Data privacy
I. Introduction and definitions
1. General
We process personal data through the operation of our website at the URL https://www.intermate.de/ (hereinafter referred to as the "website"). This data is treated confidentially and processed in accordance with applicable laws—specifically the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), and the Telecommunications-Telemedia Data Protection Act (TTDSG). With this privacy policy, we aim to inform you about which personal data we collect from you, for what purposes and on what legal basis we use it, and to whom we may disclose it. Furthermore, we will explain the rights you have to protect and enforce your data privacy.
2. Definitions
Our privacy policy contains technical terms used in the GDPR and the BDSG. To help you better understand these, we would like to explain these terms in simple language first:
2.1 Personal Data
"Personal data" means any information relating to an identified or identifiable natural person (Art. 4 No. 1 GDPR). Examples of information for an identified person include their name or email address. Data is also considered personal if the identity is not immediately apparent but can be determined by combining your own or third-party information to identify the individual. A person becomes identifiable, for example, through the provision of their address, bank details, date of birth, username, IP addresses, and/or location data. Relevant here is any information that allows for a conclusion to be drawn about a person in any way.
2.2 Processing
Under Art. 4 No. 2 of the GDPR, "processing" refers to any operation performed in connection with personal data. This includes, in particular, the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction of personal data.
II. Controller and Data Protection Officer
3. Controller
The party responsible for data processing is:
Company: Intermate Media GmbH ("we")
Legal Representatives: Alisa Sljoka, Ann-Sophie Sell, Jörn Mecher, Kathrin Franssen, Philip Papendieck, Sabrina Kosse
Address: Schlüterstraße 54, 10629 Berlin
Phone: +49 (0) 30 75 43 91 18
Email: info@intermate.de
4. Data Protection Officer
We have appointed an external data protection officer for our company. You can reach them at:
Company: HABEWI GmbH & Co. KG
Legal Representative: General Partner HABEWI Beteiligungs GmbH, represented by Arne Platzbecker (Managing Director)
Address: Palmaille 96, 22767 Hamburg
Phone: 040/ 46008966
Fax: 040/ 46008977
Email: datenschutz@habewi.de
III. Scope of processing
5. Scope of processing: Website
In connection with the website, we process the personal data of yours that is listed in detail in Section IV below. We only process data that you actively provide on the website (e.g., by filling out forms) or that you provide automatically when using our services.
Your data is processed exclusively by us and is generally not sold, rented, or disclosed to third parties. If we use external service providers to assist in the processing of your personal data, this is done within the framework of so-called data processing agreements, under which we, as the controller, retain authority over our processors. We use external service providers for the hosting and maintenance of our website. We host our website with the external provider Webflow (Address: 398 11th Street, San Francisco, CA 94103). Should additional external service providers be used for any of the processing activities listed in Section IV, they will be identified there.
As a general rule, we do not transfer data to third countries, nor do we have any plans to do so. We will provide information regarding any exceptions to this principle in the processing activities described below. Any such data transfer to third countries will be based on the so-called EU Standard Contractual Clauses.
IV. Details of processing
6. Provision of the website and server log files
6.1 Description of processing
Every time the website is accessed, we automatically collect information that your browser transmits to our server. This includes the following data:
· IP address
· Browser software used, as well as its version and language
· Operating system
· The website from which visitors reached the website (so-called referrer)
· The subpages accessed on the website
· The date and time of the website access
· Internet service provider
· Country and location from which a user visited the website
This data is also stored in the so-called log files of our system. The temporary storage of your IP address by the system is necessary to be able to deliver our website to a user's device. For this, the user's IP address must remain stored for the duration of the session. For security reasons, your IP address is also recorded in the log files to defend against attacks on our website (in particular so-called DDoS attacks) and for fraud prevention.
6.2 Purpose
Processing is carried out to enable the website to be accessed and to ensure its stability and security. Furthermore, processing serves the purpose of statistical evaluation and the improvement of our online services.
6.3 Legal basis
Processing is necessary to safeguard the overriding legitimate interests of the controller (Art. 6(1)(f) GDPR). Our legitimate interest lies in the purpose specified in section 6.2.
