(edited on 1 July 2025)
These data protection provisions are issued by
The Munich Duty Editor
Rambergstrasse 6
80799 Munich
Email: info@munchen.news
Below, we will inform you in detail about what personal data we collect on our website and in connection with the services and offers mentioned in this privacy policy, for what purposes and how long this data is stored. We will then tell you what rights you have with regard to data processing and how you can exercise these rights.
If you have any questions or comments regarding data protection on our website, please feel free to contact us at any time. You can contact us, for example, by email at office@munchen.news.
This privacy policy applies to the collection, processing and use (‘Use’) of your personal data when using our online offerings, as well as to all other deliveries and services that you wish to receive through us.
I. Name and address of the responsible person
The responsible person within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the Member States, as well as other data protection provisions, is:
Editorial office of ‘Munich Duty Officer’
Rambergstrasse 6
80799 Munich
Email: info@munchen.news
If your data is processed by the responsible party on the basis of an agreement in accordance with Art. 26 (1) GDPR together with third parties (so-called ‘joint responsibility’), you will be informed of this in the following descriptions of the individual data processing processes.
II. Data Protection Officer
You can contact our data protection officer at:
Munich Duty Editor
Rambergstrasse 6
80799 Munich
Email: info@munchen.news
III. General information about data processing
1. Legal basis for processing personal data
If we obtain the consent of the data subject for the processing of personal data, the legal basis for the processing of personal data is Article 6(1)(a) of the General Data Protection Regulation (GDPR). When processing personal data necessary for the performance of a contract to which the data subject is party, the legal basis is Article 6(1)(b) of the GDPR. This also applies to processing operations necessary for the implementation of pre-contractual measures. If the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, the legal basis is Article 6(1)(c) of the GDPR. If the vital interests of the data subject or another natural person require the processing of personal data, the legal basis is Article 6(1)(d) of the GDPR. If processing is necessary to protect the legitimate interests of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh that interest, the legal basis for processing is Article 6(1)(f) GDPR.
2. Data deletion and storage period
The personal data of the data subject shall be deleted or blocked as soon as the purpose of storage ceases to exist. Furthermore, storage may take place if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which the controller is subject. Blocking or deletion of the data also takes place after expiry of the prescribed storage period, unless there is a need for further storage of the data for the conclusion or fulfilment of a contract.
IV. Provision of the website and creation of log files
1. Description and scope of data processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.
The following data is collected:
- Information about the browser type and version used
- User’s operating system
- User’s internet service provider
- User’s IP address
- Date and time of access
- Websites from which the user’s system accessed our website
- Websites accessed by the user’s system via our website
The data is also stored in our system’s log files. This is not influenced by the user’s IP address or other data that allows the data to be attributed to the user. This data is not stored together with other personal data of the user.
2. Legal basis for data processing
The legal basis for temporary data storage is Article 6(1)(f) of the GDPR.
3. Purpose of data processing
The temporary storage of the IP address by the system is necessary to ensure that the website is delivered to the user’s computer. For this purpose, the user’s IP address must be stored for the duration of the session.
For these purposes, we also have a legitimate interest in data processing in accordance with Article 6(1)(f) of the GDPR.
4. Storage period
Data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of data collected for the provision of the website, this occurs when the respective session has ended.
V. Use of cookies
1. Description and scope of data processing
Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user’s computer system. When a user accesses a website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic string of characters that allows the browser to be uniquely identified when the website is visited again. We use cookies to make our website more user-friendly. Some elements of our website require that the calling browser can be identified even after you have navigated to another page.
These cookies make our digital offering easier and more efficient to use, and enable us to analyse user habits in order to provide high-quality editorial content tailored to your interests. In addition, cookies enable advertisements to be tailored to your individual interests and usage habits.
You can find details about the type of cookie usage in our consent management tool. There you also have the option of subsequently editing the configuration you selected when you first visited our site.
