Privacy Policy
Ress Möbelwerkstätten GmbH & Co KG (hereinafter referred to as “Ress”) processes personal data as described below, in accordance with current law, and in particular with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act and further regulations based on these provisions.
With this Privacy Policy, we are fulfilling our legal obligation to explain your rights with regard to your personal data and how we save this information.
I. Applicability of data protection
Data protection applies to personal data which we process, as a data controller.
‘Personal data’ is defined as all information referring to an identifiable natural person. A natural person is considered identifiable when they can be linked, directly or indirectly, in particular to an identifier such as a name, a customer number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
‘Processing’ is defined as any operation or set of operations, automated or otherwise, which is performed on personal data or on sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
II. Name and contact details of the data controller according to Art. 13 I a, 14 I a GDPR
The data controller is:
Ress Möbelwerkstätten GmbH & Co KG (District Court Schweinfurt HRA 8617), Ottelmannshäuser Straße 1, 97631 Bad Königshofen, Germany, Telephone: +49 / (0) 9761 / 408- 0, Fax: +49 / (0) 9761 / 408 29, E-Mail: info@ress-moebel.de, represented by Ress Verwaltungs GmbH (AG Schweinfurt HRB 5019), in turn represented by Managing Director: Michael Reß, USt-Id-Nr.: DE 814751697, Website: www.ress-moebel.de.
III. Contact details of the data protection officer according to Art. 13 I b, 14 I b GDPR
The data protection officer is:
Ms Dorit Hemmerling
Ress Möbelwerkstätten GmbH & Co. KG
Ottelmannshäuserstr.1
97631 Bad Königshofen
Tel. 09761-40 811
E-Mail: d.hemmerling@ress-moebel.de
IV. Specific forms of personal data processing
Ress processes personal data as follows:
1. Collection of website visitors’ personal data/creation of log files
When you visit our website, we process your data as follows:
a) Description and scope of data processing
If you use our website for information only, we will process solely the personal data your browser provides to our server. This data consists of:
Your IP address
The date and time of your request
Time zone difference to Greenwich Mean Time (GMT)
Content of your request (specific page), the pages accessed, the names of the file accessed
Access status/HTTP status code, report as to whether access was successful
Data quantity transmitted in each case
Website from which the request comes
Browser
Operating system and interface
Browser software language and version
Data quantity transmitted
Referrer URL (i.e. the website by which you accessed our website)
Access status (file transferred, file not found etc.)
This data is also saved in the log files of our system. This data is not saved together with the user’s other personal data. It is passed on to our contract data processor Strato AG.
b) Legal grounds for data processing
The legal basis for temporary storage of data and log files is point (f) of Article 6 (1) GDPR.
c) Purpose of data processing
Data is saved in log files to ensure the functionality of the website. In addition, the data we save in this way allows us to optimise our website, ensure its security, and stabilise our IT systems. Data from log files is not analysed for marketing purposes
These purposes cover our legitimate interest in data processing according to point (f) of Article 6 (1) GDPR.
d) Duration of data storage
Data is deleted as soon as it is no longer required for the purpose for which it was collected. Data collected in log files is deleted after a maximum of seven days. It is possible that data may be saved for longer. However, where this occurs, the user’s IP address is deleted or anonymised so that it can no longer be linked to the calling client.
e) Information according to point (e) of Article 13 II GDPR
The provision of this data is neither a statutory nor a contractual requirement. Data is also not required for the conclusion of a contract. You are under no obligation to provide this data. However, for the website to operate, data is required to be collected and saved in log files. For this reason, if you do not consent to the provision of your data, you will be unable to use our website.
2. Use of Cookies
We use cookies on our website as follows:
a) Description and scope of data processing
In addition to collecting the data mentioned above, we use cookies, which are stored on your device when you use our website. Cookies are small data packages that are linked to your browser and stored on the hard drive of your device. When a user accesses our website, a cookie can be saved on the user’s operating system. The cookie will contain a characteristic sequence of characters that will allow us to recognise your browser the next time you access our website.
Our website uses the following cookie types:
Transient cookies
Persistent cookies.