6.4 Storage duration
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of data collection for the provision of the website, this is the case when the respective session has ended. Log files are deleted after 7 days.
7. Cookies and other tracking technologies
7.1 Description of processing
Our website uses cookies. Cookies are small text files that are stored on the user's device when visiting a website. Cookies contain information that enables the recognition of a device and, if applicable, certain functions of a website. We distinguish between our own cookies and external, so-called third-party cookies. Our site uses "session cookies" and "persistent cookies." Session cookies are automatically deleted when you end your internet session and close your browser. Persistent cookies remain stored on your device for a longer period. In addition to cookies, we also use other tracking technologies, such as pixels or so-called fingerprinting. If cookies are technically necessary for the operation of our site, your consent is not required. All other non-technically necessary cookies and tracking technologies are only set after you have actively consented to the use of cookies/tracking technologies via our consent tool. To obtain and document consent, we use the "Cookiebot" service, which is operated by Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark. The consent tool stores your selection itself in a cookie on your device. This means you do not need to make a decision about cookies again during a subsequent visit to our website.
You can find information on which cookies are used on our website for which purpose, how long they are stored on your device, and which consents you may have already given in the settings of the consent tool https://www.intermate.de/cookiebot-cookie-declaration.
7.2 Purpose
We use cookies to make our website more user-friendly and to offer the functions described in section 7.1.
7.3 Legal basis
Processing is necessary with regard to technically required cookies, as well as the use of the consent tool, to safeguard the overriding legitimate interests of the controller (Art. 6(1)(f) GDPR in conjunction with Section 25(2) TTDSG). Our legitimate interest lies in the purpose specified in section 7.2. For processing with regard to all other cookies/tracking technologies—i.e., those that are not technically required—the legal basis is consent (Art. 6(1)(a) GDPR in conjunction with Section 25(1) TTDSG). Such consent is voluntary.
7.4 Storage duration, withdrawal of consent
Cookies are automatically deleted at the end of a session or once the specified storage period has expired. Since cookies are stored on your device, you as the user have full control over their use. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been saved can be deleted. This can also be done automatically. If cookies are disabled, deleted, or restricted for our website, it may be the case that individual functions of our website can no longer be used, or can only be used to a limited extent. You may revoke any consent you have given for the use of cookies at any time with future effect in the settings of the consent tool https://www.intermate.de/cookiebot-cookie-declaration.
7.5 Recipients
When using third-party cookies, data may be transmitted to the respective providers of these third-party services. In some cases, this may also involve a transfer to third countries outside the European Union or the European Economic Area. We provide information about data recipients and transfers to third countries in the settings of the consent tool or in the corresponding section regarding the third-party service within this privacy policy. Personal data may also be transmitted to the consent tool service provider, "Cookiebot" (Cybot A/S).
8. Contact form and contact via email
8.1 Description of processing
We have provided a contact form on our website for you to get in touch with us. In this form, you are asked to enter your email address, your name, and a message for us. When you click the "Submit" button, the data is transmitted to us using SSL encryption (see section 17). The contact form can only be submitted if you confirm that you have read these privacy policy terms by checking the corresponding box. You can also contact us via the email addresses provided on the website. In this case, the personal data transmitted with the email will be processed by us.
8.2 Purpose
By providing a contact form on our website, we want to offer you a convenient way to get in touch with us. The data transmitted via the contact form or your email is used exclusively for the purpose of processing and responding to your request.
8.3 Legal basis
Processing is necessary to safeguard the overriding legitimate interests of the controller (Art. 6(1)(f) GDPR). Our legitimate interest lies in the purpose specified in section 8.2. If the email contact is aimed at concluding or fulfilling a contract, the data is processed for the purpose of contract performance (Art. 6(1)(b) GDPR).
8.4 Storage period
We delete data as soon as it is no longer required to achieve the purpose for which it was collected. This is generally the case when the respective communication with you has ended. Communication is considered ended when it is clear from the circumstances that your request has been conclusively resolved. If statutory retention periods prevent deletion, the data will be deleted immediately after the expiry of the relevant statutory retention period.
9. Newsletter
9.1 Description of processing
We send out a monthly newsletter. Through this newsletter, we keep you informed about Social Media Updates / Intermate Updates. You will only receive our newsletter if you actively sign up for our distribution list. You can subscribe by filling out and submitting the newsletter registration form on our website.
