Data protection declaration for services from the Offerista Group Hungary Kft.

A – Scope of application, data controller, data protection officer

I SCOPE OF THE DATA PROTECTION DECLARATION

This data protection declaration informs you of the type, purpose and scope of the collection and processing of personal data for the following services.

II Name and address of the data controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is the Offerista Group Hungary Kft., Szilágyi Dezső tér 1. 2. em. in 1011 Budapest, Hungary, Managing Directors Ognyan Popov, phone: +36 30 157 5527, privacy@offerista.com.

III Name and address of the data protection officer

You can contact our data privacy team at any time via email to privacy@offerista.com regarding any questions about our data storage and processing practices, as well as regarding utilizing your rights in these matters.

B - General information on data processing

I Scope

We collect and use our users’ personal data to the extent necessary to provide a functioning website and to perform our services, including the location-based display of advertising from local retailers and service providers. In order to make our services available to you free of charge, we finance our services through advertising revenue. Therefore it is necessary that we collect, in anonymous form, the data we need to be able to invoice our customers for the adverts.

Insofar as we obtain the consent of the user, this serves as the legal basis for the processing of personal data pursuant to Art. 6 para. 1 sent. 1 lit. a) GDPR. When processing personal data that is required to fulfil a contract with the user, Art. 6 para. 1 sent. 1 lit. b) GDPR serves as the legal basis. If processing is necessary to safeguard the legitimate interests of our company or a third party, and if the interests of the user do not prevail, Art. 6 para. 1 sent. 1 lit. f) GDPR serves as the legal basis.

III Storage period and data erasure

The user’s personal data will be deleted as soon as the purpose for its collection has been fulfilled. If the data controller is legally obliged to store the data beyond this time, the data will be blocked from the time that the original purpose is achieved until it is erased. Information on the storage period is provided for each type of processing.

C - Data processing for apps

1. Access data (Server log files)

When you use our apps, we collect the data that is automatically sent during your use and that is required for the use of our services. This data includes your IP address, information on the user agent, as well as the date and time of the use of our services. This data is stored in our system log files. This data is not stored together with other personal data relating to the user. The legal basis for the temporary storage of data is Art. 6 para. 1 sent. 1 lit. f) GDPR. The temporary storage of your IP address by the system is necessary. For these purposes, our legitimate interest in processing the data is also based on Art. 6 para. 1 sent. 1 lit. f) GDPR. The data will be deleted and the IP address anonymized as soon as they are no longer necessary for the purposes for which they were collected. The collection and storage of data in log files is essential for the operation of the apps.

2. Push notifications

2.1 Description and scope of the data processing

Insofar as the user has authorized the sending of push notifications, a corresponding token will be generated via the device’s operating system each time the app is started (for Android via Google’s GCM (Google Cloud Messaging) and for iOS via Apple’s APNS (Apple Push Notification Service)) and sent from the app to an Offerista server (Push-Backend"). There, the token is stored in a database together with the app’s visitor ID. Using this database, push notifications are sent downstream via the AWS SNS service (Amazon Simple Notification Service), which uses the push token to contact the online services of the device operator (Apple or Google) and deliver the push notification. We offer to send you push notifications:

In order to be able to send you these push notifications with current offers and advertising from local retailers, we obtain the appropriate consent. Consent is requested during the initial app setup and/or later as required.

2.2 Purposes of data processing

The purpose of push notifications is to inform you about products of interest and news in the form of advertising from providers who display advertising on our services.

The legal basis is the consent given by you pursuant to Art. 6 para 1 sent. 1 lit. a) GDPR.

2.4 Storage period

The data (push token and visitor ID) will be deleted no later than three months after the last time the app is opened, or upon revocation.

2.5 Revocation and erasure

You can revoke your consent at any time by revoking the authorization for notifications in your device’s system settings. For iOS, you will find this option under “settings” > “notifications” > “NAME OF THE APP “. For Android, you will find this option under “settings” > “apps” or “app manager” > “NAME OF THE APP > “view notifications”. For Windows, you will find this option under “settings” > notifications & actions” > “NAME OF THE APP > deactivate tab”. If you revoke your consent in this way, we will stop sending you push notifications. Please note, however, that some of our features (e.g. notification of exclusive offers in the vicinity) will no longer be available. You may reactivate your authorization in the system settings at any time. You also have the option to deactivate each service individually:

3. Location data

3.1 Description and scope of the data processing

Location data is determined from user input or GPS geo-coordinates, whereby we determine location at postcode level through longitudinal and latitudinal data captured by the device. In order to be able to send you location-specific offers and so that you only receive information on offers from retailers in the vicinity, we obtain your consent. If, in response to the system query “Allow Prospecto.hu to access your location?”, you click on the “Always allow” button, you are giving us your consent to collect and process your location, to display offers in the vicinity, and to compile anonymous statistics about the use of our offers. Information on your location is also collected if you are not currently using the app but it is open in the background. If you click on the “When using the app” button, you are giving your consent to the collection of information about your location, but only when you are actively using the app. If you select this option, the app may not be able to alert you to current offers in the vicinity. Alternatively, you have the option not to allow location tracking, and instead to enter your location manually in the form of your postcode. We will then use the postcode provided to make available brochures, offers and advertising from local retailers at the specified location. Please note that the app may not alert you to current offers in the vicinity based solely on the postcode entered.

3.2 Purposes of data processing

To be able to notify you of suppliers and offers in your vicinity and to send you geolocation-based information via push notifications, we need to know your location. Without the localization of your location - either via manual input of your location or via automatic location determination - you cannot use the services offered by the Prospecto.hu app. To be able to inform you of suppliers’ offers in your vicinity by means of push notifications, we also need your location even if you are not using the app at the time. In the event that you have given us your consent to capture your location even when you are not using the app, we will also collect information on your location if you approach a shop whose advertising you have viewed through our services. We also need your location data (postcode level) in order to provide our advertising customers with information on the success rates and local reach of their advertising in the form of anonymous statistics.

The legal basis for processing location data is the consent given by you pursuant to Art. 6 para. 1. sent. 1 lit. a) GDPR.

3.4 Storage period

We store your data for three years.

3.5 Revocation and erasure

You may revoke your consent to the collection and use of information about your location at any time. If you revoke your consent, we will no longer capture your location. Please note, however, that some of our features (e.g. notification of exclusive offers in the vicinity) will no longer be available. You may reactivate your authorization in the system settings at any time. You can deactivate automatic location tracking in the apps at any time. In the apps:

Or via your device settings:

4. Offerista tracking tool

4.1 Description and scope of the data processing

We collect the following data about your usage behaviour:

4.2 Purposes of data processing

We use this data to analyze and evaluate the apps’ functions by creating user profiles, to invoice our customers for advertising, and to customize our services as needed.

