II. | Use of Personal Data by the Company |
The Company processes personal data of the Data Subjects such as names, contact data, tax numbers and all other information necessary for the participation of a Data Subject in the PSUP 2023 as well as for the administration, processing and execution of the PSUP 2023 (processing purpose). The legal basis for data processing is Art. 6 para. 1 (b) GDPR.
In addition, the Company processes personal data of the Data Subjects if and to the extent required by the law applicable to the Company (e.g., tax law). The legal basis for data processing in this respect is Art. 6 para. 1 (c) GDPR.
III. | Transfer of Personal Data |
The Company may disclose personal data to an external service provider (“External Service Provider”) commissioned or involved for the purposes of the administration, processing and/or execution of the PSUP 2023 in order to support the processing of personal data for the processing purpose set out in Section II above. If and to the extent permitted by law, the Company may also commission other third parties to provide certain services, such as IT-services and legal services, for the processing purpose set out in Section II above and may disclose personal data to such third parties. These recipients provide their assistance or services to the Company under its control and direction and may have access to personal data to the extent necessary to provide their assistance or services.
In addition, the Company may, to the extent required and permitted by law, transfer personal data to domestic and foreign authorities or courts in order to fulfil legal obligations.
IV. | Storage and Deletion of Personal Data |
The Company processes the personal data within the framework of the participation of the Data Subjects in the PSUP 2023. The Company deletes the personal data if it no longer needs it for the fulfilment of its contractual obligations under the PSUP 2023 and if there are no legal storage obligations. In the event of a legal obligation to retain personal data, the Company shall restrict the processing of such personal data.
V. | Rights of the Data Subjects |
The Data Subjects may, at any time and free of charge, contact the Company or its Data Protection Officer directly with an informal notification in order to exercise their rights under the GDPR. The Data Subjects have the right, subject to the legal requirements, the fulfilment of which is to be examined on a case-by-case basis, to request information on their personal data, any rectification or deletion of their personal data, information regarding restrictions on the processing of their personal data and they have the right to receive their personal data in a structured, generally used and machine-readable format.
The Data Subjects also have the right to object to the processing of their personal data, subject to the legal requirements, the fulfilment of which must be examined on a case-by-case basis.
In addition, Data Subjects have the right to lodge a complaint with a supervisory authority.
- 16 -