Only your email address is required to sign up for the newsletter. All other information (such as your first and last name) is voluntary and is used solely to personalize the emails. We use a double opt-in process to manage and verify newsletter subscriptions. Registration takes place in several steps. First, you sign up for the newsletter on our website. You will then receive an email from us at the address you provided. In this email, we ask you to confirm that you have indeed signed up for the newsletter and wish to receive it. Confirmation is completed by clicking the link provided in the email. Only after successful confirmation will we add you to our newsletter distribution list and send you future emails. As part of the double opt-in process, we store the date, time, and your IP address both at the time of registration and at the time of confirmation.
9.2 Purpose
Processing is carried out to provide the newsletter service and to send newsletter emails to subscribers. The collection and storage of the date, time, and IP addresses during newsletter registration serves to document the consent provided and to protect against the unauthorized use of email addresses.
9.3 Legal basis
Our subscriber newsletter is processed based on your consent in accordance with Art. 6(1)(a) GDPR. You can view your declaration of consent on our website at any time at https://www.intermate.de/. Providing your consent is voluntary. The collection and storage of the date, time, and IP addresses during newsletter registration is necessary to safeguard the overriding legitimate interests of the controller (Art. 6(1)(f) GDPR). Our legitimate interest lies in the purpose specified in section 9.2.
9.4 Storage period and withdrawal of consent
If you do not confirm your newsletter subscription within 24 hours of receiving the corresponding confirmation email, your data will be automatically deleted. Otherwise, we will process your personal data for the duration of your newsletter subscription. You may unsubscribe from our newsletter at any time by withdrawing your consent. A simple notification is sufficient (via email to info@intermate.de or by mail to Intermate Media GmbH, Schlüterstraße 54, 10629 Berlin). You can also unsubscribe by clicking the unsubscribe link in any newsletter email or here at https://www.intermate.de/. Once you withdraw your consent, you will no longer receive our newsletter, and your personal data will be removed from our active distribution list.
9.5 Recipients and transfer to third countries
We use the services of the newsletter provider HubSpot to manage our newsletter distribution list and to send emails. This is carried out as part of a data processing agreement. HubSpot is a service offered by HubSpot, Inc., Cambridge, Massachusetts. Further information on data protection at HubSpot can be found at https://legal.hubspot.com/de/privacy-policy?hubs_content=www.hubspot.de/&hubs_content-cta=Datenschutzbestimmungen
10. Social networks
10.1 Description of processing
Our website does not use any social media plugins. The Instagram and LinkedIn logos displayed on our website are merely linked to our company's corresponding profiles on these social networks. No data is transmitted to the social networks by including these logos. If you click on one of the logos, you will simply be redirected to the external website of the respective social network.
However, our profiles within social networks do constitute data processing. If you are logged into the respective social network when visiting such a profile, this information will be associated with your user account there. If you interact with our profile, e.g., by commenting on, "sharing," "liking," or "retweeting" a post, this information is also stored in your user account. Your interactions with our profile are generally also visible to us.
On the social network Instagram, we have the ability to obtain statistical data regarding the use of our Instagram profile via the "Insights" function. These statistics are provided by Instagram. The "Insights" function is mandatory. We cannot choose to turn this function on or off. It is available to all operators of an Instagram business account, regardless of whether you use the Insights function or not. Instagram Insights provides us with anonymized data on the development and reach of our Instagram profile, as well as the posts, stories, and videos we publish there. We also receive statistical information in Instagram Insights regarding the origin, gender, and age of our Instagram profile followers.
On the social network LinkedIn, we have the ability to obtain statistical data regarding the use of our LinkedIn profile via the "Insights" function.
The social networks you interact with store your data using pseudonyms as user profiles and use them for advertising and market research purposes. For example, advertisements that correspond to your presumed interests may be displayed to you within the social network and on third-party websites. For this purpose, cookies are generally used, which the social network places on your device. You have the right to object to the creation of these user profiles; to exercise this right, you must contact the social networks directly.
