Source: http://www.hdh.net/en/privacy-statement/
Timestamp: 2019-04-20 22:20:35+00:00

Document:
In principle, we process personal data of our users only insofar as this is necessary to provide a functioning website and our content as well as services. The processing of personal data of our users takes place regularly only with the consent of the user. An exception applies to cases in which prior consent can not be obtained for reasons of fact and the processing of the data is permitted by law.
Insofar as we obtain the consent of the data subject for processing personal data, Art. 6 para. 1 lit. a EU GDPR serves as the legal basis.
In the processing of personal data necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 lit. b GDPR applies as the legal basis. This also applies to processing operations required to carry out pre-contractual actions.
The personal data of the data subject will be deleted or blocked as soon as the purpose of its storage is achieved. Moreover, the data can be stored if the European or national legislator has provided for the storage in legislative acts, such as, e.g. EU regulations, laws or other regulations, to which the controller is subjected. Blockage or deletion of the data also takes place when a storage period prescribed by the standards mentioned expires, unless there is a need for further storage of the data for conclusion of a contract or fulfillment of the contract.
The legal basis for the processing of personal data using cookies is Article 6 (1) lit. f and Art. 5 para. 1 lit. a GDPR.
The user data collected by cookies will not be used to create user profiles.
You may ask the Responsible Person to confirm if personal data concerning you is processed by the Responsible Person.
(7) all available information on the source of the data if the personal data are not collected from the data subject.
You have the right to request information about whether your personal data has been transferred to a third country or an international organization. In this connection, you can request the appropriate guarantees in accordance with Art. 46 GDPR in relation with the transfer.
You have a right to rectification and / or completion against the Responsible Person, if the personal data process concerning you is incorrect or incomplete. The Responsible Person must make the correction without delay.
(4) if you have objected to the processing pursuant to Art. 21 (1) GDPR and it is not yet certain whether the legitimate reasons of the Responsible Person outweigh your reasons.
If the limitation of the processing has been restricted according to the aforementioned prerequisites, you will be informed by the Responsible Person before the restriction is lifted.
(3) You invoke Art. 21 para. 1 GDPR in regards to objecting to the processing and there are no prior justifiable reasons for the processing, or you invoke Art. 21 para. 2 GDPR for opposing the processing.
(5) The deletion of your personal data is required to fulfill a legal obligation under European Union law or the law of the Member States to which the controller is subjected.
If the Responsible Person has made the personal data concerning you public and is according Article 17 (1) GDPR required to delete it, the Responsible Person shall take appropriate measures, taking into account the technology available and the implementation costs to inform the data controllers who process the personal data that you, as the data subject required to delete all links to such personal data or copies or replicas of such personal data.
If you have the right of rectification, delete or cancellation or restriction of processing against the Responsible Person, the Responsible Person is obliged to notify all recipients to whom your personal data have been disclosed of this correction or deletion of the data or restriction of processing, unless this proves to be impossible or involves a disproportionate effort.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task that is in the public interest or in the exercise of official authority that has been delegated to the Responsible Person.
You have the right, for reasons that arise from your particular situation, to object to the processing of personal data concerning you at any time, pursuant to Art. 6 para. 1 lit. e or f GDPR.
The Responsible Person will no longer process the personal data concerning you unless the Responsible Person can demonstrate compelling legitimate grounds for processing, which outweigh your interests, rights and freedoms, or the processing is for the purpose of enforcing, exercising or defending legal claims.
If the personal data relating to you are processed in order to operate direct marketing purposes, you have the right to object at any time to the processing of your personal data for the purposes of such advertising. If you object to processing for direct marketing purposes, your personal data will no longer be processed for such purposes.
Regardless of Directive 2002/58/EC, you have the option, in the context of the use of services from the information society, of exercising your right to object through automated procedures that use technical specifications.

References: Art. 6
 Art. 6
 Art. 5
 Art. 46
 Art. 21
 Art. 21
 Art. 21
 Art. 6