(knott.de/KNOTT-App/KNOTT-Shop)

I. Name and contact details of the controller
The controller within the meaning of the European General Data Protection Regulation (GDPR) and
other national data protection laws of the member states as well as further
data protection provisions is:
KNOTT GmbH
Obinger Straße 15
83125 Eggstätt
Tel: +49 8056 906-0
Fax: +49 8056 906-106
Email: info@knott.de
The name and contact details of the controller's data protection officer are:
Monika Kefer-Spieleder
Blumenstr. 9A
83569 Vogtareuth
info@kefer-it.de
www.kefer-it.de

II. General information on the processing of personal data
1. Extent of the processing of personal data
We (the "controller" within the meaning of the GDPR) take
the protection of your data very seriously. As a rule, we
process (Art. 4 no. 2 GDPR) the personal data (Art. 4 no. 1 GDPR) of our
users (the "data subject" within the meaning of the
GDPR) only in so far as this is necessary in order to provide
a functioning website, shop or app and our services and
content. The collection and use of our users' personal data
generally takes place only with the user's consent. An exception applies in cases in which
obtaining consent in advance is not possible for factual reasons and
the processing of the data is permitted by statutory provisions. Our offer is generally aimed
at adults. Persons under 18 years of age should not transfer any personal data to us without the consent of
their parents or guardians.
Your personal data is stored on protected computers of our provider
and on our own computer systems. We will process and use all personal data that we learn about you through this
website exclusively for the purposes stated in each case.
2. Legal basis for the processing of personal data
In so far as we obtain the consent of the data subject for processing operations involving personal data,
Art. 6 (1) (a) GDPR serves as the legal basis for the
processing of personal data.
Where personal data is processed that is necessary for the performance of a contract to which
the data subject is party, or in order to take steps prior to entering into a contract,
Art. 6 (1) (b) GDPR serves as the legal basis.
In so far as the processing of personal data is necessary for compliance with a legal
obligation to which our company is subject, Art. 6 (1) (c) GDPR serves
as the legal basis.
If the processing is necessary to safeguard a legitimate interest of our company or
of a third party, and if the interests, fundamental rights and fundamental freedoms
of the data subject do not override the first-mentioned interest, Art. 6 (1) (f) GDPR serves as the
legal basis for the processing.
3. Storage period and erasure of personal data
The data subject's personal data is erased or blocked as soon as
the purpose of the storage ceases to apply. Data may also be stored beyond that point
if the European or national legislator has provided for this in Union regulations,
laws or other provisions to which the controller is subject,
in particular tax or accounting legislation. Data is also blocked
or erased when a storage period prescribed by the standards
mentioned expires, unless there is a need for the data to be stored further
for the conclusion or the performance of a contract.
4. Links to third-party providers
In so far as our website contains pure recommendation, partner or customer links to third-party offers,
our privacy policy no longer applies to them, but that of the third-party provider.
Excepted from this are the third parties mentioned below, which are listed individually.

III. Provision of the website and log files
1. Description and extent of the data processing
Each time our website is called up, our system automatically records data and
information from the computer system of the calling computer.
The following data is collected in this process:
- IP address
- date and time of the request
- content of the request (the specific page)
- time zone difference from Greenwich Mean Time (GMT)
- operating system name and operating system version
- browser name and browser version
- referrers (source pages, such as a Google search)
- access status/HTTP status code
- the volume of data transferred in each case
- websites from which the user's system reaches our website
- the user's internet service provider
The data is also stored in the log files of our system. This data is not stored
together with other personal data of the user.
2. Legal basis for the data processing
The legal basis for the temporary storage of the data and the log files is Art. 6
(1) (f) GDPR. We have a legitimate interest here in improving the functionality and
stability of the website.
3. Purpose of the data processing
The temporary storage of the IP address by the system is necessary in order to make it possible to
deliver the website to the user's computer. For this, the user's IP
address has to remain stored for the duration of the session.
Storage in log files takes place in order to ensure that the website functions.
The data also serves us to optimise the website and to ensure the
security of our information technology systems. The data is not evaluated for
marketing purposes in this connection.
These purposes are also where our legitimate interest in the data processing under Art.
6 (1) (f) GDPR lies.
4. Duration of storage
The data is erased as soon as it is no longer necessary to achieve the purpose for which it was
collected. Where the data is recorded in order to provide the website, this is
the case when the session concerned has ended. In all other respects, the duration of
storage follows tax and accounting requirements.
Where the data is stored in log files, this is the case after seven days at the latest.
Storage beyond that is possible. In this case the users' IP addresses
are erased or altered so that the calling client can no longer be
identified.
5. Right to object and possibility of removal
Recording the data in order to provide the website and storing the data in
log files is absolutely necessary for the operation of the website. Consequently, the user has
no possibility of objecting.

