Privacy Policy

Name and address of the controller
The controller responsible for data processing within the meaning of the General Data Protection Regulation, other EU Member State data protection laws and further data protection regulations is:

​

Munich Aerospace e. V.
Willy-Messerschmitt-Str. 1
D-82024 Taufkirchen
GERMANY

E-mail: info@munich-aerospace.de
www.munich-aerospace.de

The privacy statement is based on the terms used by the European legislator when adopting the EU General Data Protection Regulation (hereinafter: “GDPR”). The privacy statement shall be easy to read and understand. To ensure this, the most important terms are explained below:

​

2.1 Personal data means any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of this natural person.

​

2.2 Data subject means any identified or identifiable natural person whose personal data is processed by the controller.

​

2.3 Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

​

2.4 Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements.

​

2.5 Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

​

2.6 The controller or person responsible for processing means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

​

2.7 Processor means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.

​

2.8 Recipient means a natural or legal person, public authority, agency, or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.

​

2.9 Third party means a natural or legal person, public authority, agency, or body other than the data subject, controller, processor, and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

​

2.10 Consent means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to you.

In the case of purely informational use of the website, i.e., if you do not register or otherwise transmit information to us, we automatically collect the following data and information from the computer system of the calling computer each time the website is called up:

​

• IP address of the user (anonymised)

• Information about the browser type and version used

• Operating system of the user

• Date and time of access

• Websites from which the user’s system accesses the website

• Remote login name and remote user for authenticated sessions

• Content of the calls

• Volume of data transmitted

• Name of the called up file

​

The data will also be stored in the log files of our system. These data will not be stored together with other personal data of the user.

When using this general data, we do not draw any conclusions about the data subject. The data is only evaluated statistically.

The legal basis for the temporary storage of the log files is Art. 6(1) p. (f)) GDPR.

​

The temporary storage of the data by the system is necessary in order to

• enable delivery of the website to the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session.

• to optimise the content of our website as well as the advertising for it

• to ensure the functionality of our information technology systems and the technology of our website

• to provide law enforcement authorities with the information necessary for prosecution in the event of a cyber attack

• The temporary storage of banner data by the system is necessary in order to fulfil the data protection requirements.

​

These purposes also constitute our legitimate interest in data processing pursuant to Art. 6(1) page. 1 (f)) GDPR.

The data is deleted as soon as it is no longer required to achieve the purpose – in this case at the end of the usage process.

​

In the case of storing data in log files, this is the case after 7 days at the latest. Storage beyond this period is possible. In this case, the IP addresses are deleted or anonymised so that it is no longer possible to assign the calling client.

​

The collection of data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the website, which is why there is no possibility to object.

4.1 General

This website uses so-called cookies. Cookies are small text files which, as soon as you visit a website, are sent to your browser by a web server and stored locally on your terminal device (PC, notebook, tablet, smartphone, etc.) and stored on your computer and send certain information to the user (i.e., us). Cookies do not cause any damage to the computer and do not contain viruses. Each cookie contains a characteristic string of characters (so-called cookie ID) that enables the browser to be uniquely identified when the website is called up again.

​

Permanent (persistent) cookies remain stored even if the browser session is ended and can be called up again when you visit the site again. The cookies are stored on your computer and transmitted from it to our site. Therefore, you also have full control over the use of cookies. If you do not wish data to be collected via cookies, you can set your browser via the menu under “Settings” so that you are informed about the setting of cookies or generally exclude the setting of cookies or can also delete cookies individually. However, please note that the functionality of this website may be limited if cookies are deactivated. As far as session cookies are concerned, they will be automatically deleted after leaving the website.

​

When accessing our website, you will be informed about the use of cookies and consent to the processing of personal data used in this context will be obtained. In this context, a reference to this privacy statement is also made.

​

4.2 Technically required cookies

On the one hand, we use technically required cookies to keep the website functional. Some elements of our website require that the calling browser can be identified even after a page change. Furthermore, we use technically required cookies to comply with legal requirements or to make our website more user-friendly; for this purpose, the following data may be stored and transmitted: Language settings, cookie consents. The user data collected through technically required cookies are not used to create user profiles.

You can find out more about the cookies we use in the cookie banner. Furthermore, you can access the information at any time by clicking on “Change privacy settings” in the footer.

​

The legal basis for the processing of personal data using technically necessary cookies in the sense of Section 25(2) TTDSG is Art. 6(1) p. 1(f) GDPR.

