A. Privacy policy in accordance with the GDPR
I. Name and address of the controller
The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is:
MELAG Medizintechnik GmbH & Co. KG
Geneststr. 6-10
10829 Berlin
Germany
Email: info@melag.de
Website: www.melag.de
II. Name and address of the data protection officer
The data protection officer of the controller is:
Dr. Matthias Liebetrau
MELAG Medizintechnik GmbH & Co. KG
Geneststr. 6-10
10829 Berlin
Germany
Tel.:
Email: Datenschutz@melag.de
Website: www.melag.com
III. Competent Supervisory Authority
The competent supervisory authority is: Berlin Commissioner for Data Protection and Freedom of Information Alt-Moabit 59–61, 10555 Berlin, Germany Phone: +49 30 13889-0 Email: mailbox@datenschutz-berlin.de.
IV. General information on data processing
1. Scope of processing personal data
We only process personal data of our users to the extent necessary to provide functional software. The processing of personal data of our users takes place regularly only with the consent of the user.
2. Legal basis for the processing of personal data
Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 para. 1 lit. a EU General Data Protection Regulation (GDPR) serves as the legal basis.
When processing personal data that is necessary for the performance of a contract to which the data subject is party, Art. 6 para. 1 lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary for the implementation of pre-contractual measures.
Insofar as the processing of personal data is necessary for the fulfillment of a legal obligation to which our company is subject, Art. 6 para. 1 lit. c GDPR serves as the legal basis.
3. Data deletion and storage period
The personal data of the data subject will be deleted or blocked as soon as the purpose of storage ceases to apply. Storage may also take place if this has been provided for by European or national legislators in EU regulations, laws, or other provisions to which the controller is subject. The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfillment of a contract.
4. Cookies and Tracking Technologies
Our platform and the MELAG website use cookies and similar technologies where technically necessary. Essential cookies ensure the secure provision of basic functions (such as login and session handling). Optional cookies and analytics tools (e.g. web analytics, user statistics) are only used with explicit consent in accordance with Art. 6(1)(a) GDPR. Users may withdraw their consent at any time via the cookie banner or through their browser settings.
5. Data Processors
For the operation and provision of MELAverse, we use various data processors in accordance with Art. 28 GDPR. These include, in particular: Microsoft Ireland Operations Ltd. (hosting, cloud services, security services) and Shopware AG (registration and account management). We also engage additional IT service providers on a case-by-case basis, with whom we have concluded GDPR-compliant data processing agreements. An up-to-date list of the data processors we use is available upon request.
6. Automated Decision-Making / Profiling
No automated decision-making, including profiling, takes place.
7. Licensing and use of the software
Purpose
The platform is used in the business-to-business sector and offers the following functions in particular:
(1) Upload, download, and storage of device logs
(2) Management of service cases and maintenance information
(3) Access to technical documentation and support functions
Registration and access
(1) Registration is required to use the platform. The user must provide complete and accurate information and notify us immediately of any changes.
(2) Access is restricted to authorized persons within the user's organization. The user is obliged to keep access data confidential and not to grant access to unauthorized third parties.
(3) The platform operator is entitled to temporarily or permanently block user accounts in the event of violations of these terms and conditions.
Permitted use
The platform may only be used for the contractually agreed purposes. The following are prohibited in particular:
Manipulation, decompilation, or reverse engineering of the platform software
Uploading or distributing illegal content
Unauthorized disclosure of platform data to third parties
The following also applies to service technicians:
V. Description and scope of data processing
To use MELAverse, you must create a user account via the MELAG website.
Registration is carried out via a modular online shop system (Shopware).
The personal account data is stored and managed by Shopware Services.
For the use of MELAverse, user data is requested, retrieved, and displayed in anonymized form.
