Privacy

The data controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the Member States, as well as other data protection regulations, is:

youbuyda GmbH Siemensstr. 7
35394 Gießen
Germany
Phone: +49 (0) 641 9699 32 606
Email: info@youbuyda.de
Websites: https://youbuyda.com and https://storeplus.de

The data protection officer of the data controller, in accordance with Article 37 of the GDPR, is:

Mr. Rechtsanwalt Frank Eckerkunst
c/o ITWerk Giessen GmbH*
Siemensstrasse 7
35394 Giessen
Germany
Tel: +49 641 96993-0
Email: datenschutz@storeplus.de

* Information regarding insurance:
Professional indemnity insurance details:
Professional indemnity insurance with Hiscox Insurance Company Ltd.
Branch for the Federal Republic of Germany
Arnulfstraße 31
80636 Munich
Territorial scope of the insurance: Europe
Insured activity: Data protection officer
Professional indemnity insurance coverage: €1,000,000

1. Terminology

In our privacy policy, we use various terms that are based on legal principles and are explained below to make our privacy policy simple and easy to understand. In the context of this privacy policy, the term:

"Personal data" refers to all information relating to an identified or identifiable natural person (hereinafter referred to as the "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics expressing the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person;

"Processing" means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

"Restriction of processing" means the marking of stored personal data with the aim of limiting their processing in the future;

"Profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements;

"Pseudonymization" means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;

"Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

"Processor" means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller;

"Recipient" means a natural or legal person, public authority, agency, or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;

"Third party" means a natural or legal person, public authority, agency, or body other than the data subject, controller, processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data;

"Consent" of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, by a statement

1. Provision of the Website and Creation of Log Files Description and Scope of Data Processing, Legal Basis, Purpose, and Storage Duration

Every time our website is accessed, our system automatically collects data and information from the computer system of the accessing device.
The following data is collected:

• Information about the browser type and version
• The user's operating system
• The user's internet service provider
• The user's IP address
• Date and time of access
• Websites from which the user's system accesses our website
• Websites accessed by the user's system through our website

The data is also stored in log files of our system. The storage of this data does not occur together with other personal data of the user.

2. Provision of Order Data - Description and Scope of Data Processing, Purpose, and Storage Duration

With each received order from a youbuyda customer through the channels connected to the Local Commerce Suite, our system automatically collects data and information about the order.

The collected personal data includes:

The legal basis for the temporary storage of data and log files is Art. 6(1)(f) of the GDPR. The temporary storage of the IP address by the system is necessary to deliver the website to the user's device. For this purpose, the user's IP address must be stored for the duration of the session. The storage in log files is done to ensure the functionality of the website. Additionally, the data serves us to optimize the website and ensure the security of our information technology systems. In this context, there is no evaluation of the data for marketing purposes. These purposes also constitute our legitimate interest in data processing according to Art. 6(1)(f) of the GDPR. The data is deleted or anonymized when it is no longer necessary for achieving the purpose of its collection, so that it is no longer possible to attribute the accessed client. The collection of data for the provision of the website and the storage of data in log files are mandatory for the operation of the website. Therefore, there is no possibility for the user to object to this.

1. Buyer Data:
   • Name: Names of end customers placing orders.
   • Contact Information & Addresses: Contact details such as email addresses, phone numbers, and postal addresses, including street name, street addition, postal code, city, and country of end customers.
2. Order Details:
   • Order ID: Unique identifiers assigned to each order for tracking and referencing.
   • Order Type: Pickup, Reservation, or Delivery.
   • Order Status: Depending on the order type, the status can be Pending, Confirmed, Rejected, Cancelled, Return, Cancel in Progress, Shipped, Ready for Pickup, Picked Up, Waiting.
   • Order Date: Date and time of the order.
   • Order Items: Details of purchased products, including names, quantities, prices, EAN, SKU, ASIN, store item number.
   • Total Order Amount: The total amount paid for the order, including item costs, taxes, and shipping costs.

The processing of this personal data serves the following purposes:

• Financial Accounting: Maintaining accurate and comprehensive financial records reflecting customer sales orders, revenues, expenses, and financial activities.
• Accounting: Supporting essential accounting tasks, including maintaining the general ledger, posting entries, and preparing the trial balance.
• Tax and Compliance: Calculating and reporting taxes, such as sales tax and value-added tax, in compliance with applicable tax laws and regulations.
• Financial Reporting: Generating financial reports, statements, and summaries to provide insights into the customer's business success and financial situation.
• Budgeting and Planning: Using historical sales and transaction data to develop budgets, forecasts, and business plans.
• Business Decisions: Informing business decisions regarding pricing, inventory, expansion, and resource allocation.

