Data protection information
We place great importance on the protection and lawful collection, processing and use of personal data. In any processing of personal data we comply strictly with the statutory provisions, and in the following text we wish to inform you about our collection and use of data. 1. Name and address of the party responsible for data processing The responsible data controller under the General Data Protection Regulation (GDPR), any other data protection laws which are applicable in the member states of the European Union and all other regulations applicable to data protection law is: TÜV Markenverbund e.V. Friedrichstrasse 136 10117 Berlin Germany Tel.: +49 30 – 847 124 69 100 E-mail: info@tuev-markenverbund.de Website: www.tuev-markenverbund.de
2. Processing of personal data 2.1 Processing of personal data when you visit our website www.tuev-markenverbund.de a) Use of cookies No cookies are used. b) Preparation of logfiles Whenever you call up our website, the TÜV Trademark Association uses an automated system to save the following data and information:
- The previously visited website (referrer)
- The website or file which is called up
- Browser type and version
- The operating system used
- The type of device used
- Time of access
- IP address in anonymous form (this is only used to determine the place of access)
c) Purpose of data collection The processing of data is carried out in order to deliver the content of the website and ensure the functionality of the IT systems. The data in the logfiles are always stored separately from all other personal data. d) Deletion of data The data are stored in unabridged form for up to 7 days. They are completely deleted after 30 days. An individualised identification of the visitor to the website is not possible at any time. 2.2 Processing of personal data transmitted by e-mail The website www.tuev-markenverbund.de provides a contact e-mail address. If anyone uses this address to contact the responsible data controller, the personal data transmitted by the data subject are automatically stored. Data storage is solely for the purposes of data processing or contact with the data subject. Data transmission to third parties takes place insofar as the data are made electronically accessible to the members of the TÜV Trademark Association (TÜV companies). The data will deleted when the statutory data storage obligations have expired and the data are no longer required to fulfil the contract. 2.3 Processing of personal data in the course of other data collection The TÜV Trademark Association exercises its own rights and the rights of its members as trademark holders. For this purpose, the personal data of the relevant persons are stored and processed. This data storage serves solely for the purpose of any legal action against the data subject. In addition, the personal data of business partners and representatives of public authorities who support us in legal enforcement will also be stored and processed. Data transmission to third parties takes place insofar as the data are made electronically accessible to the members of the TÜV Trademark Association (TÜV companies). The data will deleted when the statutory data storage obligations have expired and the data are no longer required to fulfil the contract. 3. Rights of the data subject If your personal data are processed, you are a data subject as defined by the GDPR and you are entitled to the following rights in relation to the responsible data controller:
3.1 Right of information You are entitled to demand that the responsible data controller provides you with confirmation of whether any personal data concerning you are processed by us. If such data processing applies, you are entitled to demand the following information from the responsible data controller:
- The purposes for which the personal data are processed;
- The categories of personal data which are processed;
- The recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed;
- The planned storage duration for the personal data concerning you or, if specific information on the storage duration is not possible, the criteria which determine the storage duration;
- The existence of a right to demand the correction or deletion of the personal data concerning you, a right to restrict the processing by the responsible data controller or a right of objection to this processing;
- The existence of any right to complain to a supervisory authority;
- All available information about the origin of the data if the personal data were not collected from the data subject;
- The existence of an automated decision-making process, including profiling under Article 22 (1) and (4) of the GDPR and – at least in these cases – meaningful information about the logic involved, the scope and the intended effects of such data processing for the data subject.
You are entitled to demand information about whether the personal data concerning you will be transmitted to a third country or an international organisation. In this connection, you are entitled to demand that you be notified about the suitable guarantees under Article 46 of the GDPR in connection with the transmission of data. 3.2 Right of correction You have a right to demand that the responsible data controller corrects or supplements your personal data if the processed personal data are incorrect or incomplete. The responsible data controller must carry out the correction without delay. 3.3 Right to restrict data processing Subject to the following conditions, you are entitled to demand a restriction of the processing of the personal data concerning you:
- If you contest the correctness of the personal data concerning you for a period which enables the responsible data controller to check the correctness of the personal data;
- If the processing of the data is unlawful and you reject the deletion of the personal data and demand a restriction of the use of the personal data instead of deletion;
- If the responsible data controller no longer needs the personal data for the purpose of data processing, but you need the data for the assertion, exercise or defence of legal claims, or
- If you have filed an objection to the data processing under Article 21 (1) of the GDPR and it has not yet been determined whether the justified reasons of the responsible data controller will prevail over your reasons.
