Privacy Policy

ifinancecars.co.uk > Privacy Policy

We take the protection of your data seriously and make every effort to collect and store as little data as possible. Nevertheless, a certain degree of storage and evaluation of user data is necessary in order to guarantee and improve the operation of this website. The use of this website is basically possible without having to provide any personal data. Also an allocation of data to a certain person does not take place – unless you apply for finance and tell us your name and other personal details, for example in our application form.

If you use one of the services offered on this website, this regularly requires the collection, processing and storage of personal data, such as your name, address, e-mail address or telephone number. This collection, processing and storage takes place in principle either on the basis of your express consent obtained beforehand or on the basis of a corresponding legal authorisation and on the basis of the provisions of the European General Data Protection Regulation (GDPR). We would like to inform you here about the type, scope and purpose of the data collected, processed, stored and used by us via this website as well as about your rights existing in this context.

We use SSL transport encryption on this site. This serves, among other things, to protect confidential content, for example when we receive enquiries. You can see that the connection is actually encrypted in the address line of your browser, which always begins with “https://” and confirms the existing transport encryption with a green lock symbol.

Name and address of the controller

The person responsible in the sense of the data protection basic regulation and the other data protection-juridical regulations is:

  • Boyd Yule 
  • 28 New Sneddon St, Paisley, PA3 2AZ
  • privacy@ifinancecars.co.uk

Definitions

The data protection law knows special terms which we also use in this data protection declaration in accordance with the legal definitions of the European data protection basic regulation. Therefore, in this data protection declaration the following terms are used

“personal data”
any information relating to an identified or identifiable natural person (“data subject”);

“data subject”
any identified or identifiable natural person whose personal data are processed; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, on-line identifier or one or more specific characteristics which express the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person;

“processing”
any operation or set of operations which is performed with or without the aid of automated means relating to personal data, such as collection, recording, organisation, sorting, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or association, qualification, erasure or destruction;

“Restriction of processing”
the marking of stored personal data with a view to limiting their future processing;

“Profiling”
any automated processing of personal data consisting in the use of such personal data for the purpose of evaluating certain personal aspects relating to a natural person, in particular to analyse or predict aspects relating to the work performance, economic situation, health, personal preferences, interests, reliability, behaviour, whereabouts or movement of that natural person; as a company committed to data protection, we refrain from any form of profiling;

“Pseudonymization”
the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the provision of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures ensuring that the personal data are not attributed to an identified or identifiable natural person;

“file system”
any structured collection of personal data accessible according to specific criteria, whether centralised, decentralised or organised on a functional or geographical basis;

“controller” (or: “controller”) means”
the natural or legal person, public authority, agency or other body which alone or jointly with others decides on the purposes and means of the processing of personal data; where the purposes and means of such processing are laid down by Union law or by the law of the Member States, the controller or the specific criteria for his designation may be laid down by Union law or by the law of the Member States;

“processor” means
a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller;

“recipient”
a natural or legal person, public authority, agency or other body to whom personal data are disclosed, whether or not that person is a third party. However, authorities which may receive personal data in the course of a specific investigation task under Union law or the law of the Member States shall not be considered as recipients; the processing of such data by those authorities shall be carried out in accordance with the applicable data protection rules and in accordance with the purposes of the processing;

“third party”
a natural or legal person, public authority, agency or any other body, other than the data subject, the controller, the processor and the persons authorised to process the personal data under the direct responsibility of the controller or the processor;

“consent” means”
any voluntary, informed and unequivocal expression of the data subject’s will in the particular case, in the form of a statement or other unequivocal confirmatory act, by which the data subject indicates that he or she is involved in the processing of personal data concerning him or her and that he or she is in agreement with the processing of such data, shall be deemed to have been made by the data subject.

Legal basis for data processing

The processing of personal data by us takes place on the basis of the provisions of the European General Data Protection Regulation (GDPR):

For processing operations in which we obtain consent for a specific processing purpose, the processing is based on Article 6 paragraph 1 letter a of the GDPR. Insofar as the processing of personal data is necessary for the performance of a contract to which the person concerned is a party (e.g. for the delivery of goods or the rendering of any other service or consideration) or for the implementation of pre-contractual measures (e.g. for inquiries regarding our products or services), the processing is based on Article 6 paragraph 1 letter b of the GDPR.

