Data Protection Information to Fulfil Transparency Obligations under the GDPR
Scope
For the creation of photo and video recordings and their publication for advertising and informational purposes on our own website and in printed materials.
Protecting your personal data is a matter of great importance to us. We therefore process your data exclusively on the basis of statutory provisions (EU General Data Protection Regulation – GDPR – and the German Federal Data Protection Act – BDSG). In this data protection notice, we inform you about the most important aspects of data processing. Exactly which data are processed and how they are used depends primarily on the respective contract or mandate.
Chapter I – Data Controller
§ 1 Provider and Controller
Controller in the sense of Art. 4 No. 7 GDPR is:
oose eG
Schomburgstr. 50
D – 22767 Hamburg
Mail: datenschutz@oose.de
Commercial Register, Hamburg Local Court: GnR 1067
Board Members:
Nicola Jährig (E-Mail: nicola.jaehrig@oose.de)
Felix Heppner (E-Mail: felix.heppner@oose.de)
Tim Weilkiens (E-Mail: tim.weilkiens@oose.de)
Chair of the Supervisory Board:
Stephan Roth (E-Mail: stephan.roth@oose.de)
§ 2 Data Protection Officer
External Data Protection Officer:
Karsten Klug
– Externer Datenschutzbeauftragter –
Klug Datenschutz-Consulting
Kaiser-Wilhelm-Str. 93
20355 Hamburg
Mail: mail@klug-datenschutz.de
Chapter II – Processing Framework
§ 3 Nature, Purposes and Legal Bases
(1) We process personal data in accordance with the GDPR and BDSG. Specifically, we process photo and video recordings of persons who have participated in oose events and have given their consent, for the purposes of event reporting, self-promotion, and press and public relations.
Legal bases
a) On the basis of a balancing of interests under Art. 6(1)(f) GDPR – the processing (creation and publication of photo and video recordings) is necessary for the purposes of the legitimate interests pursued by the controller or a third party, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data (e.g. if the data subject is a child).
“Third party” means any natural or legal person, authority, institution or other body other than the data subject, the controller, the processor, or persons authorised to process personal data under the responsibility of the controller or processor.
Legitimate interests of the controller or third parties include using the recordings for self-promotion, providing information about events and capturing impressions and atmospheres, so long as you have not objected to the use of your data.
b) On the basis of your consent under Art. 6(1)(a) GDPR – where you have given us consent to process personal data for specific purposes (here: creating and publishing photos for self-promotion and press/public relations), the lawfulness of processing is based on that consent. You may withdraw such consent at any time. This also applies to consents given before the GDPR’s effective date (25 May 2018). Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.
§ 4 Data Sources and Data Categories
We process the photo and video recordings that we have taken ourselves at our events or that have been made on our behalf by service providers (e.g. professional photographers). We may also store geographic data and the date of creation. We do not link recordings to your first or last name.
§ 5 Storage Period
We store photo and video recordings for a maximum of three years.
§ 6 Obligation to Provide Data
Providing your image or likeness is mandatory when you attend our events, since we cannot practically guarantee that you will not appear in a photo or video excerpt.
§ 7 Automated Decision-Making and Profiling
(1) We do not use fully automated decision-making pursuant to Art. 22 GDPR.
(2) We do not carry out profiling (Art. 4 No. 4 GDPR) of your personal data.
Chapter III – Data Disclosure and International Transfers
§ 8 Recipients or Categories of Recipients
(1) Within our organization, only those departments that need your data to fulfil contractual or legal obligations receive access. Service providers and vicarious agents may also receive data for this purpose, provided they observe confidentiality obligations. These may include advertising agencies, IT service providers, logistics, printing services, telecommunications, sales and marketing.
(2) We may disclose information about you only if required by law, you have consented, or disclosure is necessary to fulfil the contract. Possible external recipients include:
Companies with which we collaborate
Cooperation partners
(3) Other recipients may be entities to which you have given your consent.
§ 9 Transfers to Third Countries
We do not transfer data to countries outside the European Union.
Chapter IV – Data Subject Rights
§ 10 Specific Data Protection Rights
(1) You have the right to:
withdraw consent at any time (Art. 7(3) GDPR)
access your data (Art. 15 GDPR)
rectify inaccurate data (Art. 16 GDPR)
erase data (“right to be forgotten,” Art. 17 GDPR)
restrict processing (Art. 18 GDPR)
data portability (Art. 20 GDPR)
object to processing (Art. 21 GDPR)
(2) Restrictions on the rights of access and erasure may apply under §§ 34, 35 BDSG.
§ 11 Right to Lodge a Complaint
Beyond the rights above, you may lodge a complaint with a competent supervisory authority (Art. 77 GDPR in conjunction with § 19 BDSG).
§ 12 Withdrawal of Consent
(1) You may withdraw any consent you have given to the processing of personal data at any time, including consents given before 25 May 2018.
(2) Withdrawal takes effect for the future and does not affect the lawfulness of processing prior to withdrawal.
Information on Your Right to Object (Art. 21 GDPR)
§ 1 Case-by-Case Right to Object
(1) Under Art. 21 GDPR, you have the right, for reasons arising from your particular situation, to object at any time to processing of personal data based on Art. 6(1)(e) GDPR (public interest) or Art. 6(1)(f) GDPR (legitimate interests), including profiling under those provisions.
(2) If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
§ 2 Right to Object to Direct-Marketing Processing
(1) We may process your data for direct marketing purposes. You have the right to object at any time to such processing.
(2) If you object, we will no longer process your personal data for direct marketing.
To object, please direct your request to:
oose eG
– Widerspruch Datenschutz –
Schomburgstr. 50
D – 22767 Hamburg
Mail: datenschutz@oose.de
Stand 06.03.2024