The legal basis for this is Art. 6 para. 1 sent. 1 lit. b) GDPR.

4.4 Storage period

We erase the data after a maximum of 36 months.

5. Google Analytics

5.1 Description and scope of the data processing

We use Google Analytics, a web analytics service from Google Inc. (“Google”). Google Analytics uses what are known as “cookies”, text files which are stored on users’ mobile devices and permit analysis of their use of the website. The information generated by the cookie on the use of our app is usually transferred to a Google server in the USA and stored there. IP anonymization is activated on this website, meaning that Google will first truncate the user’s IP address within the European Union, or in other treaty states of the European Economic Area. Only in exceptional cases is the full IP address sent to a Google server in the US and truncated there. The following data is captured: Online tags (including cookie identifiers), anonymized IP addresses, device identifiers.

5.2 Purposes of data processing

On our behalf, Google will use this information to evaluate use of the app by you, the user, to collate reports on app activities and to provide the app provider with further services related to website use and internet use.

The legal basis for processing the data is Art. 6 para. 1 sent. 1 lit. f) GDPR. Our legitimate overriding interest lies in improving the quality of our offerings and their content. We learn how our services are used, and are thus able to constantly optimize our offer.

5.4 Storage period

The data is deleted after 26 months.

5.5 Objection

You can prevent the storage of cookies by using the appropriate setting on your browser software; however we would point out to users that if you do this, you may not be able to use all functions of this website to their full extent. In addition, users can prevent Google from collecting data on their use of the website (including their IP address) generated by the cookie, and also prevent the processing of this data by Google, by downloading and installing the browser plugin available via the following link. The current link is: https://tools.google.com/dlpage/gaoptout?hl=de

6. Google Ads – Remarketing

6.1 Description and scope of the data processing

We have integrated Google Remarketing. This allows us to create user-friendly advertising, showing you interest-based ads in other apps in the Google network. To do this, Google Remarketing sets a cookie in your device’s browser. The cookie allows Google to recognize you when, after leaving our app, you visit other apps that also belong to the Google network. Every time you open an app with integrated Google Remarketing, your device’s browser automatically identifies itself to Google. Google thus receives personal data, such as the user’s IP address and surfing behaviour, which Google uses, among other things, to display interest-based ads. The personal data collected by the cookie every time a visit is made to our apps, including the IP address of the data subject’s device, is transmitted to Google in the United States of America, stored there, and may be passed on to third parties.

6.2 Purpose

The purpose is to display interest-based ads through the Google advertising network or other websites.

The legal basis for data processing is the consent given by you prior to using our apps pursuant to Art. 6 para. 1. sent. 1 lit. a) GDPR.

6.4 Storage period

The data is deleted after a maximum of 18 months.

6.5 Revocation

You can revoke the use of cookies by Google, effective for the future, at any time. In the browser:

Further information on Google Remarketing and Google’s privacy policy can be found under: https://www.google.com/privacy/ads/ and https://www.google.de/intl/de/policies/privacy/.

7. Google Ads Conversion Tracking

7.1 Description and scope of the data processing

We use Google AdWords Conversion Tracking, a service of Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; in the following “Google”). Conversion Tracking is a service that enables us to record what happens after a user clicks on one of our adverts, e.g. whether you afterwards install our app and when you open it for the first time. Furthermore we can record which keywords, adverts, advertising groups and campaigns led to which user action. If you click on one of our adverts in Google search or on a selected Internet site of the Google advertising network, a temporary cookie is saved on your device (conversion cookie). If you complete an action, our system recognizes the (via the code snippet inserted by you) and records a conversion. Cookies for conversion tracking are only valid for 30 days. No personal data is collected and/or saved by the cookies. Accordingly we cannot assign conversion data to a particular user, instead we only have access to the complete data for adverts and keywords.

7.2 Purpose

The purpose of the data processing is to measure the success of our services and offers, and to improve them for both our users and our advertising customers.

The legal basis for data processing is the consent given by you prior to using our apps pursuant to Art. 6 para. 1. sent. 1 lit. a) GDPR.

7.4 Storage period

Cookies for conversion tracking are only valid for 30 days. No personal data is collected and/or saved by the cookies.

7.5 Objection and erasure

You can, at all times, object to conversion tracking with future effect, or deactivate the function in your device’s browser:

Further information on Google remarketing and Google’s data protection declaration can be found under: https://www.google.com/privacy/ads.

8. AdSense mobile application

8.1 Description and scope of the data processing

We use the online service Google AdSense, which facilitates the placement of advertising on third-party apps. Through this service, the ads displayed on third-party apps are selected according to the content of the respective third-party app by means of an algorithm, which enables an interest-based approach of visitors to the app. When you visit our services listed above, Google AdSense sets a cookie on your device, allowing the service provider to analyze how you use our apps. Every time you visit one of our apps, the AdSense cookie automatically causes your device’s browser to submit personal data to Alphabet Inc. for online advertising and commission invoicing purposes. Data is used to track visitor origin and clicks, and subsequently to enable commission invoicing. The data collected by the cookie, to the extent necessary to capture the ads displayed and enable invoicing, is transferred to Alphabet Inc. in the United States of America, stored and, if necessary, passed on to third parties. Google AdSense is explained in more detail here: https://www.google.de/intl/de/adsense/start/.

8.2 Purpose

The purpose of the Google AdSense component is to integrate commission-based advertising into our website in order to earn advertising revenue.

The legal basis for data processing is the consent given by you prior to using our apps pursuant to Art. 6 para. 1. sent. 1 lit. a) GDPR.

8.4 Storage period

The data is deleted after a maximum of 18 months.

8.5 Revocation

You can, at all times, revoke the use of cookies with future effect, or deactivate the function in your device’s browser.

Further information on Google Remarketing and Google’s privacy policy can be found under: https://www.google.com/privacy/ads/.

9. DoubleClick

9.1 Description and scope of the data processing

We have integrated Google Ad Manager into our apps and web portals. When you are active on our apps/portals, Google Ad Manager transmits data to the Google Ad Manager server, which in turn triggers a cookie request in your app. If your app accepts the request, Google Ad Manager sets a cookie on your device. Google Ad Manager cookies contain no personally identifiable information. Instead they contain a cookie ID which is needed, for example, to display ads in the app and, at the same time, track which ads have already been displayed to avoid duplication. In addition, it is useful for tracking conversions for commission invoicing, for example if a Google Ad Manager ad was served to you and you then go to shop on the advertiser’s website. Every time the app is accessed, Google Ad Manager transmits this information to Google for online advertising and invoicing purposes. Google Ad Manager cookies do not contain any personal information.

