Source: https://cytotools.de/data-protection.html
Timestamp: 2019-04-26 11:14:03+00:00

Document:
Personal data is all data which relate to an identified or identifiable natural person. Processing of personal data means any operation or set of operations, whether automated or not, performed upon personal data, such as collection, storage, organization and well as data erasure. Details here can be seen in Art. 4 No. 1 and 2 GDPR.
Our site is hosted by the company 1&1 Internet SE, Elgendorfer Str. 57, D-56410 Montabaur. All data which is acquired from visitors to our website, and which we store, is therefore on the servers of 1&1 Internet SE. The servers of 1&1 are located in Montabaur. 1&1 handles the user data which occurs strictly according to the instructions of CytoTools as the controller. We dictate the purpose and means of processing in the sense of Art. 28 GDPR.
Our website does not use either cookies or an analysis software.
The file inquiry of the client (file name and URL).
A combination of these data with other data sources is not carried out.
Furthermore, these data are stored in the server log files of our system and are located in the 1&1 server. A storage of these data together with other personal data of the user does not occur here either.
The legal basis for the temporary data and log file storage is Art. 6 para. 1 lit. f GDPR.
The temporary storage by the system of the information, described previously, is necessary in order to be able to transmit the website to the computer of the user. To this end, the IP-address of the user must remain stored for the duration of the session.
The storage in log files is carried out to ensure the functionality of the website. Furthermore, the data help us to improve the website and safeguard the safety of our technical information systems. No evaluation of the data for marketing purposes takes place here.
This is also the purpose of our legitimate interest in the data processing according to Art. 6 para. 1 lit. f GDPR.
The data are erased as soon as they are no longer necessary to fulfill the purpose of their acquisition.
In the case of data acquisition to enable the presentation of the website, this occurs as soon as the session in question is terminated.
In the case of storage of data in log files, this occurs at the latest after 28 days. The IP-address of the user is anonymized already after 14 days.
The data can also temporarily remain stored without anonymization as long as this is necessary to pursue legal rights or to defend these rights.
The acquisition of the data for the presentation of the website and the storage of the data in log files is absolutely necessary for the operation of the internet site. Therefore, on the user side, there is no contradiction possibility.
It is possible to contact CytoTools via the E-mail address provided.
In this case, the personal data of the user transmitted by E-mail will be stored. However, here too, there will be no transfer of data to third parties. The data are used exclusively for the processing of the conversation.
The legal basis for the processing of data which are transferred when sending an E-mail is Art. 6 para. 1 lit. f GDPR. If the E-mail contact is intended to conclude a contract, then the additional legal basis for processing is Art. 6 para. 1 lit. b GDPR.
Our processing of personal data contained in the E-mail serves exclusively the purpose of processing the contact which you have initiated. This includes the required legitimate interest in processing the data which you have sent by E-mail.
The data which you have sent by E-mail will be deleted as soon as we have taken note of your inquiry or we have given a final answer to your request, so that the conversation has terminated. The conversation is then terminated when the circumstances show that the matter in question has been finally decided. The data can however remain temporarily stored as long as this is necessary for claims enforcement or the defense of legal rights, or when there is a statutory retention requirement. The latter can be the case in particular when a contract has been made by E-mail. Then, Cyto Tools can store the E-mail as long as this is necessary for the contract implementation, and after this, e.g. for the enforcement of, or defensive measures against, guarantee claims.
If you contact us by E-mail, you can contradict the storage of your personal data at any time. In such a case however, it would not be possible to continue the conversation. If you wish to contradict, please contact us by E-mail. In this case, all personal data which have been stored in the course of the contact will be deleted. The data can however remain temporarily stored as long as this is necessary for claims enforcement or the defense of legal rights, or when there is a statutory retention requirement.
(8) the existence of automated individual decision-making or profiling, according to Art. 22 para. 1 and 4 GDPR and – at least in these cases – meaningful information about the logic involved, as well as the significance and intended effects of such a processing for the person concerned.
You have the right to demand information about whether your personal data has been transferred to a third country or an international organization. In this connection, you can demand that there are appropriate safeguards in connection with data transfer according to Art. 46 GDPR and that you are informed.
You have right to demand corrections from the controller, to the extent that your personal data which is being processed is incorrect. If they are incomplete, you have the right to demand completion. The controller must make any corrections without delay.
The GDPR also provides a right to the limitation of personal data. If the processing of your personal data has been limited, then these data - apart from their storage - may only be processed with your explicit approval, or for the enforcement or defense of legal rights, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a member state.
If there is a limitation of processing, according to the prerequisites described above, you will be informed by the controller before the limitation is lifted.
(4) if you have entered an objection against the processing according to Art. 21 para. 1 GDPR, but it has not yet been determined whether the justified reasons of the controller prevail over your grounds.
(1) The personal data which concern you are no longer necessary for the purpose for which they were acquired or otherwise processed.
(2) You revoke your consent, which is the basis for the processing according to Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR, and there is no other legal basis for processing.
(3) According to Art. 21 para. 1 GDPR, you submit an objection to the processing and there are no primary justified grounds for processing, or you object to the processing according to Art. 21 para. 2 GDPR.
(4) Your personal data were illegally processed.
(5) The erasure of your personal data is necessary in order to fulfill a legal obligation according to the law of the EU, or the law of a member state to which the controller is subject.
(6) Your personal data were gathered in relation to offered society information services according to Art. 8 para. 1 GDPR.