If the processing of the personal data concerning you has been restricted, then – apart from storage – the relevant data may only be processed either with your consent or to assert, exercise or defend legal claims, to protect the rights of another natural person or legal entity or for an important public interest of the EU or a member state. If the processing has been restricted under the above conditions, you will be notified by the responsible data controller before the restriction is cancelled. 3.4 Right of deletion You are entitled to demand that the responsible data controller delete the personal data concerning you without delay, and the responsible data controller shall be obliged to delete the data without delay, if any of the following reasons apply:
- The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.
- You revoke your consent on which the data processing under Article 6 (1) letter a or Article 9 (2) letter a of the GDPR was based, and there is no other legal basis for data processing.
- You file an objection to the data processing under Article 21 (1) of the GDPR and there are no overriding justified reasons for data processing, or you file an objection to the data processing under Article 21 (2) of the GDPR.
- The personal data concerning you were unlawfully processed.
- The deletion of the personal data concerning you is necessary to comply with a legal obligation under EU law or the law of member states to which the responsible data controller is subject.
- The personal data concerning you were collected in relation to the offer of information society services according to Article 8 (1) of the GDPR.
If the responsible data controller has made the personal data concerning you publicly accessible and is obliged to delete the data under Article 17 (1) of the GDPR, the controller shall adopt appropriate measures including technical measures, taking the available technology and the implementation costs into account, to inform the persons responsible for data processing who process the personal data, that you are the data subject and have demanded that they delete all links to the personal data and all copies or replications of these personal data. The right to deletion shall not apply if the data processing is necessary for the following purposes:
- To exercise a right to freedom of opinion and information;
- To comply with a legal obligation which requires data processing under the law of the EU or member states to which the controller is subject, or to carry out a task in the public interest or in the exercise of official authority which has been assigned to the responsible data controller;
- For reasons which are in the public interest in the area of public health under Article 9 (2) letters h and i and Article 9 (3) of the GDPR;
- For archiving purposes which are in the public interest, for scientific or historical research or for statistical purposes under Article 89 (1) of the GDPR, insofar as the right granted in sub-section 1 would be likely to render the implementation of the goals of this data processing impossible or to seriously hinder them, or
- For the assertion, exercise or defence of legal claims.
3.5 Right of notification If you have asserted your right of correction, deletion or restricted data processing to the responsible data controller, the controller shall be obliged to notify all recipients to whom the personal data concerning you has been disclosed of this correction, deletion of data or restriction of data processing, unless this proves to be impossible or would involve a disproportionately great effort. You are entitled to demand that the responsible data controller inform you of these recipients. 3.6 Right of data portability You have the right to receive the personal data concerning you which you have made available to the controller in a structured, standard and machine-readable format. You also have the right to transmit these data to another responsible data controller without any hindrance by the controller to whom the personal data were made available, insofar as
- The data processing is based on consent under Article 6 (1) letter a of the GDPR or Article 9 (2) letter a of the GDPR or on a contract under Article 6 (1) letter b of the GDPR, and
- The data processing is carried out by automated processes.
In the exercise of this right, you also have the right to cause the personal data concerning you to be transmitted directly from one responsible data controller to another responsible data controller insofar as this is technically practicable. This must not impair the freedom and rights of any other persons. The right to data portability does not apply to any processing of personal data which is required to fulfil a task which is in the public interest or is carried out in the exercise of official authority which has been assigned to the responsible data controller. 3.7 Right of objection You have the right at any time, for reasons which arise from your specific situation, to file an objection to the processing of the personal data concerning you which is carried out on the basis of Article 6 (1) letter e or f of the GDPR. The responsible data controller will then no longer process the personal data concerning you unless he can prove compelling legitimate grounds for data processing which take priority over your interests, rights and freedom, or unless the data processing serves the assertion, exercise or defence of legal claims. 3.8 Right of complaint to a supervisory authority Without prejudice to any other administrative or judicial legal remedy, you are also entitled to file a complaint to a supervisory authority, especially in the member state of your place of residence, your place of work or the place of the suspected violation if you are of the opinion that the processing of the personal data concerning you violates the provisions of the GDPR. The supervisory authority to which the complaint is submitted will then notify the claimant about the status and results of the objection, including the possibility of a judicial remedy under Article 78 of the GDPR.
4. Legal basis of the data processing Personal data are processed on the following legal basis:
- If the data are transmitted by e-mail, Article 6 (1) letter f shall apply;
- With regard to the data subjects affected by the legal action, Article 6 (1) letter f shall apply;
- With regard to business partners, Article 6 (1) letter b shall apply;
- With regard to representatives of public authorities, Article 6 (1) letter f shall apply.
Insofar as processing of the personal data is necessary to fulfill a legal obligation to which the TÜV Trademark Association is subject, Article 6 (1) letter c of the GDPR shall serve as the legal basis. (Version of 25 May 2018)