9.2 Purpose

The purpose of the cookie is to optimize and display commission-based advertising. The cookie is used, among other thing, to serve and display user-relevant ads, as well as to generate reports on advertising campaigns or to improve them. Furthermore, the cookie is used to avoid serving the same ad multiple times.

The legal basis for the setting of cookies and the associated data processing is the consent given by you pursuant to Art. 6 para. 1 sent. 1 lit. a) GDPR.

9.4 Storage period

The data is deleted after a maximum of 18 months.

9.5 Revocation

You can, at all times, revoke the use of cookies with future effect, or deactivate the function in your device’s browser.

10. AppsFlyer

10.1 Description and scope of the data processing

Our services use AppsFlyer, an analytics service from AppsFlyer Ltd., 111 New Montgomery Street San Francisco, California 94105. The information on the use of the apps generated by AppsFlyer is normally transmitted to a server outside Germany and is stored there. The following data is collected via AppsFlyer: anonymized IP address, meta data about user interactions recorded in the apps (e.g. app installation, calling up the app manually or by clicking on a campaign link), AdID or IDFA. In the code we have activated IP anonymization, so that the user’s IP address is truncated before it is stored by AppsFlyer Ltd.

10.2 Purposes of data processing

The anonymous information is used to evaluate use of the apps, and to compile reports on user activities in the apps. We use these reports to improve our services.

The legal basis for processing the data is Art. 6 para. 1 sent. 1 lit. f) GDPR. Our legitimate overriding interest lies in improving the quality of our offerings and their content. We learn how our services are used, and are thus able to constantly optimize our offer.

10.4 Storage period

The data is deleted after 3 years.

10.5 Objection and erasure

You can object to the use of AppsFlyer. To do so, send an email to: privacy@appsflyer.com. You can, at all times, object to the use of IDFA/AdID with future effect, or deactivate the function in your device’s browser:

11. Crashlytics

11.1 Description and scope of the data processing

We use “Crashlytics” from Crashlytics Inc,1355 Market Street #900, San Francisco, California 94103. Crashlytics identifies software problems and their causes. Crashlytics collects the following data: Device status information, device type, device identification. This data is stored in anonymous form.

11.2 Purpose

The purpose of the data collection is to identify software errors and their causes.

The legal basis is our overriding interest in ensuring the ongoing functionality of our apps pursuant to Art. 6 para. 1 sent. 1 lit. f) GDPR.

11.4 Storage period

The data is deleted after 3 years.

11.5 Objection

For further information on Crashlytics’ data protection, go to: https://try.crashlytics.com/terms/privacy-policy.pdf.

13. Information exclusively for iOS apps

13.1 Using Apple iCloud

13.1.1 Description and scope of the data processing

In your iOS apps Offerista uses the iCloud for the storage of an unambiguous, anonymous user ID. The user ID is a randomly generated but unambiguous number. Offerista guarantees that the user ID is only stored within the scope of your personal iCloud account. Data protection provisions apply to the storage of data in the iCloud. Information from Apple on data protection for the iCloud can be found under: https://support.apple.com/de-de/HT202303 und https://www.apple.com/de/privacy/. The user ID is stored in a special directory, in your personal iCloud directory, to which Offerista has no access.

13.1.2 Purpose of data processing

The storage of the user ID in the iCloud serves exclusively for the synchronization of data between more than one device on which you execute iOS apps.

The legal basis for processing the data is Art. 6 para. 1 b) of the GDPR.

13.1.4 Objection and erasure

iCloud functionality can be deactivated using the system settings of your iOS device: After deactivation, data is no longer stored in your personal iCloud directory, and the synchronization of data between your personal iOS devices no longer takes place.

13.2 Synchronization via the programming interface

If you add or delete a favourite shop in an app, we will use your user ID to synchronize this between your iCloud and the app by means of a programming interface. We can thus ensure cross-device access to your favourite shops without being able to assign this data to you as a person.

14. Information exclusively for Windows apps

14.1 Using Microsoft OneDrive

14.1.1 Description and scope of the data processing

In your Windows 10 apps, Offerista uses an unambiguous, anonymous user ID for the synchronization of personal settings and data between various Windows 10 devices which have Microsoft OneDrive functionality. The user ID is a randomly generated, unambiguous number. The storage of the user ID in OneDrive serves exclusively for the synchronization of data between more than one device on which you execute Windows 10 apps. Offerista guarantees that the user ID is only stored within the scope of your personal OneDrive account. Data protection provisions apply to the storage of data in Microsoft’s OneDrive. The user ID is stored in a special directory in your personal OneDrive directory, to which Offerista has no access.

14.1.2 Purpose of data processing

The storage of the user ID in the OneCloud serves exclusively for the synchronization of data between more than one device on which you execute Windows apps.

The legal basis for processing the data is Art. 6 para. 1 lit. b) GDPR.

14.1.4 Objection and erasure

This functionality can be deactivated using the system settings of your Windows 10 device: After deactivation, data is no longer stored in your personal OneDrive directory, and the synchronization of data between your personal Windows 10 app devices no longer takes place.

14.2 Synchronization via the programming interface

If you add or delete a favourite shop in the Windows 10 app, we will use your user ID to synchronize this with our API in your OneDrive. We can thus ensure cross-device access to your favourite shops without being able to assign this data to your as a person.

15. barcoo app – QR code/barcode scanner

15.1 Description and scope of the data processing

If you wish to use our QR code/barcode scanner, we need access to the camera in your device. After clicking on the “Scan barcode” icon, we will ask you whether you would like to give us the following consent. Android: “Enable barcoo to record photographs and videos?” iOS: “May Barcoo access your camera? Don’t worry! We ONLY need access to your camera to scan barcodes and QR codes. We won’t be spying on you;)”. We also have to collect the scanned code and your visitor ID. After a code has been scanned the corresponding product page is opened. For this we use cookies. Cookies are text files that are saved in your device’s browser.

15.2 Purpose of data processing

The data is required to use the QR code/barcode scanner function.

The legal basis for the data processing is Art. 6 para. 1 sent. 1 lit. b) GDPR, i.e. the processing of personal data necessary for the performance of a contract. Nevertheless we also obtain your consent (Art. 6 para. 1 sent. 1 lit. a) GDPR).