10.2 Purpose
We maintain profiles on the aforementioned social networks for the purpose of public relations and corporate communication with customers and interested parties. We use the "Insights" function on Instagram to evaluate the reach of our posts on the social network and to make them more engaging for our visitors in the future.
10.3 Legal basis
The legal basis for data processing in the context of our social media profiles is the protection of our overriding legitimate interests (Art. 6(1)(f) GDPR). Our legitimate interest lies in the purpose stated in section 10.3. If you are asked for consent by the respective operator of a social network, the legal basis is Art. 6(1)(a) GDPR. Furthermore, data processing regarding our presence on Instagram and LinkedIn is based on a joint controllership agreement pursuant to Art. 26 GDPR.
10.4 Recipients and transfer to third countries
The respective social networks are operated by the companies listed below. Further information on data protection regarding our profile on these social networks can be found in the linked privacy policies.
· Instagram: Meta Platforms, Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA or Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland; Privacy Policy: help.instagram.com/155833707900388/.
· LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Privacy Policy: www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy. The data processing agreement with LinkedIn can be found at www.linkedin.com/legal/l/dpa. The joint controller addendum is available at legal.linkedin.com/pages-joint-controller-addendum.
· TikTok: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. Privacy Policy: https://www.tiktok.com/legal/page/eea/privacy-policy/de
The social networks also process your personal data in the USA.
11. Google Analytics
11.1 Description of processing
Our website uses Google Analytics, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as "Google"). Google Analytics uses cookies (see section 7) that enable an analysis of your use of our website. We use the "Universal Analytics" version of Google Analytics, which allows for cross-device analysis by assigning data to a pseudonymous User ID. The information generated by the cookies is generally transmitted to a Google server in the USA and stored there. However, we use Google Analytics exclusively with IP anonymization enabled. This means your IP address is truncated by Google within member states of the European Union or other states party to the Agreement on the European Economic Area before being transmitted. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data held by Google. The statistics generated by Google Analytics capture, in particular, how many users visit our website, the country or location from which the access occurs, which subpages are visited, and which links or search terms visitors use to reach our website. You can find the Google Analytics terms of service at www.google.com/analytics/terms/de.html. An overview of data privacy in Google Analytics is available at www.google.com/intl/de/analytics/learn/privacy.html. Google's privacy policy can be viewed at www.google.de/intl/de/policies/privacy.
11.2 Purpose
Processing is carried out to evaluate the use of our website. The information obtained in this way serves to improve and tailor our online presence to user needs.
11.3 Legal basis
Processing is based on consent in accordance with Art. 6(1)(a) GDPR. This is obtained by us via the consent tool (see section 7.1). Such consent is voluntary.
11.4 Storage duration and right to object, withdrawal of consent
We have explained the storage duration as well as your control and setting options regarding cookies in section 7.4. You can revoke the consent you have given for Google Analytics at any time in the settings of the consent tool with effect for the future. Alternatively, you can object to data processing by Google Analytics at any time by downloading and installing the browser add-on offered by Google at tools.google.com/dlpage/gaoptout?hl=en. The analytical data processed and stored by Google Analytics is automatically deleted by us after 14 months.
11.5 Recipients and transfer to third countries
According to the German data protection supervisory authorities (Data Protection Conference), Google Analytics is operated under joint controllership with us. Against this background, we have also concluded the "Google Measurement Controller-Controller Data Protection Terms" with Google. Google also processes your personal data in the USA.
12. Google Webfonts
12.1 Description of processing
Our website uses "Google Webfonts," a font replacement service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as "Google"). With Google Webfonts, the standard fonts on your device are replaced by fonts from the Google catalog when our website is displayed. If your browser prevents the integration of Google Webfonts, the text on our website will be displayed in your device's standard fonts. Google Fonts are loaded directly from a Google server. For this to happen, your browser sends a request to a Google server. As a result, your IP address may be transmitted to Google in connection with the address of our website. However, Google Webfonts does not store cookies on your device. According to Google, data processed as part of the Google Webfonts service is transmitted to resource-specific domains such as fonts.googleapis.com or fonts.gstatic.com. It is not associated with data that may be collected in connection with the use of other Google services, such as the Google search engine or Gmail. Further information on data protection regarding Google Webfonts can be found at developers.google.com/fonts/faq?hl=en&csw=1. General information on data protection at Google is available at policies.google.com/privacy?hl=en.
