Privacy policy
Table of contents
I. Privacy policy for the online service „Recognition application service“1. Responsible authorities
1.2. Authority responsible under data protection law in the administrative procedure
3. Rights of data subjects
3.2. Right to rectification
3.3. Right to erasure
3.4. Right to restriction of processing
3.5. Right to data portability
3.6. Right to object to processing
3.7. Right to withdraw consent that has been granted
3.8. Right to lodge a complaint with the data protection supervisory authority
4.2. Visiting the website „Application Service Recognition“ online service
4.3. Electronic applications for the recognition of foreign professional qualifications
4.4. Data processing across various electronic applications
4.4.2 Identification by way of a user account
4.4.3 Transfer of data from the user account to the application
4.4.4 Using the inbox function
4.4.5 Transmission of data to user account
4.4.6 Transmission of submitted applications
4.4.7 Session cookie in the form management system
4.4.8 Session cookie when submitting the application
4.4.9 Transport-Report
4.4.10 Statistik-Report
1. Information on the processing of personal data
2. Collection and storage of personal data
3. Legal basis and purpose of processing
4. Storage duration
5. Use of cookies
6. Rights of the data subjects
This page contains two privacy policies:
Privacy policy concerning the application service for recognition, which is accessible at https://www.berufsanerkennung-antragsservice.de/en.
If you are using the National Feedback Component (NFK):
The privacy policy for the National Feedback Component (NFK).
I. Privacy policy for the online service „Recognition application service“
- which authority is responsible in each case under data privacy law (section 1),
- who you can contact if you have questions on data privacy (section 1), and
- what rights you and other individuals have when your personal data is processed (section 2).
1. Responsible authorities
1.1. Authority responsible under data protection law for the operation of the „Application Service Recognition“ online service
The following authority is responsible under data privacy law for operating the website of the application service for recognition, i.e. for all data processing steps described in section 4.2:
Ministry of Employment, Health and Welfare of the State of North Rhine-Westphalia
Fürstenwall 25
40219 Düsseldorf, Germany
General enquiries can be addressed to the responsible authority in the following ways (for data privacy issues, see section 2):
Phone: +49 (0)211 855-5
Email: poststelle@mags.nrw.de
Enquiries relating to data privacy should be addressed directly to the authority’s Data Protection Officer, whose contact details are provided in section 2.
1.2. Authority responsible under data protection law in the administrative procedure
The competent authority is responsible under data protection law for the administrative procedure for the „recognition of professional qualifications“. The name and contact information of the competent authority can be found in the footer at the bottom of the application form.
2. Data Protection Officer
Contact details of the Data Protection Officer:
Ministry of Employment, Health and Welfare of the State of North Rhine-Westphalia
Data Protection Officer
Fürstenwall 25
40219 Düsseldorf, Germany
Phone: +49 (0)211 855-5
Email: datenschutz@mags.nrw.de
3. Rights of data subjects
Anyone whose personal data is processed by an authority can assert the rights set out below as a data subject by contacting the responsible authority (as defined in section 1).
3.1. Right of access and to obtain a copy
Pursuant to Article 15 General Data Protection Regulation (GDPR), data subjects have the right to obtain confirmation from the authority as to whether the latter is processing personal data concerning them. If that is the case, they can request the information on the data processing stated in Article 15 GDPR. At the request of the data subjects, the responsible authority (as defined in section 1) will provide a copy of the personal data undergoing processing.
3.2 Right to rectification
Pursuant to Article 16 GDPR, data subjects have the right to obtain from the authority the rectification of inaccurate personal data concerning them or to have any incomplete personal data completed by the authority.
3.3. Right to erasure
Pursuant to Article 17 GDPR, data subjects have the right to obtain from the authority the erasure of personal data concerning them if the criteria under Article 17 GDPR are met.
3.4. Right to restriction of processing
Pursuant to Article 18 GDPR, data subjects have the right to obtain from the authority the restriction of processing of personal data concerning them if the criteria under Article 18 GDPR are met.