IV. Use of cookies
1. Description and extent of the data processing
Our website uses cookies. Cookies are text files that are stored in the
internet browser, or by the internet browser, on the user's computer system.
If a user calls up a website, a cookie may be stored on the user's
operating system. This cookie contains a characteristic string of characters that
allows the browser to be identified unambiguously when the website is called up again.
We use cookies in order to make our website more user-friendly. Some elements
of our website require the calling browser to be identifiable even after
a change of page.
The following data is stored and transferred in the cookies:
language settings
When our website is called up, the user is informed about the use of cookies
and their consent to the processing of the personal data used in this
connection is obtained. Reference is also made to
this privacy policy in this connection.
2. Legal basis for the data processing
The legal basis for the processing of personal data using
cookies is Art. 6 (1) (f) GDPR. We have a legitimate interest here in improving the
functionality and stability of the website.
3. Purpose of the data processing
The purpose of using technically necessary
cookies is to make the use of websites simpler for
users. Some functions of our website cannot be offered without the use
of cookies. For these it is necessary for the browser to be recognised again after
a change of page.
We need cookies for the following applications:
carrying over language settings
The cookies used on our site are as follows:
cookieconsent_status: this cookie stores your current session in relation to PHP
applications and thereby ensures that all the functions of the site that are based on the PHP
programming language can be displayed in full.
The user data collected by technically necessary cookies is not used to create
user profiles.
These purposes are also where our legitimate interest in the processing of
personal data under Art. 6 (1) (f) GDPR lies.
4. Duration of storage
Cookies are stored on the user's computer and transferred from it to our site.
You as the user therefore also have full control over the use of
cookies. In all other respects, the duration of storage follows tax and
accounting requirements.
5. Right to object and possibility of removal
By changing the settings in your internet browser you can deactivate or restrict the transfer
of cookies. Cookies that have already been stored can be erased at any
time. This can also be done automatically. If cookies are deactivated for our website,
it may no longer be possible to use all the functions of the website in full.

V. GPS location
1. Description and extent of the data processing
Through our app we offer users the possibility of registering for GPS
location, including that of their trailer (theft protection), by providing personal
data.
Theft protection through GPS tracking with a COBBLESTONE GPS tracker from Copenhagen
Trackers.
After registration with Copenhagen Trackers, the tracker was paired with your smartphone.
The Cobblestone GPS tracker is supplied with an integrated SIM card, and the GPS data
is transferred to the manufacturer.
Only after that is the GPS data shown in the KNOTT app through an interface transfer.
If you voluntarily enter the chassis number of your vehicle and integrate the
tracker in your personal profile in the KNOTT app, the location data is linked.
You are notified about your location data by email, and you are also
notified if your vehicle leaves the radius you have set personally.
The data is entered in an input form and transferred to us and
stored. The data is passed on to Copenhagen Trackers ApS, Vester
Voldgade 94B, 1552 København V.
As part of the registration process, the user's consent to the processing
of this data is obtained.
Where required, the location data is also used to locate Knott
service partners.
2. Legal basis for the data processing
Where the user has given consent, the legal basis for the processing of the data
is Art. 6 (1) (a) GDPR.
3. Purpose of the data processing
Registration of the user is necessary for the GPS tracking and the theft protection
connected with it in the app.
The purpose of determining the location is to locate service partners nearby and thereby make them findable.
4. Duration of storage
In order to ensure effective theft protection, the last location data of the
tracker is stored on our servers for one year and erased after that.
Information on the further processing and use of your data can be found directly at the
manufacturer: cphtrackers.com/privacy-policy/
The simple location data is erased once the app's permission to access the location
is withdrawn.
5. Right to object and possibility of removal
As a user you have the possibility of cancelling the registration at any time. You can have the data
stored about you changed at any time.
If the data is necessary for the performance of a contract
or in order to take steps prior to entering into a contract,
early erasure of the data is possible only in so far as no
contractual or statutory obligations prevent erasure.
Simple location of the mobile phone can be prevented by withdrawing the app's permission to
access location data or by deactivating the location data.

