Source: http://www.spang-brands.de/en_datenschutz.html
Timestamp: 2019-04-22 12:15:42+00:00

Document:
In the processing of personal data necessary for the performance of a contract to which the data subject is a part of, art. 6 para. 1 lit. b GDPR serves as the legal basis. This also applies to processing operations required to carry out precontractual actions. Insofar as processing of personal data is required to fulfill a legal obligation that is subject to our company, art. 6 para. 1 lit. c GDPR serves as the legal basis. In the event that vital interests of the data subject or another natural person require the processing of personal data, art. 6 para. 1 lit. d GDPR serves as the legal basis. If processing is necessary to safeguard the legitimate interests of our company or a third party, and if the interests, fundamental rights and fundamental freedoms of the person concerned do not outweigh the former interest, art. 6 para. 1 lit. f GDPR serves as the legal basis for processing.
On the websites of Spang & Brands GmbH there is a contact form that can be used for electronic contact. Alternatively, contact via the provided e-mail address is possible. If the data subject contacts the controller through one of these channels, the personal data transmitted by the data subject will be automatically stored. The storage serves solely for purposes of processing or contacting the person concerned. A transfer of data to third parties does not take place. Legal basis for the processing of the data is in the presence of the consent of the user art. 6 para. 1 lit. a GDPR.
The controller will only process and store personal data of the data subject for as long as necessary to achieve the purpose of the storage. In addition, such storage may take place if provided for by the European or national legislator in EU regulations, laws or other regulations to which the person responsible for processing is subject. As soon as the storage purpose is removed or a storage period prescribed by the aforementioned regulations expires, the personal data is routinely blocked or deleted.
a. the processing on a consent acc. art. 6 para. 1 lit. a GDPR or art. 9 para. 2 lit. a GDPR or on a contract acc. art. 6 para. 1 lit. b GDPR is based and b. the processing is done by automated means.
In exercising this right, you also have the right to obtain the personal data concerning you directly from one person responsible to another person responsible, as far as technically feasible. Freedoms and rights of other persons may not be affected. The right to data portability does not apply to the processing of personal data necessary for the performance of a task in the public interest or in the exercise of official authority delegated to the controller.
You have the right at any time, for reasons that arise from your particular situation, to object against the processing of your personal data, which pursuant to art. 6 para. 1 lit. e or f GDPR takes place; this also applies to profiling based on these provisions. The controller will no longer process the personal data concerning you unless he can demonstrate compelling legitimate reasons for processing that outweigh your interests, rights and freedoms, or the processing is intended to assert, exercise or defend legal claims.
b. is permissible on the basis of Union or member State legislation to which the controller is subject, and that legislation contains appropriate measures to safeguard your rights and freedoms and your legitimate interests, or c. with your express consent.
However, these decisions must not be based on special categories of personal data pursuant to art. 9 (1) GDPR, unless art. 9 (2) lit. a or g and reasonable procedures have been taken to protect the rights and freedoms and your legitimate interests. Regarding the cases mentioned in a. and c., the person responsible shall take reasonable steps to safeguard the rights and freedoms and your legitimate interests, including at least the right to obtain the intervention of a person by the controller, to express his or her own position and to contest the decision.
Without prejudice to any other administrative or judicial remedy, you have the right to complain to a supervisory authority, in particular in the member State of its place of residence, employment or the place of the alleged infringement, if you believe that the processing of your personal data violates against GDPR. The supervisory authority to which the complaint has been submitted shall inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy under article 78 of the GDPR.

References: art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 9
 art. 6
 art. 6
 art. 9
 art. 9