I. Name and Address of the Data Controller
The data controller, in accordance with the General Data Protection Regulation (GDPR) and other national data protection laws of the member states, as well as other privacy regulations, is:
Tinycampercars
Gley & Kneißl & Gley GbR
Marie-Curie-Allee 101
10315 Berlin
kontakt@tinycampercars.de
Anne Gley, Virginia Kneißl und Alex Gley
Right to withdraw the data protection consent statement.Right to data portability.II. General Information on Data Processing
1. Scope of the Processing of Personal Data
We collect and use personal data from our customers only to the extent necessary for providing our services. The collection and use of personal data typically only occurs with the customer’s consent. An exception applies in cases where obtaining prior consent is not possible for practical reasons, and the processing of data is permitted by law.
2. Legal Basis for the Processing of Personal Data
a) If we obtain consent for processing personal data, Art. 6(1)(a) of the GDPR serves as the legal basis.
b) For processing necessary to fulfill a contract where the data subject is a party, Art. 6(1)(b) GDPR is the legal basis. This also applies to processing required for pre-contractual measures.
c) If processing personal data is necessary for fulfilling a legal obligation, Art. 6(1)(c) GDPR applies.
d) In cases where vital interests of the data subject or another person require data processing, Art. 6(1)(d) GDPR serves as the legal basis.
e) If processing is necessary to safeguard the legitimate interests of our company or a third party, and the interests or fundamental rights of the data subject do not override those interests, Art. 6(1)(f) GDPR serves as the legal basis.
3. Data Deletion and Storage Duration
Personal data of the data subject will be deleted or blocked as soon as the purpose for storing it no longer applies. Data may be stored beyond this period if required by European or national laws in regulations that the controller is subject to. The data will also be deleted or blocked if the storage period prescribed by these regulations expires unless further storage is required for contract fulfillment.
IV. Rights of the Data Subject
If your personal data is processed, you are considered a data subject under the GDPR and have the following rights:
1. Right to Information
You can request confirmation from the controller whether personal data concerning you is being processed. If such processing is occurring, you can request the following information:
(1) The purposes of the data processing.
(2) The categories of personal data being processed.
(3) The recipients or categories of recipients who have received or will receive your personal data.
(4) The planned duration of data storage or the criteria used to determine that duration.
(5) The existence of the right to rectify, delete, or restrict processing, as well as the right to object to processing.
(6) The right to lodge a complaint with a supervisory authority.
(7) Any available information about the origin of the data, if it was not collected directly from you.
(8) The existence of automated decision-making, including profiling, and relevant information about the logic involved and the consequences of such processing.
You also have the right to know if your personal data is being transferred to a third country or international organization and to be informed of the appropriate safeguards per Art. 46 GDPR.
2. Right to Rectification
You have the right to rectification and/or completion from the controller if the personal data being processed concerning you is inaccurate or incomplete. The controller is obliged to make the correction without delay..
3. Right to Restriction of Processing
You may request the restriction of processing your personal data under the following circumstances:
(1) If you dispute the accuracy of your data, for a period allowing the controller to verify its accuracy.
(2) If the processing is unlawful, and you object to the deletion and instead request restriction of use.
(3) If the controller no longer needs the data, but you need it for legal claims.
(4) If you have objected to processing, pending verification of whether the legitimate grounds of the controller override yours.
If the processing of your personal data has been restricted, these data – apart from their storage – may only be processed with your consent or for the establishment, exercise, or defense of legal claims, or to protect the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State.
If the restriction of processing has been applied under the above conditions, you will be informed by the controller before the restriction is lifted.
4. Right to Erasure
a) Obligation to Erase
You can request the data controller to immediately delete your personal data, and the data controller is obligated to delete this data without delay if one of the following reasons applies:
(1) The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
(2) You withdraw your consent on which the processing was based according to Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR, and there is no other legal basis for the processing.
(3) You object to the processing according to Art. 21 para. 1 GDPR, and there are no overriding legitimate grounds for the processing, or you object to the processing according to Art. 21 para. 2 GDPR.
(4) The personal data concerning you has been processed unlawfully.
(5) The deletion of the personal data concerning you is necessary to fulfill a legal obligation under Union law or the law of the Member States to which the controller is subject.
(6) The personal data concerning you was collected in relation to services offered by the information society in accordance with Article 8(1) of the GDPR.
b) Information to Third Parties
If the controller has made the personal data concerning you public and is obliged to delete it in accordance with Article 17(1) of the GDPR, they will take reasonable steps, taking into account available technology and implementation costs, including technical measures, to inform data controllers processing the personal data that you, as the data subject, have requested the deletion of all links to such personal data or copies or replications of such personal data.
c) Exceptions
The right to deletion does not apply insofar as processing is necessary for:
(1) the exercise of the right to freedom of expression and information;
(2) to fulfill a legal obligation that requires processing under the law of the Union or the member states to which the controller is subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller;
(3) for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) as well as Art. 9(3) GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes, or for statistical purposes according to Art. 89(1) GDPR, insofar as the right mentioned under section a) is likely to make the achievement of the objectives of this processing impossible or seriously impaired, or
(5) to assert, exercise, or defend legal claims.
5. Right to information
If you have asserted your right to rectification, deletion, or restriction of processing against the controller, they are obliged to inform all recipients to whom your personal data has been disclosed of this rectification or deletion of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.
You have the right to be informed about these recipients by the controller.
6. Right to data portability
You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that
(1) the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR, and
(2) the processing is carried out by automated means.
In exercising this right, you also have the right to request that the personal data concerning you be transmitted directly from one controller to another, where technically feasible. The freedoms and rights of other persons must not be affected by this.
The right to data portability does not apply to the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
7. Right to object
You have the right to object at any time to the processing of your personal data based on Art. for reasons related to your particular situation.
You have the right to object at any time to the processing of your personal data based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. The controller shall no longer process your personal data unless they can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.
If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling insofar as it is related to such direct marketing.
If you object to the processing for the purposes of direct marketing, your personal data will no longer be processed for these purposes.
You have the option to exercise your right to object in connection with the use of information society services—regardless of Directive 2002/58/EC—by automated means that make use of technical specifications.
8. Right to withdraw the data protection consent statement
You have the right to withdraw your data protection consent statement at any time. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the withdrawal.
9. Automated decision-making in individual cases, including profiling
You have the right not to be subject to a decision based solely on automated processing— including profiling—that has legal effects concerning you or similarly significantly affects you. This does not apply if the decision
(1) is necessary for the conclusion or performance of a contract between you and the controller,
(2) is permissible under Union or Member State law to which the controller is subject, and which provides for appropriate measures to safeguard your rights and freedoms as well as your legitimate interests, or
(3) is based on your explicit consent.
However, these decisions must not be based on special categories of personal data under Art. 9(1) GDPR, unless Art. 9(2)(a) or (g) applies and appropriate measures have been taken to protect your rights and freedoms as well as your legitimate interests.
In relation to the cases mentioned in (1) and (3), the controller shall take appropriate measures to safeguard your rights and freedoms as well as your legitimate interests, which shall include at least the right to obtain human intervention from the controller, to present your point of view, and to contest the decision.
10. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your residence, your workplace, or the place of the alleged infringement, if you believe that the processing of your personal data violates the GDPR.
The supervisory authority with which the complaint has been lodged will inform the complainant about the status and results of the complaint, including the possibility of a judicial remedy under Art. 78 GDPR.