3.5. Right to data portability
Pursuant to Article 20 GDPR, data subjects have the right to receive from the authority the personal data concerning them in a structured, commonly used and machine-readable format. They have the right to transmit the data to another controller. This applies in each case only where the processing is based on consent or the processing is carried out by automated means.
3.6. Right to object to processing
Pursuant to Article 21 GDPR, data subjects have the right to lodge an objection based on Article 6 (1) Sentence 1 (e) GDPR with the authority, on grounds relating to their particular situation, to processing of personal data concerning them.
The authority will no longer process the personal data unless it can state and, if necessary, prove that the criteria for continuing to process this data are met in accordance with Article 21 GDPR.
3.7. Right to withdraw consent that has been granted
Data subjects may at any time withdraw consent that they have given to the authority for the processing of personal data concerning them in accordance with Art. 7 para. 3 GDPR. The withdrawal of consent is only effective for the future; the processing of personal data that has already taken place on the basis of the consent is not affected by the withdrawal.
If consent is only given for a single processing step, this processing step is carried out and completed immediately after consent is given, and subsequent processing steps are not carried out on the basis of consent, any revocation can no longer have any effect.
3.8. Right to lodge a complaint with the data protection supervisory authority
Data subjects can lodge a complaint at any time about the processing of personal data concerning them by the responsible data protection supervisory authority.
4. How your personal data is processed
Section 4 outlines the individual steps involved in the processing of personal data.
4.1. Technical operation of the application service for recognition
The technical operation of the application service for recognition, and therefore all processing of personal data under this privacy policy, is carried out in full by the State Office for Information and Technology of North Rhine-Westphalia (Landesbetrieb Information und Technik Nordrhein-Westfalen, IT.NRW), Mauerstrasse 51, 40476 Düsseldorf, Germany. IT.NRW acts as processor in each case pursuant to Article 28 GDPR.
Excluded from this is data processing when transmitting submitted applications in accordance with Section 4.4.6. This is carried out by additionally commissioned technical service providers. For this purpose, FITKO (Federal IT Cooperation) AöR, zum Gottschalkhof 3, 60594 Frankfurt am Main, acts as a processor for the Ministry of Employment, Health and Welfare of the State of North Rhine-Westphalia in accordance with Art. 28 GDPR.
4.2. Visiting the website „Application Service Recognition“ online service
Whose personal data is processed? (Categories of data subjects) | Anyone who visits the website of the application service for recognition at https://www.berufsanerkennung-antragsservice.de. |
What categories of personal data are processed? |
|
Why is the data processed? (Purposes of processing) | To ensure the error-free operation of the website „Application Service Recognition“ online service, including troubleshooting and error rectification and safeguarding the intended functionality of the website, as well as defending against and analysing attacks. |
What happens to the personal data? | Personal data is processed using server log files. |
What is the legal basis? | The legal basis for the processing of personal data is Article 6 (1) Sentence 1 (e) GDPR in conjunction with § 8a (1) Sentence 1 of the German Online Access Act (OZG) because the processing is necessary to provide and safeguard the intended functions of the website of „Application Service Recognition“ online service. |
Is there an obligation to disclose this personal data and what are the consequences of not providing the data? | There is no legal obligation to process personal data. However, it is not possible to use the website of „Application Service Recognition“ online service without providing the information. |
How long is personal data stored? | After 48 hours, the server log files are restricted for the purpose of processing to the extent that the data can only be restored from encrypted backups in individual cases upon request. After six weeks, the data is erased from the encrypted backups as well. |
4.3. Electronic applications for the recognition of foreign professional qualifications
You will find information below on the processing of personal data when submitting applications on the application service for recognition.