​

4.3 Technically not required cookies

In addition, we use technically unnecessary cookies on our website

• that enable analysis of your browsing behavior (Wix Analytics)

• for user-friendly use of our website by integrating third-party cookies (map material)

The purpose of using technically unnecessary cookies is to improve the quality of our website and its content.

​

Section 25(1) TTDSG further stipulates that the storage of information in the end user’s terminal equipment or access to information already stored in the terminal equipment is only permissible if the end user has consented on the basis of clear and comprehensive information. Consent must be given in accordance with the GDPR.

​

According to Section 25(2) TTDSG, consent is not required in narrowly defined exceptional cases, e.g.

• if the sole purpose of storing information in the end user’s terminal equipment or the sole purpose of accessing information already stored in the end user’s terminal equipment is to carry out the transmission of a communication over a public telecommunications network.

• where the storage of information in the end-user’s terminal equipment or the access to information already stored in the end-user’s terminal equipment is strictly necessary to enable the provider of a telemedia service to provide a telemedia service explicitly requested by the user.

​

Accordingly, technically not required cookies require consent.

The legal basis for the processing of personal data using technically unnecessary cookies is Art. 6(1)(a) GDPR, provided consent has been given.

You can configure your cookie settings in your browser at any time. You can also change your cookie settings at any time via our consent banner, which is displayed in the corner, and thereby withdraw your consent.

We use the cookie consent banner provided by Usercentrics — Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich. With the help of the banner, we can obtain your consent to the storage of certain cookies, inform you about (including necessary) cookies, and document consents in compliance with data protection law. When you visit our website, the following personal data is transferred to and processed by Usercentrics:

• Your consent(s) or the withdrawal of your consent(s)

• Your IP address

• Information about your browser

• Information about your device

• Time of your visit to the website

• Geolocation
  
  

In addition, Usercentrics stores a cookie in your browser in order to be able to assign the consents given or their withdrawal to you.

The legal basis for the use of the banner is Art. 6(1) lit. c GDPR so that we can fulfill the legally required obligations to obtain and document consent.

The data will be deleted after a storage period of 12 months unless you request deletion beforehand, deactivate or delete the cookie yourself, or the purpose for data storage no longer applies. Mandatory statutory retention obligations remain unaffected.

We have concluded a data processing agreement (DPA) with Usercentrics, which ensures that Usercentrics processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Further information on data protection at Usercentrics can be found at: www.usercentrics.com/de/datenschutzerklaerung/

A contact form is available on our website which can be used for electronic contact. If you use this option, the data entered into the input form will be transmitted to us and stored. This data includes:

• Email address

• Message

• Name

• Subject

• Organization

• Role
  
  

At the time the message is sent, the following data is also stored:

• The user’s IP address

• Date and time of registration
  
  

You may also contact us by email. In this case, the personal data transmitted with the email will be stored. Insofar as this includes information on communication channels (for example email address, telephone number), you consent to our contacting you via that communication channel if necessary in order to answer your request. In this context, the data will not be passed on to third parties. The data will be used exclusively for processing the conversation.

The legal basis for the processing of the data is Art. 6(1) sentence 1 lit. f GDPR. The legal basis for the processing of data transmitted in the course of sending an email is Art. 6(1) sentence 1 lit. f GDPR. If the contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6(1) sentence 1 lit. b GDPR.

The processing of personal data from the input form serves us solely to handle the contact request. The data from your email inquiries will of course be used exclusively for the purpose for which you provided it to us when contacting us. The other personal data processed during the sending process serves to prevent misuse of the contact form and to ensure the security of our information technology systems. This also constitutes our legitimate interest.

The data will be deleted as soon as it is no longer necessary for achieving the purpose for which it was collected. This is the case when the respective conversation with the user has ended. The conversation is deemed ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified. The personal data additionally collected during the sending process will be deleted no later than after a period of seven days. If the contact is aimed at the performance of a contract, the data will be deleted after expiry of the statutory storage periods required for this purpose under commercial or tax law.

Our website uses SSL encryption when transmitting confidential or personal data. This encryption is used, for example, in payment transactions and for inquiries sent to us through this website. To ensure that this encryption is actually active, this must be monitored by you. The status of the encryption can be recognized from the browser line, which changes from “http://” to “https://” when encryption is active. If encryption is active, your data cannot be read by third parties. If encryption is not active, please use another means of contact to reach us.