Insofar as processing of personal data is required as a result of a legal obligation to which we are subject, such as for the fulfilment of tax obligations or storage regulations under commercial law, processing shall be carried out on the basis of Article 6 paragraph 1 letter c of the GDPR.

Where, exceptionally, the processing of personal data should be necessary to protect the vital interests of the data subject or of another natural person, the processing would be carried out on the basis of Article 6(1)(d) of the GDPR.

The processing of personal data necessary to safeguard a legitimate interest of our company or of a third party shall be carried out on the basis of Article 6(1)(f) of the GDPR, unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, prevail. Such a legitimate interest is also the conduct of our business for the benefit of all our employees and shareholders. The provision of personal data may be required by law (e.g. commercial law or tax law) or for reasons of contract execution. If we are not provided with such data (e.g. information on a contractual partner) for processing, we cannot conclude a corresponding contract.

Log files

On our Internet server, as on other web servers, a log file is kept. Data records are stored in this log file in which

  • the IP address with which you are travelling on the Internet and the Internet service provider you are using,
  • Date and time of each access to our website,
  • the exact URL of each web page you visit,
  • the data you requested from the server,
  • general information about the web browser (in particular the browser type and version) and operating system you use to access the website, and
  • partly the website from which you accessed our website (the so-called “referrer”)

can be recorded. This information will be

  • for the correct delivery of the respective website,
  • for statistical purposes,
  • to further improve our Internet offering and to optimise the advertising it contains,
  • to permanently guarantee the operability and integrity of our information technology systems, including averting danger in the event of attacks on our information technology systems, and
  • in the event of an attack on our information technology systems, to provide the necessary information to law enforcement authorities

is required and used.

This data is collected anonymously by us and stored separately from all personal data provided to us by the person concerned. The IP address is stored in a form shortened by the last octet.

Cookies and user profiles

Within the framework of the statutory provisions, we may

  • to provide user-friendly services that would not be possible without the setting of cookies,
  • for the purposes of advertising, market research, and
  • to improve our services and Internet offerings
  • Evaluate usage profiles under a pseudonym, but only if you have not made use of your legal right to object to this use of your data. Some of our services require that we use so-called cookies.

Cookies are small amounts of data (text files) that your Internet browser stores on your computer. Cookies can be used to store information about your visit to our website, which enables us to recognize your browser and distinguish it from the browsers of other affected persons. Most browsers are set by default to accept cookies. However, you can reconfigure your browser at any time so that it rejects cookies or asks you for confirmation beforehand. If you reject cookies, however, this may mean that not all offers and functions of this website function or can be used without problems for you.

Further details on the use of cookies on this website – including the existing opt-out options – can be found in this data protection declaration in the following sections

  • for internal visitor statistics and
  • online advertising

Internal visitor statistics (Google Analytics)

(1) This website uses Google Analytics, a web analysis service provided by Google Inc. (“Google”). Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of the website will generally be transmitted to and stored by Google on servers in the United States. However, if IP anonymisation is activated on this website, your IP address will be shortened beforehand by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA where it will be shortened. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services relating to website activity and internet usage to the website operator.

(2) The IP address transmitted by your browser as part of Google Analytics is not merged with other Google data.

(3) You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You can also prevent Google from collecting the data generated by the cookie and related to your use of the website (including your IP address) and Google from processing this data by downloading and installing the browser plug-in available under the following link: http://tools.google.com/dlpage/gaoptout?hl=de=en.

(4) This website uses Google Analytics with the extension “_anonymizeIp()”. This shortens the processing of IP addresses, thus excluding the possibility of personal references. If the data collected about you is related to a person, this is excluded immediately and the personal data is deleted immediately.