Whose personal data is processed? (Categories of data subjects) | Applicants or their representatives |
What categories of personal data are processed? |
Some of the categories of personal data referred to above are not required for every application for recognition of a foreign professional qualification. The relevant categories are marked with the addition “if necessary”. If the processing is not required, the fields used to request personal data will not appear in the application service for recognition. For example, it is not necessary to provide contact details for a representative if the applicant completes the application themself. In order for the responsible authority to be able to process the application for recognition of a foreign professional qualification, the requested data must be partly substantiated with supporting documents. The supporting documents are uploaded electronically in the application route in the form of a portable document format (PDF). In addition, a certified translation needs to be uploaded for some supporting documents. If a translation is required, this is indicated in the information fields of the application route. |
Why is the data processed? (Purposes of processing) | The above-mentioned data is processed for the following purposes:
|
What happens to the personal data? | Personal data is recorded electronically in the application service for recognition and cached if necessary to enable the applicant and the representative to complete, correct or delete the electronic application later. The information is then processed for the purpose of the decision on the recognition of foreign professional qualifications during the administrative procedure by the competent authority. |
What ist he legal basis? | The legal basis for the processing is Article 6 (1) Sentence 1 (e) GDPR, Article 9 (2) (g) GDPR in conjunction with § 8a (1), (2), (3) OZG. |
Is there an obligation to disclose this personal data and what are the consequences of not providing the data? | When applying, it is necessary to provide certain data. The application service distinguishes between mandatory and voluntary information. The application cannot be sent without the mandatory information. The application service makes it clear which information is mandatory and which is voluntary. The application does not have to be submitted electronically via the application service for recognition. It may also be submitted by other means of communication or in person. The competent body for the recognition procedure may reject the application as long as the information required for the decision is not available. |
How long is personal data stored? | Saved applications are deleted from the Recognition application service no later than 24 hours after the last change to the application, unless they are sent before then. Once the application has been sent via OSCI/XTA2, the personal data collected for the application will be deleted from the Recognition application service immediately, usually within 10 minutes. If the application is sent via FIT-Connect, the data will be deleted from the IT.NRW systems immediately after successful retrieval by the competent authority. The data is stored in the FITKO system for 7 days after successful retrieval and then deleted. If the retrieval by the competent authority is not successful, the data will be completely deleted from the systems of the technical service providers after a maximum of 21 days. |
4.4. Data processing across various electronic applications
The processing steps described in this section 4.4 are implemented uniformly for all applications that can be submitted electronically using the application service for recognition in. These processing steps are used in the electronic application procedure.
4.4.1 Registration in the personal area for processing the created applications
Whose personal data is processed? (Categories of data subjects) | Applicants or their representatives |
What categories of personal data are processed? |
|
Why is the data processed? (Purposes of processing) | Media seamless login of the applicant or representative to the personal area to be able to assign applications to a user of the application service recognition and to display previously created draft applications and make them available for processing. |
What happens to the personal data? | In case of registration a user account, e.g. BundID, the above personal data is requested and then processed in the Recognition application service if it is stored in the user account. Applicants or their representatives remain free to submit applications by other means to the competent authority. |
What is he legal basis? | The legal basis for the processing is Article 6 (1) Sentence 1 (e) GDPR in conjunction with § 8 (1), (5), (8) OZG. |
Is there an obligation to disclose this personal data and what are the consequences of not providing the data? | The applicants or representatives are not required by law to prove their identity to MAGS NRW by means of a user account. The applicant or representative is still free to submit the application to the body responsible for the recognition procedure by other means. |
How long is personal data stored? | The data is erased from the application service for recognition after the session has been ended. |