VI. Tyre pressure monitoring
1. Description and extent of the data processing
Through our app we offer users the possibility of monitoring the
tyre pressure from their smartphone with the TireControl function.
Registration is necessary for this, during
which the IP address of the smartphone, among other things, is passed on to us.
The data is not passed on to third parties. As part of the
registration process, the user's consent to the processing of this data
is obtained.
2. Legal basis for the data processing
Where the user has given consent, the legal basis for the processing of the data
is Art. 6 (1) (a) GDPR.
3. Purpose of the data processing
Registration of the user is necessary for the tyre pressure monitoring through the app.
This is also where the necessary legitimate interest lies.
4. Duration of storage
In order to ensure the theft protection that is also integrated, the data is stored on
our servers and erased only after the user profile has been actively deleted.
5. Right to object and possibility of removal
As a user you have the possibility of cancelling the registration at any time. You can have the data
stored about you changed at any time.
If the data is necessary for the performance of a contract or in order to take steps prior to entering into a contract,
early erasure of the data is possible only in so far as no
contractual or statutory obligations prevent erasure.

VII. Contact form and contact by email
1. Description and extent of the data processing
A contact form is available on our website, which can be used to make contact
electronically. If a user takes up this possibility,
the data entered in the input form is transferred to us and stored. This data
is:
name, email, address and telephone number. Only the email is necessary.
At the time the message is sent, the following data is also stored:
the user's IP address;
date and time of the registration
Alternatively, it is possible to make contact using the email address provided. In
this case the user's personal data transferred with the email
is stored.
The data is not passed on to third parties in this connection. The data is used
exclusively to process the conversation.
The personal data that you provide to us through any online forms on this website
is transferred from your PC over a secure connection in encrypted form
(SSL) across the internet to our computer, in order to protect it against misuse
by third parties. The people working on our site are all bound to
data protection in accordance with the GDPR and the German Federal Data Protection Act. Access to this data is protected by an
authorisation concept, in order to ensure that only authorised employees can view
this data.
The display and sending of the form and the storage of the data are carried out securely and under the
aforementioned conditions by the data processor
Tally B.V., with its registered office at August Van Lokerenstraat 71, 9050 Ghent, Belgium
2. Legal basis for the data processing
Where the user has given consent, the legal basis for the processing of the data
is Art. 6 (1) (a) GDPR.
The legal basis for the processing of the data transferred in the course of sending an email
is Art. 6 (1) (f) GDPR. If the email contact is aimed at concluding
a contract, the additional legal basis for the processing is Art. 6 (1) (b)
GDPR.
3. Purpose of the data processing
The processing of the personal data from the input form serves us solely to
deal with the contact made. Where contact is made by email, this is also
where the necessary legitimate interest in the processing of the data lies.
The other personal data processed during the sending process serves
to prevent misuse of the contact form and to ensure the security of our
information technology systems.
4. Duration of storage
The data is erased as soon as it is no longer necessary to achieve the purpose for which it was
collected. For the personal data from the input form of the
contact form and the data sent by email, this is the case
when the conversation concerned with the user has ended. The conversation has ended
when it can be concluded from the circumstances that the matter concerned
has been finally clarified.
The personal data additionally collected during the sending process is
erased once the purpose has been achieved at the latest. In all other respects, the duration of
storage follows tax and accounting requirements.
5. Right to object and possibility of removal
The user has the possibility of withdrawing their consent to the processing of their
personal data at any time. If the user contacts us by email,
they can object to the storage of their personal data at any time. In
such a case the conversation cannot be continued.
All personal data stored in the course of making contact
is erased in this case.