(5) We use Google Analytics to analyse and regularly improve the use of our website. The statistics obtained allow us to improve our services and make them more interesting for you as a user. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework The legal basis for the use of Google Analytics is Art. 6 Para. 1 S. 1 lit. f DS-GVO.

(6) Third party information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Terms of use: http://www.google.com/analytics/terms/de.html, Privacy policy overview: http://www.google.com/intl/de/analytics/learn/privacy.html, and privacy policy: http://www.google.com/intl/de/analytics/learn/privacy.html

[(7) This website also uses Google Analytics for a cross-device analysis of visitor flows conducted through a User ID. You can deactivate the cross-device analysis of your usage in your customer account under “My Data”, “Personal Data”.]

Google Tag Manager

This website uses the Google, Inc. tag manager, which allows us to manage various website tags, i.e. small code snippets, from a single interface. Google Tool Manager is only used to implement tags from different vendors, but does not set a cookie or collect personally identifiable information. If such data is collected through the tags implemented by Google Tag Manager, we will indicate this separately in this privacy statement in the section about each tag provider.

Online Advertising

1. use of Google AdWords Conversion

(1) We use the offer of Google AdWords to draw attention to our attractive offers with the help of advertising material (so-called Google AdWords) on external websites. In relation to the data of the advertising campaigns, we can determine how successful the individual advertising measures are. In doing so, we pursue the interest of showing you advertising that is of interest to you, of making our website more interesting for you and of achieving a fair calculation of advertising costs.

(2) These advertising media are delivered by Google via so-called “Ad Servers”. We use ad server cookies for this purpose, which can be used to measure certain parameters for measuring success, such as the display of ads or clicks by users. If you access our website via a Google ad, Google AdWords stores a cookie on your PC. These cookies usually lose their validity after 30 days and are not intended to identify you personally. For this cookie, the unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions) and opt-out information (marking that the user no longer wishes to be addressed) are usually stored as analysis values.

(3) These cookies allow Google to recognize your Internet browser. If a user visits certain pages of an AdWords customer’s website and the cookie stored on their computer has not expired, Google and the customer may recognize that the user clicked on the ad and was directed to that page. Each AdWords customer is assigned a different cookie. Cookies cannot therefore be tracked through AdWords customer websites. We ourselves do not collect or process any personal data in the aforementioned advertising measures. We only receive statistical evaluations from Google. On the basis of these evaluations we can recognise which of the advertising measures used are particularly effective. We do not receive any further data from the use of the advertising media; in particular, we cannot identify users on the basis of this information.

(4) Due to the marketing tools used, your browser automatically establishes a direct connection with Google’s server. We have no influence on the extent and further use of the data collected by Google through the use of this tool and therefore inform you according to our state of knowledge: By integrating AdWords Conversion, Google receives the information that you have called up the relevant part of our website or clicked on an advertisement from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, it is possible for the provider to find out and store your IP address.

(5) You can prevent participation in this tracking process in various ways: a) by setting your browser software accordingly, in particular by suppressing third party cookies to prevent you from receiving advertisements from third parties; b) by deactivating cookies for conversion tracking by setting your browser to block cookies from the domain “www.googleadservices.com”, https://www.googlede/settings/ads, this setting being deleted when you delete your cookies; c) by disabling the interest-based ads of the providers that are part of the “About Ads” self-regulatory campaign through the link http://www.aboutads.info/choices, this setting being deleted when you delete your cookies; d) by permanently disabling it in your Firefox, Internet Explorer or Google Chrome browsers through the link http://www.google.com/settings/ads/plugin Please note that in this case you may not be able to make full use of all the functions of this offer.

(6) The legal basis for the processing of your data is Art. 6 Para. 1 S. 1 lit. f DS-GVO. Further information on data protection at Google can be found here: http://www.google.com/intl/de/policies/privacy and https://services.google.com/sitestats/de.html Alternatively, you can visit the website of the Network Advertising Initiative (NAI) at http://www.networkadvertising.org . Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework

4. Remarketing

Besides AdWords Conversion we use the Google Remarketing application. This is a process with which we would like to address you again. Through this application, you can be shown our advertisements after visiting our website during your further Internet use. This is done by means of cookies stored in your browser, which are used by Google to record and evaluate your usage behaviour when you visit various websites. This allows Google to determine your previous visit to our website. According to Google’s own statements, the data collected during remarketing is not merged with your personal data, which may be stored by Google. In particular, according to Google, a pseudonymisation is used for remarketing.