4.4.2 Identification by way of a user account
Whose personal data is processed? (Categories of data subjects) | Applicants or their representatives |
What categories of personal data are processed? |
|
Why is the data processed? (Purposes of processing) | Media seamless authentication of the applicant or representative to be able to assign an application to a user of the application service recognition. |
What happens to the personal data? | In the case of identification by way of a user account such as the BundID, the aforementioned data, if stored in the user account, will be requested. The data is retrieved from the authority responsible for maintaining the user account (transmission). |
What is the legal basis? | The legal basis for the processing is Article 6 (1) Sentence 1 (e) GDPR in conjunction with § 8 (1), (5), (8) OZG. |
Is there an obligation to disclose this personal data and what are the consequences of not providing the data? | Applicants or representatives are not required by law to prove their identity to MAGS NRW by means of a user account. However, all applications that can be submitted electronically via the Recognition application service technically require legitimization. The electronic application cannot be completed without legitimization. The applicant or representative is still free to submit the application by other means to the office responsible for the recognition procedure. |
How long is personal data stored? | The personal data will be deleted with the other application data after the application has been sent to the office responsible for the recognition procedure on the Recognition application service. |
4.4.3 Transfer of data from the user account to the application
Whose personal data is processed? (Categories of data subjects) | Applicants or their representatives |
What categories of personal data are processed? |
|
Why is the data processed? (Purposes of processing) | To transfer the aforementioned data of the applicants or their representatives without any media discontinuity in order to pre-fill the application form. |
What happens to the personal data? | If the applicant or representative authenticates themselves using a user account, e.g. BundID, at the start of the application process, the above personal data can be transferred to the respective application. The data can only be transferred if it is stored in the user account. The data is retrieved from the authority responsible for maintaining the user account (transmission). Applicants or their representatives can amend and overwrite all transferred data. |
What is the legal basis? | The legal basis for the processing is Article 6 (1) Sentence 1 (e) GDPR in conjunction with § 8 (1), (5), (8) OZG. |
Is there an obligation to disclose this personal data? | Applicants or their representatives are not required by law to consent to the transfer of data. |
How long is personal data stored? | The personal data will be stored in the application and deleted with the other application data after submission. |
4.4.4 Using the inbox function
Whose personal data is processed? (Categories of data subjects) | Applicants or their representatives |
What categories of personal data are processed? |
|
Why is the data processed? (Purposes of processing) | The data is used to enable contact with applicants or their representatives for the purpose of providing information relating to the application and/or communicating the administrative decision by electronic means. |
What happens to the personal data? | If the inbox is used, the aforementioned personal data is stored in the application service for recognition. The data is also shared with the authority responsible for the recognition procedure. |
What is the legal basis? | The data is processed only with the consent of applicants or the representatives in accordance with Art. 6 (1) Subsection 1 (a) GDPR. |
Is there an obligation to disclose this personal data and what are the consequences of not providing the data? | Applicants or their representatives are not required by law to consent to the use of the inbox function. The authority responsible for the recognition procedure can still contact the applicant or representative by post. |
How long is personal data stored? | Once the application has been sent via OSCI/XTA2, the personal data collected for the application will be deleted from the Recognition application service immediately, usually within 10 minutes. If the application is sent via FIT-Connect, the data will be deleted from the IT.NRW systems immediately after successful retrieval by the competent authority. The data is stored in the FITKO system for 7 days after successful retrieval and then deleted. If the retrieval by the competent authority is not successful, the data will be completely deleted from the systems of the technical service providers after a maximum of 21 days. If the application is not sent, the data is deleted when the Recognition application service is closed. |
4.4.5 Transmission of data to user account
Whose personal data is processed? (Categories of data subjects) | Applicants or their representatives |
What categories of personal data are processed? | The same categories as in the respective application (in accordance with section 4.3). |
Why is the data processed? (Purposes of processing) | The documents relating to the electronic application are sent to a user account to support the applicant and, if applicable, the representative when using the electronic administrative services. |
What happens to the personal data? | Documents relating to the electronic application are sent to a user account by the Recognition Application Service and can be accessed there by the applicant or representative. |
What is the legal basis? | The legal basis for the processing is Article 6 (1) Sentence 1 (e) GDPR, Article 9 (2) (g) GDPR in conjunction with § 8 (6), (9) OZG. |
Is there an obligation to disclose this personal data? | There is no legal obligation to process the data. The application does not have to be submitted electronically via the Recognition application service. It can also be submitted via other communication channels or in person. |
How long is personal data stored? | Once the application has been sent via OSCI/XTA2, the personal data collected for the application will be deleted from the Recognition application service immediately, usually within 10 minutes. If the application is sent via FIT-Connect, the data will be deleted from the IT.NRW systems immediately after successful retrieval by the competent authority. The data is stored in the FITKO system for 7 days after successful retrieval and then deleted. If the retrieval by the competent authority is not successful, the data will be completely deleted from the systems of the technical service providers after a maximum of 21 days. |
4.4.6 Transmission of submitted applications
Whose personal data is processed? (Categories of data subjects) | Applicants or their representatives |
What categories of personal data are processed? | The same categories as in the respective application (in accordance with section 4.3). |
Why is the data processed? (Purposes of processing) | Carrying out the administrative procedure to decide on the respective application. After clicking on the button to send an application, the data will be transmitted by IT.NRW to the authority responsible for data protection (authority responsible for data protection in the administrative procedure in accordance with section 1.2) or, if applicable, to the additionally commissioned technical service provider. |
What happens to the personal data? | After clicking on the button to send an application, the data will be transmitted by IT.NRW to the authority responsible for data protection (authority responsible for data protection in the administrative procedure in accordance with section 1.2) or, if applicable, to the additionally commissioned technical service provider. |
What is the legal basis? | The legal basis for the processing of the aforementioned data is Article 6 (1) Sentence 1 (e) GDPR, Article 9 (2) (g) GDPR in conjunction with § 8 (6), (9), § 8a (1) OZG. |
How long is personal data stored? | Once the application has been sent via OSCI/XTA2, the personal data collected for the application will be deleted from the Recognition application service immediately, usually within 10 minutes. If the application is sent via FIT-Connect, the data will be deleted from the IT.NRW systems immediately after successful retrieval by the competent authority. The data is stored in the FITKO system for 7 days after successful retrieval and then deleted. If the retrieval by the competent authority is not successful, the data will be completely deleted from the systems of the technical service providers after a maximum of 21 days. |
4.4.7 Session cookie in the form management system
Whose personal data is processed? (Categories of data subjects) | Users of the web browser on which the online application form is completed. |
What categories of personal data are processed? | Unique identifier for the purpose of recognizing the user in the form management system. |
Why is the data processed? (Purposes of processing) | To clearly attribute the application form to a particular browser session and to identify the communication between the form management system and the browser. |
What happens to the personal data? | The unique identifier is stored in a cookie file on the user’s computer. |
What is the legal basis? | 1. The legal basis for the processing of the data is Article 6 (1) Sentence 1 (e) GDPR in conjunction with § 8a (1) Sentence 1 OZG 2. If data is retrieved from the user's terminal device or stored on the terminal device, this is done on the legal basis of § 25 (2) No. 2 TTDSG, as the retrieval and storage is necessary for the function of the online application. |
Is there an obligation to disclose this personal data and what are the consequences of not providing the data? | There is no legal obligation to process personal data. However, it is not possible to use the „Recognition application service“ online service without processing the information. |
How long is personal data stored? | The session cookie, which contains the unique identifier, is deleted when the web browser is closed. |
4.4.8 Session cookie when submitting the application
Whose personal data is processed? (Categories of data subjects) | Users of the web browser on which the online application form is completed. |
What categories of personal data are processed? | Unique identifier for the purpose of recognising the user in the application service for recognition. |
Why is the data processed? (Purposes of processing) | During identification by way of a user account or at the latest at the beginning of the application procedure, a session cookie is created to identify the current user. This cookie is renewed during the processing of the application form and when the user account page is accessed. |
What happens to the personal data? | The unique identifier is stored in a cookie file on the user’s computer. |
What is the legal basis? | 1. The legal basis for the processing of the data is Article 6 (1) Sentence 1 (e) GDPR in conjunction with § 8a (1) Sentence 1 OZG. 2. If data is retrieved from the user's terminal device or stored on the terminal device, this is done on the legal basis of § 25 (2) No. 2 TTDSG, as the retrieval and storage is necessary for the function of the online application. |
Is there an obligation to disclose this personal data and what are the consequences of not providing the data? | There is no legal obligation to process personal data. However, it is not possible to use the „Recognition application service“ online service without processing the information. |
How long is personal data stored? | The session cookie expires 10 minutes after the processing of the application form has been completed or after the user account page was last accessed. |
4.4.9 Transport-Report
Whose personal data is processed? (Categories of data subjects) | Applicants or their representatives |
What categories of personal data are processed? | Meta data |
Why is the data processed? (Purposes of processing) | The data is processed for the purpose of determining the processing status of the respective application and serves to provide proof that the application has been processed by the technical facilities of the processor IT.NRW. |
What happens to the personal data? | The personal data is recorded electronically in the transport report on the Recognition application service. |
What is the legal basis? | The legal basis for the processing of the data is Article 6 (1) Sentence 1 (e) GDPR in conjunction with § 8a (1) Sentence 1, (2), (3) OZG. |
Is there an obligation to disclose this personal data and what are the consequences of not providing the data? | There is no legal obligation to process the personal data. However, the processing of the data is necessary to provide proof of whether and how the respective application was processed on the Recognition application service. |
How long is personal data stored? | The transport report is created immediately after the application is sent. It will be deleted from the Recognition application service 3 years after it has been created. |
4.4.10 Statistik-Report
Whose personal data is processed? (Categories of data subjects) | Applicants or their representatives |
What categories of personal data are processed? | Meta data |
Why is the data processed? (Purposes of processing) | The data is processed for the purpose of determining the number of applications processed on the Recognition application service. At the same time, the statistics report serves as proof that an application has been successfully transmitted to the competent authority or received by the follow-up system. |
What happens to the personal data? | The personal data is recorded electronically in the statistics report on the Recognition application service. |
What is the legal basis? | The legal basis for the processing of the data is Article 6 (1) Sentence 1 (e) GDPR in conjunction with § 8a (1) Sentence 1, (2), (3) OZG. |
Is there an obligation to disclose this personal data and what are the consequences of not providing the data? | There is no legal obligation to process data. However, the processing of data is necessary for the correction of errors in the transmission of applications to the responsible authority for the recognition procedure. |
How long is personal data stored? | The statistics report is created once a month and will be deleted from the application service recognition after 24 hours. |
II. Privacy policy for the use of the National Feedback Component
The Ministry of Employment, Health and Welfare of the State of North Rhine-Westphalia (hereinafter: MAGS NRW) informs you here about the processing of personal data when using the National Feedback Component (NFK) via the Recognition Application Service. Personal data is any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data or an online identifier.
1. Information on the processing of personal data
The controller pursuant to Article 4(1) No. 7 and Article 26 of the General Data Protection Regulation (GDPR) is:
Referat DV II 3
Alt-Moabit 140
10557 Berlin
If you have any questions about the protection of your data, please contact the data protection officer:
Bundesministerium des Innern und für Heimat
Alt-Moabit 140
10557 Berlin
The following act as processors:
Köpenicker Straße 9
10997 Berlin
The processor and operator of the National Feedback Component is the Informationstechnikzentrum Bund (ITZBund).
Informationstechnikzentrum BundBernkasteler Straße 8
53175 Bonn
An agreement on order processing in accordance with Article 28 GDPR has been concluded.