VIII. Registration in the app
1. Description and extent of the data processing
Through our app we offer users the possibility of registering by providing personal
data. The data is entered in an input form and transferred to us
and stored. The data is not passed on to third parties, subject to the bodies
named below. The following data is collected during the registration process:
surname, first name;
email address
At the time of registration the following data is also stored:
the user's IP address;
date and time of the registration;
unique ID (an account identifier that links the aforementioned data with its own
individual identifier)
As part of the registration process, the user's consent to the processing
of this data is obtained.
Data about the trailer can also be stored voluntarily, such as the address, the registration
number, pictures and the vehicle identification number (VIN). Entries about the ETS
Plus system are also possible, which can be transferred to the service partner through the app
(status data and fault memory data of the ETS Plus).
The data is used internally for statistical purposes in order to improve
the way the app is used.
2. Legal basis for the data processing
Where the user has given consent, the legal basis for the processing of the data
is Art. 6 (1) (a) GDPR, and otherwise Art. 6 (1) (f) GDPR for the statistical
evaluations.
3. Purpose of the data processing
Registration of the user is necessary in order to hold certain content and services available in
our app.
Registration of the user may be necessary for the performance of a contract with the user or in order to
take steps prior to entering into a contract, in particular service or
repair, in which case the details provided can be used to make the process
easier.
4. Duration of storage
The data is erased as soon as it is no longer necessary to achieve the purpose for which it was
collected.
For the data collected during the registration process, this is the case when the
registration on our website is cancelled or changed.
For the data collected during the registration process for the performance of a contract or in order to
take steps prior to entering into a contract, in particular service or repair, this is the
case when the data is no longer necessary for the performance of the contract. Even
after the contract has been concluded, it may be necessary to store the contractual partner's
personal data in order to comply with contractual or statutory
obligations.
5. Possibility of objection and removal
As a user you have the possibility of cancelling the registration at any time. You can have the data
stored about you changed at any time.
You can remove the data stored from the Knott backend using a "delete profile"
function.
If the data is necessary for the performance of a contract
or in order to take steps prior to entering into a contract,
in particular service or repair, early erasure
of the data is possible only in so far as no contractual or statutory obligations prevent
erasure.

IX. Adyen
1. Description and extent of the data processing
If the user decides during the ordering process to pay with the online
payment service provider Adyen, the personal data is transferred as part of the order thereby placed
to Adyen N.V., Simon Carmiggeltstraat 6-50, 1011 DJ in
Amsterdam, Netherlands. Adyen thereby takes on the function of an online
payment service provider that makes cashless payment for products and services on the
internet possible.
The personal data transferred to Adyen is mostly the
first name, surname, address, telephone number, IP address, email address,
credit card number/IBAN, CCV code or other data necessary to process the order,
as well as data connected with the order, such as
the number of items, the item number, the invoice amount and taxes in percent,
invoice information and so on. Personal data may also be passed on by Adyen to
service providers, subcontractors or other affiliated companies,
in so far as this is necessary to fulfil the contractual obligations arising from your order
or the personal data is to be processed on their behalf.
Further information can be found in Adyen's privacy policy at:
www.adyen.com/de_DE/richtlinien-und-haftungsausschluss/privacy-policy
2. Legal basis for the data processing
The legal basis for the processing of the data collected in the course of processing the payment
is Art. 6 (1) (b) GDPR.
3. Purpose of the data processing
The personal data is processed for the purpose of payment and therefore for the
performance of the contract. This transfer is therefore necessary in order to process your order with
the payment method you have chosen, in particular to confirm your
identity and to administer your payment and the customer relationship.
4. Duration of storage
The data is erased as soon as it is no longer necessary to achieve the purpose for which it was
collected.
In all other respects, the duration of storage follows tax and
accounting requirements.
5. Right to object and possibility of removal
With regard to the right to object, we refer you to Adyen, since the data is stored
there. According to information from Adyen, the data is stored only for as long as
necessary. Further information can be found at:
www.adyen.com/de_DE/richtlinien-und-haftungsausschluss/privacy-policy
Please address your objection to Adyen; the contact details can be found at:
https://www.adyen.com/de_DE/kontakt