On our platform, we offer companies and organizations in the aviation and aerospace sector the opportunity to be listed in the Aerospace directory via the “Get Listed” form. The data entered there is transmitted to us via an input form and stored in our database. After internal review and approval by us, selected information is publicly displayed in the platform directory and is therefore visible to all platform visitors.

As a rule, the entered data is not disclosed to third parties unless there is a legal obligation to disclose it or the disclosure serves criminal prosecution or legal enforcement. For technical processing and storage of data, we use the Wix service (see below).

As part of the listing and registration process, the following personal data is collected:

• Email address

• Name of the submitter

• Company or organization name

• Type of institution

• Description of the organization, products, and services

• Website

• Company address

• Optional: role in the company

• IP address

• Date and time of submission
  
  

The collected data is processed for the following purposes:

• inclusion of the organization in the public Aerospace Match directory and display on the interactive platform map and in the list directory

• enabling other platform users to specifically search for industry actors, partners, technology providers, and skilled professionals

• prevention of misuse and verification of the submission by means of a double opt-in procedure

• processing of update and correction requests

Insofar as you have given explicit consent as part of the form, the processing is additionally based on Art. 6(1) lit. a GDPR; consent given may be withdrawn at any time with effect for the future. The storage of the IP address and the time of submission for proof of submission and prevention of misuse is based on our legitimate interest pursuant to Art. 6(1) lit. f GDPR.

The data collected as part of the listing and registration process will be stored as long as the organization is listed in the directory. After deletion of the listing on your own initiative or upon justified request, the personal data will be deleted unless statutory retention obligations prevent this. Data collected as part of an unconfirmed double opt-in process will be automatically deleted after [one month].

In the current version of the platform, users cannot independently manage, modify, or delete the entered data. Incoming update requests can be submitted via the “Get Listed” form (option: “Update Information”) or via the contact form on this website. Requests for deletion may also be submitted via the contact form or directly to the controller.

We use the open-source JavaScript library Leaflet (leafletjs.com) on our website to display an interactive map. The map tiles are provided by OpenStreetMap. The responsible provider is the OpenStreetMap Foundation (OSMF), St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. To display the map content, Leaflet causes so-called map tiles to be retrieved directly from the servers of the OpenStreetMap Foundation in the user’s browser. The connection to this server is established directly by the user’s browser, without the data passing through our servers.

As part of the retrieval, the following personal data is transmitted to the map service provider:

• IP address

• Browser and device information (user agent)

• Operating system

• Date and time of access

• Referrer URL (the page from which the request originates)

• Technical log data
  
  

The interactive map is used to geographically represent the aviation and aerospace ecosystem and make it visually accessible for users of the Aerospace Match platform. Specifically, the map makes it possible to locate companies, technologies, and expertise in the fields of design, development, and manufacturing of aircraft and spacecraft, thereby facilitating the targeted search for suitable partners, technology providers, and skilled professionals within the ecosystem. The cartographic representation is therefore an integral part of the core functionality of the platform, which is designed to efficiently connect relevant players in the aviation and aerospace industry.

The integration of the map and the associated transmission of data to the map service provider takes place exclusively on the basis of your consent pursuant to Art. 6(1) lit. a GDPR in conjunction with Section 25(1) TDDDG. The map is loaded only after your consent has been given. You may withdraw your consent at any time with effect for the future by adjusting your settings in our consent management tool on this website. The lawfulness of processing carried out prior to withdrawal remains unaffected.

The server infrastructure of the OpenStreetMap Foundation is located in the United Kingdom and in the Netherlands. For the United Kingdom, there is an adequacy decision by the European Commission pursuant to Art. 45(1) GDPR, so that the level of data protection there is recognized as equivalent to that in the European Union.

Further information on data processing by OSMF can be found in its Privacy Policy at: www.wiki.osmfoundation.org/wiki/Privacy_Policy

The interactive map and the associated directory display companies and organizations in the aviation and aerospace sector, including information on their location, name, company website, and a description of their activities, products, and services. The location display is based on precise geocoding of the company address. Contact data of individual persons is not displayed.

Users can specifically search the displayed organizations using filter options (stakeholder type, activity domain). Search and filter queries are not stored; no user profiles are created.

The company data displayed on the platform (company name, address, website) comes from publicly accessible internet sources. Descriptions of the organizations are independently created and editorially maintained by us on the basis of public information. Information submitted by company representatives themselves via the “Get Listed” registration form and reviewed and approved by us is included in the directory accordingly.