15.4 Processing duration

We delete your data immediately after the scan has been completed.

15.5 Revocation

You can revoke this consent at any time with future effect using your browser settings.

16. Email contact

16.1 Description and scope of the data processing

In our apps, we can be contacted via the email address provided. In this case, the personal data transmitted in your email (email address, UUID, version of the operating system, name of the device, information on whether location tracking was authorized and, where appropriate, most recent location information) is stored. In this context, data is not disclosed to third parties.

16.2 Purpose of data processing

The data is used exclusively to process the conversation. The processing of your personal data serves us solely to process the contact request.

The legal basis for the data processing is the consent given by you through sending us an email pursuant to Art. 6 para. 1 sent. 1 lit. a) GDPR.

16.4 Processing duration

The data will be deleted after 30 days, i.e. as soon as it is no longer necessary for the purposes for which it was collected. This is the case when the respective conversation with you comes to an end i.e. when it can be inferred from the circumstances that the relevant facts have been conclusively clarified.

16.5 Objection

You can erase the information regarding the browser version from the subject line before sending the email. You can object to the storage of your personal data at any time. In such a case, the conversation cannot take place. In such a case, personal data stored in the course of making contact will be deleted.

17. Advertisers’ pixels

In advertising materials (brochures etc.) served on our apps, pixels from the respective retailer or service provider may be integrated. Pixels capture, for example, how often a brochure is clicked on. This information is forwarded to the respective retailer. To do so, IP addresses are processed exclusively in truncated and therefore anonymous form. It is therefore impossible to identify individuals personally from this information. The advertiser is responsible for the anonymous processing of the data. The point of contact for users remains Offerista.

D – DATA PROTECTION DECLARATION FOR WEBSITES

1. Access data (Server log files)

1.1 Scope

When you use our websites, we collect the data that is automatically sent by your browser during your use and that is required for the use of our services. This data especially includes the URL, the type of browser, the browser version, the requesting provider, the IP address and the date and time when our services were used. This data is stored in our system log files. This data is not stored together with other personal data relating to the user. The IP addresses of the user are not affected by this. We store these in exclusively anonymized form.

1.2 Purpose

The temporary storage of IP addresses by the system is necessary to enable delivery of the website to the user’s computer. To do this, the user’s IP address must be stored for the duration of the session.

For these purposes, our legitimate interest in processing the data is also based on Art. 6 para. 1 sent. 1 lit. f) GDPR.

1.4 Storage period

The data will be deleted as soon as it is no longer necessary for the purposes for which it was collected. In the case of data collection in order to serve the website, this is when the respective session ends.

2. Newsletter – Offerista.com

2.1 Description and scope of the data processing

On our website, you have the opportunity to subscribe to our free newsletter on current trends in digital retail marketing. When registering for the newsletter, the name entered in the input mask and the email address will be sent to us. In addition, the IP address of the requesting computer and the date and time of registration are collected during registration. As part of the registration process, your consent to the processing of the data is obtained by means of a double opt-in process and reference is made to this privacy policy. Revocation can be effected at any time within such advertising emails. We use Rapidmail. for the sending and the administration of our newsletter. Rapidmail shall not forward the data described here to third parties. Rapidmail is an analysis service of SC-Networks GmbH, Enzianstr. 2, 82319 Starnberg. Rapidmail uses so-called “cookies”, text files that are stored on your computer and that allow an analysis of the use of the newsletter. The information generated by the cookie is sent to a server in Germany and analysed there. The newsletters also contain counting pixels. This is a miniature graphic that lets us know if a newsletter has arrived, been opened by you and which links in the newsletter were clicked. As part of this request, technical information, such as information about the browser and your system, the device used and the mail client as well as your IP address and time of the request are collected. In addition, the reading duration is recorded, this being done only on a target group basis. Although for technical reasons this information can be assigned to the individual newsletter recipients, it is neither our endeavour, nor that of Rapidmail to observe individual users.

2.2 Purpose

The collection of your email address serves to enable the delivery of the newsletter. The collection of other personal data as part of the registration process serves to prevent misuse of the services or the email address used and to prove the legal requirements. The information from your use of the newsletter shall be used for the technical improvement of the services and the evaluation of the reading habits of our users and shall serve us to send content according to the interests of our users. In order to be able to send you personalised newsletters, explicit tracking consent is required. If you have agreed to this in the context of an opt-in request in a newsletter, you agree that a personal user profile shall be created based on your data.

The consent to the sending of email addresses is on the basis of Article 6 para. 1 lit. a, Article 7 of the GDPR as well as § 7 para. 2 No. 3 or para. 3 of the German Fair Trade Practices Act. The use of the shipping service provider, carrying out statistical surveys and analyses as well as logging the registration procedure are based on our legitimate interests in accordance with Article 6 para. 1 lit. f of the GDPR. Our interest is to deploy a user-friendly and secure newsletter system that serves both our business interests such as direct advertising and the expectations of our users.

2.4 Storage period

The data shall be deleted as soon as they are no longer necessary for the purposes for which they were collected, that is to say at the latest when you unsubscribe from the newsletter.

2.5 Revocation

The subscription to the newsletter and the creation of a personal user profile may be revoked by you at any time by clicking the link “cancel” or “tracking cancellation” in the newsletter.

3. Use of technically necessary cookies

3.1 Description and scope of the data processing

Our website uses technically necessary cookies. Cookies are text files that are stored in your Internet browser or placed on your computer system by the Internet browser. When you visit a website, a cookie may be stored in your operating system. This cookie contains a string of characters that allow the browser to be uniquely identified when the website is revisited.

3.2 Purpose

The purpose of using technically necessary cookies is to facilitate the use of websites by users. Some features of our website cannot be offered without the use of cookies. For these features, the browser must be recognizable even after the user has changed websites.

The legal basis for processing data through the use of cookies is our interest in providing a functioning Internet service pursuant to Art. 6 para. 1 sent. 1 lit. f) GDPR.

3.4 Storage period

The data transferred by the cookie is deleted after 2 months.

3.5 Erasure

You can disable or restrict the transmission of cookies by changing your Internet browser settings. Cookies already stored can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may not be possible to make full use of all its functions.

4. Google Analytics

4.1 Description and scope of the data processing

We have integrated Google Analytics (with the anonymization function) into this website. Thereby, what are known as ‘cookies’ (text files) are stored on your computer to facilitate the analysis of how you use our website. As a general rule, the information collected by the cookie is transmitted to a Google server in the USA where it is stored. In order to avoid this, we use IP anonymization. This means your IP address will be truncated within the member states of the European Union or in other countries that have signed the Agreement on the European Economic Area. Only in exceptional cases is the full IP address sent to a Google server in the US and truncated there. Google will used the information collected on our behalf to evaluate use of the website, compile reports on website activity, and provide other related services. The IP address transmitted by your browser will not be merged with any other Google data.