X. Google Analytics
1. Description and extent of the data processing
This website uses Google Analytics, a web analytics service of Google LLC ("Google"),
1600 Amphitheatre Parkway, Mountain View, CA 94043, United States, with the extension
"_gat._anonymizeIp()". The IP addresses are therefore
processed further and stored only in shortened form,
so that a direct reference to a person is excluded. Google Analytics
uses what are known as "cookies". These are text files that are stored on your computer
and that make it possible to analyse your use of the website. The information generated by the cookie
about your use of this website (including your IP address)
is transferred to a Google server in the EU or in the USA and stored
there. Google will use this information to evaluate your use of the website,
to compile reports on website activity for the website operators
and to provide further services connected with the use of the website and of the internet.
Google may also transfer this information
to third parties where this is required by law or in so far as
third parties process this data on Google's behalf. To our knowledge, Google will in
no case connect your IP address with other data held by Google.
2. Legal basis for the data processing
The legal basis for the processing of personal data using
Google Analytics is Art. 6 (1) (f) GDPR. We have a legitimate interest
here in improving the functionality and stability of the website.
3. Purpose of the data processing
The data is needed to improve and analyse our website. Because the data is
anonymised, this statistical collection serves solely the purpose of
improving our offer. Further information can be found in
Google's privacy policy at: policies.google.com/privacy.
4. Duration of storage
The data is not stored for longer than necessary. It is erased once the
statistics have been evaluated and the data is no longer needed. In
all other respects, the duration of storage follows tax and accounting
requirements.
5. Right to object and possibility of removal
You can prevent the installation of the cookies by setting your browser
software accordingly. We point out, however, that in this case you may
not be able to use all the functions of this website in full.
You can prevent the data generated by the cookie and relating to your use of the website
(including your IP address) from being recorded by Google, and prevent this data from being processed
by Google, by downloading and installing the browser plug-in available at the following link: tools.google.com/dlpage/gaoptout.
You can prevent recording by Google Analytics by clicking on the link
we provide. An opt-out cookie is then set that prevents your data from being
recorded in future when you visit this website.

