17. Social Media

We also operate several social media pages in addition to this website. We currently have company pages/ company profiles on YouTube and LinkedIn. You can reach our pages there via the corresponding buttons on our website. We expressly point out that you use these pages and their functions on your own responsibility.

When you visit our pages on the aforementioned platforms, personal data may be transmitted to and processed by the operator of the respective platform, e.g. IP address, processor type used and browser version including plug-ins. The data collected about you in this context will be processed by the provider of the social media and may also be transferred to countries outside the EU/ EEA.

If you are logged in with your personal user account while visiting such a website, the operator can assign the visit to your account. If you wish to avoid this, you should log out from the operator of the respective platform before visiting our online presence there or deactivate the “stay logged in” function, delete the cookies present on your device and close and restart your browser.

The purpose and scope of the data collection and the further processing and use of the data by the operator of the respective platform as well as your rights in this regard and setting options for protecting your privacy can be found in the respective privacy policies:

LinkedIn: https://www.linkedin.com/legal/privacy-policy
YouTube: https://policies.google.com/privacy

We do not collect or process any further data from your use of our presence on the corresponding social media platforms.

18. Social Media

a) Right of access

Every person affected by the processing of personal data has according to art. 15 GDPR the right to obtain from the controller information about the personal data stored about him or her and a copy of that information. Furthermore, the GDPR has granted the data subject access to the following information:

• the purposes of the processing
• the categories of personal data processed
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations
• if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration
• the existence of the right to obtain the rectification or erasure of personal data concerning him or her or to obtain the restriction of processing by the controller or the right to object to such processing
• the existence of a right of appeal to a supervisory authority
• if the personal data are not collected from the data subject: any available information on the origin of the data
• the existence of automated decision-making, including profiling, pursuant to art. 22 (1) and (4) GDPR and, at least in these cases, meaningful information about the logic involved and the consequences and intended effects of such processing for the data subject.

Furthermore, the data subject shall have the right to obtain information as to whether personal data have been transferred to a third country or to an international organisation. If this is the case, the data subject also has the right to obtain information on the appropriate safeguards in relation to the transfer. If a data subject wishes to exercise this right of rectification, he or she may contact the data controller or its data protection officer at any time.

b) Right of rectification

Any person affected by the processing of personal data has according to art. 16 GDPR the right to request the immediate rectification of any inaccurate personal data concerning him or her. Furthermore, the data subject has the right to request the completion of incomplete personal data, including by means of a supplementary declaration, considering the purposes of the processing. If a data subject wishes to exercise this right of rectification, he or she may contact the data controller or its data protection officer at any time.

c) Right to erasure (“right to be forgotten”)

Any person concerned by the processing of personal data has according to art. 17 GDPR the right to obtain from the controller the erasure without delay of personal data concerning him or her, where one of the following grounds applies and insofar as the processing is not necessary:

• The personal data were collected or otherwise processed for purposes for which they are no longer necessary.
• The data subject withdraws the consent on which the processing was based pursuant to art. 6 (1) lit. a) GDPR or art. 9 (2) lit. a) GDPR and there is no other legal basis for the processing.
• The data subject objects to the processing pursuant to art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to art. 21 (2) GDPR.
• The personal data have been processed unlawfully.
• The erasure of the personal data is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
• The personal data has been collected in relation to information society services offered pursuant to art. 8 (1) GDPR.

If one of the aforementioned reasons applies, and a data subject wishes to arrange for the deletion of personal data stored by the ALBOMED GmbH, he or she may contact the data controller or its data protection officer at any time.

If the personal data was made public by the ALBOMED GmbH and our company is responsible pursuant to art. 17 (1) GDPR, ALBOMED GmbH shall implement reasonable measures, including technical measures, to compensate other data controllers for processing the personal data published, taking into account the available technology and the implementation costs, in order to inform the data subject that he or she has requested from those other data controllers the erasure of all links to the personal data or to copies or replications of the personal data, unless the processing is necessary. The employee of the ALBOMED GmbH will arrange the necessary in individual cases.

d) Right to restriction of processing

Any person affected by the processing of personal data has according to art. 18 GDPR the right to request the controller to restrict the processing if one of the following conditions is met:

• The accuracy of the personal data is contested by the data subject for a period enabling the controller to verify the accuracy of the personal data.
• The processing is unlawful, the data subject objects to the erasure of the personal data and requests instead the restriction of the use of the personal data.
• The controller no longer needs the personal data for the purposes of the processing, but the data subject needs it for the assertion, exercise or defence of legal claims.
• The data subject has objected to the processing pursuant to art. 21 (1) GDPR and it is not yet clear whether the legitimate grounds of the controller override those of the data subject.

If one of the aforementioned conditions is met, and a data subject wishes to request the restriction of personal data stored by the ALBOMED GmbH, he or she may contact the data controller or its data protection officer at any time.

e) Right to data portability

Any person concerned by the processing of personal data has according to art. 20 GDPR the right to receive the personal data concerning him or her, which have been provided by the data subject to a controller, in a structured, commonly used and machine-readable format. The data subject shall also have the right to transmit such data to another controller without hindrance from the controller to whom the personal data have been provided, provided that the processing is based on consent pursuant to art. 6 (1) lit. a) GDPR or art. 9 (2) lit. a) GDPR or on a contract pursuant to art. 6 (1) lit. b) GDPR and the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, when exercising the right to data portability pursuant to art. 20 (1) GDPR, the data subject shall have the right to obtain the direct transfer of personal data from one controller to another controller where technically feasible and if this does not adversely affect the rights and freedoms of other persons. To assert the right to data portability, he or she may contact the data controller or its data protection officer at any time.

f) Right to object

Any person affected by the processing of personal data has according to art. 21 GDPR the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her which is carried out on the basis of art. 6 (1) lit. e) or lit. f) GDPR. This also applies to profiling based on these provisions.

The ALBOMED GmbH shall no longer process the personal data in the event of the objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the assertion, exercise or defence of legal claims.

If the ALBOMED GmbH processes personal data for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data processed for such marketing. This also applies to the profiling, insofar as it is related to such direct marketing. If the data subject objects to ALBOMED GmbH to the processing for direct marketing purposes, ALBOMED GmbH will no longer process the personal data for these purposes.

In addition, the data subject has the right, on grounds relating to his or her particular situation, to object to processing of personal data concerning him or her which is carried out by the ALBOMED GmbH for scientific or historical research purposes, or for statistical purposes pursuant to art. 89 (1) GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.

To exercise the right to object, he or she may contact the data controller or its data protection officer at any time. The data subject is also free to exercise his/her right to object in connection with the use of information society services, notwithstanding Directive 2002/58/EC, by means of automated procedures using technical specifications.

g) No automated decision-making

As a responsible company, we do not use automated decision-making or profiling.

h) Right to revoke consent

You have the right to revoke your consent granted to the processing of personal data according to art. 6 (1) lit a) GDPR at any time with effect for the future. The revocation of consent does not affect the lawfulness of the processing carried out based on the consent until the revocation. I you want to make changes or revoke consent with effect for the future you may contact the data controller or its data protection officer at any time.

i) How to make use of your rights

If a data subject wants to make use of the rights as stated in art. 15 to 22 GDPR he or she may contact the data controller or its data protection officer at any time. We have a statutory comment period of one month for processing your request, which can be extended by another month in exceptional cases. We aim to process your request in full within the first month after receiving it. Please note that due to legal storage periods, we may still be obliged to store certain of your personal data even after a request for deletion has been made.

j) Right to complain

If the data subject wishes to exercise the right to withdraw consent, he or she may, at any time, contact any employee of the controller.

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your place of residence, your place of work or the place of the alleged violation, without prejudice to any other administrative or judicial remedy.

The supervisory authority for data protection responsible for us is the

Bayerisches Landesamt für Datenschutzaufsicht
(Bavarian State Office for Data Protection Supervision)

Location: Promenade 18 | 91522 Ansbach | Germany
Postal Address: PO Box 1349 | 91504 Ansbach | Germany

fon: +49 (0) 981 180093-0 | email: poststelle@lda.bayern.de