The processing includes the collection, recording, and management of personal and financial data to support accurate financial accounting, compliance with tax and accounting regulations, and effective accounting practices.

youbuyda stores the following types of personal data related to orders and transactions:

• Customer Data
• Order Details

The retention of personal data related to orders is carried out in accordance with legal and regulatory requirements as well as the policies of affiliated channels (e.g., Amazon). Personal data such as name, address, and contact information are stored locally (encrypted at rest) for a maximum of 30 days. The API and personal data are used solely for the specified purposes and are not shared with third parties unless it serves the primary function of the application. The security and confidentiality of your data are of the utmost importance to us.

Please note that we may update this privacy policy as necessary to comply with applicable laws and regulations. It is your responsibility to regularly stay informed about any changes.

3. Use of Cookies

Description and Scope of Data Processing, Legal Basis, Purpose, Storage Duration, Withdrawal, and Deletion Options

Our website uses cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the user's computer system. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string that enables unique identification of the browser when the website is accessed again.

a) We use technically necessary cookies to make our website more user-friendly. Some elements of our website require that the calling browser can be identified even after a page change.

The cookies typically store and transmit the following data:

• Language settings
• Login information
• Session ID

b) If we additionally use (technically unnecessary) cookies on our website that enable an analysis of users' browsing behavior, the following data can typically be transmitted:

• Entered search terms
• Frequency of page views
• Use of website functions
• IP address
• Browser data

When accessing our website, the user is informed about the use of cookies for analytical purposes and their consent is obtained for the processing of personal data used in this context. In this context, a reference to this privacy policy is also provided. The legal basis for the processing of personal data using technically necessary cookies is Art. 6(1)(f) of the GDPR. The legal basis for the processing of personal data using cookies for analytical purposes is Art. 6(1)(a) of the GDPR, provided that the user has given consent for this.

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For these functions, it is necessary that the browser can be recognized even after a page change. We require cookies for the following applications:

• Retaining language settings
• Remembering search terms
• Remembering general cookie settings

The user data collected by technically necessary cookies is not used to create user profiles. The use of analysis cookies is for the purpose of improving the quality of our website and its content. Through the analysis cookies, we learn how the website is used and can continuously optimize our offer. These purposes also constitute our legitimate interest in the processing of personal data according to Art. 6(1)(f) of the GDPR. Cookies are stored on the user's computer and transmitted to our site. As a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Already stored cookies can be deleted at any time, including automatically. If cookies are deactivated for our website, it may no longer be possible to fully use all functions of the website. The transmission of Flash cookies cannot be prevented through the browser settings, but can be prevented by changing the settings of the Flash Player.

4. Registration Function

We offer visitors the opportunity to register on our site using a contact form. The personal data that is visible in the input mask is collected and stored only for the use of our offer. In the event that a third party abuses your data, we store the IP address, the time, and the date of registration as a safeguard in order to investigate any misuse if necessary. The disclosure of your data to third parties is generally excluded. The data collected in other ways is not compared with this data. Registered visitors always have the option to change or completely delete the entered personal data from the database.

5. Contact Option

You are free to contact us at any time via a contact form or email to express your wishes and goals. The data voluntarily provided by the user in this case will be stored in our database for processing and will be deleted after the purpose of processing has been achieved. The disclosure to third parties and the comparison with other data are excluded.

6. Data Protection for Applications and in the Application Process

For the purpose of processing an application process, applicant data is electronically collected, stored, and processed. This is particularly the case when the application is submitted electronically, for example, via email. If an employment contract is concluded, the data will continue to be stored in compliance with legal regulations for the usual organizational and employment purposes in your personnel file. If no employment contract is concluded with the applicant, the applicant data will be automatically deleted from the database after the rejection has been communicated, unless there are special legal requirements, such as the obligation to provide evidence under the General Equal Treatment Act, which require a longer storage period or if you have expressly consented to a longer storage period in the application process.

7. Use of Facebook, Google+, Instagram, LinkedIn, Pinterest, Twitter, Youtube

If we use plugins from social networks such as Facebook, Google+, Instagram, LinkedIn, Pinterest, Twitter, Youtube on our website, you can recognize the respective plugins by the corresponding company logo. By accessing our website, a direct connection is established between your server and the social media server through the respective components of the social media service. For example, Facebook receives information that you have visited our website with your IP address. If you click the respective "Like" button while logged into your social media account, you can link the offers and content of our website to your network profile. If you are logged into a specific page on social media during the activation of the link, the provider of the social network may be able to determine your username and real name from the transmitted data and associate this information with your personal user account on the social network.