The processing and public display of company data is based on our legitimate interest pursuant to Art. 6(1) lit. f GDPR. Our legitimate interest lies in providing a complete, up-to-date, and user-friendly overview of the aviation and aerospace ecosystem and promoting networking among relevant industry actors. Since only company data from generally accessible sources is processed and its publication serves the purpose of corporate representation in the market, the legitimate interests of the platform generally outweigh the data protection interests of the organizations concerned in our balancing test.

The company data is stored in the platform database for as long as it is required for the purpose of the platform, i.e. as long as the respective company belongs to the aviation or aerospace sector and no deletion request has been made.

The database underlying the platform and the geocoding tool used for geocoding company locations are provided via the Wix service. The provider is Wix.com Ltd., 40 Hanamal Tel Aviv St., Tel Aviv 6350671, Israel.

Israel is subject to an adequacy decision of the European Commission pursuant to Art. 45(1) GDPR. Personal data may also be stored or processed on servers in other jurisdictions (including the USA and Ireland). For transfers to third countries without an adequacy decision, Wix uses standard contractual clauses approved by the EU Commission pursuant to Art. 46(2) lit. c GDPR.

Further information on data processing by Wix can be found at: de.wix.com/about/privacy

11.1 Links to external websites
 
This website contains links to external websites. We are responsible for our own content. We have no influence on the content of external links and are therefore not responsible for them; in particular, we do not adopt their content as our own. If you are redirected to an external site, the privacy policy provided there applies. If you notice unlawful activities or content on such pages, you are welcome to inform us. In this case, we will review the content and respond accordingly (notice-and-take-down procedure).
 
11.2 Rented server space
 
Please note that we use rented server space from the provider Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, www.hetzner.com. By visiting the website, the server space provider may automatically receive information. This information is automatically stored by the provider in so-called server log files (see Section 3), which your browser automatically transmits. Further information about the data can be found in Section 3.
 
11.3 Wix
 
We use the website builder system of Wix.com Ltd., Nemal St. 40, 6350671 Tel Aviv, Israel, for our website.
 
Through the use of Wix, we collect personal data from you, in particular contact data where you provide it, IP address, and geographic location. Wix also uses tracking functions by means of cookies (see Section 4) to track your behavior on websites (e.g. bounce rate, page views).
 
We use Wix because it is an easy-to-use website builder system that allows us to insert content quickly. This means information is always made available to you promptly. Through the tracking options, we can better tailor our measures to you.
 
Wix may transfer data to third parties, in particular affiliated companies in Ireland or Canada.
 
The legal basis for the use of the tool itself is Art. 6(1) lit. f GDPR. Our legitimate interests lie in the simple handling of the tool. For the tracking options, the legal basis is Art. 6(1) lit. a GDPR. Israel itself is regarded by the European Commission as a country with an adequate level of data protection. In addition, we have concluded a data processing agreement with Wix.

The data is stored for varying lengths of time, but for a maximum of 3 months. Further details can be found in Section 4 for the individual cookies.

You may delete your data at any time by contacting Wix directly at privacy@wix.com or by deactivating, deleting, or managing cookies so that they are automatically deleted. To do this, you must make the appropriate browser settings. Further information on data protection at Wix can be found at https://de.wix.com/about/privacy.

If personal data concerning you is processed, you are a data subject within the meaning of the GDPR and you have the following rights against the controller pursuant to Section 1:

• Right of access

• Right to rectification

• Right to restriction of processing

• Right to erasure

• Right to notification

• Right to data portability

• Right to object to processing

• Right to withdraw data protection consent

• Right to withdraw data protection consent

• Right not to be subject to automated decision-making

• Right to lodge a complaint with a supervisory authority
   

12.1 Right of access
 

You may request confirmation from the controller as to whether personal data concerning you is being processed by us. If such processing exists, you may at any time request from the controller, free of charge, information about the personal data stored about you and the following information:

• the purposes for which the personal data is processed;

• the categories of personal data being processed;

• the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;

• the planned duration of storage of the personal data concerning you or, if specific details are not possible, the criteria used to determine that duration;

• the existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the controller, or a right to object to such processing;

• the existence of a right to lodge a complaint with a supervisory authority;

• all available information about the source of the data if the personal data is not collected from the data subject;

• the existence of automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.
   

You have the right to request information as to whether personal data concerning you is transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.
 

12.2 Right to rectification
 

You have the right to obtain without undue delay the rectification and/or completion of inaccurate or incomplete personal data concerning you.
 

