restrict the processing of your data. We erase them once the statutory retention periods have expired (Art. 6(1)(c) GDPR in conjunction with Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO)): as a rule, these are 6 to 10 years for commercial letters, invoices and accounting records. This does not apply if you have consented to further use or if we reserve the right to a use permitted by law, about which we inform you in this policy. We erase enquiries not related to a contract as soon as they have been finally dealt with.

You can delete your customer account at any time – via the corresponding function in the customer account or by sending a message to the contact details given in Section 1.

Chat and processing of e-mail enquiries (melibo). For the chat on our website and for processing e-mail enquiries, we use the software melibo of ThinkingTech GmbH & Co. KG, Gerbermühlstraße 7, 60594 Frankfurt am Main, Germany, as a processor. The chatbot answers frequently asked questions automatically, including with the help of artificial intelligence; incoming e-mails are recorded, assigned and processed using melibo. The content of your messages, your name, e-mail address and order number (where you provide them), the time, and technical data such as IP address and browser type are processed. Please do not enter any sensitive data such as payment details in the chat. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns an order or a contract, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in answering enquiries quickly and efficiently. For the AI functions, melibo uses the Azure OpenAI service of Microsoft Corporation as a further processor; your input is not used to train AI models. Chat histories are automatically erased after 30 days and technical logs after 90 days; backup copies are overwritten after six months at the latest. This does not apply where content has to be retained for longer to perform the contract or because of legal obligations. If the chat suggests products to you, melibo sets the cookie melibo_vid (storage period 180 days) with your consent (‘Statistics’ category). It contains a randomly generated visitor ID and serves solely to assign basket actions and orders to the respective chat so that we can measure the quality of the product recommendations (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

To perform the contract, we pass on your name and delivery address to the shipping company commissioned with the delivery, insofar as this is necessary for delivery (Art. 6(1)(b) GDPR).

So that the shipping service provider can notify you of the delivery and reach you if there are any questions about the delivery, we also transmit your e-mail address and – if you have provided it – your telephone number. Providing your telephone number is voluntary. The legal basis is Art. 6(1)(b) GDPR insofar as the data are necessary for delivery, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in smooth delivery. You can object to the disclosure of your e-mail address and telephone number at any time using the contact details in Section 1.

Depending on the shipping method chosen, we use the following companies:

• DHL Paket, Warenpost (‘Economy’ tariff): DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany
• Letter post: Deutsche Post AG, Charles-de-Gaulle-Str. 20, 53113 Bonn, Germany
• DHL Express: DHL Express Germany GmbH, Heinrich-Brüning-Str. 5, 53113 Bonn, Germany
• GLS: General Logistics Systems Germany GmbH & Co. OHG, GLS Germany-Straße 1–7, 36286 Neuenstein, Germany
• DPD: DPD Deutschland GmbH, Wailandtstr. 1, 63741 Aschaffenburg, Germany
• UPS: United Parcel Service Deutschland S.à r.l. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany
• Freight forwarding (consignments over 70 kg): Dachser SE, Thomas-Dachser-Str. 2, 87439 Kempten, Germany

Shipping via Amazon. In individual cases, we have orders within Europe fulfilled via the logistics service ‘Fulfilment by Amazon’. For this purpose, we transmit your name and delivery address to Amazon Services Europe S.à r.l., 38 Avenue John F. Kennedy, 1855 Luxembourg (Art. 6(1)(b) GDPR).

Shipment tracking with parcelLab. For shipping notifications and shipment tracking, we use parcelLab GmbH, Kapellenweg 6, 81371 München, Germany, as a processor. For this purpose, parcelLab receives the order number, tracking number, name, delivery address and e-mail address. The legal basis is Art. 6(1)(b) GDPR; for content going beyond the performance of the contract, Art. 6(1)(f) GDPR (interest in transparent delivery communication).

Shipping labels and shipping notifications with Sendcloud. To create shipping labels, we use Sendcloud B.V., Stadhuisplein 10, 5611 EM Eindhoven, Netherlands, as a processor. For this purpose, Sendcloud receives your name, delivery address, e-mail address, telephone number (if provided) and order number and, for shipments outside the EU, the information on the parcel contents required for customs clearance. On our behalf, Sendcloud also sends you e-mails about the shipping status. Sendcloud transmits these data to the respective shipping service provider (see above). The legal basis is Art. 6(1)(b) GDPR; for content of the shipping e-mails going beyond the performance of the contract, Art. 6(1)(f) GDPR (interest in transparent delivery communication). Where Sendcloud uses sub-processors outside the EU, this is done on the basis of the standard data protection clauses (standard contractual clauses) of the European Commission (Art. 46(2)(c) GDPR).

To process payments, we pass on the necessary payment data to the commissioned credit institution and the payment service provider you have chosen (Art. 6(1)(b) GDPR). Some payment service providers collect these data themselves if you have an account with them; in that case, their privacy policy also applies.

• Credit card (Visa, Mastercard, American Express): Payment processing: Computop Wirtschaftsinformatik GmbH, Schwarzenbergstraße 4, 96050 Bamberg, Germany; credit card acceptance: Commerz Globalpay GmbH, Mainzer Landstraße 41–45, 60329 Frankfurt am Main, Germany
• iDEAL (Netherlands only): Computop Wirtschaftsinformatik GmbH (see above) and your bank
• Bancontact (Belgium only): Computop Wirtschaftsinformatik GmbH (see above) and your bank
• PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg
• Payment in advance: the credit institution with which we hold our account
• Cash on delivery: the respective shipping service provider (see 4.1)

PayPal. On our product pages, we use the PayPal SDK to display information on PayPal payment options (e.g. payment in instalments). In doing so, your IP address is transmitted to PayPal. The legal basis is Art. 6(1)(f) GDPR (interest in providing information on payment options). Further information: PayPal’s privacy policy.

If you contact us in a language other than German or place an order on a foreign-language website, employees of our branches and sales partners also process your enquiry or order (Art. 6(1)(b) GDPR):

• English, Spanish: nimax Spain SL, Avenida Las Americas – Polígono Industrial Paredilla, 29130 Alhaurín de la Torre, Spain
• French, German, English: nimax France SARL, 944 Chemin du Pas de l’Ave, 83510 Lorgues, France
• Italian: Astromarket.it, Via Agrigento 18/A, 92017 Sambuca di Sicilia, Italy
• Romanian: Astromagazin SRL, Coidrisor nr. 30, 420179 Bistrița, Romania
• Portuguese: nimax Portugal Unipessoal Lda, Aveiro Business Center, Rua da Igreja, Nº 79, 3810-742 Nossa Senhora de Fátima, Portugal
• Polish: nimax Poland sp. z o.o., Bonifraterska 17, 00-203 Warszawa, Poland
• German, Dutch, English: Oostvogels V.O.F., Pieter Braeckelaan 57, 8620 Nieuwpoort, Belgium
• Dutch, German, French: Lichtenknecker Optics nv, Kuringersteenweg 44, 3500 Hasselt, Belgium

If we perform in advance vis-à-vis retailers (resellers), e.g. when delivering on account, we obtain information on identity and creditworthiness from a credit agency in individual cases. We do not carry out credit checks on consumers.

For this purpose, we transmit the company name, address and, where applicable, the name and date of birth of the owners or managing directors to:

• SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden, Germany
• Creditreform Boniversum GmbH, Hellersbergstraße 11, 41460 Neuss, Germany

The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract) and Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting ourselves against payment defaults. The decision on delivery on account is made by an employee; it is not based solely on automated processing. You can express your point of view at any time using the contact details in Section 1.

Once the contract has been fully performed, we erase the data processed for this purpose, unless statutory retention obligations apply.

If you subscribe to our newsletter, we will regularly send you information on products, offers and observing tips on the basis of your consent (Art. 6(1)(a) GDPR). Only your e-mail address is mandatory; any further information is voluntary and is used to address you personally.

Subscription takes place using the double opt-in procedure: after subscribing, you will receive an e-mail asking you to confirm your subscription. This ensures that nobody subscribes using someone else’s e-mail address. We log the time of subscription and confirmation as well as your IP address in order to be able to demonstrate consent (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR).

Sending via Mailchimp. To send the newsletter, we use Mailchimp, a service of The Rocket Science Group LLC, 405 N Angier Ave NE, Atlanta, GA 30308, USA, as a processor. Your e-mail address and further information are stored on Mailchimp servers in the USA. For transfers to the USA, see Section 11.

Performance measurement. Our newsletters contain a tracking pixel and personalised links. These allow us to record whether and when a newsletter was opened and which links were clicked; technical data such as IP address, browser type and operating system are also processed in this context. This analysis is carried out in relation to the individual recipient and forms part of your consent to receive the newsletter. We use the results to better tailor future newsletters to our readers’ interests.

Withdrawal. You can unsubscribe from the newsletter at any time – via the unsubscribe link in every newsletter or by sending a message to the contact details in Section 1. The withdrawal does not affect the lawfulness of processing carried out before the withdrawal. After you unsubscribe, we remove your e-mail address from the mailing list. We retain proof of your earlier consent for up to three years in order to be able to defend ourselves against claims (Art. 6(1)(f) GDPR).

If we have obtained your e-mail address in connection with the sale of goods, we will occasionally send you offers for similar products from our range, even without a newsletter subscription. The legal basis is Art. 6(1)(f) GDPR in conjunction with Section 7(3) of the German Act against Unfair Competition (UWG); our legitimate interest lies in addressing our customers for advertising purposes.

You can object to this use at any time – via the unsubscribe link in every e-mail or by sending a message to the contact details in Section 1. You will not incur any costs for this other than the transmission costs according to the basic rates.

After your order has been delivered, we send you a one-off e-mail asking you to review your purchase. In it, we provide links to the following review platforms:

• Trusted Shops: Trusted Shops SE, Subbelrather Str. 15c, 50823 Köln, Germany
• Google: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
• ShopAuskunft: ShopAuskunft GmbH, Kohlgartenstraße 11–13, 04315 Leipzig, Germany
• Trustpilot: Trustpilot A/S, Pilestræde 58, 1112 Kopenhagen, Denmark

The legal basis for the e-mail is Art. 6(1)(f) GDPR in conjunction with Section 7(3) UWG; our legitimate interest lies in improving our services and presenting customer experiences. You can object to this use at any time, as described in 6.2. With this e-mail, we ourselves do not transmit any data to the review platforms. However, the links in the e-mail contain information about your order (order number, e-mail address, first name and surname) so that your review can be assigned to the order. This information is only transmitted when you click on a link. From then on, the respective provider processes your data under its own responsibility; its privacy policy applies.

Review invitation by Trusted Shops. Instead of our own e-mail, the request for a review may also be sent to you on our behalf by Trusted Shops SE (address see above). For this purpose, we transmit your e-mail address and order number to Trusted Shops. Trusted Shops uses these data exclusively to send you the invitation and to assign your review to the order, and erases them automatically after 180 days at the latest. The legal basis is Art. 6(1)(f) GDPR in conjunction with Section 7(3) UWG; you can object to this use at any time, as described in 6.2, or via the unsubscribe link in the e-mail from Trusted Shops. If you submit a review, Trusted Shops’ privacy policy applies; submitted reviews are anonymised there after five years.

We also use your name and postal address for our own advertising by letter, e.g. for catalogues and offers relating to our products. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in addressing our customers for advertising purposes. You can object to this use at any time using the contact details in Section 1.

What we use. We use cookies and similar technologies (e.g. your browser’s local storage, pixels and scripts). Cookies are small text files that are stored on your terminal device. Session cookies are deleted when you close your browser; persistent cookies remain stored for the period specified in each case.

Legal bases. The storage of information on your terminal device and access to it are governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG). We use technically necessary technologies without consent (Section 25(2) No. 2 TDDDG); we base the subsequent data processing on Art. 6(1)(b) or (f) GDPR. We use all other technologies – for convenience functions, statistics and marketing – only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

Categories in our cookie banner:

• Necessary: Basket, login, load balancing, security, storing your cookie selection – Consent required: no
• Functional: Convenience functions, e.g. embedded videos – Consent required: yes
• Statistics: Analysis of website use (Section 8) – Consent required: yes
• Marketing: Advertising and performance measurement (Section 9) – Consent required: yes

CookieFirst. We manage your consents with CookieFirst, a service of Digital Data Solutions B.V., Plantage Middenlaan 42a, 1018 DH Amsterdam, Netherlands, as a processor. CookieFirst stores your selection, a random visitor ID, the time of consent and the version of the banner in a cookie and in local storage (storage period one year). The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (demonstrating consent) and Section 25(2) No. 2 TDDDG.