The scope and functioning of these cookies are described as follows:
Transient cookies are automatically erased when you close your browser. Specifically, they include session cookies, which save a session ID that can link the various requests of a browser to the session in which they were carried out. This allows us to recognise your device when you return to our website. Session cookies are deleted when you log out or close your browser.
Persistent cookies are automatically erased after a specified period, which can vary depending on the cookie. You can also erase cookies yourself via your browser settings.
We use the following cookies:
_gat (1 minute) by Google Analytics => Used to throttle request rate.
To find out more, go to:
https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage,
_ga (2 years) by Google Analytics => Used to distinguish users.
To find out more, go to:
https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage,
_gid (1 day) by Google Analytics => Used to distinguish users.
To find out more, go to:
https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage,
_cb_enabled (1 year) => Detects whether the cookie policy should be shown, and whether the user has agreed or not.
b) Legal grounds for data processing
The legal basis for processing personal data via cookies is point (f) of Article 6 (1) GDPR.
c) Purpose of data processing
The purpose of the _cb_enabled cookie is to make our website easier to use and refer users directly to our data policy. The _cb_enabled cookie is required for technical purposes. Google Analytics cookies are also used to evaluate your use of our website, compile reports on website activities and allow the website operator to provide other services relating to your use of the internet and the website. See Section IV.3 of this data policy for more information.
These purposes are central to our legitimate interest in processing personal data in accordance with point (f) of Article 6 (1) GDPR.
User data collected by cookies that is required for technical reasons is not used to create user profiles.
d) Duration of data storage
Cookies are stored on the user’s device and transmit data from the device to our website. This means that you, as the user, have full control over the use of cookies. You can deactivate or limit the transfer of cookies by changing your browser settings and delete any cookies that are already saved on your device at any time. This can also be done automatically. Deactivating cookies for our website may prevent you from using some or all of the functions on our website.
Transient cookies are deleted automatically when you close your browser. Persistent cookies are deleted automatically after a specified period of time. For more details on how long the cookies we use are stored, please see IV.2.a. of this policy.
e) Information according to point (e) of Article 13 II GDPR
The use of our cookies for the provision of data is neither a statutory nor a contractual requirement. It is also not required for the conclusion of a contract. You are under no obligation to provide this data. However, the use of cookies to provide data is required for the website to operate. If you do not give your consent, you will not be able to use parts or all of our website.
Borlabs Cookie
This website uses a Borlabs Cookie, which sets a technically necessary cookie (borlabs-cookie) to store your cookie preferences.
Borlabs Cookie does not collect any personal data.
The borlabs-cookie cookie stores the consent you have given when you entered the website. If you wish to revoke these consents, simply delete the cookie from your browser. If you re-enter/reload the website, you will be asked again for your cookie consent.
The cookie preferences can be viewed and changed here:
Cookie Preferences
3. Use of Google Analytics
We use Googles Analytics as follows:
a) Description and scope of data processing
In addition, we use Google Analytics, a web analysis service operated by Google Inc (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”). Usage includes Universal Analytics. This uses a pseudonym User ID to associate data, sessions and interactions across devices so that a user’s activities can be analysed across all of them.
Google Analytics uses so-called cookies, small data packages saved on your device that allow your use of the website to be analysed. The information about your usage of our website that is collected by the cookie includes the browser type or version you are using, your operating system, the referrer URL (the previous website you visited), the hostname of the device being used to access the website (IP address) and the time of the server request. This data is generally transferred to a Google server in the USA, where it is then stored. The IP address transferred by your browser for Google Analytics is not associated with other Google data. Furthermore, we have added the “anonymizeIP” code to Google Analytics on this website. This guarantees that your IP address will remain masked and any data collected will be in anonymized form. Only in exceptional cases is the full IP address transmitted to a Google server in the US, and solely in abbreviated form.
We have a contract with Google covering contract data processing and we implement the specifications of the data protection authorities in full when using Google Analytics.
b) Legal grounds for data processing
The legal basis for using Google Analytics is § 15 Para.3 TMG (Telemedia Act) and/or point (f) of Article 6 (1) GDPR.
c) Purpose of data processing
Google uses this information on behalf of the website operator to evaluate your usage of the website, compile reports on website activities, and provide further services to the website operator relating to website usage and internet usage.
These purposes cover our legitimate interest in the processing of personal data.
d) Duration of data storage, options for objection and elimination
Sessions and campaigns terminate after a specified period. Sessions are terminated, as standard, after 30 minutes of inactivity. Campaigns are terminated after six months. Campaigns can have a duration of up to two years. To find out more about the terms of use and data protection, go to:
https://www.google.com/analytics/terms/de.html
or
https://policies.google.com/privacy?hl=de.
You can prevent cookies from being saved on your device by using your browser settings. However, we remind you that by preventing cookies, you will no longer be able to use all of the website functions in full. In addition, you can prevent the website usage data (including your IP address) that is collected via the cookie from being transmitted to and processed by Google. To do this, download and install the browser plug-in at:
Browser add-on to deactivate Google Analytics.
Opt-out cookies prevent any further data from being collected when you visit this website again in the future. To prevent your data from being collected by Universal Analytics over several devices, you will need to opt out on each individual system. If you click here, you will set the opt-out cookie.
e) Information according to point (e) of Article 13 II GDPR
The use of Google Analytics for the provision of data is neither a statutory nor a contractual requirement. Nor is this data required for the conclusion of the contract. You are under no obligation to provide this data and will not be affected if you choose not to provide it.
4. Contacting us via our contact form, email, phone or fax
You can contact us via the contact form on our website, or by email, phone or fax. If you choose to do so, we will process your personal data as follows:
a) Description and scope of data processing
If you would like to contact us but are not seeking to enter into a contract with us, you can use the contact form on our website, email, phone or fax. If a user chooses to use the contact form, the data that is entered on the screen is transferred to us and saved. This data comprises: email address, where applicable: your form of address, your first and surnames, your telephone number and your query. In addition, when the message is sent, the following data is also saved:
The user’s IP address
The date and time the form was sent
You can also contact us using the email address, phone number or fax number provided. If you choose one of these options, any personal data that is provided by email, telephone or fax will be saved. None of this data will be passed on to third parties. The data will be used solely in relation to the conversation.
If you contact us not intending to enter into pre-contract measures and/or the fulfilment of a contract, your data will not be passed on to third parties without your consent. The data will be used solely in relation to the conversation by us and our employees.
If you contact us with the intention of entering into pre-contract measures and/or the fulfilment of a contract, we reserve the right to pass your data on.
Possible categories of recipients may be: employees, assignees, payment service providers (in particular banks and credit institutes), logistics services providers, third-party debtors, registration offices, courts of law, authorities, court bailiffs, lawyers, credit agencies.
b) Legal grounds for data processing
The legal basis for processing data arising from the contact form, transmission of emails, or from contacts via telephone or fax is point (f) of Article 6 (3) GDPR.
Where contact is required for pre-contractual measures to be taken following an enquiry by the data subject and/or for the contract to be fulfilled, the legal basis for processing data is point (b) of Article 6 (1) GDPR.
c) Purpose of data processing
We process personal data from contact forms, emails, phone calls and faxes solely for purposes of contacting the individuals concerned. This represents our legitimate interest in saving data according to point (f) of Article 6 (1) GDPR, since it would be impossible to contact you without these details. Other data processed during the transmission of the contact form is used to prevent the contact form from being misused and ensure the security of our IT systems.
If you contact us with the intention of entering into a contract (specifically with the aim of entering into contract negotiations, initiating or concluding a contract) and/or to fulfil a contract, we will process data in order to clarify, establish and realise our contractual relationship with you.
d) Duration of data storage
Data is deleted as soon as it is no longer needed to fulfil the purpose for which it was collected. In the case of personal data entered into the contact form or provided via email, telephone or fax, this will be when interactions with the user have ended. Interactions end when circumstances indicate that the matter under discussion has been fully clarified. With regard to additional personal data that is collected as the message is sent, deletion will take place within a maximum of seven days after the interaction ended.
If contact is required in order to realise pre-contractual measures taken at your request and/or for the fulfilment of a contract with us, your data will be saved for the duration of the negotiations or the contract period. Where negotiations end without a contract being concluded, we will verify at the end of a three-year period beginning on the last day of the year of negotiations whether or not we need to save your data. Where contract negotiations end with the conclusion of a contract, we will save your data for the duration of the contract and verify after a three-year period beginning on the last day of the year of contract expiry or termination whether or not we need to retain your details and whether its deletion would breach statutory retention periods, in particular according to §257 HGB (German Commercial Code) and §147 AO (German Tax Code).
e) Information according to point (e) of Article 13 II GDPR
If you use the contact form or an email solely to contact us, the provision of data is neither a statutory nor contractual requirement. The data is also not required for the conclusion of a contract. You are under no obligation to provide this data. If you do not consent to us contacting you, we will not be able to reply to you or respond to your query.
If contact is required in order to take pre-contractual measures on your request and/or to fulfil a contract with you, you will be required, as a contract party, to provide us with your personal data. The provision of this data is also required in order to establish and carry out a contractual agreement. Where this is the case, data can only be deleted before the end of the retention period if its deletion does not breach any other contractual or statutory duties.
f) SSL/TLS encryption
For security reasons and to protect confidential information such as enquiries during transmission, we use SSL or TLS encryption. When you use an encrypted connection, the URL in your browser will be prefaced by “https://” rather than the standard “http://”, and a padlock symbol will appear beside the address. When SSL and TLS encryption are activated, the data you send us will not be visible to third parties.
5. Newsletter
Our website offers you the option of signing up to our “Factory Outlet” newsletter. If you choose to subscribe, please note the following:
a) Description and scope of data processing
Our website offers you the option of subscribing to our newsletter free of charge. The newsletter tells you about upcoming factory outlet sales. When you sign up for the newsletter, the data you enter for the subscription will be transmitted to us.
This data consists of your name and your email address.
In addition, the following data will be collected when you subscribe:
– The IP address of the calling computer
– The date and time of your registration
When you subscribe to the newsletter, you will be asked to give your consent to the collection of this data and referred to this data policy.
b) legal grounds for processing data
The legal basis for processing data with the user’s consent is point (a) of Article 6 (1) GDPR. However, this applies solely to users registering for the newsletter without intending to conclude a contract.
c) Purpose of data processing
Certain content and services on our website are available only to registered users.
d) Duration of data storage
Data is deleted as soon as it is no longer needed to fulfil the purpose for which it was collected. Data collected while subscribing for the newsletter is deemed to have fulfilled its purpose when the subscription is modified or terminated.
e) Information according to point (e) of Article 13 II GDPR
As a user, you have the right to end your subscription to the newsletter at any time or change your data. You can do this by using the unsubscribe link in your subscription confirmation email, or simply by sending us an email containing the words “Unsubscribe Factory Outlet” in the subject line. Send this email to info@ress-moebel.de.
The data from your subscription is not required for the conclusion of a contract. You are under no obligation to provide this data. If you object to the newsletter, you will no longer receive one.
6. Orders/conclusion of contracts and other pre-contractual measures
Ress processes personal data in order to fulfil contracts with the data subject, or to take pre-contractual measures in response to an enquiry by the data subject. The data is processed as follows:
a) Description and scope of data processing
Where a contract is concluded, or where pre-contractual enquiries are submitted with a view to concluding a contract, we require the following data from you:
– Form of address
– First and surnames
– Address
– Delivery or collection address
– Telephone number
– Email address
– Payment method and bank data
– VAT number
– Drawings
– Order
– Delivery date
This personal data is processed. In addition, where required for the fulfilment of contracts and the introduction of pre-contractual measures, we also process all of the other personal data you provide.
We reserve the right to pass this data on.
In order to deliver goods to you, we intend to share your data with Deutsche Post AG/DHL Paket GmbH, United Parcel Service Inc. (UPS), General Logistics Systems Germany GmbH & Co. OHG (GLS), DPA Deutschland GmbH (DPA). In addition, we intend to pass the data on to Schönbuch GmbH and Creditreform.
Furthermore, where order processing requires it, Ress will transmit customers’ personal data to the following categories of recipient: assignees, payment service providers (primarily our banks and credit institutes), logistics services providers (primarily hauliers), third party debtors, registration offices, courts of law, court bailiffs, lawyers, credit agencies and data-processing contractors.
b) Legal grounds for data processing
The legal basis for processing data relating to orders for goods and pre-contractual enquiries with the intention concluding a contract is point (b) of Article 6 (1) GDPR.
c) Purpose of data processing
The aforementioned data is processed to fulfil a contract with the user or take pre-contractual measures. Without this data, we cannot enter into a contract with you, as this information is required for us to conclude and fulfil the contract.
d) Duration of data storage
Data is deleted as soon as it is no longer needed to fulfil the purpose for which it was collected. This means for the duration of contract handling. Three years after payment of the invoice for the order, starting on the last day of the year of order placement, we will review whether your data is still required and whether its deletion would breach statutory retention periods, in particular those set out in §257 HGB (German Commercial Code) and §147 AO (German Tax Code).
e) Information according to point (e) of Article 13 II GDPR
§2 I of our Terms & Conditions and section II of our Purchasing Terms specify that you are required to provide the data listed in this section of our Privacy Policy. The data is required for the conclusion of a contract and for pre-contractual measures to be taken, in particular if you wish to submit an effective offer to us. If you do not provide the data required, we will be unable to set up a contract for goods and/or you will be unable to submit an effective offer for the conclusion of a contract. Where this is the case, data can be deleted early, where statutory and contractual requirements permit.
V. Rights of data subjects
This section outlines your rights according to points (b-d) Article 13 II and points (c-e) Article 14 II GDPR. According to the GDPR, the processing of your personal data makes you a data subject. As the data subject, you have a number of rights which data controllers must fulfil:
1. Right of access according to Art. 15 GDPR
You have the right to obtain from the data controller confirmation as to whether or not your personal data is being processed by us. If your data is being processed, you are entitled to demand the following information from the data controller:
a) The purposes of processing
b) The categories of personal data being processed
c) The recipients or categories to whom your personal data has been or will be disclosed
d) The envisaged period for which the data will be stored or, if specifics cannot be provided, the criteria used to determine that period
e) The existence of the right to request that the controller rectify or erase your personal data, the right to restrict or object to data processing
f) The existence of the right to lodge a complaint with the supervisory authority
g) Where the personal data was not collected from the data subject: any available information as to its source
h) The existence of automated decision-making, including profiling, according to Article 22 (1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved as well as the significance and the intended consequences for the data subject of processing their data
You have the right to demand information as to whether your personal data has been transmitted to a third country or an international organisation. In this context, you have the right to be informed of appropriate safeguarding, pursuant to Article 46 GDPR, during data transmission.
2. Right to rectification according to Article 16, 19 GDPR
Where personal data is incorrect or incomplete, you have the right to obtain from the controller the rectification of inaccurate data and/or completion of data. The data controller must respond without undue delay.
3. Right to restriction of processing according Art. 18, 19 GDPR
Where any of the following applies, you have the right to restrict the processing of your personal data:
a) You contest the accuracy of the personal data associated with you for a period long enough to enable the controller to verify the accuracy of the personal data
b) Processing is unlawful and you oppose the erasure of the personal data, and demand its use be restricted instead
c) The controller no longer needs the personal data for the purposes of processing but is required to keep it in order to establish, exercise or defend against legal claims
or:
d) You have objected in accordance with Article 21 (1) GDPR to your data being processed and verification is still pending of whether the legitimate grounds of the controller override your own.
Where the processing of your personal data has been restricted, the data – with the exception of storage – can be processed only with your consent, or for the establishment, exercise or defence of legal claims for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State.
If you have obtained restriction of processing according to requirements outlined above, you will be informed by the data controller before the restriction on processing is lifted.
