Source: https://bnl.dfs.de/airspaceservice/service/information/privacy/privacy.jsp
Timestamp: 2019-04-20 22:17:17+00:00

Document:
If you would like to use the DFS Deutsche Flugsicherung GmbH Special use of airspace website, we will ask you for certain personal data necessary for the provision of our service. This personal data will be used for the following activities as part of our service; we will not process the data outside the specified activities.
If you wish to obtain a permit for the release of balloons or sky lanterns, your personal data (surname, first name, e-mail, mobile phone, place of release (address), date, duration, number of balloons/lanterns) will be processed automatically and forwarded to the person responsible for the airspace for a manual check, if necessary. The person responsible for the airspace may not be an employee of DFS Deutsche Flugsicherung GmbH. In such a case, your personal data will be forwarded to a third party. Your application will nevertheless be held in our system.
If you wish to apply for a permit for photo flights, the corresponding application will be forwarded to the responsible DFS branch and processed there.
We collect and use our users' personal data only to provide a functional website and as required for our contents and services. We only collect and use our users' personal data with their permission. The only exception in these cases is when the data subject's prior consent is not possible and processing of the data is required by law.
Art. 6(1)(a) of the EU General Data Protection Regulation (GDPR) is the legal basis for the processing of personal data provided that we have obtained the data subject's consent for processing their personal data.
Article 6(1)(c) of the GDPR is the legal basis if the processing of personal data is necessary for compliance with a legal obligation to which DFS Deutsche Flugsicherung GmbH is subject.
The data subject's personal data will be erased as soon as the purpose for which the data were retained is no longer necessary. The data may also be retained if this was provided for by the European or national legislatures in EU regulations, laws or other provisions to which the data controller is subject.
The data are also stored in our system's log files. This data will not be stored together with the user's other personal data.
Art. 6(1) read in conjunction with Art. 32(1) of the GDPR is the legal basis for the temporary retention of your data and log files.
The temporary retention of your IP address by the system is necessary to facilitate delivery of the website to the user's computer. To do this, the user's IP address must be retained for the duration of the session.
The data are stored in log files in order to ensure that the website functions properly. The data also help us optimise the website contents and ensure the security of our IT systems. We will not use the data for marketing purposes in any way.
The data will be erased as soon as they are no longer needed for the purpose for which they were collected. If the data are collected to facilitate provision of the website, they will be erased once the session has ended.
When the data are stored in log files, the data will be erased no later than after seven days. Storing the data for longer is possible, but in this case the users' IP addresses will be anonymised so that they can no longer be allocated to the requesting client.
The user's data that are collected will be anonymised using certain technological measures. The data will not be stored with any of the users' personal data.
Art. 32 of the GDPR is the legal basis for the processing of your personal data when using cookies.
The purpose of using technically necessary cookies is to make it easier for users to use websites. Some of the functions of our website cannot be offered without using cookies. To do this, it is necessary that the browser can be identified even after leaving the page.
Analysis cookies are used to improve the quality of our website and its contents. Thanks to analysis cookies, we learn how the website is used and can continuously optimise the contents.
The user's consent to data processing is obtained during the registration process.
The data are processed on the legal basis of Art. 6(1)(f) of the GDPR while providing air navigation services.
The user is required to register because he/she uses the air navigation service and therefore the mandatory legal recordings.
DFS Deutsche Flugsicherung GmbH will automatically deactivate the account one year after the last login. If the account is not reactivated within the next two months, the account and all of the personal data will be erased by DFS Deutsche Flugsicherung GmbH at the end of that month. You may create a new account after that at any time.
As the user, you have the option to cancel your registration at any time. Due to legal recordings, the data shall be erased one month after the cancellation request. You may amend your stored personal data at any time.
You have the right to obtain confirmation from the controller as to whether or not personal data concerning you are being processed.
The existence of automated decision-making, including profiling, referred to in Art. 22(1) and (4) of the GDPR and – at least in those cases – meaningful information about the logic involved as well as the significance and the envisaged consequences of this processing for the data subject.
You have the right to be informed of whether your personal data will be transferred to a third country or an international organisation. In this context, you may request that you be informed of the appropriate safeguards pursuant to Art. 46 of the GDPR relating to the transfer.
You have the right to have the personal data rectified and/or completed by the controller, provided that the processed personal data are inaccurate or incomplete. The controller must make the corrections without undue delay.
If you have objected to processing pursuant to Art. 21(1) of the GDPR pending the verification of whether the legitimate grounds of the controller override your grounds.
If processing of your personal data has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.
If restriction of processing has been obtained pursuant to the above conditions, you will be informed by the controller before the restriction of processing is lifted.
If you have notified the controller of your right to rectification, erasure or restriction of processing, the controller shall be obliged to communicate the rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.
You have the right for the controller to inform you about those recipients.
In exercising this right to data portability, you shall also have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This right shall not adversely affect the rights and freedoms of others.
You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on point (e) or (f) of Article 6(1) of the GDPR, including profiling based on those provisions.
The controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
You have the option in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, to exercise your right to object by automated means using technical specifications.
You have the right to withdraw your consent for data processing at any time. Withdrawing your consent shall not affect the lawfulness of the processing performed based on your consent before the consent was withdrawn.
However, these decisions shall not be based on special categories of personal data referred to in Art. 9(1) of the GDPR, unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard your rights and freedoms and your legitimate interests are in place.
In the cases referred to in points 1. and 3., the data controller shall implement suitable measures to safeguard your rights and freedoms and your legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with the supervisory authority for data protection at DFS Deutsche Flugsicherung GmbH (the Federal Commissioner for Data Protection and Freedom of Information) if you think that the processing of personal data relating to you is in violation of the GDPR.
The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 of the GDPR.
This website uses SSL encryption for security reasons and to protect the transmission of confidential information. You can recognise that you have a secure and encrypted connection by the padlock symbol in the status bar of the browser and the URL address will change from http:// to https:// . Thanks to the SSL encryption, third parties do not have access to the data you send to DFS Deutsche Flugsicherung GmbH.
The website of DFS Deutsche Flugsicherung GmbH contains links to other websites that are not operated by or the responsibility of DFS Deutsche Flugsicherung GmbH. DFS Deutsche Flugsicherung GmbH is not responsible for the content of and compliance with data protection rules on these other websites.

References: Art. 6

Art. 6
 Art. 32

Art. 32
 Art. 6
 Art. 22
 Art. 46
 Art. 21
 Art. 9
 Art. 78