12.2 Purpose
Processing is carried out to ensure that the text on our website is displayed in a more readable and aesthetically pleasing manner.
12.3 Legal basis
Processing is necessary to safeguard the overriding legitimate interests of the controller (Art. 6(1)(f) GDPR). Our legitimate interest lies in the purpose specified in section 12.2.
12.4 Recipients and transfer to third countries
The use of Google Webfonts may result in the transmission of personal data to Google. Google also processes your personal data in the USA.
13. Vimeo
13.1 Description of processing
Our website uses services from "Vimeo," a video platform operated by Vimeo LCC, 555 West 18th Street, New York, New York 10011, USA (hereinafter referred to as "Vimeo"). We use Vimeo by embedding individual videos from the platform onto our website via an iFrame, allowing them to be played directly on our site. When you visit a subpage of our website that contains an embedded video, a connection to the Vimeo servers is established, and the video is displayed within the website. This informs Vimeo which page you have visited. Your IP address may also be transmitted to Vimeo. If you play an embedded video, this information is also passed on to Vimeo. If you are logged in as a Vimeo user, Vimeo will associate this data with your user account. Further information on data protection at Vimeo can be found at vimeo.com/privacy.
13.2 Purpose
Processing is carried out to enable us to display videos on our website.
13.3 Legal basis
Processing is based on consent in accordance with Art. 6 (1) (a) GDPR. We obtain this consent via the "Cookiebot" consent tool (see section 13.2) or via a content blocker at the location on our website where a Vimeo video is to be displayed. Providing such consent is voluntary.
13.4 Withdrawal of consent
You can revoke your consent to display Vimeo videos on our website at any time in the settings of the consent tool https://www.intermate.de/cookiebot-cookie-declaration with effect for the future.
13.5 Recipients and transfer to third countries
The integration of Vimeo videos may result in personal data being transmitted to Vimeo LLC. Vimeo also processes data in the USA.
14. FACEBOOK PIXEL
14.1 Description of processing
Our website uses the remarketing service "Facebook Pixel," which is operated by Meta Platforms, Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA, or Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Meta"). The "Facebook Pixel" allows us to display advertisements on the social network that are specifically targeted at Facebook users who have shown interest in our offerings – for example, by previously visiting our website. With the help of the "Facebook Pixel," we can also track and evaluate the effectiveness and reach of our advertising on Facebook by recording whether Facebook users interact with our advertisements and are redirected to our website by clicking on them. When you visit our website, a connection to the Facebook servers is established and the "Facebook Pixel" is embedded into our website. Additionally, Facebook may store a cookie on your device (see section 7 above). If you are logged into Facebook or log in later, your visit to our website will be associated with your user account. The data collected about you via the "Facebook Pixel" is anonymous to us. It does not provide us with any conclusions about your identity. However, Facebook may establish a connection to your user profile. Data processing by Facebook is carried out in accordance with the company's data policy, which can be accessed at www.facebook.com/policy.php.
14.2 Purpose
Processing is carried out to enable targeted online advertising for our own offerings and to evaluate their effectiveness and reach.
14.3 Legal basis
Processing is based on consent in accordance with Art. 6 (1) (a) GDPR. We obtain this consent via the "Cookiebot" consent tool (see section 7.1). Providing such consent is voluntary.
14.4 Storage duration, right to object, and withdrawal of consent
We have explained the storage duration as well as your control and setting options regarding cookies/tracking pixels in section 7. You can revoke the consent you have given regarding data collection by the "Facebook Pixel" and the use of your data for displaying Facebook advertisements at any time in the consent tool settings with effect for the future. www.facebook.com/settings?tab=ads You can also object to data collection by the "Facebook Pixel" and the use of your data for displaying Facebook advertisements to Facebook at any time. You can decide which types of advertisements are displayed to you on Facebook within your Facebook account settings at www.facebook.com/settings?tab=ads. This setting is applied across all devices.
14.5 Recipients and transfer to third countries
The integration of the "Facebook Pixel" may result in personal data being transmitted to Meta. Meta also processes your personal data in the USA.
15. Google Tag Manager
Our website uses the "Google Tag Manager," a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as "Google"). No personal data is collected and no cookies are set via the Google Tag Manager. This service merely enables us to integrate and manage tags on our website. Tags are small code elements on our website that help us use other tools to, for example, measure traffic and visitor behavior, track the impact of online advertising and social channels, implement remarketing and audience targeting, and test and optimize the website. Further information on the Google Tag Manager can be found at www.google.com/intl/en/tagmanager/use-policy.html.
16. Google reCAPTCHA
16.1 Description of Processing
Our website uses "reCAPTCHA," a service operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA (hereinafter "Google"). With reCAPTCHA, we can verify whether input in forms is made by a human or by automated software, specifically so-called bots. This allows us to protect our website from spam and misuse. In this context, your IP address, the time spent on the website, mouse movements made by you, and potentially other data required for the reCAPTCHA service are transmitted to Google. Further information on data protection at Google can be found at policies.google.com/privacy?hl=de-DE
16.2 Purpose
Processing is carried out to protect forms on our website against misuse and spam.
16.3 Legal Basis
Processing is necessary for the purposes of the legitimate interests pursued by the controller (Art. 6(1)(f) GDPR). Our legitimate interest lies in the purpose specified in section 16.2.
16.4 Recipients and Transfers to Third Countries
Google also processes your personal data in the USA.
V. Security Measures
17. Security Measures
To protect your personal data from unauthorized access, we have equipped our website with an SSL or TLS certificate. SSL stands for "Secure Sockets Layer" and TLS for "Transport Layer Security," which encrypts data communication between a website and the user's device. You can recognize active SSL or TLS encryption by the small padlock icon displayed on the far left of the browser's address bar.
VI. Your Rights
18. Data Subject Rights
Regarding the data processing by our company described above, you are entitled to the following data subject rights:
18.1 Access (Art. 15 GDPR)
You have the right to obtain confirmation from us as to whether we are processing personal data concerning you. If this is the case, you have the right to access this personal data and the information detailed in Art. 15 GDPR, provided the requirements set out in Art. 15 GDPR are met.
18.2 Rectification (Art. 16 GDPR)
You have the right to request that we rectify any inaccurate personal data concerning you without undue delay and, where applicable, to have incomplete personal data completed.
18.3 Erasure (Art. 17 GDPR)
You have the right to request that we delete your personal data without undue delay, provided that one of the reasons specifically listed in Art. 17 GDPR applies, for example, if your data is no longer required for the purposes for which it was collected.
18.4 Restriction of processing (Art. 18 GDPR)
You have the right to request that we restrict the processing of your data if one of the conditions listed in Art. 18 GDPR is met; for example, if you contest the accuracy of your personal data, the processing will be restricted for the period required to verify the accuracy of your data.
18.5 Data portability (Art. 20 GDPR)
You have the right, under the conditions set out in Art. 20 GDPR, to request the provision of your data in a structured, commonly used, and machine-readable format.
18.6 Withdrawal of consent (Art. 7(3) GDPR)
You have the right to withdraw your consent at any time for any processing based on consent. The withdrawal is effective from the moment it is made. In other words, it applies to the future. The withdrawal of consent does not make the processing retroactively unlawful.
18.7 Right to lodge a complaint (Art. 77 GDPR)
If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. You may exercise this right before a supervisory authority in the EU Member State of your habitual residence, your place of work, or the place of the alleged infringement.
18.8 Prohibition of automated decision-making/profiling (Art. 22 GDPR)
Decisions that have legal consequences for you or significantly affect you may not be based solely on automated processing of personal data, including profiling. We inform you that we do not use automated decision-making, including profiling, in relation to your personal data.
18.9 Right to object (Art. 21 GDPR)
If we process your personal data on the basis of Art. 6(1)(f) GDPR (to protect overriding legitimate interests), you have the right to object to this processing under the conditions set out in Art. 21 GDPR. However, this only applies if there are reasons arising from your particular situation. Following an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms. We are also not required to stop processing if it serves the establishment, exercise, or defense of legal claims. In any case—regardless of any particular situation—you have the right to object to the processing of your personal data for direct marketing purposes at any time.
As of: September 2026