4.2 Purpose

The purpose is to improve our offer based on the data collected.

The legal basis for processing the data is Art. 6 para. 1 sent. 1 lit. f) GDPR. Our legitimate overriding interest lies in improving the quality of our offerings and their content. We learn how our services are used, and are thus able to constantly optimize our offer.

4.4 Storage period

The data is deleted after 26 months.

4.5 Objection and erasure

You can prevent cookies being stored on your computer by selecting the appropriate settings in your browser. If you do so, however, you may not be able to use all the features of this website to their full extent. In addition, you as the user can prevent Google from collecting, transferring and processing the data on your use of the website (including your IP address) generated by the cookie by downloading and installing the browser plugin available via the following link: https://tools.google.com/dlpage/gaoptout?hl=de. As an alternative to the browser plug-in, you can click on one of the following links to prevent future detection by Google Analytics within this website.

The Opt Out works only in this browser and only for this domain. An opt-out cookie is stored on your device. If you delete your cookies in this browser, you must click this link again.

5. Google AdWords Remarketing

5.1 Description and scope of the data processing

We have integrated Google Remarketing. This allows us to create user-friendly advertising, showing you interest based ads on other websites in the Google advertising network. To do this, Google Remarketing sets a cookie in your device’s browser. The cookie allows Google to recognize you when, after leaving our website, you visit other websites that also belong to the Google advertising network. Every time you open a website with integrated Google Remarketing, your device’s browser automatically identifies itself to Google. Google thus receives personal data, such as the user’s IP address and surfing behaviour, which Google uses, among other things, to display interest-based ads. For every visit to our website, the personal data collected by the cookie, including the IP address of the data subject’s device, is transmitted to Google in the United States of America, where it is stored and may be passed on to third parties.

5.2 Purpose

The purpose is to display interest-based ads through the Google advertising network or other websites for the purpose of generating advertising revenue.

The legal basis is the consent given by you through visiting the app pursuant to Art. 6 para. 1 sent. 1 lit. a) GDPR.

5.4 Storage period

The data is deleted after a maximum of 18 months.

5.5 Erasure

You can, at any time, revoke the use of cookies by Google with future effect. You can access the deactivation function via the following links, and following the instructions given there. https://www.google.com/settings/u/0/ads/authenticated or https://support.google.com/ads/answer/2662922?hl=de doubleclick: https://www.google.com/settings/u/0/ads/authenticated?hl=de#display_optout. Alternatively, you can deactivate use of cookies from third parties by bringing up the deactivation page on the network advertising initiative: https://www.networkadvertising.org/choices/ and using the opt-out function there. You can also prevent the installation of cookies by selecting the appropriate setting in your browser. The use of our website and services is then, however, perhaps only possible to a limited extent. You can find more information on Google and data protection at: https://support.google.com/adwordspolicy/answer/6020956.

6. Google AdWords Conversion Tracking

6.1 Description and scope of the data processing

We use Google AdWords Conversion Tracking, a service of Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; in the following “Google”). Conversion Tracking is a service that enables us to record what happens after a user clicks on one of our adverts. Furthermore we can record which keywords, adverts, advertising groups and campaigns led to which user action. If you click on one of our adverts in Google search or on a selected Internet site of the Google advertising network, a temporary cookie is saved on your device (conversion cookie). If you complete an action, our system recognizes the cookie (via the code snippet inserted by you) and records a conversion. Cookies for conversion tracking are only valid for 30 days. No personal data is collected and/or stored by the cookies. Accordingly we cannot assign conversion data to a particular user, instead we only have access to the complete data for adverts and keywords.

6.2 Purpose

The purpose is to optimize our Internet services in order to provide a more interest-based design, and to improve the conversion rate.

The legal basis for the collection and transmission of data is the consent given by you at the start of your visit to our websites pursuant to Art. 6 para. 1 sent. 1 lit. a) GDPR.

6.4 Storage period

Cookies for conversion tracking are only valid for 30 days. No personal data is collected and/or stored by the cookies.

6.5 Erasure

You can, at all times, revoke conversion tracking with future effect, or deactivate the function in your device’s browser. https://www.google.com/settings/u/0/ads/authenticated https://support.google.com/ads/answer/2662922?hl=de You can also completely prevent the installation of cookies by selecting the appropriate setting in your browser. The use of our website and services is then, however, perhaps only possible to a limited extent.

7. Google AdSense

7.1 Description and scope of the data processing

We use the online service Google AdSense, which facilitates the placement of advertising on third-party websites. Through this service, the ads displayed on third-party websites are selected according to the content of the respective third-party website by means of an algorithm, which enables an interest-based approach of visitors to the website. When you visit our websites, Google AdSense sets a cookie on your device, allowing the service provider to analyze how you use our websites. Every time you visit one of our websites, the AdSense cookie automatically causes your device’s browser to submit personal data to Alphabet Inc. for online advertising and commission invoicing purposes. Data is used to track visitor origin and clicks, and subsequently to enable commission invoicing. The data collected by the cookie, to the extent necessary to capture the ads displayed and enable invoicing, is transferred to Alphabet Inc. in the United States of America, stored and, if necessary, passed on to third parties. Google AdSense is explained in more detail here: https://www.google.de/intl/de/adsense/start/.

7.2 Purpose

The purpose of the Google AdSense component is to integrate interest-based advertising into third-party websites in order to earn advertising revenue through commission fees.

The legal basis for the collection and transmission of data is the consent given by you at the start of your visit to our websites pursuant to Art. 6 para. 1 sent. 1 lit. a) GDPR.

7.4 Storage period

The data is deleted after a maximum of 18 months.

7.5 Revocation and erasure

You can, at all times, revoke the use of cookies with future effect, or deactivate the function in your device’s browser. You can, at any time, permanently revoke the use of cookies with future effect. You can access the deactivation function via the following links, and following the instructions given there: https://www.google.com/settings/u/0/ads/authenticated https://support.google.com/ads/answer/2662922?hl=de. Alternatively, you can deactivate use of cookies from third parties by bringing up the deactivation page on the network advertising initiative: https://www.networkadvertising.org/choices/ and using the opt-out function there. You can also prevent the installation of cookies by selecting the appropriate setting in your browser. The use of our website and services is then, however, perhaps only possible to a limited extent. More information on data protection and cookies for advertising in Google AdSense can be found in Google’s data protection declaration, especially under the following links: https://www.google.de/policies/privacy/partners/ https://www.google.de/intl/de/policies/technologies/ads.