12.3 Right to restriction of processing
 

Under the following conditions, you may request the restriction of processing of personal data concerning you without undue delay:

• if you contest the accuracy of the personal data concerning you, for a period enabling the controller to verify the accuracy of the personal data;

• the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;

• the controller no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise, or defense of legal claims; or

• if you have objected to processing pursuant to Art. 21(1) GDPR and it has not yet been determined whether the legitimate grounds of the controller override your grounds.
   

Where processing of personal data concerning you has been restricted, such data may — apart from storage — only be processed with your consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. If the restriction of processing has been imposed under the above conditions, you will be informed by the controller before the restriction is lifted.
 

12.4 Right to erasure
 

You may request from the controller that personal data concerning you be erased without undue delay where one of the following grounds applies:

• The personal data concerning you is no longer necessary in relation to the purposes for which it was collected or otherwise processed.

• You withdraw consent on which the processing was based pursuant to Art. 6(1) lit. a or Art. 9(2) lit. a GDPR, and there is no other legal ground for the processing.

• You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR.

• The personal data concerning you has been unlawfully processed.

• The erasure of personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.

• The personal data concerning you has been collected in relation to the offer of information society services pursuant to Art. 8(1) GDPR.
   

Where the controller has made the personal data concerning you public and is obliged pursuant to Art. 17(1) GDPR to erase it, the controller, taking account of available technology and implementation costs, shall take reasonable steps, including technical measures, to inform other controllers processing the personal data that you, as the data subject, have requested the erasure of all links to, or copies or replications of, that personal data.
 

The right to erasure does not apply to the extent that processing is necessary:

• for exercising the right of freedom of expression and information;

• for compliance with a legal obligation requiring processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

• for reasons of public interest in the area of public health pursuant to Art. 9(2) lit. h and i and Art. 9(3) GDPR;

• for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Art. 89(1) GDPR insofar as the right referred to above is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

• for the establishment, exercise, or defense of legal claims.
   

12.5 Right to notification
 

If you have exercised your right to rectification, erasure, or restriction of processing vis-à-vis the controller, the controller is obliged to communicate this rectification/erasure/restriction of processing to all recipients to whom the personal data concerning you has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed by the controller about those recipients.
 

12.6 Right to data portability
 

You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used, and machine-readable format. You also have the right to transmit those data to another controller without hindrance from the controller to which the personal data was provided, where:

• the processing is based on consent pursuant to Art. 6(1) lit. a GDPR or Art. 9(2) lit. a GDPR, or on a contract pursuant to Art. 6(1) lit. b GDPR; and

• the processing is carried out by automated means.
   

In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. Freedoms and rights of other persons must not be adversely affected by this.
 

The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
 

To assert the right to data portability, the data subject may contact the controller at any time.
 

12.7 Right to object
 

You have the right, on grounds relating to your particular situation, to object at any time to processing of personal data concerning you which is based on Art. 6(1) lit. e or f GDPR; this also applies to profiling based on those provisions.
 

The controller shall no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.
 

Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for such purposes.
 

In connection with the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.
 

To exercise the right to object, the data subject may contact the controller directly.
 

12.8 Right to withdraw consent under data protection law
 

You have the right to withdraw your declaration of consent under data protection law at any time. Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. You may contact the controller for this purpose.
 

12.9 Right not to be subject to automated decision-making in individual cases, including profiling
 

You have the right not to be subject to a decision based solely on automated processing — including profiling — which produces legal effects concerning you or similarly significantly affects you. This shall not apply if the decision:

• is necessary for entering into, or the performance of, a contract between you and the controller;

• is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or

• is based on your explicit consent.
   

However, such decisions may not be based on special categories of personal data referred to in Art. 9(1) GDPR unless Art. 9(2) lit. a or g GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.
 

With regard to the cases referred to in (1) and (3), the controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view, and to contest the decision.
 

If the data subject wishes to assert rights relating to automated decisions, they may contact the controller at any time.
 

12.10 Right to lodge a complaint with a supervisory authority
 

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
 

The authority responsible for us is:
 

The Bavarian State Office for Data Protection Supervision
Promenade 18
91522 Ansbach
Tel.: 0981/180093-0
www.lda.bayern.de

We reserve the right to change our privacy practices and this policy to conform to changes in relevant laws or regulations or to better meet your needs. Possible changes to our privacy practices will be announced here accordingly. Please note the current version date of the privacy policy.