- Updated August 2026 -

We place great importance on protecting your personal data when you visit our websites. Your data is protected in accordance with statutory provisions. 

In the following, we would like to inform you about the type and scope of processing of personal data via this website in accordance with Article 13 of the General Data Protection Regulation (GDPR).

The following information provides an overview of how your personal data is handled when you visit this website. Personal data comprises all information that can be used to personally identify you. Here you will find detailed information concerning data protection.

Overview

1. Scope

2. Controller

3. Data protection officer

4. General data processing

5. Customer and contract data

6. Contact

7. Recipients of personal data

8. Processor

9. Hosting

10. Applicant management

11. Cookies

12. External web services and analytics

13. Social media

14. Your rights

15. Supervisory authority complaints office

1. Scope

The following information applies to website offerings of all listed companies in our Group. In general, these companies can be accessed online using the following URLs:

https://www.sag-gruppe.de/de/

https://www.sag1833.de/de/

https://www.ssf.de/de/

https://www.eccos-pro.com/de/ 

http://www.novacom.at 

2. Controller

The controller for data processing on our websites is:

Schulte-Schlagbaum AG
Nevigeser Str. 100-110
42553 Velbert, Germany
Telephone: +49 (0)2051 / 20 86-0
Email: sag(at)sag-schlagbaum.com

The controller is the natural or legal person that individually or jointly with others determines the purpose and means of processing of personal data (e.g. names, email addresses, etc.).

3. Data protection officer

We have appointed a data protection officer, who will be happy to answer any questions you may have about the protection of data in terms of operational data protection:

Schulte-Schlagbaum AG data protection officer:

Sascha Hasselbach
c/o EDV-Fortress
Kronprinzstr. 47-49
40764 Langenfeld
www.datenschutz-extern-nrw.de
Email: datenschutz(at)sag-schlagbaum.com

4. General data processing

The controller of these website takes the protection of your personal data very seriously.
We use your personal data confidentially and in compliance with statutory data protection regulations and this privacy policy.

Data types
When you use these websites, different types of personal data are collected. Personal data comprises information that can be used to personally identify you. This privacy policy serves to explain

• which data we collect
• how we use the data
• in what way and for what purpose this takes place.

Please note that data transmission via the Internet (e.g. when communicating by email) may be subject to security vulnerabilities. Complete protection of data from third-party access is not possible.

How do we collect your data?
We collect some data when you provide us with this information. This could be data that you enter in a contact form, for example.

Other data is collected automatically or with your consent by our IT systems when you visit the website. This primarily includes technical data (e.g. Internet browser, operating system or time of access of the website). This data is automatically collected as soon as you as you enter this website.

How we use your data
Part of the data is collected to ensure problem-free availability of our website. Other data may be used to analyse your user behaviour. If the website provides for the conclusion of contracts, the data transmitted may also be processed for contract proposals, orders or other offer-related enquiries.

Retention period
Unless a more specific retention period has been stipulated in this privacy policy, your personal data will remain with us until the purpose for processing the data no longer applies. If you assert a justified request for deletion or withdraw consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, the data will be deleted once these reasons no longer apply.

SSL or TLS encryption
For security reasons and for protecting confidential content, this website uses SSL or TLS encryption, for instance for orders or enquiries you send to us as the website operator. You can recognise an encrypted connection in your browser’s address line by the fact that it changes from ‘http://’ to ‘https://’ and by the lock symbol in your browser’s address bar.

If SSL or TLS encryption is enabled, the data you transfer to us cannot be read by third parties.

Legal basis for data processing on this website
If you have consented to the processing of data, we will process your personal data on the basis of Article 6(1)(a) GDPR or Article 9(2)(a) GDPR to the extent that particular data categories pursuant to Article 9(1) GDPR are processed. 

If you have given express consent to the transmission of personal data to third countries, the processing of data is also carried out on the basis of Article 49(1)(a) GDPR. 

If you have agreed to the storing of cookies or accessing of information on your terminal device (e.g. via device fingerprinting), the processing of data is also carried out on the basis of Section 25 para. 1 of the German Telecommunications Digital Services Data Protection Act (TDDDG). 

This consent can be withdrawn at any time. 

If your data is necessary for the fulfilment of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Article 6(1)(b) GDPR. Furthermore, we process your data insofar as this is necessary for the fulfilment of a legal obligation, pursuant to Article 6(1)(c) GDPR. We may also process data on the basis of our legitimate interest in accordance with Article 6(1)(f) GDPR. 