Some of the services listed in the consent management tool transfer data to the USA. If this is the case, the transfer is carried out exclusively on the basis of your consent in accordance with Art. 49 (1) lit. a GDPR. You give your consent by making the appropriate selection in the consent management tool that is displayed when you visit our website.
There is no adequacy decision from the EU for data transfers to the US, and the provider does not process data in accordance with the standard data protection clauses approved by the EU Commission. This means that data transferred to these providers is not protected in accordance with the GDPR standard. The provider is subject to US law and may therefore be obliged to transfer data to the special services if the relevant legal conditions are met. Risks for data subjects arise in particular from the difficulty of enforcement, the lack of control over further processing or transfer of data, and the access by government authorities described above. In addition, language barriers may make enforcement difficult.
2. Online advertising based on third-party usage
In order to be able to provide relevant advertising tailored to current interests, attempts are made to draw conclusions about current interests based on website visits and browsing behaviour.
With the help of such services, this website can use user data to communicate advertising in the form of banners and other marketing methods, possibly based on the user’s interests. Third-party cookies (so-called third-party cookies) are used for retargeting (remarketing) website visitors and for measuring success, and, if necessary, pseudonymous user profiles are created. These can be analysed for advertising and monitoring purposes. Direct attribution to a specific person is not possible.
Consent in accordance with IAB TCF2 applies to the following data processing purposes (see also the table of data processing purposes at the address):
For all processing purposes within the scope of usage-based online advertising with third parties, the prerequisite is the storage of information on the user’s end device and/or the retrieval of information from the user’s end device. (Purpose 1 according to IAB TCF 2.0) Information within the meaning of this processing purpose is, for example, cookies and device identifiers that are stored on or read from the device.
This processing purpose requires the user’s explicit consent. Without consent, no information is stored or read by third parties, and no code is called by third parties – regardless of the legal basis for data processing that possible third parties use for further purposes (see Purposes 2-10 below).
Selection of simple ads (Purpose 2 according to IAB TCF 2.0)
To select simple ads, vendors may:
– Use real-time information about the context in which the ad is displayed, including information about the content environment and the device used, such as device type and features, browser ID, URL, IP address;
– Use approximate data about the user’s location;
– Control the frequency of ad impressions;
– Control the sequence of ad impressions;
– Prevent ads from being displayed in inappropriate editorial environments (unsafe for the brand).
Creating a personalised advertising profile (Purpose 3 according to IAB TCF 2.0)
To create a personalised advertising profile, vendors may:
– Collect information about the user, including their activities, interests, website visits or app usage, demographic information or location, to create or edit a user profile for content personalisation.
Choice of personalised ads (Purpose 4 according to IAB TCF 2.0)
To select personalised advertisements, vendors may:
– Select personalised advertisements based on user profiles or other historical usage data, including previous activity, interests, website visits or app usage, location, or demographic information.
Creating a personalised content profile (Purpose 5 according to IAB TCF 2.0)
To create a personalised content profile, vendors may:
– Collect information about the user, including their activities, interests, website visits or app usage, demographic information or location, to create or edit a user profile for content personalisation.
Personalised content selection (Purpose 6 according to IAB TCF 2.0)
To select personalised content, vendors may:
– Select personalised content based on user profile or other historical usage data, including previous activity, interests, website visits or app usage, location, or demographic information.
Measuring advertising effectiveness (Purpose 7 according to IAB TCF 2.0)
To measure advertising effectiveness, vendors may:
– Measure whether and how ads were shown to a user and how the user interacted with them;
– Provide reports on ads, including their effectiveness and performance;
– Provide reports on user interactions with ads based on data measured during the user’s interaction with that ad;
– Provide reports to service providers about ads that are displayed on their services;
– Measure whether an advertisement is displayed in an inappropriate editorial environment (unsafe for the brand);
– Determine the percentage at which an advertisement could be perceived, including duration (advertisement perception capability).