If the controller has made your personal data public, and according to Art. 17 para. 1 GDPR he is obliged to erase the data, so, taking into account the available technology and the implementation costs, he will take suitable measures – also of a technical nature – so that those responsible for the processing of the data are informed that you, as the person affected, demand that they erase all links to your data, as well as all copies or duplicates of this personal data.
(5) for the purpose of exercising, enforcement of, or the defense of, legal rights .
If you have exercised the right to correction, erasure or limitation of the processing vis-à-vis the controller, he is obligated to inform all recipients who have had access to your personal data of this correction, erasure or limitation. Unless, however, this is impossible or involves disproportionate expense. Vis-à-vis the controller, you have the right to be informed about these recipients.
When exercising this right, you can furthermore demand that the personal data in question is passed on directly from one controller to another controller, to the extent that this is technically possible. Freedoms and rights of other persons may not be negatively affected by this.
The right of data portability does not apply to processing of personal data, which is necessary for performing a task in the public interest or for exercising official authority which lies in the responsibility of the controller.
You have the right, for reasons which arise from your particular situation, to object, at any time, to the processing of your personal data, according to Art. 6 para. 1 lit. e or f GDPR; this also applies to profiling based on these regulations. The controller does not process the personal data any longer, unless he can demonstrate compelling and legitimate grounds for the processing which outweigh your interests, rights and freedoms, or the processing serves the purpose of exercising, enforcement of, or the defense of legal rights. If the personal data which concern you are processed, in order to provide direct advertising, you have the right, at any time, to object to data processing for this kind of advertising. This also applies to profiling to the extent that it is connected with this kind of advertising.
If you object to having your personal data processed for the purpose of direct advertising, then the relevant personal data will no longer be processed for this purpose.
You have the possibility, in connection with the use of information society services – notwithstanding Directive 2002/58/EC – of implementing your objection right with an automatic method, whereby technical specifications are used.
You have the right, at any time, to revoke your declaration of consent under data protection law. By revoking the consent, the legitimacy of the processing carried out under the declaration of consent before the revoke occurred remains unaffected.
(3) takes place with your specific consent.
However, these decisions must not be based on particular categories of personal data, according to Art. 9 para. 1 GDPR, unless Art. 9 para 2 lit. a or g applies, and appropriate measures for the protection of rights and freedoms as well as your justified interests have been taken.
With regard to the cases described in (1) and (3), the controller takes appropriate measures to safeguard rights and freedoms as well as your justified interests, which involves at least the right to obtain an intervention of a person on the part of the controller to explain your own point of view and to challenge the decision.
Without prejudice to any other administrative or judicial remedies, you have the right to complain to a supervising authority, in particular in the member state of your place of residence, your place of work or the location of the suspected infringement, if you are of the opinion that the processing of personal data concerning you is in breach of GDPR.
The supervising authority to which the complaint was submitted informs the complainant about the status and the results of the complaint including the possibility of judicial proceedings according to Art. 78 GDPR.
The responsible supervisory authority in questions of data protection is the Data Protection Office of a federal German state. In our case , it is the state where our company is domiciled. A list of data protection officers as well as contact details can be found at the following link: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.
Please note: The following information only relates to personal data of shareholders and their representatives which are processed outside our website. The data protection declaration which provides information about the processing of personal data on our website can be accessed an any time under https://cytotools.de/datenschutz.html .
Within the scope of administering investor business, the CytoTools AG processes the following categories of your personal data: contact data (e.g. name or the E-mail address), information about your shares (e.g. number of shares, type of shares) and information about general meetings (list of participants at a GM, which, if you participated, contains your name).
The CytoTools AG only processes those personal data which are necessary to fulfill their legal obligations contained in the German Corporation Act and other laws. Beyond this, personal data, in particular Email and postal addresses, are necessary for the dispatch of information to the company shareholders within the scope of newsletters etc. This data processing is permitted according to Art. 6 para. 1 lit. c of the General Data Protection Regulation (GDPR).
As a fundamental rule, data which concern you will not be passed on to third parties. In exceptional cases, third parties do have access to this data to the extent that they have been commissioned by the CytoTools AG to carry out services within the scope of the administration of investor business. Those involved here are auditors, consultants and general meeting agencies. The servicing companies only receive personal data which is necessary for them to perform their services.
The data described above will be erased when this is no longer necessary to fulfill legal obligations and no legal retention period applies. The participants list of a general meeting is first erased two years after the meeting has taken place, certain powers of attorney, first after three years.
Upon application, you have the right, free of charge, to receive information about which of your personal data are stored. Additionally, you have the right to demand rectification of any incorrect data and the right to demand limitation of the processing of excessively processed data. Furthermore, you have the right to demand the erasure of illegally processed data or personal data which have been stored for too long (insofar as there are no legal retention periods or any other reasons according to Art. 17 para. 3 GDPR which prevent this). Moreover, you have the right to have all data submitted to us transferred to you in a common file format (right to data portability).
A corresponding E-mail to kontakt@cytotools.de. is all that is necessary for you to exercise your rights.
Furthermore, you also have the right to lodge a complaint with a supervisory data protection authority.

References: Art. 4
 Art. 28
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 22
 Art. 46
 Art. 21
 Art. 6
 Art. 9
 Art. 21
 Art. 21
 Art. 8
 Art. 17
 Art. 6
 Art. 9
 Art. 9
 Art. 78
 Art. 6
 Art. 17