The following sections in this privacy policy provide information on the relevant legal bases in each case.

5. Customer and contract data

We process personal data only where this is necessary for the establishment, implementation or amendment of a contract (master data). The legal basis for this is Article 6(1)(b) GDPR.
We process data about the use of our websites (usage data) only where this is necessary to enable use of the sites or for billing.
The collected customer data will be deleted after completion of the order or termination of the business relationship. Statutory retention obligations remain unaffected.

6. Contact

You can contact us via telephone, fax, email or one of the contact forms provided on our websites.

Enquiry by email, telephone or fax
If you contact us by email, telephone or fax, your enquiry including all resulting personal data (name, enquiry) will be stored and processed by us for the purpose of processing your request. We do not disclose this information without your consent.

The processing of this data is based on Article 6(1)(b) GDPR insofar as your request is related to the fulfilment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of the enquiries addressed to us (Article 6(1)(f) GDPR) or on your consent (Article 6(1)(a) GDPR) if this has been requested; consent can be withdrawn at any time.

The data you send to us via contact requests will remain with us until you request us to delete it, withdraw your consent to store it or the purpose for storing the data no longer applies (e.g. after we have completed processing your request). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

7. Recipients of personal data

As part of our business we collaborate with various external parties. This may also necessitate the transmission of personal data to these external parties. We only disclose personal data to external parties where this is necessary within the scope of fulfilment of a contract, insofar as we are obliged to do so by law (e.g. forwarding of data to tax authorities), insofar as we have a legitimate interest according to Article 6(1)(f) GDPR in forwarding such data or insofar any other legal basis allows for the sharing of data. 

8. Processor

When using processors, we disclose the personal data of our customers exclusively on the basis of a valid data processing agreement in accordance with Article 28 GDPR. In the event of joint processing in accordance with Article 26 GDPR, a contract on joint processing is concluded.

9. Hosting

Our websites are hosted by an external provider.

Provider details
The provider is Mittwald CM Service GmbH & Co. KG, Königsberger Strasse 4-6, 32339 Espelkamp (hereinafter Mittwald).

The use of Mittwald is based on Article 6(1)(f) GDPR. We have a legitimate interest in presenting our website in the most reliable manner possible. Insofar as the relevant consent has been requested, the processing is carried out exclusively pursuant to Article 6(1)(a) GDPR and Section 25 para. 1 TDDDG, provided this consent includes the storing of cookies or accessing of information on the user’s terminal device (e.g. device fingerprinting) in line with TDDDG. This consent can be withdrawn at any time.

For details, see Mittwald’s privacy policy at https://www.mittwald.de/datenschutz

Server log files
The website provider automatically collects and stores information in server log files, which your browser automatically transmits to us. These are:

• Browser type and browser version 
• Operating system used 
• Referrer URL
• Host name of the accessing computer 
• Time of server request
• IP address

This data is not combined with data from other sources.

The collection of this data is based on Article 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website – for this purpose, the server log files must be recorded.

Commissioned data processing
We have concluded a data processing agreement (DPA) with our Internet provider shetani OHG on the use of the abovementioned service. This is a legally required contract which ensures that the provider processes the personal data of visitors to our website exclusively according to our instructions and in compliance with the GDPR.

10. Applicant management

We provide you with the opportunity to apply for a job with us (e.g. by email, by post or via our online application form). In the following, you will find details about the scope, purpose and use of your personal data collected as part of the application procedure. We assure you that the collection, processing and use of your data takes place in compliance with existing data protection legislation and all other statutory provisions and that your data will be handled strictly confidentially.

Personal data as part of the application process
Personal data comprises all information relating to an identified or identifiable natural person (Article 4(1) GDPR). In particular, this includes details such as your name, your address, your telephone number and your date of birth.

Information about your career, qualifications or any other details that can be assigned to you with reasonable effort are also considered personal data.
However, information that cannot or can no longer be assigned to a specific person is not considered personal data.

Bases for and purposes of processing during the application procedure
If you apply for a job with us, we process your personal data for implementation of the application procedure and initiation of employment.

The legal basis for this is Section 26 of the Federal Data Protection Act (BDSG) (initiation of employment), Article 6(1)(b) GDPR (general grounds for a contract) and – insofar as you have given consent – Article 6(1)(a) GDPR. This consent can be withdrawn at any time. Your personal data will be disclosed within our company exclusively to persons involved in the processing of your application.

By sending your application, you declare your interest in pursuing a job in our company. The data submitted by you will be used exclusively for the processing of your application.

Collected data
As part of the application procedure, the following data in particular may be processed:

• Name (first name and surname)
• Email address
• Telephone number (optional)
• LinkedIn profile (optional)
• Salary expectation (optional)
• Earliest start date or notice period (optional)
• Gender (optional)
• Domicile (optional)
• Information about a valid work permit (optional)
• Details on how you became aware of us (optional)

In addition, you can upload application documents such as a covering letter, CV and certificates. These generally include additional personal data such as your date of birth, address or certificates.

We may also perform an Internet search about you as part of the application procedure. This primarily includes Google, LinkedIn and Xing searches. The legal basis for this type of processing is our legitimate interest in gaining a general impression of you via publicly accessible sources in accordance with Article 6(1)(f) GDPR.

Access and purpose
Access to your data will be granted exclusively to authorised employees in our personnel department as well as to persons involved in the application procedure.
Your data will be processed exclusively for the purpose of filling the post you applied for.

Retention period
Your personal data will as a rule only be stored for the duration of the application procedure.

If we are unable to offer you a position, you decline a job offer or you withdraw your application, we retain the right to store the data you submitted on the basis of our legitimate interest (Article 6(1)(f) GDPR) for up to six months from the point in time at which the application procedure is terminated (rejection or withdrawal of the application). Thereafter, the data will be deleted and all physical application documents destroyed. The main reason for retaining data is for purposes of evidence in the event of a legal dispute. Insofar as it becomes apparent that the data will be required after expiry of the six-month period (e.g. due to a possible or pending legal dispute), the data will only be deleted once the reason for continued retention no longer applies.

A longer retention period may also apply if you have given the relevant consent (Article 6(1)(a) GDPR) or if the data may not be deleted due to statutory retention obligations.

After expiry of this period, your data will be deleted or anonymised. Your information will then only be available in an anonymised format for statistical evaluations (e.g. number of applications or gender distribution).

Talent pool
If we do not offer you employment, we may include you in our talent pool. In this case, all documents and details relating to the application are transferred to the talent pool so that we can contact you in the event of matching vacancies.

We will only include your data in the talent pool based on your explicit consent (Art. 6(1)(a) GDPR). Granting consent is voluntary and does not affect the application procedure already initiated. The applicant can withdraw their consent at any time. In this case, the data will be permanently deleted from the talent pool, provided there are no statutory data retention requirements.

The data from the talent pool will be permanently deleted at the latest two years following the granting of consent.
In this case, your data will be stored for a maximum of 18 months, after which it will be deleted. You can withdraw your consent at any time for the future (Article 7(3) GDPR).

Formalisation of employment
If you are employed within the scope of the application process, we will migrate your application details to your personnel file.
The data will then be processed for the purpose of employment, pursuant to Section 26 para.1 BDSG.

Disclosure of data to third parties
Your application details are transmitted in an encrypted format (TLS) and stored on a system of our service provider.
For this, we use software from Personio GmbH https://www.personio.de/impressum/). Personio, acting as the processor, processes the data in accordance with Article 28 GDPR.
We have a data processing contract with Personio, which ensures compliance with data protection regulations.

Rights of the data subject
As the data subject, you have the rights outlined in Chapter III of the GDPR. In particular, these include:

• Right to be informed (Article 15 GDPR)
• Right to rectification (Article 16 GDPR)
• Right to erasure (Article 17 GDPR)
• Right to restriction of processing (Article 18 GDPR)
• Right to data portability (Article 20 GDPR)
• Right to objection (Article 21 GDPR)
• Insofar as you have given your consent to data processing, you can withdraw this consent at any time (Article 7(3) GDPR).

To assert your rights, you can contact our Recruiting Team at personal(at)sag-schlagbaum.com

Concluding application provisions
We retain the right to amend this privacy policy as necessary to adapt it to the latest legal requirements or to changes in the application procedure.

If you visit our recruiting site at a later stage or submit a new application, the current version of the privacy policy applies in each case.