Measuring content effectiveness (Purpose 8 according to IAB TCF 2.0)
To measure content effectiveness, vendors can:
– Measure and report on how content was delivered to users and how they interacted with it;
– Provide reports on directly measurable or already known information about users who interacted with the content.
Use of market research to obtain information about target groups (Purpose 9 according to IAB TCF 2.0)
When using market research to obtain information about target groups, providers may:
– Provide aggregated reports to advertisers or their representatives about the target groups reached by their advertisements, which were obtained based on survey panels or similar procedures;
– Provide aggregated reports to service providers on target groups that were reached by content and/or advertisements on their services or interacted with them, and which were identified using survey panels or similar procedures;
– For market research purposes, match offline data with online users to obtain information about target groups, as providers have declared that they match and combine offline data sources (Additional processing capability 1).
Suppliers may not:
– Measure the effectiveness and efficiency of advertisements that were shown to a specific user or with which they interacted without having their own legal basis for measuring advertising effectiveness;
– Measure what content was delivered to a specific user and how they interacted with it without having their own legal basis for measuring content effectiveness.
Product development and improvement (Purpose 10 according to IAB TCF 2.0)
For product development and improvement, providers may:
– Use information to improve their existing products with new features and develop new products;
– Create new computational models and algorithms using machine learning.
3. Legal basis for data processing
The legal basis for data processing in connection with the use of necessary cookies is the performance of a contract (Art. 6(1)(b) GDPR or § 25(2)(2) TTDSG).
The processing of personal data for advertising purposes is based on the user’s declaration of consent (Art. 6 para. 1 lit. a GDPR or § 25 para. 1 TTDSG), which he gave when entering the website (if no declaration of consent was given, the corresponding data processing does not take place; the same applies if the declaration of consent is revoked). If consent has been given for the storage of cookies on the user’s end device (Purpose 1 according to IAB TCF 2.0), the processing of personal data for subsequent purposes (Purposes 2–10 according to IAB TCF 2.0) may also be based on legitimate interest (Art. 6 para. 1 lit. f GDPR). The interest of vendors lies in delivering advertising, measuring the effectiveness of ads and content, and improving and developing their products. The user is given the opportunity to opt out of this directly in the consent dialogue.
4. Data transfer to the United States
Some of the services listed in the consent management tool transfer data to the United States. If this is the case, the transfer is carried out exclusively on the basis of your consent in accordance with Article 49(1)(a) of the GDPR. You give your consent by making the appropriate selection in the consent management tool that is displayed when you visit our website.
There is no adequacy decision from the EU for data transfers to the United States, and the provider does not process data in accordance with the standard data protection clauses approved by the EU Commission. This means that data transferred to these providers is not protected in accordance with the GDPR standard. The provider is subject to US law and may therefore be obliged to transfer data to the special services if the relevant legal requirements are met. Risks for data subjects arise in particular from the difficulty of enforcement, the lack of control over further processing or transfer of data, and the access by government authorities described above. In addition, language barriers may make enforcement difficult.
5. Joint responsibility
VI. Contact form and email contact
1. Description and scope of data processing
Our website features a contact form that can be used to establish electronic contact. If a user makes use of this option, the data entered in the form is transmitted to us and stored. This data includes:
- Company
- First name
- Surname
- Address
- Telephone number
- Email address
- Your message
The following data is also stored when the message is sent:
- User’s IP address
- Date and time of entry
Alternatively, you can contact us via the email address provided. In this case, the user’s personal data transmitted with the email is stored.
In this context, no data is transferred to third parties. The data is used exclusively for processing the conversation.
2. Legal basis for data processing
The legal basis for processing data transmitted during the establishment of contact is Article 6(1)(f) of the GDPR. If the purpose of the email contact is to conclude a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR.
3. Purpose of data processing
The processing of personal data from the input form serves us exclusively for the processing of the contact establishment.
Other personal data processed during the sending process via the contact form serves to prevent misuse of the contact form and to ensure the security of our information technology systems.
4. Storage period
Data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. For personal data from the contact form input and that sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is deemed to have ended when it can be inferred from the circumstances that the matter in question has been finally clarified.
If legal regulations stipulate storage obligations (e.g. six years for commercial letters received, Section 257 (4) HGB), deletion takes place after the expiry of the respective period.
VII. Data provided by you when concluding transactions and using services
1. Description and scope of data processing
In some areas, you may be asked to provide personal data in order to use the described paid offers or free features, or to participate in special promotions (e.g. ordering a subscription, submitting an advertisement, ordering other goods and services, creating a personal user profile, ordering editorial and/or advertising mailings, participating in competitions or other promotional campaigns). In this case, you will be informed about which information you must provide for these offers and which data you can provide voluntarily.
In particular, the following data may be collected: Name, address, bank details, password, date of birth, email address, declarations of consent, information about the transaction concluded.
Within the framework of the data agreement, we also transfer your personal data to third parties – but only if and to the extent necessary for the corresponding processing of the contract (see also section 5 below).
2. Legal basis for data processing
If the collection of data is aimed at concluding a contract, the legal basis for processing is Article 6(1)(b) of the GDPR. In addition, data is processed on the basis of your consent (Article 6(1)(a) of the GDPR).
3. Purpose of data processing
Data processing is carried out for the purpose of enabling the use of the relevant offers and functions. If you voluntarily provide additional data, we use this to tailor our services to your needs.
4. Storage period
Data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. This is usually the case when the service you are using (e.g. newsletter subscription, creation of a personal user profile) is cancelled.
If legal regulations stipulate storage obligations (e.g. six years for commercial letters received, Section 257 (4) HGB), deletion takes place after the expiry of the respective period.
VIII. Data processing for advertising purposes without consent
1. Description and scope of data processing
Since you have entered into a contract with us for the purchase of goods or services, we maintain you as a regular customer with the data collected for this primary purpose. In this case, we process your postal contact details (name and address) even without specific consent in order to send you information about new products and services. If we have received your email address in connection with the sale of a product or service, we process the email address to send you information about our own similar products or services without specific consent. We use additional voluntary data to select and design any advertising in accordance with the target group.
2. Legal basis for data processing
The legal basis for data processing is Article 6(1)(f) of the GDPR.
3. Purpose of data processing
Data processing is carried out for the purpose of advertising our own similar goods or services.
4. Storage period
The storage period is determined by the main purpose of collection (Section VII.4.).
X. Comment function
1. Description and scope of data processing
As a registered user, you have the option of publicly commenting on posts on our website. If you make use of this option, your comment, your username and the time of your comment will be published in the comments section.
2. Legal basis for data processing
The legal basis for the processing of your data is Art. 6 (1) lit. a GDPR.
We reserve the right to check comments for possible violations of our terms of use. The legal basis for data processing in this case is Art. 6 (1) lit. f GDPR and is carried out in our interest to detect violations.
3. Purpose of data processing
The purpose of data processing is to publish your comment.
4. Storage period
Your comments are published for an indefinite period. However, you have the option to delete them at any time. We also reserve the right to delete comments at a later date, especially if the article being commented on is removed from the online offering or if we discover a violation of our terms of use.
X. Use of social media plugins
1. General information
We have integrated buttons (‘plugins’) from various social media networks into our website so that you can use the interactive features of the social media networks you use on our website. These plugins provide various functions, the content and scope of which are determined by the social media network operators. Please note that we are not the providers of the social networks and have no influence on the data processing carried out by the respective service providers.
You can find more detailed information about the individual plugins in the following information:
2. Facebook
Some editorial content may include the ‘Embedded Posts’ plugin https://developers.facebook.com/docs/plugins/embedded-posts/ from the social network ‘Facebook’, 1601 South California Avenue, Palo Alto, CA 94304, USA. If you visit pages that have this plugin embedded and you are logged into your Facebook account, the plugin establishes a direct connection between your browser and the Facebook server.
Please note that we, as the provider of the pages, do not receive any information about the content of the data transmitted or its use by Facebook, and that we are not responsible for the processing of data by Facebook. For more information, please refer to Facebook’s privacy policy at http://de-de.facebook.com/policy.php.
We use the Software Developer Kit (SDK) of the social network Facebook, 1601 South California Avenue, Palo Alto, CA 94304, USA, in our applications. So-called tracking pixels are integrated into the apps. When you use our apps, the SDK establishes a direct connection between your mobile device and the Facebook server. Facebook thus receives information that our app has been used on your device. If you are a Facebook user, Facebook can use this to associate the use of our apps with your user account. Please note that we, as the app provider, do not receive any information about the content of the data transmitted or its use by Facebook. For more information, please refer to Facebook’s privacy policy at https://www.facebook.com/about/privacy/.
3. X
Our pages incorporate features from the social network ‘X’. These features are provided by X Internet Unlimited Company, Attn: Data Protection Officer, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07 IRELAND. When you use X and the ‘Re-Tweet’ function, the websites you have visited are linked to your X account and communicated to other users. This data is also transmitted to X. Please note that, as the provider of the pages, we do not receive any information about the content of the data transmitted or its use by X. For more information, please refer to X’s privacy policy at https://x.com/de/privacy.
4. reddit
Our pages integrate plugins from the social network Reddit (Reddit Inc., 520 Third Street, Suite 305, San Francisco, CA 94107, USA). You can recognise Reddit plugins by the orange Reddit Smiley logo on our page.
If you click on the Reddit share button while logged into your Reddit account, you can link the content of our pages to your Reddit profile. As a result, Reddit can associate your visit to our pages with your user account. Please note that we, as the provider of the pages, do not receive any information about the content of the data transmitted or its use by Reddit. For more information, please refer to Reddit’s privacy policy at: https://www.reddit.com/help/privacypolicy. If you do not want Reddit to be able to assign your visit to our pages to your Reddit account, please log out of your Reddit account first.
5. Twitch
Our website uses plugins from the online service Twitch. The provider is Twitch Interactive, Inc., 225 Bush Street, 6th Floor, San Francisco, CA 94104, USA.
When you visit one of our pages equipped with a Twitch plugin, a connection to the Twitch servers is established. The Twitch server is informed which of our pages you have visited. In addition, Twitch receives your IP address. This also happens if you are not logged in to Twitch or do not have a Twitch account. The information collected by Twitch is transferred to a Twitch server in the USA.
If you are logged into your Twitch account, you allow Twitch to directly link your viewing behaviour to your personal profile. You can prevent this by logging out of your Twitch account.
For more information about how user data is handled, please refer to Twitch’s privacy policy at: https://www.twitch.tv/p/legal/privacy-policy/.
XI. Advertising on the website
At this stage, the website is not monetised. Marketing research is being conducted on the quality of advertising block placements.
XII. Rights of the data subject
If personal data concerning you is being processed, you are a data subject under the GDPR and you have the following rights in relation to the Data Controller:
1. Right to information
You may request confirmation from the Responsible Person as to whether we are processing personal data relating to you.
If such processing is taking place, you may request the following information from the Responsible Person:
(1) the purposes for which the personal data is being processed;
(2) the categories of personal data being processed;
(3) the recipients or categories of recipients to whom your personal data has been or will be disclosed;
(4) the planned storage period for your personal data or, if specific information on this is not available, the criteria for determining the storage period;
(5) the existence of the right to rectify or erase personal data concerning you, the right to restrict processing by the controller or the right to object to such processing;
(6) the existence of the right to lodge a complaint with a supervisory authority;
(7) any available information on the origin of the data, if the personal data are not collected from the data subject;
(8) the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
You have the right to request information on whether personal data concerning you is transferred to a third country or an international organisation. In this regard, you may request to be informed of the appropriate safeguards pursuant to Article 46 of the GDPR in connection with the transfer.