8. DoubleClick

8.1 Description and scope of the data processing

We have integrated DoubleClick by Google into our websites. When you are active on our websites, DoubleClick by Google transmits data to the DoubleClick server, which in turn triggers a cookie request in your browser. If your browser accepts the request, DoubleClick sets a cookie on your device. DoubleClick cookies contain no personally identifiable information. Instead they contain a cookie ID which is needed, for example, to display ads on the website and, at the same time, track which ads have already been displayed to avoid duplication. In addition, it is useful for tracking conversions for commission invoicing, for example if a DoubleClick ad was served to you and you then go to shop on the advertiser’s website from the same browser. Every time the website is accessed, DoubleClick transmits this information to Google for online advertising and invoicing purposes. DoubleClick cookies do not contain any personal information.

8.2 Purpose

The purpose of the cookies is to display interest-based advertising with high conversion rates in order to generate advertising revenue. The cookie is used, among other thing, to serve and display user-relevant ads, as well as to generate reports on advertising campaigns or to improve them. Furthermore, the cookie is used to avoid serving the same ad multiple times and for commission invoicing.

The legal basis for the setting of cookies and the associated data processing is the consent given by you pursuant to Art. 6 para. 1 sent. 1 lit. a) GDPR.

8.4 Storage period

The data is deleted after 26 months.

8.5 Erasure

You can, at all times, revoke the use of cookies with future effect, or deactivate the function in your device’s browser. You can, at any time, permanently revoke the use of DoubleClick-cookies with future effect. You can access the deactivation function via the following links, and following the instructions given there. https://www.google.com/settings/u/0/ads/authenticated?hl=de#display_optout. Alternatively you can deactivate the use of cookies by third parties by calling up the deactivation page of the network advertising initiative: https://www.networkadvertising.org/choices/ and using the opt-out possibilities mentioned there. You can also prevent the installation of cookies by selecting the appropriate setting in your browser. The use of our website and services is then, however, perhaps only possible to a limited extent. For more information on DoubleClick-cookies go to: https://support.google.com/adsense/answer/2839090.

9. Google Tag Manager

9.1 Description and scope

The Offerista Group uses Google Tag Manager on its web pages, a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”), for European users, from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Tag Manager itself, which uses tags, works without cookies and does not collect personally identifiable information.

9.2 Purpose of processing

The Tag Manager triggers other tags, which in turn may collect data under certain circumstances. For these respective third party providers, appropriate explanations can be found in this privacy policy. Google Tag Manager does not use this data itself. The Google Tag Manager only ensures that the usage data required by our partners are passed on to them (see the other data processing operations described in this privacy policy). In some cases, the data is processed on a Google server in the USA. In the event that personal information is transferred to the US, Google has submitted itself to the EU-US Privacy Shield. Google may ask you for permission to share some product data (such as your account information) with other Google products to enable certain features, such as to simplify the addition of new Conversion-Tracking Tags for AdWords. Additionally, the developers from Google review product usage information from time to time to optimise the product further. However, Google shall never share data of this nature without your consent with other Google products.

The legal basis is Article 6 para. 1 S.1 lit. f of the GDPR, based on our legitimate interest in effectively incorporating and managing multiple tags on our website. More information can be found in the Information from Google on the Tag Manager.

9.4 Processing duration

Since the Tag Manager only serves to manage the tags, no personally identifiable information is stored here.

9.5 Erasure

IF YOU HAVE DISABLED OR OTHERWISE DEACTIVATED COOKIES, THIS WILL BE OBSERVED FOR ALL TRACKING TAGS USED WITH THE GOOGLE TAG MANAGER, THE TOOL WILL NOT CHANGE YOUR COOKIE SETTINGS.

10. Contact form and Email contact

10.1 Description and scope

On our websites, we can be contacted via the email address provided. In this case, the personal data transmitted via your email will be stored. In this context, data is not disclosed to third parties.

10.2 Purpose of processing

The data is used exclusively to process the conversation.

The legal basis for the data processing is the consent given by you pursuant to Art. 6 para. 1 sent. 1 lit. a) GDPR.

10.4 Processing duration

The data will be deleted as soon as it is no longer necessary for the purposes for which it was collected. This is the case when the respective conversation with you comes to an end i.e. when it can be inferred from the circumstances that the relevant facts have been conclusively clarified.

10.5 Erasure

You can object to the storage of your personal data at any time by sending an email to privacy@offerista.com. In such cases, personal data stored in the course of making contact will be deleted.

10. Notes exclusively for prospecto.hu

11.1 Location data

11.1.1 Description and scope of the data processing

After opening the website you will be asked whether we may determine your location. You can agree or decline. If you agree your location will be determined using a positioning service. By doing so, you may give the following consent: “Allow this website to access your location?” If you decline you can enter your location manually. If you have reached our website by clicking on a banner on a third-party site, we will determine your approximate location based on your truncated IP address.

11.1.2 Purposes of data processing

In order to be able to show you offers and prices in your vicinity we need your location. Without the localization of your location - either via manual input of your location or via automatic location determination - you will only be able to make limited use of the services offered on our websites.

The legal basis for processing location data is the consent given by you pursuant to Art. 6 para. 1. sent. 1 lit. a) GDPR.

11.1.4 Storage period

Data is stored for a period of three years, and is deleted if consent is revoked.

11.1.5 Objection and erasure

You can deactivate automatic location detection at any time as follows. “Auto-location” button/”Never forward location to this website”

11.2. Offerista tracking tool

11.2.1 Description and scope of the data processing

We use a tracking tool to collect data on your usage behaviour. To do so we use what is called a cookie. This is a small text file that we place in your browser. We collect the following data: Actions performed

11.2.2 Purposes of data processing

We use this data to analyze and evaluate the functionality of our websites, to deliver interest-based advertising, and to invoice our advertising clients.

The legal basis is our interest in generating advertising revenue pursuant to Art. 6 para. 1 sent. 1 lit. f) GDPR. This interest is overriding, as we provide our service free of charge and finance ourselves through advertising revenue.

11.2.4 Storage period

We erase the data a maximum of 12 months after it is collected.