11. Cookies

Our website uses so-called cookies. Cookies are small data files, which do not cause any damage to your terminal device. They are stored either temporarily for the duration of a session (session cookies) or permanently (permanent cookies) on your terminal device. Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your terminal device until you delete them yourself or until they are automatically deleted by your web browser.

Types of cookies used and setting options
Cookies may be set by us (first-party cookies) or by third-party companies (third-party cookies). Third-party cookies allow specific services provided by third-party companies to be integrated in websites (e.g. cookies for processing payment services).

Cookies have various functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g. the shopping cart function or the display of videos). Other cookies can be used for analysing user behaviour or for marketing purposes.

Cookies that are necessary to carry out the electronic communication process or to provide certain functions that you have requested (e.g. for the shopping cart function) or to optimise the website (e.g. cookies to measure the web audience) – referred to as essential cookies – are stored pursuant to Article 6(1)(f) GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing essential cookies to ensure optimised provision of its services free of technical errors. If consent to storing cookies and similar recognition technologies has been requested, the data processing is based exclusively on this consent (Article 6(1)(a) GDPR and Section 25 para. 1 TDDDG); consent can be withdrawn at any time.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general and activate automatic deletion of cookies when you close the browser. Deactivating cookies may limit the functionality of this website.

Insofar as we use additional cookies and services on this website, you can find more information under ‘Cookie management’.

Cookie management
We use a tool from service provider Usercentrics for managing cookies.
You can find more information on this provider in section 12 (External web services and analytics).

Essential cookies
These cookies are essential for the operation of our website and enable security functions, for example.

Statistics/analysis tool
In order to improve our offerings and our website, we collect anonymised data for statistics and analyses. For example, these cookies allow us to calculate the number of visitors, determine the effect of certain pages of our website and improve our content.

Third-party cookies
In some cases, these cookies are placed on your computer by third-party providers and are used to provide useful information, such as Google Maps.

Services

Matomo (self-hosted)

Usercentrics Consent Management Platform

SalesViewer

12. External web services and analytics

When visiting this website, your browsing behaviour may be statistically analysed. This is done mainly with so-called analytics software.

Detailed information on this analytics software can be found in the following privacy policy.

Matomo
This website uses the open analytics platform Matomo.

Matomo enables us to collect and analyse data on the use of our website based on website visitors. This allows us to determine, among other things, when which pages were visited and from which region. We also record various log files (e.g. IP address, referrer, the browser and operating system used) and can measure whether visitors to our website perform certain actions (e.g. clicks, purchases, etc.).

Cookieless analytics
We have configured Matomo in such a way that it does not save any cookies in your browser.

Hosting
We host Matomo exclusively on our own servers to ensure that all analytics data remains with us and is not forwarded.

Legal basis
The use of this analysis tool is based on Article 6(1)(f) GDPR. The website operator has a legitimate interest in the analysis of user behaviour to ensure optimisation of its web content and its advertising. Insofar as the relevant consent has been requested, the processing is carried out exclusively pursuant to Article 6(1)(a) GDPR and Section 25 para. 1 TDDDG, provided this consent includes the storing of cookies or accessing of information on the user’s terminal device (e.g. device fingerprinting) in line with TDDDG. This consent can be withdrawn at any time.

Usercentrics: Managing your cookie consent 
This website uses consent technology from Usercentrics to obtain your consent to store certain cookies on your terminal device or to document this in a data protection compliant manner. The provider of this technology is Usercentrics GmbH, Sendlinger Strasse 7, 80331 Munich, Website: https://usercentrics.com/de/ .

When you access our website, the following personal data is transmitted to Usercentrics:

Your consent or withdrawal of your consent

• Your IP address
• Information about your browser 
• Information about your terminal device 
• Time you visited the website 
• Geolocation

Furthermore, Usercentrics stores a cookie in your browser to enable you to give or withdraw consent. The data collected will be stored until you request us to delete it or you delete the Usercentrics cookie yourself, or until the purpose for storing the data no longer applies. Mandatory data retention obligations remain unaffected.

Legal basis
Usercentrics is used to obtain consent for the use of certain technologies as required by law. The legal basis for this is Article 6(1)(c) GDPR.

Commissioned data processing
We have concluded a data processing agreement (DPA) with our Internet provider shetani OHG on the use of the abovementioned service. This is a legally required contract which ensures that the provider processes the personal data of visitors to our website exclusively according to our instructions and in compliance with the GDPR.

SalesViewer
We have integrated SalesViewer on this website. The provider is SalesViewer / SalesViewer GmbH, Hueststr. 30, 44787 Bochum (hereinafter ‘SalesViewer’).

SalesViewer enables us to record visits to our website by other companies. To this end, the IP address of the website visitor is compared to the company IP addresses stored in the SalesViewer database. If the IP address belongs to a company, the visit and the user behaviour are recorded. IP addresses that are not listed in the SalesViewer database are immediately deleted again, so that website visits by private individuals are ignored by SalesViewer.

For enhanced data protection, SalesViewer offers an opt out procedure. You can find more details under the provider’s link below:
https://www.salesviewer.com/de/opt-out/.

Legal basis
The use of SalesViewer is based on Article 6(1)(f) GDPR. The website operator has a legitimate interest in recording visits to our website by companies and their user behaviour. Insofar as the relevant consent has been requested, the processing is carried out exclusively pursuant to Article 6(1)(a) GDPR and Section 25 para. 1 TDDDG, provided this consent includes the storing of cookies or accessing of information on the user’s terminal device (e.g. device fingerprinting) in line with TDDDG. This consent can be withdrawn at any time.

You can find more details in the provider’s privacy policy at https://www.salesviewer.com/de/plattform/datenschutz/.

Commissioned data processing
We have concluded a data processing agreement (DPA) on the use of the abovementioned service. This is a legally required contract which ensures that the provider processes the personal data of visitors to our website exclusively according to our instructions and in compliance with the GDPR.

13. Social media

We operate web presences used for business purposes on various social media portals. LinkedIn, Instagram and YouTube are linked to in our website footers. We also operate a Facebook page and a Xing company profile.

Operators and providers
Besides enabling us to communicate directly with you, the portal providers of these portals provide us with statistical analyses and other functions that are based on the data collection by these social media portals. 

In this way, we partly determine the purpose of the data collection, meaning that we carry joint responsibility with the social media operators.

We only have minimal control over the data processing performed by the platform operators. If you do not wish to use social media channels, you can naturally find us and information about us via our own websites.

We as the operator can merely view your public profile. The information available here depends on your profile settings. 

We use these sites to provide information about our company/our facilities and our products and services. Interaction with you as the interested party provides us with direct insight as to how we and our products are perceived in the market, who our customers and interested parties are, and what they are looking for, thus helping us to improve our products and services for you. 

In addition, these portals are quick and easy options to contact us so that you as the interested party can ask us any questions you may have directly from wherever you are on the web. This means we can respond to your needs without delay. 

Responsibility
As a rule, data processing via the social media operators’ platforms is carried out within the framework of the general terms and conditions agreed between you and the platform operators as well as their privacy policies.

Please note that certain information about your visit to some of our social media pages is collected and processed by the provider even if you do not have a user account or have not logged in to one of the platforms with your account.

If you visit one of our social media presences (e.g. Facebook), we are jointly responsible with the social media platform operator for any data processing operations triggered by this visit. As a general rule, you can exercise your rights (information, rectification, erasure, restriction of processing, data portability and complaint) with us and with the relevant social media portal operator (e.g. with Facebook).

Please note that we do not have full control over the data processing operations of the social media portals, despite our joint responsibility with the operators of these social media portals. Our options are largely determined by the corporate policy of the relevant provider.

Retention period
The data collected directly by us via our social media presence is deleted from our systems as soon as you request us to delete it, withdraw your consent to store it, or the reason for storing it no longer applies. Stored cookies remain on your terminal device until you delete them. Mandatory statutory provisions – in particular retention periods – remain unaffected. We have no influence on the retention period of your data that is stored by the operators of the social networks for their own purposes. For details, please contact the operators of the social networks directly.