2. Right to rectification
You have the right to rectification and/or completion in relation to the Responsible Person if the personal data processed concerning you is incorrect or incomplete. The Responsible Person must make the rectification immediately.
3. Right to restriction of processing
Under the following conditions, you may request restriction of the processing of personal data concerning you:
(1) if you contest the accuracy of the personal data concerning you, for a period enabling the controller to verify the accuracy of the personal data;
(2) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
(3) the controller no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims; or
(4) you have objected to processing pursuant to Article 21(1) of the GDPR and it is not yet clear whether the legitimate grounds of the controller override your grounds.
If the processing of personal data concerning you has been restricted, this data – with the exception of its storage – may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
If the restriction of processing has been lifted in accordance with the above conditions, the Controller will inform you before lifting the restriction.
4. Right to erasure
a) Obligation to erase
You may request the Controller to immediately erase personal data concerning you, and the Controller is obliged to immediately erase such data if one of the following reasons applies:
(1) The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
(2) You have withdrawn your consent on which the processing was based in accordance with Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR, and there is no other legal basis for the processing.
(3) You object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR.
(4) The personal data concerning you has been unlawfully processed.
(5) The erasure of personal data concerning you is necessary to comply with a legal obligation under Union or Member State law to which the Controller is subject.
(6) Personal data concerning you has been collected in relation to the services offered by the information society in accordance with Art. 8 (1) GDPR.
b) Notification of third parties
If the Controller has made your personal data public and is obliged to erase it in accordance with Article 17(1) of the GDPR, it shall take appropriate measures, in particular of a technical nature, taking into account the available technology and the cost of implementation, to inform the controllers who process the personal data that you, as the data subject, have requested the deletion of all links to, or copies or replications of, that personal data.
c) Exceptions
The right to erasure does not exist if processing is necessary
(1) for exercising the right of freedom of expression and information;
(2) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(3) for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) of the GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the GDPR, insofar as the right referred to in point (a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
(5) for the establishment, exercise or defence of legal claims.
5. Right to be informed
If you have exercised your right to rectification, erasure or restriction of processing against the Controller, the latter is obliged to notify all recipients to whom your personal data has been disclosed of this rectification or erasure or restriction of processing, unless this proves impossible or involves disproportionate effort.
You have the right to be informed by the Controller about these recipients.
6. Right to data portability
You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, provided that
(1) the processing is based on consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR or on a contract pursuant to Article 6(1)(b) GDPR, and
(2) the processing is carried out by automated means.
When exercising this right, you also have the right to have personal data concerning you transferred directly from one controller to another controller, where technically feasible. The freedoms and rights of others must not be infringed as a result.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller.
7. Right to object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions.
The controller will no longer process the personal data concerning you unless the controller can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
If personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing purposes; this also applies to profiling insofar as it is related to such direct marketing.
If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes.
You have the option, in connection with the use of information society services, irrespective of Directive 2002/58/EC, to exercise your right to object by means of automated procedures using technical specifications.
8. Right to withdraw consent to data protection
You have the right to withdraw your consent to data protection at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
9. Automated decision-making in individual cases, including profiling
You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision
(1) is necessary for entering into, or performance of, a contract between you and the Controller,
(2) is authorised by Union or Member State law to which the Controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or
(3) is based on your explicit consent.
However, these decisions may not be based on special categories of personal data pursuant to Article 9(1) of the GDPR, unless Article 9(2)(a) or (g) applies and appropriate measures are in place to safeguard your rights and freedoms and your legitimate interests.
In the cases mentioned in (1) and (3), the controller shall implement appropriate measures to safeguard your rights and freedoms and legitimate interests, which shall include at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.
10. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.
The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy in accordance with Article 78 of the GDPR.