4. Right to erasure according to Article 17, 19 GDPR
a) Obligation to erase data
You have the right to obtain from the controller the erasure of your personal data without undue delay. The controller is obliged to erase the data without undue delay where one of the following grounds applies:
(1) Your personal data is no longer required to fulfil the purposes for which it was collected or otherwise processed
(2) You withdraw your consent for data processing according to point (a) of Article 6 (1)) or point (a) of Article 9 (2) GDPR, and where there were no other legal grounds for the processing
(3) You object to processing pursuant to Article 21 (1) GDPR and there are no overriding legitimate grounds for processing; or you object to processing pursuant to Article 21 (2) GDPR
(4) Your personal data has been unlawfully processed
(5) Your personal data has to be erased in order to comply with the legal obligation in Union or Member state law to which the controller is subject
(6) Your personal data has been collected in relation to the offer of information society services referred to in Article 8 (1) GDPR
b) Provision of information to third parties
Where the controller has made your personal data public and is obliged, pursuant to Article 17 (1), to erase it, the controller must take reasonable steps, taking into account the available technology and cost of implementation, to inform other data processors who have demanded and are processing your personal data that you, the data subject, have demanded the deletion of all links to, or copy or replication of, this personal data.
c) Exceptions
You do not have the right to insist on your data being erased if processing is necessary for:
(1) Exercising the right of freedom of expression and information
(2) Compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
(3) Reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9 (2) as well as Article 9 (3) GDPR
(4) Archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89 (1) insofar as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of processing
or:
(5) The establishment, exercise or defence of legal claims.
Right to be informed
If you have exercised your right to demand that the data controller correct, delete or limit the processing of your data, the data controller is obliged to inform all recipients of your personal data to correct or delete it, and/or to limit its processing accordingly, unless this is proven to be impossible or entails an unreasonable amount of time and effort.
You have the right to demand that the data controller inform you who has received your data.
5. Right to data portability according to Article 20 GDPR
You have the right to receive the personal data that you have provided to a controller in a structured, commonly used and machine-readable format. You have the right to transmit this data to another controller without hindrance from the controller to whom you originally provided the data, where:
a) Processing is based on consent pursuant to point (a) of Article 6 (1), or point (a) of Article 9 (2), or on a contract pursuant to point (b) of Article 6 (1)
and:
b) Processing is carried out by automated means
In exercising this right, you also have the right to have personal data transmitted directly from one controller to another, where technically feasible. However, this must not adversely affect the rights and freedoms of others.
The right to data portability does not apply for personal data that is processed in order to perform a task carried out in the public interest or in the exercise of official authority vested in the controller.
6. Right to object according to Article 21 GDPR
You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data which is based on point (e) or (f) of Article 6 (1) GDPR, including profiling based on those provisions.
The data controller shall no longer process your personal data unless the controller demonstrates compelling legitimate grounds for the processing which override your own interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.
Where personal data is processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for this marketing, which includes profiling to the extent that it is related to this direct marketing.
Where you object to the processing of your personal data for direct marketing purposes, your personal data will no longer be processed for these purposes.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you are entitled to exercise your right to object by automated means using technical specifications.
7. Right to revoke consent to data processing according to Article 7 III GDPR
You have the right to withdraw your consent to data processing according to Article 6 or Article 9 II GDPR at any time. Withdrawing your consent will not affect the lawfulness of processing based on consent before its withdrawal.
8. Automated individual decision-making, including profiling according to Article 22 GDPR
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly. This does not apply when the decision:
a) Is necessary for entering into, or performance of, a contract between the data subject and a data controller
b) Is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, as the data subject
or:
c) Is based on your explicit consent
However, these decisions must not be based on special categories of personal data referred to in Article 9 (1), unless point (a) or (g) of Article 9 (2) applies and suitable measures are in place to safeguard your rights and freedoms and legitimate interests as the data subject.
In the cases referred to in points (a) and (c), the data controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, as the data subject. This includes at least the right to obtain human intervention on the part of the controller, express your point of view and contest the decision.
9. Right to lodge a complaint with the supervisory authority
Without prejudice to any other administrative or non-judicial remedy, you have the right to lodge a complaint with a supervisory authority according to Article 77 GDPR, in particular in the Member State in which you live or work, or the place of the suspected breach, if you believe that the processing of your personal data is in breach of the GDPR.
The supervisory authority receiving the complaint must inform the complainant of the status of proceedings and outcomes, including options for judicial remedy according to Article 78 GDPR.
VI. Information according to Article 13 II f, 14 II g GDPR
There is no automated decision-making.