5. DoubleClick by Google

(1) This website continues to use the online marketing tool DoubleClick by Google. DoubleClick uses cookies to serve ads relevant to users, to improve campaign performance reports, or to prevent a user from seeing the same ads more than once. Google uses a cookie ID to track which ads appear in which browser, thereby preventing them from appearing more than once. In addition, DoubleClick may use cookie IDs to collect conversions related to ad requests. This is the case, for example, when a user sees a DoubleClick ad and later uses the same browser to visit the advertiser’s website and make a purchase. According to Google, DoubleClick cookies do not contain personally identifiable information.

(2) Because of the marketing tools used, your browser automatically connects directly to Google’s server. We have no influence on the extent and the further use of the data, which are raised by the employment of this Tool by Google and inform you therefore according to our state of knowledge: By the integration of DoubleClick Google receives the information that you called the appropriate part of our Internet appearance or clicked an announcement of us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, it is possible that the provider may find out and store your IP address.

(3) You can prevent participation in this tracking process in various ways: a) by setting your browser software accordingly, in particular by suppressing third-party cookies, you will not receive any third-party advertisements; b) by deactivating cookies for conversion tracking by setting your browser to block cookies from the “www.googleadservices.com” domain, www.googleadservices.comde/settings/ads, whereby this setting is deleted when you delete your cookies; c) by disabling the interest-based ads of the providers that are part of the “About Ads” self-regulatory campaign via the link http://www.aboutads.info/choices, whereby this setting is deleted when you delete your cookies; d) by permanently disabling it in your Firefox, Internet Explorer or Google Chrome browsers via the link http://www.google.com/settings/ads/plugin Please note that in this case you may not be able to make full use of all the functions of this offer.

(4) The legal basis for the processing of your data is Art. 6 Para. 1 S. 1 lit. f DS-GVO. Further information on DoubleClick by Google can be found at https://www.google.de/doubleclick and http://support.google.com/adsense/answer/2839090, as well as on data protection at Google in general: https://www.google de/intl/en/policies/privacy. Alternatively, you can visit the Network Advertising Initiative (NAI) website at http://www.networkadvertising.org Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

6. Facebook Custom Audiences

(1) Furthermore, the website uses the remarketing function “Custom Audiences” of Facebook Inc. (“Facebook”). This allows users of the Website to display interest-related advertisements (“Facebook Ads”) when visiting the social network Facebook or other websites that also use the process. We are interested in displaying advertisements that are of interest to you in order to make our website more interesting to you.

(2) Because of the marketing tools used, your browser automatically connects directly to the Facebook server. We have no influence on the extent and further use of the data collected by Facebook through the use of this tool and therefore inform you according to our state of knowledge: By integrating Facebook Custom Audiences, Facebook receives the information that you have called the corresponding website of our website or clicked on an advertisement from us. If you are registered with a Facebook service, Facebook can assign the visit to your account. Even if you are not registered with Facebook or have not logged in, it is possible for the provider to find out and store your IP address and other identification features.

(3) The “Facebook Custom Audiences” function can be deactivated for logged in users at https://www.facebook.com/settings/?tab=ads#_=ads#_ .

(4) The legal basis for the processing of your data is Art. 6 Para. 1 S. 1 lit. f DS-GVO. Further information on data processing by Facebook can be found at https://www.facebook.com/about/privacy

7. Bing Ads

We use the service “Bing Ads” (bingads.microsoft.com) provided and operated by the Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (“Microsoft”), in order to draw attention to our attractive offers by means of advertising on external websites. This enables us to determine how successful the individual advertising measures are in relation to the data from the advertising campaigns. In doing so, we pursue the interest of displaying advertising to you that is of interest to you, of making our website more interesting for you and of achieving a fair calculation of advertising costs.