12. Advertisers’ pixels

In advertising materials (brochures etc.) served on our portals, pixels from the respective retailer or service provider may be integrated. Pixels capture, for example, how often a brochure is clicked on. This information is forwarded to the respective retailer. To do so, IP addresses are processed exclusively in truncated and therefore anonymous form. It is therefore impossible to identify individuals personally from this information. The advertiser is responsible for the anonymous processing of the data. The point of contact for users remains Offerista.

13. Social Media

13.1 Social-Media-Presence

We are represented in the following social networks with social media presence and are available to you: • Facebook | (Data protection statement)Instagram | (Data protection statement)Xing | (Data protection statement) • LinkedIn | (Data protection statement)YouTube | (Data protection statement) Our presence on Facebook in particular, is operated under shared responsibility with Facebook Ireland Ltd., 4 Grand Canal Square, D2 Dublin, Ireland (“Facebook”). On the social media platforms we inform you about the latest news and take advantage of the possibilities of the social networks to communicate with their members and our users directly and provide information about our products and services. However, please note that we have a low level of influence on data processing through the social networks. If you visit a social media page, your data can also be distributed to countries outside the European Union that have a lower data protection level than in the European Union (e.g. USA). Therefore, carefully check which personal information and messages you share on social networks and in case of doubt, please use other forms of contact that we have provided. We can use the networks to obtain statistics on the use of our social media presence (e.g. information on the number of views, names of users, interactions such as likes and comments and aggregated demographic and other information or statistics). (The legal basis is Article 6 para. 1 clause 1 b) of the GDPR if we obtain and process your data within the framework of a specific inquiry on our presence on social media as well as Article 6 para. 1 clause 1 f) of the GDPR based on our aforementioned legitimate interests, if data processing concerns the creation of the mentioned statistics. More information on the type and scope of these statistics with regard to Facebook can be found in Facebook-Page Statistics-Notes.. Statistics-Notes. Further information on the respective responsibilities can be obtained from Facebook-Page-Insights-Add-on. Provided we obtain your personal data within the framework of our social media offer, you are entitled to exercise the rights listed below in Section E of this data protection statement. Furthermore, if you want to enforce your rights towards the social media provider, the easiest option is to contact the respective provider directly. The provider will be aware of the details of the technical operation of his/her platform as well as the specific data processing purposes and can implement appropriate measures upon request if you exercise your rights. The contact details can be found in the data protection notices linked above. We will also help you with the enforcement of your rights if it is possible for us and will forward your queries to the respective provider. You can use the contact details listed above in section A, under II. for this purpose.

13.2 Social-Media-Plug-ins

We have embedded functions of the respective social networks on our website (so-called plug-ins). If you use these functions to share or comment on the linked content, a direct connection will be established to the servers of the respective social networks. We embedded the functions of the social networks so that the networks only receive the information accessed on our website once you actually interact with the respective social plug-in and not when you first access our page. If you logged into the respective social network with your user name and password while interacting with the respective social plug-ins, information regarding your visit to our page is transmitted to the plug-in and the respective provider can allocate this information to your user account. If you interact with the social plug-in, i.e. you use the Facebook “Like” or Twitter “Tweet This” function for example, the contents of our pages will then be linked and shared with your Facebook or Twitter profile. If you are not a member of the respective social networks or logged out from the provider prior to visiting our website, it is still possible for your IP address to be transmitted and saved if you interact with the respective social plug-ins. Please note that the content and scope of the data that is directly collected and transmitted by the social networks via the social plug-ins as well as the storage duration of up to 250 days and the intended purpose is explicitly determined by the respective providers. We have no influence on this transmission of information. Please obtain further information from the data protection notices of the provider linked above. The legal basis of the inclusion of social plug-ins is Article 6 para. 1, clause 1 f) of the GDPR based on our legitimate interest in the provision of the aforementioned social network functions.

13.3 LinkedIn Analytics and LinkedIn Ads

We use conversion tracking technology and the retargeting feature of the LinkedIn corporation on our website. By using this technology, visitors to this website can receive personalised advertisements on LinkedIn. There is also an opportunity to create anonymous reports about the performance of these advertisements as well as information about website interaction. The LinkedIn Insight Tag is thus incorporated into this website, establishing a connection with the LinkedIn server when you visit this website while logged into your LinkedIn account at the same time. For more information on the collection and use of data by LinkedIn, and about your rights and options to protect your privacy, please refer to the data protection provisions of LinkedIn at https://www.linkedin.com/legal/privacy-policy. If you are logged into LinkedIn, you can deactivate data collection at any time by clicking on the following link: https://www.linkedin.com/psettings/enhanced-advertising.

The legal basis for using Hubspot services is Article 6 I f DS-GDPR – legitimate interest. Our legitimate interest in using this service is to optimise our marketing measures and improve the service quality on our website.

14. Hubspot

We use HubSpot for our online marketing activity on this website. HubSpot is a software company from the USA with a subsidiary in Ireland. Contact: HubSpot 2nd Floor 30 North Wall Quay Dublin 1- Ireland Tel.: +353 1 5187500

14.1 Description and scope of data processing

This involves an integrated software solution with which we cover various aspects of our online marketing. These include, among others: email marketing (newsletters as well as automated mailings such as providing downloads), social media publishing & reporting, reporting (e.g. traffic sources, access, etc.), contact management (e.g. user segmentation & CRM), homepages and contact forms.

14.2 Purpose of data processing

We also use HubSpot’s “Messages” live chat service for sending and receiving messages on certain sub-sites to improve the user experience of our website (round chat icon on the bottom right-hand side of the screen). Upon agreeing to and using this feature, the following data will be transferred to the HubSpot server: The content of all chat messages sent and received Context information (e.g. the page on which the chat was used) Optional: Email address of the user (if provided by the user via the chat feature)

The legal basis for using Hubspot services is Article 6 I f DS-GDPR – legitimate interest. Our legitimate interest in using this service is to optimise our marketing measures and improve the service quality on our website. HubSpot is certified under the conditions of the “EU – U.S. Privacy Shield Framework” and is governed by the TRUSTe Privacy Seal as well as the “U.S. – Swiss Safe Harbor” framework. More information about HubSpot’s privacy policy More information about HubSpot regarding the EU General Data Protection Regulations More information about the cookies used by HubSpot If you prefer HubSpot not to collect data about you, you can deactivate the use of cookies at any time by changing your browser settings or clicking on the following opt-out link: Opt-out link.

14.4 Storage duration

Data will be stored for a maximum period of 13 months and duly deleted at your request providing no other obligations to store this data exist. “Data will be stored for a maximum period of 13 months and duly deleted at your request.