The servers of the social networks are located both in the USA and in other countries of the European Union. You should be aware that the respective companies are subject to their own data protection regulations and that personal data may not be protected to the same extent as in the member states of the European Union.

For the use of Google+, you need a public Google Account, which is visible worldwide. In addition, the following data can generally be transmitted to the provider of the social network:

• Your IP address
• The date and time of the visit to our website
• The address of the website on which the attached link is located
• Information about the user's operating system and browser

Furthermore, please note that we have no influence on the scope of data processing by the providers of the social networks. For more information on data protection policies, please visit the respective pages of the social networks.

For more information on each social media service, please visit:

Facebook
facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA
https://de-de.facebook.com/about/privacy/
https://developers.facebook.com/docs/plugins

Google+
Google Ireland Ltd, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland
https://developers.google.com/+/web/buttons-policy

Instagram
Instagram LLC 1601 Willow Rd Menlo Park CA 94025 USA
https://help.instagram.com/155833707900388

LinkedIn
LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
https://www.linkedin.com/legal/privacy-policy?trk=hb_ft_priv

Pinterest
Pinterest, Inc., 808 Brannan St, San Francisco, CA 94103, USA
https://pinterest.com/about/privacy/

Twitter
Twitter Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA
https://twitter.com/privacy

8. Use of Google AdSense

On our site, we use Google AdSense, a service provided by Google Ireland Ltd, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. Google AdSense selects ads that are relevant to the content of the website on which they are displayed. For this purpose, a web crawler examines the relevant content, similar to how a website is indexed for the Google search engine. For example, if a website is about photography, it is likely that ads related to photography will be displayed. In addition to the contextual targeting, AdSense also supports interest-based targeting based on the individual profile of a visitor to the website or ad. Google AdSense uses cookies for this purpose. Cookies are small text files that store information on your computer to enable analysis of your browsing behavior. You can prevent the storage of cookies by adjusting the appropriate settings. You can also delete set cookies at any time. Google AdSense also uses web beacons, which are miniature graphics integrated into web pages. The purpose is to record and analyze log files using Google AdSense web beacons. With the help of web beacons, Google Ireland Ltd can determine when a person has opened a web page and which links were followed. The evaluation of visitor numbers for certain web pages is also possible through web beacons. Google Ireland Ltd also receives information about individuals and their data, including IP addresses. These data are stored and processed by Google. Under certain circumstances, the collected data and information about individuals may be shared with third parties by Google Ireland Ltd. For more information and detailed explanations, please visit the following link: https://www.google.de/intl/de/adsense/start.

9. Use of Google Analytics with anonymization function

On our site, we use Google Analytics, a web analytics service provided by Google Ireland Ltd, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. Google Analytics uses cookies, which are small text files that store information on your computer to enable analysis of website usage. The information generated by the cookies about your use of the website is usually transmitted to and stored on a Google server in the United States. By activating the IP anonymization function, Google will truncate your IP address within the European Union or other parties to the Agreement on the European Economic Area before transmission, so that your full IP address is not transmitted. The full IP address is only transmitted to a Google server in the USA in exceptional cases, where it is shortened. Google will use this information on behalf of the website operator to evaluate your use of the website, compile reports on website activity, and provide other services related to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics is not associated with any other data held by Google. You can prevent the storage of cookies by adjusting your browser settings. However, please note that if you do this, you may not be able to use the full functionality of this website. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

10. Use of Google Remarketing

On our site, we use Google Remarketing, a service provided by Google Ireland Ltd, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. Google Remarketing is used to identify users who have visited our site in the past and to re-engage them through targeted advertising measures. With the help of the Google advertising network, targeted ads that are relevant to the user can be displayed and highlighted. Google uses cookies for this processing. Cookies are small text files on your computer that enable analysis of website usage and store data for a certain period. This allows us to recognize users if they access this website within the Google advertising network. For more information and detailed explanations, please visit the following link: https://www.google.com/privacy/ads/.