Withdrawal and settings. You can withdraw or change your consent at any time with effect for the future – via the ‘Cookie settings’ link at the bottom of every page. A complete list of the cookies used, with provider, purpose and storage period, can also be found there. In addition, you can delete or block cookies in your browser; in that case, some functions of the website may not be available.

Campaign attribution. If you come to us via an advertisement or a campaign link, we store, with your consent (Marketing category), the campaign parameters (e.g. gclid, msclkid, UTM parameters), the landing page and the referring page in your browser’s local storage. This allows us to attribute orders to the correct campaign. The data are erased after 90 days at the latest; if you withdraw your consent, we remove them immediately. The legal basis is Section 25(1) TDDDG, Art. 6(1)(a) GDPR.

We only use the following analytics services if you have given your consent in the ‘Statistics’ category (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). The exception is Matomo without cookies (8.3). You can withdraw your consent at any time via the cookie settings.

We use Google Tag Manager of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (‘Google’). It loads and controls the analytics and marketing services used on the website, and does so only in accordance with your selection in the cookie banner (Google Consent Mode). Tag Manager itself does not set any cookies, but it does process your IP address. We first route some of the measurement data via our own server endpoint under our domain. There, we can shorten or remove data before they are passed on to Google. The legal basis for Tag Manager is Art. 6(1)(f) GDPR; our legitimate interest lies in efficient, consent-compliant control of the services.

We use Google Analytics 4 from Google to analyse the use of our website and to improve our services. Google Analytics uses cookies (_ga and _ga_*, storage period up to two years) and processes, among other things, pages visited, time spent, clicks, device and browser information, approximate location and, in the case of purchases, order value and products. IP addresses are not logged or stored in Google Analytics 4. The collected data are erased after 14 months. Google may transmit data to Google LLC in the USA (see Section 11). Further information: Google’s privacy policy.

We use the open-source software Matomo, which is operated on our own servers; no data are passed on to third parties. Without your consent, Matomo works without cookies and without accessing your terminal device. In that case, we only record page views, time, referring page, device and browser type and a shortened IP address; the legal basis is Art. 6(1)(f) GDPR (interest in the statistical analysis and improvement of our services). If you have given your consent in the ‘Statistics’ category, Matomo additionally sets cookies so that repeat visits can be recognised (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). IP addresses are always shortened before storage. The raw data are erased after 180 days.

We use Microsoft Clarity of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity records the use of our website – e.g. mouse movements, clicks, scrolling behaviour and page views – and uses this to create heatmaps and session recordings. Entries in form fields are masked in the process. Clarity sets cookies (_clck, storage period one year; _clsk, one day). We use the results to identify errors and improve usability. Data may be transmitted to Microsoft Corporation in the USA (see Section 11). Further information: Microsoft’s privacy statement.

We only use the following services if you have given your consent in the ‘Marketing’ category (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the cookie settings.

We advertise via Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) in Google search results, in Google Shopping, on YouTube and on third-party websites. In doing so, we use the following functions:

• Conversion tracking: We measure whether you place an order with us after clicking on an advertisement. For this purpose, Google sets cookies (e.g. _gcl_au, storage period three months) or entries in local storage.
• Remarketing: Visitors to our website may be shown interest-based advertisements on other websites and in Google services. For this purpose, Google sets, among others, the cookie IDE (domain doubleclick.net, storage period one year) with a pseudonymous identifier. If you are logged in to Google and have agreed to the personalisation of advertisements, Google may link these data to your Google account across devices.
• Enhanced Conversions: After an order, we transmit your e-mail address and, where applicable, telephone number and address to Google in encrypted (hashed) form. Google matches them with logged-in Google accounts in order to make measurement more accurate.

Google may transmit data to Google LLC in the USA (see Section 11). Further information and settings: Google ad settings and Google’s privacy policy.

We advertise via Microsoft Advertising (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) in Bing search results and in partner networks. Using Universal Event Tracking (UET), we measure whether you place an order with us after clicking on an advertisement and can show advertisements to visitors to our website again (remarketing). For this purpose, Microsoft sets cookies and entries in local storage (_uetsid, storage period one day; _uetvid, one year; MUID, one year). Data may be transmitted to Microsoft Corporation in the USA (see Section 11). Further information: Microsoft’s privacy statement and advertising settings.

On some pages, we embed videos from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use the privacy-enhanced mode (youtube-nocookie.com). The videos are only loaded once you have given your consent in the ‘Functional’ category (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). A connection to YouTube’s servers is then established; in the process, YouTube learns which page you have visited and receives your IP address. As soon as you play a video, YouTube may use cookies and similar technologies (e.g. VISITOR_INFO1_LIVE, YSC). If you are logged in to Google, YouTube may assign your usage behaviour to your account. Data may be transmitted to Google LLC in the USA (see Section 11). Further information: Google’s privacy policy.

To help you choose products, we offer a digital product adviser from Neo Commerce GmbH, Baierbrunner Str. 15, 81379 München, Germany (‘Neocom’). The adviser asks you questions about your requirements and suggests suitable products. Your answers and input, your interactions with the adviser, the page accessed, technical data on your browser and device, and your IP address are processed. Please do not enter any personal information in free-text fields. Neocom acts as a processor on our behalf and uses Cloudflare’s network for its operation (see Section 2). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing good advice and product selection. Where information is stored on your terminal device that is not strictly necessary for the service you have requested, this is done only with your consent (Section 25(1) TDDDG).

To display our Trusted Shops trust mark, the reviews collected and the Trusted Shops products for buyers, the Trustbadge of Trusted Shops SE, Subbelrather Str. 15c, 50823 Köln, is embedded. When it is accessed, the Trusted Shops server stores access data such as IP address, date and time, volume of data transferred and the requesting provider. These data are not analysed and are overwritten no later than seven days after the end of your visit. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a trustworthy presentation of our services. We only transmit further data if you decide to use Trusted Shops products after placing an order or are already registered there; in that case, your agreement with Trusted Shops applies.

All fonts (e.g. Roboto Condensed, Ubuntu, Merriweather Sans, Font Awesome) are stored locally on our server. When the website is accessed, no connection is established to external font providers.

On our website, we link to our profiles on Facebook, Instagram, YouTube and X. These are simple links, not plugins: data are only transmitted when you click on a link and visit the platform. The privacy policy of the respective provider applies there.

Some of the service providers mentioned have their registered office in the USA or belong to a US group. On 10 July 2023, the European Commission adopted an adequacy decision for the USA (EU-US Data Privacy Framework, Art. 45 GDPR). Transfers to companies certified under this framework are therefore permitted. In addition, we have agreed standard data protection clauses (standard contractual clauses) of the European Commission with the providers (Art. 46(2)(c) GDPR), which apply if the certification lapses.

• Google LLC: Tag Manager, Analytics, Ads, YouTube, Google reviews (6.3, 8, 9.1, 10.1) – Certified under the Data Privacy Framework: yes
• Microsoft Corporation: Clarity, Microsoft Advertising, AI functions in the chat via Azure OpenAI (3, 8.4, 9.2) – Certified under the Data Privacy Framework: yes
• Cloudflare, Inc.: Content delivery network, security (2, 10.2) – Certified under the Data Privacy Framework: yes
• The Rocket Science Group LLC (Mailchimp): Newsletter (6.1) – Certified under the Data Privacy Framework: yes

You can check whether a company is certified at dataprivacyframework.gov. All other recipients in this policy, including our branches and sales partners, have their registered office in the European Union. For Sendcloud sub-processors outside the EU, see 4.1.

You have the following rights vis-à-vis us with regard to your personal data:

• Right of access to the data we process (Art. 15 GDPR)
• Rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR)
• Erasure of your data, unless there is a legal obligation to retain them and the data are not required for the establishment, exercise or defence of legal claims (Art. 17 GDPR)
• Restriction of processing, e.g. for as long as you contest the accuracy of your data (Art. 18 GDPR)
• Data portability: receiving the data you have provided to us in a structured, commonly used and machine-readable format, or having them transmitted to another controller (Art. 20 GDPR)
• Withdrawal of consent at any time with effect for the future; the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal (Art. 7(3) GDPR)
• Lodging a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the place of your habitual residence, place of work or place of the alleged infringement. The supervisory authority competent for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) (Bavarian State Office for Data Protection Supervision), Promenade 18, 91522 Ansbach.

To exercise your rights, please use the contact details in Section 1. We do not make any decisions based solely on automated processing within the meaning of Art. 22 GDPR.