Instagram
We have an Instagram profile. The provider of this service is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: 
https://www.facebook.com/legal/EU_data_transfer_addendum
https://privacycenter.instagram.com/policy/

Details on how your personal data is handled by this service can be found in Instagram’s privacy policy at https://privacycenter.instagram.com/policy/ 

The company is certified according to the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the US that is intended to ensure compliance with European data protection standards for data processing in the USA. Every DPF-certified company undertakes to adhere to these data protection standards. More information in this regard is available from the provider under the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000GnywAAC&status=Active 

LinkedIn
We have a LinkedIn profile. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn uses marketing cookies.
If you wish to disable LinkedIn marketing cookies, please use the following link:https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

Data transfer to the USA is based on the standard contractual clauses of the EU Commission.
Details can be found here: https://de.linkedin.com/legal/l/dpa? and  https://www.linkedin.com/legal/l/eu-sccs

Details on how your personal data is handled by this service can be found in LinkedIn’s privacy policy at 
https://www.linkedin.com/legal/privacy-policy 

YouTube
We have a YouTube profile. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Details on how your personal data is handled by this service can be found in YouTube’s privacy policy at 
https://policies.google.com/privacy?hl=de

The company is certified according to the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the US that is intended to ensure compliance with European data protection standards for data processing in the USA. Every DPF-certified company undertakes to adhere to these data protection standards.

More information in this regard is available from the provider under the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt000000001L5AAI&status=Active

14. Your rights

Many data processing operations are only possible with your express consent.

You have the right to request information free of charge at any time regarding your stored personal data, its origin, recipients and purpose of its collection. You also have a right to object to data processing and to data portability, and you have a right to file complaints with the relevant supervisory authority. Furthermore, you have the right to request rectification, blocking or erasure of your personal data and – in certain circumstances – restriction of processing.

Right to object to the collection of data in special cases and to direct marketing (Article 21 GDPR)
If data processing is based on Article 6(1)(e) or (f) GDPR, you have the right to object to the processing of your personal data at any time for reasons arising from your particular situation; this also applies to profiling based on these provisions. The relevant legal basis on which processing is based can be found in this privacy policy. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the

processing is for the establishment, exercise or defence of legal claims (objection under Article 21(1) GDPR).

If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is associated with such direct marketing. If you object, your personal data will subsequently no longer be used for the purpose of direct marketing (objection under Article 21(2) GDPR).

Withdrawal of your consent to data processing
You can withdraw your consent with future effect at any time. The lawfulness of the data processed prior to your revocation remains unaffected by the withdrawal of consent.

You have the right to request information free of charge at any time regarding your stored personal data, its origin, recipients and purpose of its collection. You also have the right to have this data corrected or deleted. If you have given your consent to data processing, you can withdraw this consent at any time for the future. You also have the right to request the restriction of the processing of your personal data in certain circumstances. Furthermore, you have a right to file complaints with the relevant supervisory authority.

For this, and with regard to any additional questions concerning data protection, you can contact us at any time.

Right to file complaints with the relevant supervisory authority
In the event of breaches of the GDPR, data subjects have a right of appeal to a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged breach. The right of appeal is without prejudice to any other administrative or judicial remedy.

Right to data portability
You have the right to have data that we automatically process based on your consent or in fulfilment of a contract delivered to you or a third party in a standard, machine-readable format. To the extent that you request direct transfer of data to another controller, this shall only take place where technically feasible.

Information, rectification and erasure
Within the framework of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing and, if applicable, a right to correction or deletion of this data. For this, and with regard to any additional questions concerning personal data, you can contact us at any time.

Right to restriction of processing
You have the right to request the restriction of the processing of your personal data. You can contact us at any time in this regard. The right to restrict processing exists in the following cases:

• If you dispute the accuracy of your personal data stored by us, we will usually need time to verify this claim. For the duration of the review, you have the right to request restriction of the processing of your personal data.
• If the processing of your personal data happened/is happening unlawfully, you can request restriction of data processing instead of erasure.
• If we no longer need your personal data, but you need it to exercise, defend or enforce legal claims, you have the right to request restriction of the processing of your personal data instead of deletion.
• If you have lodged an objection pursuant to Article 21(1) GDPR, a balancing of your and our interests must be carried out. As long as it has not yet been determined whose interests prevail, you have the right to demand restriction of the processing of your personal data.

If you have restricted the processing of your personal data, such data may – apart from being stored – only be processed with your consent or for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or a Member State.

15. Supervisory authority complaints office

Every data subject has a right of appeal to a supervisory authority in accordance with Article 77 GDPR if the processing of personal data concerning the data subject is in breach of the GDPR. The relevant supervisory authority with regard to data privacy matters is the Data Protection Officer of the federal state in which our company has its registered office.

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia

Ms Bettina Gayk
Kavalleriestr. 2-4
40213 Düsseldorf
Telephone: +49 (0) 0211 / 38424-0
Email: poststelle(at)ldi.nrw.de