The following personal data is collected during account creation and later processed in MELAverse:
(1) User group (practice/clinic/service technician)
Practice data
(2) Practice name
(3) Specialization
(4) Street and house number
(5) Postal
(6) City
(7) State
(8) Specialist dealer (optional)
Contact
(9) Title
(10) First
(11) Last
(12) Phone
Registration
(13) Email
Service partner management
(1) Information about service and contact persons (see section IX )
(2) Account information of dashboard contacts (see section X )
Furthermore, the following non-personal data is stored in a database instance and processed for use:
(1) Anonymized IDs for archiving device and processing logs as well as documents in cloud storage (see section VI and section VIII )
(2) Device information and cycle data (see section VII )
8. Legal basis for data processing
The legal basis for the processing of data is Art. 6 para. 1 lit. a GDPR if the user has given their consent.
If the registration serves to fulfill a contract to which the user is a party or to take steps prior to entering into a contract, the additional legal basis for processing the data is Art. 6 para. 1 lit. b GDPR.
9. Purpose of data processing
Registration of the user is necessary for the fulfillment of a contract with the user or for the implementation of pre-contractual measures.
Only trained and professional personnel are authorized to obtain a license for MELAverse. The user data collected is necessary to determine whether the user belongs to this group of persons.
10. Duration of storage
The collected data must be stored for the duration of use of MELAverse. Deletion can take place at the earliest after completion of the contract. This is the case for data collected during the licensing process for the fulfillment of a contract or for the implementation of pre-contractual measures if the data is no longer required for the execution of the contract. Even after the conclusion of the contract, personal data of the contractual partner will be stored in order to fulfill contractual or legal obligations.
11. Right to object and right to erasure
As a user, you can request the deletion of your stored data at any time.
Please note that deleting your data will terminate your license for MELAverse and you will no longer be able to use the software. You can activate a new license at any time in the future.
The stored data can be changed in the account management section of the website. In this case, the software can only be reused after a new check by MELAG.
VI. Archiving of device and processing logs
1. Description and scope of data processing
MELAverse offers the option of archiving device and processing logs in cloud storage (Microsoft Azure Cloud) and downloading them on demand. It is also possible to transfer device and reprocessing logs from the MELAtrace software to the cloud storage and download them on demand. This requires the creation of a user account via the MELAG website, which is implemented by a modular online shop system (Shopware). The personal account data is stored and managed by Shopware services on the website. MELAverse and MELAtrace use the same account information for the functions related to the respective purpose.
Note:
This is the same user account and the same processed data in accordance with V.
In addition, an anonymized user ID and an anonymized storage location (container) are generated and linked to each other for archiving purposes. These are stored in a database instance and used for the purposes of archiving and restoring log files.
MELAG expressly reserves the right to subject archived logs to automated, recurring data analysis for statistical purposes and to process the findings obtained from this in further applications. Processing for statistical purposes is based on our legitimate interest pursuant to Art. 6 (1) lit. f GDPR. The legitimate interest lies in the further development and improvement of our products and services. Insofar as personal data is processed in this context, this is done in pseudonymized form.
Recommendation:
MELAG recommends that no patient-related data, such as names, addresses, or other characteristics that could identify natural or legal persons, be recorded in documents, processing logs, settings, comment fields, or other areas of the application.
MELAG stores and archives the documents generated in the application in the form provided by the system. The respective user remains responsible for the accuracy and permissibility of the uploaded and archived content. Insofar as MELAG processes the content on behalf of the user, this is done on the basis of the agreements made between the parties (e.g., order processing agreement).
To increase IT security, uploaded content is automatically checked by the security services described in section XI for possible threats such as malicious access, data exfiltration of confidential information, or malware.
Despite these measures, it cannot be completely ruled out that malware or inappropriate content may remain undetected and be archived. If such content is passed on or obtained from third parties (see section X ), this shall be done in accordance with the contractual and legal provisions.
2. Legal basis for data processing
The legal basis for data processing is Art. 6 (1) lit. a GDPR if the user has given their consent.
If the registration serves to fulfill a contract to which the user is a party or to take pre-contractual measures, the additional legal basis for the processing of the data is Art. 6 para. 1 lit. b GDPR.
3. Purpose of data processing
Registration of the user is necessary for the fulfillment of a contract with the user or for the implementation of pre-contractual measures. Only trained and professional personnel are authorized to activate and deactivate the cloud archiving of log files.
The user data collected is used for:
the creation and assignment of individual archive paths (containers)
the generation and display of device and cycle information (see Section VI)
the provision of technical assistance (e.g., direct access to the troubleshooting portal and download of device documentation)
These functions are technically necessary for the fulfillment of the contract.
4. Duration of storage
The storage of the collected data is guaranteed for the duration of the contract (cloud archiving).
Even after the contract has been terminated, personal data of the contractual partner will be stored in order to fulfill contractual or legal obligations.
5. Right to object and right to erasure
As a user, you have the right to have your stored data deleted at any time.
Please note that deleting the data will terminate your license for MELAverse and you will no longer be able to use the software. This means that the device and log data archived by MELAverse will no longer be accessible and will also be permanently deleted.
You can obtain a new license at any time in the future, but you will no longer have access to the device and log data archived in the past. MELAG therefore strongly recommends that you back up the log data from the cloud archive to another medium before requesting the deletion of your stored data.
The stored data can be modified in the account management section of the website. In this case, the software can only be reused after MELAG has rechecked it.
VII. Management of device and cycle data
1. Description and scope of data processing
MELAverse offers the option of creating and managing devices. In addition, device data can be transferred from the MELAtrace software to the MELAverse cloud structure. The following device information is collected and stored, if available:
(1) Device name
(2) Serial
(3) IP address
(4) TCP port
(5) COM port
(6) Device type
(7) Reference to user account
Note:
This is the same user account and the same processed data as per V.
By using the archiving of device and processing logs, MELAverse will read and archive the data contained in the logs.
For archiving purposes, an anonymized user ID and an anonymized storage location (container) are generated and linked to each other. These are stored in a database and used for the purposes of archiving and restoring cycle data.
In addition, the following information about errors, warnings, and device status read from the device logs is stored in a database and used to display and evaluate cycle data:
(1) Reference to device information
(2) Date and time of the device log
(3) Logged batch counters
(4) File name of the device log
(5) Program result
(6) Logged errors
(7) Logged warnings
(8) Reference to the storage location (container) of the read log information and the device log in accordance with section VI
Note:
MELAG expressly reserves the right to subject archived cycle information to automated, recurring data analysis for statistical purposes and to process the findings obtained from this in further applications. Processing for statistical purposes is based on our legitimate interest pursuant to Art. 6 (1) lit. f GDPR. The legitimate interest lies in the further development and improvement of our products and services. Insofar as personal data is processed in this context, this is done in pseudonymized form.
2. Legal basis for data processing
The legal basis for the processing of data is Art. 6 para. 1 lit. a GDPR if the user has given their consent.
If the registration serves to fulfill a contract to which the user is a party or to take pre-contractual measures, the additional legal basis for the processing of the data is Art. 6 para. 1 lit. b GDPR.
3. Purpose of data processing
Registration of the user is necessary for the fulfillment of a contract with the user or for the implementation of pre-contractual measures. Only trained and professional personnel are authorized to:
The anonymized data is used for:
creating and assigning individual archive paths (containers)
generating and displaying device and cycle information
Providing assistance such as direct access to the troubleshooting portal and downloading the manufacturer's device documentation
These functions are technically necessary for the fulfillment of the contract.
4. Duration of storage
The collected data will be stored for the duration of the contract.
Even after the contract has been terminated, the contractual partner's personal data will be stored in order to fulfill contractual or legal obligations.
5. Right to object and right to erasure
As a user, you have the right to have your stored data deleted at any time.
Please note that deleting your data will terminate your license for MELAverse and you will no longer be able to use the software. This means that the device and log data archived by MELAverse will no longer be accessible and will also be permanently deleted.
You can obtain a new license at any time in the future, but you will no longer have access to the device and log data archived in the past. MELAG therefore strongly recommends that you back up the log data from the cloud archive to another medium before requesting the deletion of your stored data. The stored data can be modified in the account management section of the website. In this case, the software can only be reused after MELAG has checked it again.
VIII. Archiving of documents
1. Description and scope of data processing
MELAverse offers the option of archiving documents in PDF format and in JPG/JPEG and PNG image formats in a cloud storage system (Microsoft Azure Cloud) and downloading them as required.
This requires the creation of a user account via the MELAG website, which is implemented by a modular online shop system (Shopware). The personal account data is stored and managed by Shopware services on the website.
Note:
This is the same user account and the same processed data in accordance with V.
In addition, an anonymized user ID and an anonymized storage location (container) are generated and linked to each other for archiving purposes. These are stored in a database instance and used for the purposes of archiving and restoring documents.
MELAG expressly reserves the right to subject archived documents to automated, recurring data analysis for statistical purposes and to process the findings obtained from this in other applications. Processing for statistical purposes is based on our legitimate interest pursuant to Art. 6 (1) lit. f GDPR. The legitimate interest lies in the further development and improvement of our products and services. Insofar as personal data is processed in this context, this is done in pseudonymized form.
Recommendation:
MELAG recommends that no patient-related data, such as names, addresses, or other characteristics that could identify natural or legal persons, be recorded in documents, processing logs, settings, comment fields, or other areas of the application. MELAG stores and archives the documents generated in the application in the form provided by the system. The respective user remains responsible for the accuracy and admissibility of the uploaded and archived content. Insofar as MELAG processes the content on behalf of the user, this is done on the basis of the agreements made between the parties (e.g., order processing agreement).
To increase IT security, uploaded content is automatically checked by the security services described in section XI for possible threats such as malicious access, data exfiltration of confidential information, or malware. Despite these measures, it cannot be completely ruled out that malware or inappropriate content may remain undetected and be archived. If such content is passed on or obtained from third parties (see section X), this shall be done in accordance with the contractual and legal provisions.
2. Legal basis for data processing
The legal basis for the processing of data is Art. 6 para. 1 lit. a GDPR if the user has given their consent.
If the registration serves to fulfill a contract to which the user is a party or to take steps prior to entering into a contract, the additional legal basis for processing the data is Art. 6 para. 1 lit. b GDPR.
3. Purpose of data processing
Registration of the user is necessary for the fulfillment of a contract with the user or for the implementation of pre-contractual measures.
Only trained and professional personnel are authorized to archive documents in the cloud environment and download them on demand. The user data collected is necessary to determine whether the user belongs to this group of persons.
4. Duration of storage
The storage of the collected data is guaranteed for the duration of the contract (cloud archiving).
Even after the contract has been terminated, the personal data of the contractual partner will be stored in order to comply with contractual or legal obligations.
5. Right to object and right to erasure
As a user, you have the right to have the data stored about you deleted at any time.
Please note that deleting your data will terminate your license for MELAverse and you will no longer be able to use the software. This means that the documents archived by MELAverse will no longer be accessible and will also be permanently deleted.
You can obtain a new license at any time in the future, but you will no longer have access to the documents archived in the past. MELAG therefore strongly recommends that you back up the document data from the cloud archive to another medium before requesting the deletion of the data stored about you.
The stored data can be modified in the account management section of the website. In this case, the software can only be reused after a renewed check by MELAG.
IX. Management of service and contact persons
1. Description and scope of data processing
MELAverse offers the option of storing, editing, and deleting service and contact persons.
This requires the creation of a user account via the MELAG website, which is implemented by a modular online shop system (Shopware). The personal account data is stored and managed by Shopware services on the website.
Note:
This is the same user account and the same data processed in accordance with V.
The following information about service and contact persons is collected and stored, if available:
(1) Name of the service and contact person
(2) Depot of the service and contact person
(3) Email address of the service and contact person
(4) Phone number of the service and contact person
(5) Notes on the service and contact person
(6) Status of the service and contact person as main contact person
Special feature
The data collected consists of free text fields that are filled in by the user. MELAG expressly recommends that no patient-related data, such as names, addresses, or other characteristics that could identify natural or legal persons, be recorded in documents, processing logs, settings, comment fields, or other areas of the application.
Furthermore, it is recommended that recorded information about service and contact persons be deleted as soon as it is no longer needed. MELAG will only archive all information about service and contact persons in the form generated by the application and, upon request, use it for the purposes described in Section X.
2. Legal basis for data processing
The legal basis for the processing of data is Art. 6 (1) lit. a GDPR if the user has given their consent.
If the registration serves to fulfill a contract to which the user is a party or to take steps prior to entering into a contract, the additional legal basis for the processing of the data is Art. 6 para. 1 lit. b GDPR.
3. Purpose of data processing
Registration of the user is necessary for the fulfillment of a contract with the user or for the implementation of pre-contractual measures.
Only trained and professional personnel are authorized to archive documents in the cloud environment and download them on demand. The user data collected is necessary to determine whether the user belongs to this group of persons.
4. Duration of storage
The storage of the collected data is guaranteed for the duration of the contract (cloud archiving).
Even after the contract has been terminated, the personal data of the contractual partner will be stored in order to comply with contractual or legal obligations.
5. Right to object and right to erasure
As a user, you have the right to have the data stored about you deleted at any time.
Please note that deleting your data will terminate your license for MELAverse and you will no longer be able to use the software. This means that the documents archived by MELAverse will no longer be accessible and will also be permanently deleted.
You can obtain a new license at any time in the future, but you will no longer have access to the documents archived in the past. MELAG therefore strongly recommends that you back up the document data from the cloud archive to another medium before requesting the deletion of the data stored about you.
The stored data can be modified in the account management section of the website. In this case, the software can only be reused after MELAG has rechecked it.
X. Management of dashboard access
1. Description and scope of data processing
MELAverse allows the user group "Practice/Clinic" to grant one or more users from the user group "Service Technicians" access to the MELAverse dashboard. The "Service Technician" user group can thus view several dashboards from "Practice/Clinic" and execute the functions provided. Mutual consent from both parties (invitation and acceptance) is required to set up such a link. This is done by linking user accounts and the same processed data in accordance with Section V and requires the creation of user accounts via the MELAG website, which is implemented by a modular online shop system (Shopware). The personal account data is stored and managed by Shopware services on the website.
Such a link can be refused, rejected, or deactivated at any time, both for "Practice/Clinic" and for "Service Technicians," directly in MELAverse.
Important note:
By granting access, users in the "Service technician" group will have access to all information and functions of the MELAverse software that are available to the "Practice/clinic" user group.
This also includes:
Access to all personal data (e.g., account information), except passwords
Uploading and downloading device and processing logs
Management of device and cycle data
Uploading and downloading documents
This does not include the functions specified in this paragraph and section IX .
Users in the "Practice/Clinic" user group are thereby granted access to all account information of the linked user accounts in the "Service Technician" group in accordance with Section V.
To ensure this function, the following information is collected and stored (if available):
(1) Anonymized account ID (in accordance with section V) of the requesting participant
(2) Anonymized account ID (in accordance with section V) of the participant being requested
(3) Date and time of the request
(4) Current request status:
a. Requested
b. Withdrawn
c. Accept
d. Rejected
e. Deactivated
f. Removed
(5) Date and time for the respective request status
(6) Anonymized account ID (in accordance with section V) of the participant who disabled the account
(7) Anonymized account ID (in accordance with section V) of the removing participant
Policy for sharing MELAverse dashboards:
1. Permitted recipients
MELAverse - Privacy Policy As of September 2025
Invitations to share MELAverse dashboards may only be sent to partners with whom a verifiable and verified business relationship exists.
2. Unacceptable acceptance of requests
Requests from unknown or unverified persons must be rejected. Suspicious, unsolicited, or dubious contact requests must be reported to MELAG immediately.
3. Obligations for service technicians
Service technicians are prohibited from sending invitations on a large scale or indiscriminately (e.g., to all practices in a region), especially not for the purpose of arbitrarily expanding the customer base.
4. Consequences of violations
Violations of this policy may result in measures in accordance with the applicable contractual provisions, including, but not limited to, the withdrawal of access rights to MELAverse dashboards and the loss of the license.
2. Legal basis for data processing
The legal basis for the processing of data is Art. 6 (1) lit. a GDPR if the user has given their consent.
If the registration serves to fulfill a contract to which the user is a party or to take pre-contractual measures, the additional legal basis for the processing of the data is Art. 6 para. 1 lit. b GDPR.
3. Purpose of data processing
Registration of the user is necessary for the fulfillment of a contract with the user or for the implementation of pre-contractual measures.
Only trained and professional personnel are authorized to manage requests to share dashboards. The user data collected is necessary to determine whether the user belongs to this group of persons.
4. Duration of storage
The collected data will be stored for the duration of the contract (cloud archiving).
Even after the contract has been terminated, personal data of the contractual partner will be stored in order to fulfill contractual or legal obligations.
5. Right to object and right to erasure
As a user, you have the right to have the data stored about you deleted at any time.
Please note that deleting your data will terminate your license for MELAverse and you will no longer be able to use the software. This means that the documents archived by MELAverse will no longer be accessible and will also be permanently deleted.
You can obtain a new license at any time in the future, but you will no longer have access to the documents archived in the past. MELAG therefore strongly recommends that you back up the document data from the cloud archive to another medium before requesting the deletion of the data stored about you.
The stored data can be modified in the account management section of the website. In this case, the software can only be reused after MELAG has rechecked it.
XI. Use of Microsoft Defender for Cloud / Microsoft Defender for Storage
1. Purpose of processing
We use the security services "Microsoft Defender for Cloud" and "Microsoft Defender for Storage" to ensure the IT security and integrity of our systems. These services are used to detect and defend against threats, including malicious access, data exfiltration of confidential data, and the uploading of malware.
2. Legal
Processing is based on our legitimate interest in the security of data processing in accordance with Art. 6 (1) lit. f GDPR. Insofar as we act on behalf of our customers, processing is based on the relevant agreements on order processing in accordance with Art. 28 GDPR.
3. Categories of data processed
The services automatically process metadata and content data of uploaded files to the extent necessary for the detection of threats. This may also include personal data if it is contained in the uploaded content.
4. Recipients of the data
The recipient is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as the European branch of Microsoft. Microsoft may also use sub-processors within its corporate structure.
5. Transfer to third countries
It cannot be ruled out that, in the course of processing by Microsoft, data may also be transferred to servers in third countries, in particular the USA. If such a transfer takes place, it is based on EU standard contractual clauses and additional technical and organizational measures to ensure an adequate level of data protection.
6. Storage period
The data collected as part of the security check will only be stored for as long as necessary for threat detection and will then be deleted, unless there are legal retention obligations.
7. Further
Further information on data processing by Microsoft can be found at: https://privacy.microsoft.com/de-de/privacystatement
XII. Rights of the data subject
If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:
You can request confirmation from the controller as to whether personal data concerning you is being processed by us.
If such processing is taking place, you may request the following information from the controller:
(1) the purposes for which the personal data is processed;
(2) the categories of personal data being processed;
(3) the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed;
(4 the planned duration of storage of the personal data concerning you or, if this is not possible, criteria for determining the duration of storage;
(5) the existence of a right to rectify or erase the personal data concerning you, a right to restrict processing by the controller or a right to object to such processing;
(6) the existence of a right to lodge a complaint with a supervisory authority;
(7) all available information on the origin of the data if the personal data is not collected from the data subject;
(8) the existence of automated decision-making, including profiling, pursuant to Art. 22 (1) and (4) GDPR and, at least in these cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
You have the right to request information on whether the personal data concerning you is transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.
2. Right to rectification
You have the right to obtain from the controller the rectification and/or completion of personal data concerning you if the personal data processed are inaccurate or incomplete. The controller shall carry out the rectification without undue delay.
3. Right to restriction of processing
You may request the restriction of the processing of personal data concerning you under the following conditions:
(1) if you dispute the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;
(2) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
(3) the controller no longer needs the personal data for the purposes of the processing, but you require it for the assertion, exercise, or defense of legal claims; or
( if you have objected to the processing pursuant to Art. 21 (1) GDPR and it is not yet clear whether the legitimate reasons of the controller outweigh your reasons. If the processing of personal data concerning you has been restricted, such data may – with the exception of storage – only be processed with your consent or for the assertion, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. If the processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.
4. Right to erasure
a) Obligation to erase
You may request that the controller delete personal data concerning you without undue delay, and the controller is obliged to delete such data without undue delay if one of the following reasons applies:
(1) The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.
(2) You withdraw your consent on which the processing is based in accordance with Art. 6 (1) lit. a or Art. 9 (2) lit. a GDPR, and there is no other legal basis for the processing.
(3) You object to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing or you object to the processing pursuant to Art. 21 (2) GDPR.
(4) The personal data concerning you has been processed unlawfully.
( The erasure of personal data concerning you is necessary for compliance with a legal obligation to which the controller is subject under Union law or the law of the Member States.
(6) The personal data concerning you has been collected in relation to the services offered by information society services in accordance with Art. 8 (1) GDPR.
b) Information to third parties
If the controller has made the personal data concerning you public and is obliged to erase it pursuant to Art. 17 (1) GDPR, the controller shall take reasonable steps, including technical measures, to inform controllers processing the personal data of the erasure of the personal data, taking into account the available technology and implementation costs, so that the controllers are informed of the erasure. that you, as the data subject, have requested the erasure of all links to this personal data or of copies or replications of this personal data.
c) Exceptions
The right to erasure does not apply if processing is necessary
(1) for exercising the right of freedom of expression and information;
(2) for compliance with a legal obligation which requires processing in accordance with Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(3) for reasons of public interest in the area of public health pursuant to Art. 9 para. 2 lit. h and i as well as Art. 9 para. 3 GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 para. 1 GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of this processing; or
(5) for the establishment, exercise, or defense of legal claims.
5. Right to information
If you have exercised your right to rectification, erasure, or restriction of processing vis-à-vis the controller, the controller is obliged to notify all recipients to whom your personal data has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves disproportionate effort.
You have the right to be informed by the controller about these recipients.
6. Right to data portability
You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data has been provided, provided that
(1) the processing is based on consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract pursuant to Art. 6 para. 1 lit. b GDPR and
(2) the processing is carried out by automated means.
In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. The freedoms and rights of other persons must not be affected by this.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
7. Right to object
You have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions. The controller shall no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercising or defense of legal claims.
If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.
In connection with the use of information society services, you have the option, notwithstanding Directive 2002/58/EC, to exercise your right to object by means of automated procedures using technical specifications.
8. Right to revoke your data protection consent
You have the right to withdraw your data protection consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
9. Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision
(1) is necessary for the conclusion or performance of a contract between you and the controller,
(2) is authorized by Union or Member State law to which the controller is subject and that law provides for appropriate measures to safeguard your rights and freedoms and legitimate interests, or
(3) is based on your explicit consent.
However, these decisions may not be based on special categories of personal data pursuant to Art. 9 (1) GDPR, unless Art. 9 (2) lit. a or g GDPR applies and appropriate measures to protect your rights and freedoms and legitimate interests have been taken.
With regard to the cases referred to in (1) and (3), the controller shall take appropriate measures to safeguard your rights and freedoms and legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express your own point of view and to contest the decision.
10. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.
The supervisory authority with which the complaint has been lodged shall inform the complainant on the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
XIII. Changes to the Privacy Policy
Significant changes to this privacy policy will also be communicated to users in a timely manner before they take effect.
XIV. Changes to the platform
The platform operator is entitled to further develop the platform, change, restrict, or supplement functions. Significant changes will be communicated to the user at least 15 days before they take effect. The user may terminate the contract within this period.
XV. Term and termination
The contract term is determined by the creation of an account and use of the platform. The right to extraordinary termination for good cause remains unaffected.
Upon termination of the contract, the user data will be provided in a common machine-readable format upon request and then deleted, unless there are legal obligations to retain it.
XVI. Intellectual property
All rights to the platform, the software, and the underlying databases are reserved exclusively by the platform operator. The user only receives the rights necessary for contractual use.
XVII. Confidentiality
Both parties undertake to keep all confidential information obtained within the scope of this contract confidential. This obligation shall continue to apply for a period of five years after the end of the contract.