15. Offerista Engage

As “Offerista Engage”, we provide partners participating in the Google advertising network with interactive flip catalogues. When the adverts are displayed, we perform success tracking using so-called "tracking pixels" to collect the following data: – Action performed in the advert – Session ID – Server access logs with typical browser data (user agent, URL call, IP address (anonymised), referrer and time). The purpose is to display interest-based adverts via the Google advertising network on third-party websites for the purpose of generating advertising revenue. The legal basis for data processing is the consent granted by you prior to using the website into which “Offerista Engage” is incorporated, pursuant to Art. 6 para. 1 sentence 1 b) GDPR. The data will be deleted after 24 months at the latest.

E Rights of data subjects

If your personal data is processed, you are the data subject within the meaning of the GDPR, and you have the following rights with regard to the data controller.

1. Right of access

You have the right to obtain information from the data controller about the extent to which we are processing your personal data. If processing is taking place, you can ask the data controller for the following information: (1) the purposes for which personal data is processed; (2) the categories of personal data processed; (3) the recipients or categories of recipients to whom your personal data has been or will be disclosed; (4) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; (5) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning you, the data subject, or to object to such processing; (6) the right to lodge a complaint with a supervisory authority; (7) where the personal data was not collected from you, any available information as to its source; (8) the existence of automated decision-making, including profiling, pursuant to Art. 22 paras. 1 and 4 GDPR and meaningful information on the logic involved as well as the significance and the envisaged consequences of such processing for you. You also have the right to be informed whether your personal data has been transferred to a third country or to an international organization. If this is the case, you have the right to be informed of the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.

2. Right to rectification

You have a right to request the rectification and/or completion of your personal data by the data controller if the personal data being processed is incorrect or incomplete. The data controller must make the rectification without delay.

3. Right to restriction of processing

Under the following conditions, you may request the restriction of processing of your personal data: (1) if you contest the correctness of your personal data for a period of time that enables the data controller to verify the correctness of the personal data; (2) if the processing is unlawful, you decline your right to the erasure of your personal data and instead demand that the use of your personal data be restricted; (3) if the data controller no longer needs your personal data for the purposes of processing, but you need it to establish, exercise or defend legal claims, or (4) if you have filed an objection to the processing of your personal data pursuant to Art. 21 para. 1 GDPR and it is not yet clear whether the legitimate grounds of the data controller outweigh your own grounds. If the processing of your personal data has been restricted, such data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. If the processing of your personal data has been restricted pursuant to the above conditions, you will be notified by the data controller before the restriction is lifted.

4. Right to erasure

4.1 Obligation to erase

You may require the data controller to promptly erase your personal data if any of the following conditions are met: (1) if your personal data is no longer necessary for the purposes for which it was collected or otherwise processed; (2) if you revoke your consent to the processing of personal data pursuant to Art. 6 para. 1 sent. 1 lit. a) or Art. 9 para. 2 sent. 2 lit. a) GDPR and there is no other legal basis for processing; (3) if you lodge an objection to the processing of your personal data pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate reasons for processing, or you lodge an objection against the processing of your personal data pursuant to Art. 21 para. 2 GDPR; (4) if your personal data has been unlawfully processed; (5) if your personal data has to be erased for compliance with a legal obligation in Union or Member State law to which the data controller is subject; (6) if your personal data was collected in relation to the information society services offered pursuant to Art. 8 para. 1 GDPR.

4.2 Information to third parties

In the event that the data controller has made your personal data public and is obliged to erase your personal data pursuant to Art. 17 para. 1 of the GDPR, then the data controller will take the appropriate measures to inform other data processors involved in processing the disclosed personal data that you have requested the erasure of all links to your personal data, as well as the erasure of all copies or replications of your personal data. Such measures include measures of a technical nature, taking into account the available technology and the implementation costs.

4.3 Exceptions

You do not have the right to erasure if processing of your data is necessary (1) to exercise the right to freedom of expression and information; (2) to fulfil a legal obligation requiring the data to be processed under the law of the Union or the Member States to which the data controller is subject, or to perform a task in the public interest, or in the exercise of official authority vested in the data controller; (3) for reasons of public interest in the field of public health pursuant to Art. 9 para. 2 lit. h) and i) and Art. 9 para. 3 GDPR; (4) for archival purposes in the public interest, for scientific or historical research purposes, or for statistical purposes pursuant to Art. 89 para. 1 GDPR, insofar as the law referred to in Section A is likely to render impossible or seriously prejudice the achievement of the objectives of such processing, or (5) for the establishment, exercise or defence of legal claims.

5. Right to information

If you have asserted your right to rectification, erasure or restriction of processing with regard to the data controller, the data controller shall communicate any rectification or erasure of personal data or restriction of processing carried out to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort. With regard to the data controller, you have a right to be informed about these recipients.

6. Right to data portability

You have the right to receive the personal data you made available to the data controller in a structured, common and machine-readable format. In addition, you have the right to transmit this data to another data controller without hindrance from the data controller to which the personal data has been provided, insofar as (1) processing is based on consent provided pursuant to Art. 6 para. 1 sent. 1 lit. a) GDPR or Art. 9 para. 1 lit. a) GDPR, or on a contract pursuant to Art. 6 para. 1 sent. 1 lit. b) GDPR, and (2) processing is carried out by automated means. Furthermore, when exercising this right, you have the right to have the personal data transmitted directly from one data controller to another, where technically feasible. This should not affect the rights and freedoms of other persons. The right to data portability does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.

7. Right to object

You shall have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6 para. 1 sent.1 lit e) or f), including profiling based on those provisions. The data controller shall no longer process your personal data unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims. Where your personal data is processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where you object to processing for direct marketing purposes, your personal data shall no longer be processed for such purposes. You are also free to exercise your right to object to the use of the data for services provided by information societies by means of automated procedures using technical specifications.

You have the right to revoke your consent to data processing at any time. The revocation of consent does not affect the legality of processing carried out prior to the revocation on the basis of your consent.

9. Automated decision-making in individual cases including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision (1) is necessary for the conclusion or performance of a contract between you and the data controller, (2) is permitted by Union or Member State legislation to which the data controller is subject, and where such legislation contains appropriate measures to safeguard your rights and freedoms and legitimate interests, or (3) is made with your express consent. However, these decisions must not be based on particular categories of personal data pursuant to Art. 9 para. 1 GDPR unless Art. 9 para. 2 lit a) or g) applies, and appropriate measures have been taken to protect your rights and freedoms and/or legitimate interests. In the cases referred to in points (1) and (3), the data controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR. The supervisory authority to which the complaint has been submitted shall inform the complainant of the status and results of the decision, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.