If you access our website via a “Bing Ads” ad, Microsoft stores a cookie in your web browser. These cookies are used to measure the success of the ads, in particular to determine whether someone who clicked on the ad and thus reached our site reached a predetermined target page (“conversion site”). In addition, Microsoft uses the cookie to collect and process information for the creation and use of pseudonymous usage profiles, which are used to analyze user behavior and play advertisements. We ourselves do not collect and process any personal data in the aforementioned advertising measures. We only receive statistical evaluations from Microsoft. On the basis of these evaluations we can recognise which of the advertising measures used are particularly effective. We do not receive any further data from the use of advertising media; in particular, we cannot identify users on the basis of this information.

You can prevent participation in this tracking procedure in various ways:

a) by setting your browser software accordingly, in particular by suppressing third party cookies, you will not receive any advertisements from third parties; or

b) by their objection, which they can explain under the link http://choice.microsoft.com/de-DE/opt-out.

The legal basis for the processing of your data is Art. 6 Para. 1 S. 1 lit. f DS-GVO. Further information on data protection at Bing Ads and Microsoft can be found here: https://privacy.microsoft.com/de-de/privacystatement Microsoft has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

E-mail and contact forms

If you send us an e-mail or contact us via a contact or application form, the personal data voluntarily transmitted to us will automatically be stored and, if necessary, processed for the purpose of processing or establishing contact. This includes – if indicated by you – in particular your name, your address or e-mail address,  address, your telephone number as well as other information voluntarily provided by you. If you contact us via a form provided on this website, your IP address will also be stored. As a matter of principle, we only use the personal data collected here to the extent necessary to process your enquiries and orders. In no case will this data be passed on to third parties unless we are legally obliged to do so.

Newsletter

If you subscribe to a newsletter offered by us on this website, you must provide us with certain personal data, in particular your e-mail address, using the corresponding input form.

For legal reasons, we use the “double opt-in” procedure for newsletter registration by means of an automatically processed confirmation e-mail to the e-mail address provided by you. This enables us to check whether the owner of the e-mail address you provided has actually authorised the receipt of the newsletter as the person concerned.

We use the personal data collected in the course of newsletter registration exclusively for the following purposes

  • to send the newsletter as well as
  • for the dispatch of information and requests by e-mail which are necessary or necessary for the operation or further development of the newsletter service.

A newsletter subscription can be cancelled at any time, the consent to the storage of personal data can be revoked at any time. This cancellation or revocation can be made via the link contained in each newsletter or via any other communication to the person responsible for processing. In the event of both termination and revocation, we will delete the relevant personal data unless otherwise required by law, and discontinue sending the newsletter to the person concerned.

In addition to the data transmitted via the input form, we also save the date and time of your registration and the IP address you used for this purpose. This is done for the purpose of our own legal protection and for the purpose of protecting our technical systems against misuse.

The newsletters sent by us contain pixel-code, i.e. miniature graphics embedded in the e-mail, the call of which is recorded in a log file and used to identify whether and when the respective newsletter was opened. In the same way also a recording and evaluation of the call of links contained in the newsletter takes place. These data are stored and processed exclusively for the purpose of statistical evaluation of the newsletter dispatch, optimisation of the newsletter dispatch and better adaptation of the newsletter content to the respective subscriber.

Integration of Google Maps

On this website we use the offer of Google Maps. This allows us to display interactive maps directly on the website and allows you to conveniently use the map function.
When you visit the website, Google receives the information that you have accessed the corresponding subpage of our website. In addition, the data mentioned under § 3 of this declaration will be transmitted. This takes place regardless of whether Google provides a user account that you are logged in to or whether there is no user account. If you are logged in at Google, your data will be assigned directly to your account. If you do not want your profile to be associated with Google, you must log out before activating the button. Google stores your data as usage profiles and uses them for advertising, market research and / or needs-based design of its website. Such evaluation is carried out in particular (even for users who are not logged in) to provide demand-oriented advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, and you must contact Google to exercise this right.

Further information on the purpose and scope of data collection and processing by the plug-in provider can be found in the provider’s privacy policy. There you will also find further information on your rights in this regard and setting options to protect your privacy: http://www.google.de/intl/de/policies/privacy Google also processes your personal data in the USA and has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

Duration of storage, deletion and blocking of personal data

Personal data of the data subjects shall be processed or stored by the data controller only for the period of time necessary to achieve the storage purpose, subject to other statutory provisions. A further determining criterion for the duration of the storage of personal data is the respective legal retention period. Once the storage purposes have ceased to apply and existing legal storage periods have expired, the personal data shall be blocked or deleted by the data controller in accordance with the statutory provisions and requirements even without a corresponding request from the data subject.

Your rights as a person

Below we describe the rights which each person affected by the processing of personal data has vis-à-vis the person responsible for the processing. If you wish to exercise any of these rights, you can contact the data controller at any time. We recommend that you inform us of your request by sending an e-mail to datenschutz@rheinwunder.com .

Every person affected by the processing of personal data has the data controller;

1. the right of confirmation, i.e. the right to ask the data controller to confirm whether personal data concerning them will be processed;

2. the right of access, i.e. in the case of the processing of personal data, the right of access to such personal data and to the following information:

a) the purposes of the processing;

(b) the categories of personal data to be processed;

(c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

(d) if possible, the envisaged duration for which the personal data will be stored or, if that is not possible, the criteria for determining that duration;

(e) the existence of a right of rectification or erasure of personal data relating to them or of a right of limitation or of opposition to the processing by the controller;

(f) the existence of a right of appeal to a supervisory authority;

(g) where the personal data are not collected from the data subject, any available information as to the source of the data;

(h) the existence of automated decision-making, including profiling, in accordance with Article 22(1) and (4) of the basic Regulation on data protection and, at least in these cases, meaningful information on the logic involved and the scope and intended impact of such processing on the data subject.

3. where personal data are transferred to a third country or to an international organisation, the right to be informed of the appropriate safeguards in accordance with Article 46 of the basic Regulation on data protection in connection with the transfer;

4. the right to obtain a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on the administrative costs. Where the data subject submits the request by electronic means, the information shall be made available in a common electronic format, unless the data subject indicates otherwise. This right to receive a copy shall not prejudice the rights and freedoms of others;

5. the right to rectification, i.e. the right to ask the data controller without delay to rectify any inaccurate personal data concerning him. Taking into account the purposes of the processing, the data subject shall have the right to request the completion of incomplete personal data, including by means of a supplementary statement;

6. the right to be erased (‘the right to be forgotten’), i.e. the right to require the data controller to erase personal data concerning him without delay, and the data controller is obliged to erase personal data without delay if one of the following reasons applies:

(a) personal data are no longer necessary for the purposes for which they were collected or otherwise processed.

(b) The data subject shall withdraw the consent on which the processing was based pursuant to Article 6(1)(a) or Article 9(2)(a) of the basic Regulation and there is no other legal basis for the processing.

(c) the data subject objects to the processing pursuant to Article 21(1) of the basic Regulation and there are no overriding legitimate reasons for the processing or the data subject objects to the processing pursuant to Article 21(2) of the basic Regulation.

(d) the personal data have been unlawfully processed.

(e) The deletion of personal data is necessary to fulfil a legal obligation under Union law or the law of the Member States to which the controller is subject.

(f) The personal data have been collected in relation to information society services offered in accordance with Article 8(1). Where the controller has made the personal data public and is obliged to erase them in accordance with paragraph 1, he shall take reasonable measures, including technical measures, taking into account available technology and implementation costs, to inform data controllers processing the personal data that a data subject has requested them to erase all links to or copies or replications of those personal data. This does not apply if the processing is necessary.

(a) the exercise of freedom of expression and information;

(b) to fulfil a legal obligation which processing is subject to under the law of the Union or of the Member States to which the controller is subject or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller;

(c) on grounds of public interest in the field of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) of the basic Regulation on data protection;

(d) for archival, scientific or historical research purposes in the public interest or for statistical purposes in accordance with Article 89(1) of the basic Regulation on data protection, in so far as the said right is likely to make it impossible or seriously prejudicial to the attainment of the objectives of such processing; or

e) to assert, exercise or defend legal claims.

7. the right to limit the processing, i.e. the right of a data subject involved in the processing of personal data to obtain from the controller the immediate erasure of personal data relating to him and the controller shall be obliged to erase personal data without delay if one of the following applies

(a) the accuracy of the personal data is contested by the data subject for a period of time which enables the controller to verify the accuracy of the personal data,

(b) the processing is unlawful and the data subject refuses to erase the personal data and instead requests that the use of the personal data be restricted;

(c) the controller no longer needs the personal data for the purposes of the processing, but the data subject needs them for the exercise, exercise or defence of legal rights; or

(d) the data subject has objected to the processing pursuant to Article 21(1) of the basic Regulation until it is established whether the legitimate reasons of the controller outweigh those of the data subject. Where processing has been limited as a result, such personal data shall not be processed, except with the consent of the data subject or for the exercise, exercise or defence of rights or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the Union or of a Member State, except where the data are stored. A data subject who has obtained a restriction on processing shall be informed by the controller before the restriction is lifted.

8. the right to data transferability, i.e. the right of the data subject of the processing of personal data to obtain the personal data concerning him which he has provided to a controller, in a structured, common and machine-readable format, and the right to communicate these data to another controller without obstruction by the controller to whom the personal data have been provided, provided that

(a) the processing is based on a consent pursuant to Article 6(1)(a) or Article 9(2)(a) of the basic data protection Regulation or on a contract pursuant to Article 6(1)(b) of the basic data protection Regulation; and

(b) the processing is carried out by automated means. In exercising his right to data transfer, the data subject shall have the right to obtain that the personal data be transferred directly from one controller to another controller, in so far as this is technically feasible. This right must not affect the rights and freedoms of others. The exercise of this right to data transfer does not affect the right to cancellation (“right to be forgotten”). This right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

9. the right of opposition, that is to say the right of the data subject to the processing of personal data to object at any time, on grounds relating to his/her particular situation, to the processing of personal data concerning him/her under Article 6(1)(e) or (f) of the basic Regulation on data protection, including profiling based on these provisions. The controller shall no longer process the personal data unless he can prove compelling legitimate reasons for the processing outweighing the interests, rights and freedoms of the data subject or the processing is for the exercise, exercise or defence of legal rights.

Where personal data are processed for the purposes of direct marketing, the data subject shall have the right to object at any time to the processing of personal data concerning him for the purposes of such advertising, including profiling, in so far as it is linked to such direct marketing.

Where the data subject objects to processing for the purposes of direct marketing, personal data shall no longer be processed for those purposes. Notwithstanding Directive 2002/58/EC, the data subject may exercise his right of objection in relation to the use of information society services by means of automated procedures using technical specifications.

The data subject shall have the right to object to the processing of his personal data concerning him for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1) of the basic Regulation on data protection, on grounds relating to his particular situation, unless such processing is necessary for the performance of a task in the public interest.

10. the right not to be the subject of an automated decision in a particular case (including profiling) which has legal effect in relation to it or which similarly significantly affects it.

This shall not apply if the decision

(a) necessary for the conclusion or performance of a contract between the data subject and the person responsible,

(b) is authorised by legislation of the Union or of the Member States to which the data controller is subject and contains appropriate measures to safeguard the rights and freedoms and the legitimate interests of the data subject; or

(c) with the express consent of the data subject. In the cases referred to in points (a) and (c) above, the controller shall take appropriate measures to safeguard the rights and freedoms and the legitimate interests of the data subject, including at least the right to obtain the intervention of a person from the controller, to present his or her views and to contest the decision. Automated decisions shall not be based on special categories of personal data unless the data subject has given his consent or processing based on Union law or the law of a Member State which is proportionate to the objective pursued, respects the nature of the right to data protection and provides for appropriate and specific measures to safeguard the fundamental rights and interests of the data subject is necessary for reasons of substantial public interest.

Compare