Information on data processing under the EU General Data Protection Regulation (GDPR)

The following information provides an overview of how we process your personal data and your rights under data-privacy law.

1. Who is responsible for the data processing, and whom can you contact in this respect?

The body responsible for the processing of your personal data (the "data controller") is:

BDÜ Weiterbildungs- und Fachverlagsgesellschaft mbH

Address
Uhlandstr. 4-5, 10623 Berlin
Telephone
+49 30 887128-37
Fax
+49 30 887128-40
E-mail
konferenz@bdue.de

You can reach our data protection officer under:

Udo Wenzel, agentia Wirtschaftsdienst

Address
Budapester Str. 31, 10787 Berlin
Telephone
+49 30 21964398
E-mail
udo.wenzel@agentia.de

2. For what purposes, and on what legal basis, do we process your personal data?

We process personal data that we receive in the context of orders for services and products. In addition, we process personal data to the extent necessary for answering queries and providing the participant portal.

If you place an order, your information from the ordering process, including the contact data you have given there, will be stored by us in order to handle the order, and in case of subsequent questions. We only pass on these data for dealing with your order/query to third parties who are commissioned as processors according to Article 28 of the GDPR; to the extent necessary.

Thus processing of the data entered during the ordering process is done exclusively on the basis of your consent (Art. 6, para. 1, item a GDPR). You can revoke this consent at any time. A simple notification by e-mail, without a specific form, is sufficient. The legality of the data-processing actions that have occurred until revocation is not affected by the revocation.

On our Web site, we operate an internal participant portal, to which you can install access. The processing of the personal data for this access is done on the basis of your consent (Art. 6 para. 1, item a, GDPR) while the access is being installed. The data collected during this will be stored by us until you demand we delete them, or revoke your consent for the storage. Statutory periods of retention are not affected by this.

3. To whom may my personal data possibly be transmitted?

Within the company BDÜ Weiterbildungs- und Fachverlags GmbH, only those employees and bodies bound to secrecy obtain access to your data who need these in order to met our contractual and statutory obligations, or to handle your query and/or order, including invoicing for it. For these purposes defined specifically by us, service providers who may be employed by us (such as IT service providers) also obtain personal data; these service providers are also bound to secrecy. The same applies to our tax consultant, to whom we transmit the data necessary for proper accounting on the basis of Article 9. para. 2, item h GDPR in conjunction with Sec. 22 para. 1, item 1-b, Revised Federal Data Privacy Act [BDSGneu].

The processing of the data by service providers employed by us is done as commissioned processing under Art. 28 GDPR. If service providers in third countries are employed, in addition to written instructions, these will be obliged to maintain the level of data protection in Europe by appropriate measures (such as agreeing on the EU standard contract clauses.

Apart from this, we will only transmit your personal data to third parties if this is legally permitted or you have consented.

The processing is done on the basis of your consent, according to Article 6 para. 1, item a, or Article 9, para. 2, item a, of the GDPR.

4. How long will my data be stored?

We store your personal data in principle as long as is necessary for carrying out preliminary contractual measures and for handling orders and making the participant portal available.

The data you have specified remain in our hands until you call on us to delete them, or revoke your consent to their storage, or the purpose of the data storage no longer exists. Mandatory statutory provisions are not affected by this.

In addition, we are subject to various legal obligations of retention, arising from the German Commercial Code [Handelsgesetzbuch] and Tax Code [Abgabenordnung], among others. The periods of retention provided for there extend up to ten years past the end of the contractual relationship. Due to these statutory provisions, we are obliged to continue to store data for a corresponding further period, on the basis of Article 6, para. 1. item c. or Article 9, para. 1, item g of the GDPR.

The further storage for a corresponding period is done on the basis of Article 6. para. 1 item f, GDPR, to protect our legitimate interests, or of Article 9, para. 1, item f, GDPR, to assert, exercise, or defend legal claims.

5. What rights do you, as the person affected by the processing of your personal data, have under the GDPR?

Right to be informed

You have the right, under Article 15 GDPR in conjunction with Sec. 34, Revised Federal Data Privacy Act, to demand information from us about the personal data concerning you processed by us. In this case, we will provide you with a copy of the personal data, possibly also in electronic format. You also have the right to the information specified in Article 15 para. 1 GDPR. However, the aforementioned rights are not unrestricted; the restrictions on these rights are given in particular by Article 15 para. 4 GDPR and Sec, 34m Revised Federal Data Privacy Act zu entnehmen.

Right to correction of incorrect data

You have the right to prompt correction of incorrect personal data concerning you, and to completion of incomplete data, according to Article 16 GDPR.

Right to deletion

You have the right, as provided by Article 17 GDPR in conjunction with Sec. 35 Revised Federal Data Privacy Act, to demand the prompt deletion of the personal data concerning your. However, this right to deletion is not unrestricted. In particular, a deletion cannot be demanded if further processing of the personal data concerning you is necessary for us to perform the contract that exists between us, to perform a legal obligation, or to assert, exercise, or defend legal claims. The preconditions and restrictions of the right to deletion are given in particular by Article 17 GDPR and Sec, 35 Revised Federal Data Privacy Act.

Right to limit the processing of personal data

You have the right, as provided by Article 18 GDPR, to demand limitation of the processing of the personal data concerning you, if one of the preconditions of Article 18 para. 1 GDPR applies. In this case, we may continue to store these data, but apart from this, only process them under strict preconditions. The preconditions and restrictions of the right to restriction of processing are given in particular by Article 18 GDPR.

Right to transfer of data

You have the right, as provided by Article 20 GDPR, to receive those personal data provided by you, which we process by an automated method on the basis of your consent, in a structured, usual, and machine-readable format. We are forbidden to hinder the transmission of these data by you to another data controller. In addition, you can demand that we transmit them directly to another data controller, if this is technically feasible. The preconditions and restrictions of the aforementioned rights are given in particular by Article 20 GDPR.

We will provide the aforementioned notifications and measures demanded by you free of charge, as provided by Article 12, para. 5, GDPR.

Right of complaint to a data-protection supervisory authority

As a person affected, you have the right, as provided by Article 77 GDPR, in conjunction with Sec. 19, Revised Federal Data Privacy Act, regardless of other administrative or judicial remedies, to complain to a data-protection supervisory authority, if you are of the opinion that the processing of your personal data violates the GDPR.

The supervisory authority responsible is the:

Berlin State Data-Protection and Freedom-of-Information Officer

Address
Friedrichstraße 219, 10969 Berlin
Telephone
+49 30 13889-0
Fax
+49 30 215-5050
E-mail
mailbox@datenschutz-berlin.de

Right to object

You can revoke a consent to the processing of your personal data granted to us at any time. Please note that the revocation only takes effect for the future, and does not affect the legality of the processing done on the basis of your consent until this revocation.

You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data done on the basis of Article 6, para. 1, item f of the GDPR (processing to safeguard the legitimate interests of the data controller or of a third party).

If you make an objection, we will no longer process your personal data, unless we can demonstrate compelling grounds warranting protection for this processing, which outweigh your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.