XI. Rights of the data subject
Where personal data is processed, you are a data subject within the meaning of the GDPR and have
the following rights towards the controller:
1. Right of access of the data subject
The data subject has the right to obtain from the controller confirmation as to
whether or not personal data concerning them is being processed; where that is the case,
they have a right of access to that personal data and to the following
information:
a) the purposes of the processing;
b) the categories of personal data that are processed;
c) the recipients or categories of recipient to whom the personal data
has been or will be disclosed, in particular recipients in
third countries or international organisations;
d) where possible, the envisaged period for which the personal data will be stored,
or, if that is not possible, the criteria used to determine that period;
e) the existence of the right to request from the controller rectification or erasure of
personal data concerning them or restriction of processing
or to object to such processing;
f) the existence of the right to lodge a complaint with a supervisory authority;
g) where the personal data is not collected from the data subject, any
available information as to its source;
h) the existence of automated decision-making, including profiling, referred to in
Article 22 (1) and (4) GDPR and, at least in those cases, meaningful
information about the logic involved, as well as the significance and the envisaged
consequences of such processing for the data subject.
Where personal data is transferred to a third country or to an international organisation,
the data subject has the right to be informed of the appropriate safeguards pursuant to
Article 46 GDPR relating to the transfer.
This right may be restricted where data is processed for scientific or historical
research purposes or statistical purposes, in so far as it is
likely to render impossible or seriously impair the
achievement of the research or statistical purposes
and the restriction is necessary for the fulfilment of the research or
statistical purposes.
2. Right to rectification
The data subject has the right to obtain from the controller without undue delay the rectification
of inaccurate personal data concerning them. Taking into account
the purposes of the processing, the data subject has the right to have incomplete personal data
completed, including by means of providing a supplementary
statement.
This right may be restricted where data is processed for scientific or historical
research purposes or statistical purposes, in so far as it is
likely to render impossible or seriously impair the achievement of the research or statistical purposes
and the restriction is necessary for the fulfilment of the research or
statistical purposes.
3. Right to erasure
The data subject has the right to obtain from the controller the erasure of
personal data concerning them without undue delay, and the controller
is obliged to erase personal data without undue delay where one of the following
grounds applies:
a) the personal data is no longer necessary for the purposes for which it was collected or otherwise
processed.
b) the data subject withdraws the consent on which the processing was based pursuant to
Article 6 (1) (a) GDPR or Article 9 (2) (a) GDPR, and there is no
other legal ground for the processing.
c) the data subject objects to the processing pursuant to Article 21 (1) GDPR and there are no
overriding legitimate grounds for the processing,
or the data subject objects to the processing pursuant to Article 21 (2) GDPR.
d) the personal data has been unlawfully processed.
e) the personal data has to be erased for compliance with a legal
obligation in Union or Member State law to which
the controller is subject.
f) the personal data has been collected in relation to the offer of information society
services referred to in Article 8 (1) GDPR.
Where the controller has made the personal data public and is obliged pursuant to
paragraph 1 above to erase it, the controller, taking account of the
available technology and the cost of implementation, takes reasonable steps, including
technical measures, to inform controllers who are processing the personal
data that a data subject has requested from them the
erasure of any links to, or copy or replication of, that personal data.
Paragraphs 1 and 2 above do not apply to the extent that the processing is necessary
a) for exercising the right of freedom of expression and information;
b) for compliance with a legal obligation that requires processing by Union
or Member State law to which the controller is subject, or for the
performance of a task carried out in the public interest or in the exercise of
official authority vested in the controller;
c) for reasons of public interest in the area of public health in accordance with
Article 9 (2) (h) and (i) GDPR as well as Article 9 (3) GDPR;
d) for archiving purposes in the public interest, scientific or historical
research purposes or statistical purposes in accordance with Article 89 (1) GDPR, in so far as the
right referred to in paragraph 1 above is likely to render
impossible or seriously impair the achievement of the objectives of that
processing, or
e) for the establishment, exercise or defence of legal claims.
4. Right to restriction of processing
The data subject has the right to obtain from the controller restriction of
processing where one of the following applies:
a) the accuracy of the personal data is contested by the data subject,
for a period enabling the controller to verify the accuracy of the
personal data,
b) the processing is unlawful and the data subject opposes the erasure of the
personal data and requests the restriction of its use
instead;
c) the controller no longer needs the personal data for the purposes of the processing,
but the data subject requires it for the establishment, exercise or
defence of legal claims, or
d) the data subject has objected to the processing pursuant to Article 21 (1)
GDPR pending the verification of whether the legitimate grounds of the
controller override those of the data subject.
Where processing has been restricted pursuant to paragraph 1 above, such
personal data may, with the exception of storage, only be processed with the data subject's consent
or for the establishment, exercise or defence of
legal claims or for the protection of the rights of another natural or legal
person or for reasons of important public interest of the Union or of a
Member State.
A data subject who has obtained a restriction of processing pursuant to paragraph 1 above
is informed by the controller before the restriction
is lifted.
This right may be restricted where data is processed for scientific or historical
research purposes or statistical purposes, in so far as it is
likely to render impossible or seriously impair the achievement of the research or statistical purposes
and the restriction is necessary for the fulfilment of the research or
statistical purposes.
5. Right to be informed
The controller communicates any rectification or erasure of personal data or
restriction of processing carried out in accordance with Article 16, Article 17 (1)
and Article 18 GDPR to each recipient to whom the personal data has been disclosed,
unless this proves impossible or involves disproportionate effort.
The controller informs the data subject about those recipients
if the data subject requests it.
6. Right to data portability
The data subject has the right to receive the personal data concerning them that they
have provided to a controller in a structured, commonly used and
machine-readable format, and has the right to transmit that data to another
controller without hindrance from the controller to which the
personal data has been provided, where
a) the processing is based on consent pursuant to Article 6 (1) (a) or Article 9 (2)
(a) GDPR or on a contract pursuant to Article 6 (1) (b) GDPR and
b) the processing is carried out by automated means.
In exercising their right to data portability pursuant to paragraph 1 above,
the data subject has the right to have the personal data transmitted directly from
one controller to another, where technically
feasible.
The exercise of the right referred to in paragraph 1 of this article is without prejudice to the
right to erasure. That right does not apply to processing necessary for
the performance of a task carried out in the public interest or in
the exercise of official authority vested in the controller.
7. Right to withdraw consent under data protection law
You have the right to withdraw your declaration of consent under data protection law at any
time. The withdrawal of consent does not affect the
lawfulness of the processing carried out on the basis of the
consent up to the withdrawal.
8. Right to object
The data subject has the right to object at any
time, on grounds relating to their particular situation,
to the processing of personal data concerning them that is
based on Article 6 (1) (e) or (f) GDPR; this also applies
to profiling based on those provisions. The controller no longer processes the
personal data unless they can demonstrate compelling legitimate grounds
for the processing that override the interests, rights and freedoms of the data
subject, or the processing serves the establishment, exercise or
defence of legal claims.
Where personal data is processed for direct marketing purposes, the
data subject has the right to object at any time to the processing of personal data concerning them
for the purposes of such marketing; this also applies to
profiling to the extent that it is related to such direct marketing.
Where the data subject objects to processing for direct marketing purposes,
the personal data is no longer processed for those purposes.
In the context of the use of information society services, the
data subject may, notwithstanding Directive 2002/58/EC, exercise their right to object by
automated means using technical specifications.
The data subject also has the right to object, on grounds relating to their particular
situation, to the processing of personal data concerning them
that is carried out for scientific or historical research purposes or statistical
purposes pursuant to Article 89 (1) GDPR, unless the
processing is necessary for the performance of a task carried out for reasons of public interest.
This right to object may be restricted in so far as it is likely to render impossible or seriously
impair the achievement of the research or statistical purposes
and the restriction is necessary for the fulfilment of the research or statistical purposes.
9. Automated individual decision-making, including profiling
The data subject has the right not to be subject to a decision based solely on automated
processing, including profiling,
that produces legal effects concerning them or similarly significantly
affects them.
Paragraph 1 above does not apply if the decision
a) is necessary for entering into, or the performance of, a contract between the data subject and
the controller,
b) is authorised by Union or Member State law to which the
controller is subject and which also lays down suitable
measures to safeguard the data subject's rights and freedoms and legitimate
interests, or
c) is based on the data subject's explicit consent.
In the cases referred to in paragraph 2 (a) and (c) above, the controller implements
suitable measures to safeguard the data subject's rights and freedoms and legitimate
interests, at least the right to obtain human intervention
on the part of the controller, to express their point of view and to
contest the decision.
Decisions under paragraph 2 above may not be based on special categories
of personal data referred to in Article 9 (1) GDPR, unless Article 9
(2) (a) or (g) GDPR applies and suitable measures to safeguard the data subject's rights and
freedoms and legitimate interests are in place.
10. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or
judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority,
in particular in the Member State of their habitual residence, place of work or the place
of the alleged infringement, if the data subject considers that the
processing of personal data concerning them infringes this regulation.
The supervisory authority with which the complaint has been lodged informs the
complainant of the progress and the outcome of the complaint, including the
possibility of a judicial remedy pursuant to Article 78 GDPR.

Eggstätt, 1.09.2026

Annex:
External recipients that receive personal data as processors:

1. Solvesall d.o.o, Trzaska cesta 68A, 1000 Ljubljana, Slovenia, info[at]solvesall.si
   
2. Tim Burkhardt, Dipl. Informatiker (FH), Dr. Schwind-Straße 9, 97506 Grafenrheinfeld, mail[at]tim-burkhardt.de
3. TechDivision GmbH, An der Alten Spinnerei 2a, 83059 Kolbermoor