11. Use of Google AdWords

The most important component of Google AdWords is keywords. With the help of keywords, an advertiser can specify in advance that an ad should only be displayed in the results for a search using the specified terms or on thematically relevant pages. This allows for targeted targeting based on the interests of visitors and minimizes wastage. Negative keywords can also be defined, where the ad will not be displayed. Google Ireland Ltd, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland operates the service. AdWords allows for the presentation of search-relevant ads to users. If a person has been directed to our website via a Google ad, a conversion cookie is set on the user's browser. This allows both us and Google Ireland Ltd to track whether specific product sales have occurred or if a sales process has been abandoned through the use of these AdWords ads. Conversion cookies do not contain any information about the individual and are automatically deleted within 30 days. The information generated by the conversion cookies is used by Google for creating visitor statistics. These statistics enable us to determine the number of users who have been directed to our website through AdWords ads. Conversion cookies store information about the individual who visited the page. This data, including IP addresses, is transmitted to Google Ireland Ltd and may be shared with third parties. By adjusting the appropriate settings, you can prevent the storage of cookies. You can also delete set cookies at any time. For more information and detailed explanations, please visit the following link: https://www.google.de/intl/de/policies/privacy/.

12. Use of Google Fonts

This website uses Google Fonts, a service provided by Google Ireland Ltd, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. Google Fonts is used to incorporate web fonts into web pages. When a webpage is loaded, the web fonts are requested from an external server instead of being retrieved from the user's local font collection. The use of Google Fonts is not authenticated, and the website visitor does not send cookies to the Google Fonts API. Requests to the Google Fonts API are made to resource-specific domains such as fonts.googleapis.com or fonts.gstatic.com, which separate your font requests from other information you send to google.com and do not contain any other information. The anonymized request data is deleted after 24 hours. For more information and detailed explanations, please visit the following link: https://policies.google.com/privacy?hl=de.

13. Use of Google Maps

We use the Google Maps function on our website. Google Maps is a service provided by Google Ireland Ltd, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. Google Maps allows us to display geographical information visually. When you access our website, Google sets a cookie that enables the processing of user settings and data. Unless you manually delete this cookie, it will usually be deleted after a certain period of time. If you do not agree with the processing of your data, you have the option to deactivate the Google Maps service through the appropriate settings. To do this, you need to disable the JavaScript function in your browser. However, please note that you will not be able to use the Google Maps function to its full extent. For more information and detailed explanations, please visit the following link: https://policies.google.com/privacy?hl=de.

14. Use of Google reCAPTCHA v3

We use the reCAPTCHA service provided by Google Inc. on our website. The use of reCAPTCHA ensures sufficient data security when transmitting forms, especially to verify whether the input is made by a natural person or is being abused through automated processing. The query includes the transmission of the IP address and, if necessary, further data required by Google for the reCAPTCHA service. For this purpose, your input is transmitted to and processed by Google. The data processing is subject to Google Inc.'s separate privacy policies. For more information on Google Inc.'s privacy policies, please visit https://google.de/intl/de/privacy or https://google.com/intl/de/policies/privacy/.

15. Blog with Comment Function (and Subscription)

On our website, you have the option to leave your own comments on blog posts. A blog is a publicly viewable journal where users (called "bloggers") chronologically record or post thoughts or observations. Usually, these "posts" can be commented on by third parties. When a user publishes a comment, the comment, username, and IP address are stored until the blog is deleted. The storage is based on our legitimate interest in detecting and attributing unlawful posts or comments for liability reasons. Generally, no further disclosure takes place, unless it is legally required or necessary for legal defense.

With the consent of other users, it is possible to subscribe to the comments left by them, allowing the option to receive subsequent comments. If a user decides to subscribe to comments, we will send an email in the double-opt-in procedure with information on how to revoke the subscription, in order to verify that the subscriber is the owner of the provided email address. The subscription to comments can be terminated at any time, and consent can be revoked.

16. Use of Affiliate Services

We use content from Awin on this website. Awin is an affiliate network provided by AWIN AG, Eichhornstraße 3, 10785 Berlin. Affiliate is an online distribution system where a commercial provider (referred to as the "Merchant" or "Advertiser") compensates its distribution partners (referred to as "Affiliates" or "Publishers") through commissions. The Merchant or Advertiser provides advertising materials that the Affiliate embeds and uses on their website or through other channels such as keyword advertising or email marketing. When the website is accessed, Awin sets a cookie. The Awin cookie only stores the identification number of the Affiliate, as well as the order number of the website visitor and the advertising material, for the purpose of processing commission payments between the Merchant and Affiliate, which are conducted by Awin. The user can prevent the setting of the cookie by adjusting the settings of their internet browser accordingly. Further information and detailed explanations can be found at the following link: https://www.awin.com/de/news-und-events/dsgvo/awin-and-die-datenschutz-grundverordnung.