2. Collection and storage of personal data
When using the online service
Every time the website (platform with input mask) is accessed, data about this process is temporarily processed in a log file. In detail, the following personal data is stored for each access or retrieval:
- date and time of access (timestamp),
- IP address of the accessing device or server,
- request details and destination address (protocol version, HTTP method, referrer, user agent string),
- name of the file accessed and amount of data transferred (requested URL incl. query string, size in bytes) and
- notification of whether the access was successful (HTTP status code).
As the operator of the Recognition application service, MAGS NRW does not process any personal data within the meaning of Art. 4 (1) GDPR.
- The above-mentioned personal data will be completely deleted after a maximum of 90 days.
3. Legal basis and purpose of processing
The collection is mandatory on the basis of Article (Art.) 6(1)(c), (e) of the General Data Protection Regulation (GDPR) in conjunction with Section 3 of the Federal Data Protection Act (BDSG); Section 5 of the Federal Office for Information Security Act (BSI-Gesetz) for the storage of data to protect against attacks on the Internet infrastructure of MAGS NRW and the federal government's communication technology beyond the time of your visit. This data is analysed and, in the event of attacks on the communications technology, is required to initiate legal and criminal prosecution. The data will be deleted after a maximum of 90 days.
The sole purpose of processing your personal data is to ensure the functionality of the federal government's IT systems or those of its service providers. Your feedback, on the other hand, is processed anonymously during evaluation. This means that the entries you make will not be processed together with your personal data and, in particular, will not be forwarded to the relevant authority to which you provide feedback. It is not possible to draw conclusions about your person from your answers. Please ensure that you do not enter any personal data in free text fields. Your personal data will only be processed for the stated purpose. The processing of the above-mentioned personal data is necessary for this purpose.
Personal data of employees of the public bodies utilising the NFK are processed on the basis of Art. 6 (1) (b) GDPR and stored for the duration of the contract.
4. Storage duration
The above-mentioned personal data will be completely deleted after a maximum of 90 days.
5. Use of cookies
The form does not use cookies.
6. Rights of the data subjects
Data subjects have the following rights with regard to their personal data:
- Right to information, Art. 15 GDPR
The right of access gives data subjects comprehensive insight into the data concerning them and some other important criteria, such as the purposes of processing or the duration of storage. The exceptions to this right set out in Section 34 BDSG apply. - Right to rectification, Art. 16 GDPR
The right to rectification includes the possibility for the data subject to have incorrect personal data concerning them corrected. - Right to erasure, Art. 17 GDPR
The right to erasure includes the possibility for the data subject to have data erased by the controller. However, this is only possible if the personal data in question is no longer necessary, is being processed unlawfully or consent has been withdrawn. The exceptions to this right set out in Section 35 BDSG apply. - Right to restriction of processing, Art. 18 GDPR
The right to restriction of processing includes the possibility for the data subject to prevent further processing of the personal data concerning them for the time being. A restriction occurs primarily in the review phase of other rights exercised by the data subject. - Right to object to the collection, processing and / or use, Art. 21 GDPR
The right to object includes the possibility for data subjects to object to the further processing of their personal data in a particular situation, insofar as this is justified by the fulfilment of public tasks or public and private interests. The exceptions to this right set out in Section 36 BDSG apply. - Right to data portability, Art. 20 GDPR
The right to data portability includes the possibility for the data subject to receive the personal data concerning him or her from the controller in a commonly used, machine-readable format in order to have it forwarded to another controller if necessary. According to Art. 20 (3) Sentence 2 GDPR, however, this right is not available if the data processing serves the fulfilment of public tasks.
You can assert the aforementioned rights in writing using the contact details provided in section 1.
In accordance with Art. 77 GDPR, you have the right to lodge a complaint with the data protection supervisory authority, which is the Federal Commissioner for Data Protection and Freedom of Information (BfDI), Graurheindorfer Str. 153, 53117 Bonn, poststelle@bfdi.bund.de.
Further contact information can be found here: https://www.bfdi.bund.de/DE/Service/Kontakt/kontakt_node.html.
You can also contact the above-mentioned data protection officer at any time with questions and complaints.