1.     Controller

The controller within the meaning of the GDPR and other national data protection laws and other provisions of data protection law for the processing of data is

Christian Twellmann

Eimsbütteler Chaussee 39

20259 Hamburg, Germany

web [at] mpilot.de

2.     Legal basis for the processing of personal data

Your personal data is processed on the basis of the following legal bases:

a)    Consent of the data subject

Insofar as I obtain the consent of the data subject for processing personal data, Art. 6 para. 1 s. 1 lit. a GDPR serves as the legal basis for the processing of personal data.

b)    Performance of contractual obligations

If I process personal data that is necessary for the performance of a contract to which the data subject is a party of, Art. 6 para. 1 s. 1 lit. b GDPR serves as the legal basis. This also applies to processing which is necessary to carry out pre-contractual measures.

 

c)    Legal requirements and obligations

Insofar as the processing of personal data is necessary for the fulfilment of a legal obligation to which I am subject to, Art. 6 para. 1 s. 1 lit. c GDPR serves as the legal basis.

 

d)    Safeguarding legitimate interests

If the processing is necessary to safeguard a legitimate interest of mine or of a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the former interest, Art. 6 para. 1 s. 1 lit. f GDPR serves as the legal basis.

3.     Data deletion and storage period

The personal data of the data subject will be deleted or blocked as soon as the purpose of the processing no longer applies.

4.     Recipients of your data

Internally, only those entities process personal data that require it for the fulfilment of their processing purposes. This also applies to the processors, service providers and vicarious agents I use. All bodies and persons who work with personal data are obliged to maintain data secrecy and have been made aware of the sensitive nature of handling such data.

Personal data will only be passed on to third parties if this is in accordance with data protection regulations. In particular, persons assigned to carry out my business operations (e.g., banks, tax consultants, service providers for IT services) as well as government agencies/authorities may receive your personal data insofar as this is necessary to fulfil a statutory obligation.

5.     Data subject rights

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights against the controller:

a)    Right of access

In accordance with Art. 15 GDPR, you have the right to request information about the personal data I process. In particular, you can request to be informed regarding:

 

–      the purposes of the processing,

 

–      the categories of personal data concerned,

 

–     the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations (in this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR),

 

–      the planned storage period,

 

–      the right to request rectification or erasure of personal data or restriction of processing of personal data or to object to such processing,

 

–      the right to lodge a complaint with a supervisory authority,

 

–      if the personal data are not collected from you, to about the source of the personal data,

 

–    and the existence of automated decision-making, including profiling, referred to in Art. 22 para. 1 and 4 GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

 

b)    Right to rectification

In accordance with Art. 16 GDPR, you have the right to have your personal data corrected and/or completed if it is incorrect or incomplete. I must carry out the correction without delay.

 

c)    Right to restriction of processing

In accordance with Art. 18 GDPR, you have the right to request the restriction of the processing of your data, insofar as the accuracy of the data is disputed by you or the processing is unlawful. If the processing has been restricted, you will be informed by me before the restriction is lifted.

 

d)    Right to erasure

In accordance with Art. 17 GDPR, you have the right to erasure of your personal data, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims.

 

e)    Notification regarding rectification or erasure of personal data or restriction of processing

If you have asserted the right to rectification, erasure or restriction of processing, all recipients to whom the personal data have been disclosed will be notified of the rectification, erasure of the personal data or restriction of processing, unless this proves impossible or involves disproportionate effort.

 

f)      Right to data portability

You have the right within the limits of Art 20 GDPR to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided.

 

g)    Right to object

You have the right within the limits of Art. 21 GDPR to object at any time, on grounds relating to your particular situation, to the processing of personal data relating to you which is carried out on the basis of Art. 6 para. 1 s. 1 lit. e or f GDPR.

 

h)    Right to withdraw the consent

You have the right to withdraw your consent at any time according to Art. 7 para. 3 GDPR. The withdraw does not affect the lawfulness of prior processing carried out on the basis of the consent.

 

i)      Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right according to Art. 77 GDPR to lodge a complaint with a supervisory authority.