17. Receipt of our Newsletter

Our website offers the option to subscribe to our newsletter. Through the newsletter, we provide regular updates on offers, news, events, and other significant information. The newsletter can only be received by providing the necessary personal data on the registration page, which is marked as mandatory, with the email address being sufficient, and completing the registration. To ensure a consensual newsletter dispatch, we use the double opt-in (DOI) procedure. As part of this procedure, the potential recipient is initially added to the distribution list provisionally. Subsequently, the potential recipient receives a confirmation email to legally confirm their subscription. Only upon confirmation, the address is fully activated in our mailing list, and the recipient agrees to receive the newsletter. During the initial registration, we store the following information, which is necessary to document and prove a legally compliant registration:

• Your IP address
• The date and time of accessing our website

The data is used solely for the purpose of sending the newsletter. The receipt of the newsletter can be terminated at any time, and consent can be revoked. A corresponding link can be found in each newsletter. Additionally, it is possible to unsubscribe from the newsletter subscription on the website. The dispatch may be carried out by a mailing service provider. The mailing service provider acts on our behalf based on a data processing agreement and may use the data in pseudonymized form for improving their services or statistical purposes. The mailing service provider is not permitted to use the data for direct contact or disclose it to third parties. Further information about the mailing service providers can be found here:

MAILCHIMP Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA.
https://mailchimp.com/legal/privacy/

If personal data about you is processed by us, you are a data subject within the meaning of the General Data Protection Regulation (GDPR), and you have the following rights against the controller:

1. Right to information

You have the right to obtain confirmation from the controller as to whether or not personal data concerning you is being processed by us. If such processing exists, you have the right to obtain the following information from the controller:

1. the purposes for which the personal data are processed;
2. the categories of personal data that are processed;
3. the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed;
4. the planned duration of storage of the personal data concerning you, or, if specific information on this is not possible, the criteria used to determine the storage period;
5. the existence of the right to rectification or erasure of personal data concerning you, the right to restriction of processing by the controller, or the right to object to such processing;
6. the existence of the right to lodge a complaint with a supervisory authority;
7. all available information on the source of the data if the personal data is not collected from the data subject;
8. the existence of automated decision-making, including profiling, according to Article 22(1) and (4) of the GDPR, and, at least in these cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organization. In this context, you can request to be informed about the appropriate safeguards pursuant to Article 46 of the GDPR in connection with the transfer.

2. Right to rectification

You have the right to obtain from the controller the rectification and/or completion of inaccurate or incomplete personal data concerning you. The controller shall make the rectification without undue delay.

3. Right to restriction of processing

Under the following conditions, you can request the restriction of processing of your personal data:

1. If you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;
2. If the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
3. If the controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise, or defense of legal claims; or
4. If you have objected to processing pursuant to Article 21(1) of the GDPR pending the verification whether the legitimate grounds of the controller override your grounds.

If the processing of your personal data has been restricted, such data, apart from being stored, may only be processed with your consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. If the processing restriction is lifted based on the above conditions, you will be informed by the controller before the restriction is lifted.

4. Right to erasure / Obligation to erase

You can request the erasure of your personal data from the controller without undue delay, and the controller is obliged to erase this data without undue delay if one of the following grounds applies:

1. The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.
2. You withdraw your consent on which the processing pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR was based, and there is no other legal ground for the processing.
3. You object to the processing pursuant to Article 21(1) of the GDPR, and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR.
4. The personal data concerning you have been unlawfully processed.
5. The erasure of the personal data concerning you is required for compliance with a legal obligation under Union or Member State law to which the controller is subject.
6. The personal data concerning you have been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR.

If the controller has made the personal data concerning you public and is obliged to erase them pursuant to Article 17(1) of the GDPR, the controller, taking into account available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers that are processing the personal data that you have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

Exceptions
The right to erasure does not apply to the extent that processing is necessary:

1. for exercising the right of freedom of expression and information;
2. for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
3. for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) of the GDPR;
4. for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1) of the GDPR, to the extent that the right referred to in Section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
5. for the establishment, exercise, or defense of legal claims.

5. Right to notification

If you have exercised your right to rectification, erasure, or restriction of processing against the controller, the controller is obliged to communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

You have the right to be informed about those recipients by the controller.

6. Right to data portability

You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used, and machine-readable format. You also have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

1. the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR or on a contract pursuant to Article 6(1)(b) of the GDPR; and
2. the processing is carried out by automated means.

In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. This must not adversely affect the rights and freedoms of others.

The right to data portability does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to Object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Article 6(1)(e) or (f) of the GDPR, including profiling based on those provisions.

The controller shall no longer process the personal data concerning you unless they demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

Where personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for such purposes. You have the possibility to exercise your right to object in relation to the use of information society services, notwithstanding Directive 2002/58/EC, by automated means using technical specifications.

8. Right to Withdraw Consent

You have the right to withdraw your consent to the processing of your personal data at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

9. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR.