Privacy Policy

1) Introduction and contact details of the controller

1.1 We are pleased that you are visiting our website and thank you for your interest. In the following, we inform you about how we handle your personal data when you use our website. Personal data is all data with which you can be personally identified.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Michail Frantzeskakis, Veraterms by FlyDropGlobal, Am Hackenbruch 68e, 40231 Düsseldorf, Germany, Phone: 015236362561, Email: ceo@flydropglobal.com. The controller for the processing of personal data is the natural or legal person who, alone or jointly with others, decides on the purposes and means of the processing of personal data.

2) Data collection when visiting our website

2.1 In the case of merely informational use of our website, i.e. if you do not register or otherwise provide us with information, we only collect the data that your browser transmits to our server (so-called "server log files"). When you visit our website, we collect the following data, which is technically necessary for us to display our website to you:

• The website visited
• Date and time at the moment of access
• Amount of data sent in bytes
• Source/reference from which you arrived at the page
• Browser used
• Operating system used
• IP address used (where applicable in anonymised form)

Processing takes place in accordance with Art. 6(1)(f) GDPR, on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or otherwise used. We nevertheless reserve the right to subsequently review the log files if there are concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the "https://" prefix and the padlock symbol in your browser's address bar.

3) Hosting & Content Delivery Network

For the hosting of our website and the display of page content, we use Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden. The published pages are delivered via a worldwide content delivery network from the nearest location in each case. In this process, the data mentioned in section 2.1 may also be processed outside the European Union. The provider bases transfers to third countries on EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914).

We operate the database containing the customer data, the login and the data storage at Supabase Inc. in the Frankfurt am Main region, Germany. The data stored there remains on servers within the European Union, unless different data recipients are named below for specific processing operations.

We have concluded a data processing agreement with Supabase Inc. which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties. With Lovable Labs Sweden AB, a data processing agreement pursuant to Art. 28 GDPR will be in force from 01.11.2026, which upon switching to the “Business” plan becomes part of Lovable's terms of service.

4) Cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e. small text files stored on your device. Some of these cookies are automatically deleted after the browser session ends (so-called "session cookies"), while others remain on your device for a longer period and enable page settings to be saved (so-called "persistent cookies"). In the latter case, you can find the storage duration in the overview of the cookie settings of your browser.

Insofar as personal data is also processed through individual cookies we use, processing takes place either in accordance with Art. 6(1)(b) GDPR for the performance of the contract, or in accordance with Art. 6(1)(a) GDPR in the case of consent given, or in accordance with Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a user-friendly and effective design of the visit to the page.

You can set your browser so that you are informed about the placement of cookies and can decide individually whether to accept them, or you can exclude the acceptance of cookies in certain cases or in general.

Please note that if you do not accept cookies, the functionality of our website may be limited.

5) Contact

5.1 When you contact us (e.g. via the contact form or email), personal data is processed — exclusively for the purpose of processing and responding to your request, and only to the extent required for this purpose.

The legal basis for processing this data is our legitimate interest in responding to your request in accordance with Art. 6(1)(f) GDPR. Where your contact is aimed at the conclusion of a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. Your data will be deleted where it is apparent from the circumstances that the matter in question has been conclusively settled and provided no statutory retention obligations preclude this.

5.2 - Resend

For sending transactional emails, i.e. messages linked to a specific occasion and triggered by a specific user action (e.g. conclusion of a contract, registration, or password reset), we use the following provider: Plus Five Five, Inc., 2261 Market Street, #5039, San Francisco, CA 94114, USA.

On the basis of our legitimate interest in effective and user-friendly email communication, we transfer the data you provide when carrying out such a user action to this provider in accordance with Art. 6(1)(f) GDPR, so that it can carry out the sending of the email on our behalf.

We have concluded a data processing agreement with the provider, which protects the data of our website visitors and prohibits its disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

6) Data processing when opening a customer account

In accordance with Art. 6(1)(b) GDPR, personal data continues to be collected and processed to the extent required in each case, provided you disclose it to us when opening a customer account. Which data is required to open an account is set out in the input form of the corresponding form on our website.

Deletion of your customer account is possible at any time and can be carried out by sending a message to the above address of the controller. After deletion of your customer account, your data will be deleted, provided all contracts concluded through it have been fully performed, no statutory retention periods preclude this, and there is no longer any legitimate interest of ours in further storage.

Registrations that have not been confirmed and for which there is neither a login, a payment, a membership of a Business account nor a commission are deleted automatically after 5 days.

7) Data processing for the performance of the contract

7.1 For the performance of the contract, we work with the following service provider(s), who support us in whole or in part in the performance of concluded contracts. Certain personal data is transferred to these service providers in accordance with the following information.

7.2 Use of payment service providers

- Stripe

One or more online payment methods of the following provider are available on this website: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

Where you select a payment method of this provider, the payment data you provided during the ordering process (including, among other things, name, address, bank account and card details, currency and transaction number) is transferred to it, as well as information relating to the content of your order, in accordance with Art. 6(1)(b) GDPR. In this case, the transfer of your data takes place exclusively for the purpose of processing the payment with the provider and only to the extent required for this purpose.

7.3 (deleted)

7.4 Electronic termination facility for continuing contracts with consumers

Consumers who have concluded continuing contracts for consideration on this website (e.g. subscription contracts) have the option of terminating them via an electronic button, in accordance with the applicable notice periods.

Activating the button leads to a confirmation page, on which the consumer can provide further details relating to the termination, clearly identify themselves, and then electronically declare their termination.

The collection of personal data and its transfer to us takes place in accordance with Art. 6(1)(b) GDPR and only to the extent necessary for the proper processing of the termination. Also on the basis of Art. 6(1)(b) GDPR, the personal data provided is used to confirm, in electronic form, receipt of the termination declaration and the time of termination. A further legal basis for processing is Art. 6(1)(c) GDPR. We are legally obliged to maintain an electronic termination facility for continuing consumer contracts for consideration concluded via electronic commerce.

We retain the details of the termination until the end of the third calendar year after receipt of the termination, in order to be able to prove the termination and defend against legal claims (Art. 6(1)(f) GDPR). Thereafter they are deleted automatically.

7.5 Electronic withdrawal function for distance contracts

Consumers who conclude contracts on this website for which a statutory right of withdrawal exists have the option of declaring withdrawal via an electronic withdrawal function, in accordance with the applicable provisions on withdrawal.

When using the withdrawal function, in addition to details identifying the contract to be withdrawn from, further personal data must be provided or confirmed, such as the consumer's name and email address.

The collection of this information and its transfer to us takes place in accordance with Art. 6(1)(b) GDPR and only to the extent necessary for the proper processing of the withdrawal. Also on the basis of Art. 6(1)(b) GDPR, the personal data provided is used to confirm receipt of the withdrawal declaration by email. A further legal basis for processing is Art. 6(1)(c) GDPR. We are legally obliged to maintain an electronic withdrawal function for consumer distance contracts for consideration.

We retain the details of the withdrawal until the end of the third calendar year after receipt of the withdrawal, in order to be able to prove the withdrawal and defend against legal claims (Art. 6(1)(f) GDPR). Thereafter they are deleted automatically.

7.6 Referral Partner Programme

If you apply to our Referral Partner Programme, we process the data contained in your participation request together with the data required to run the programme. These are: name or company name, address, date of birth, e-mail address, a tax number where one exists, the referral code assigned to you together with the subscriptions attributed to it, and the bank account to which the commission is paid.

We collect the date of birth in order to identify unambiguously the person to whom a commission is paid. Without it we cannot make a payout.

If a subscriber enters a referral code when registering, that code is permanently linked to their user account. We do not use tracking cookies for this purpose.

The legal basis is Art. 6(1)(b) GDPR, as the processing is necessary to enter into and perform the participation relationship. Where we retain the data beyond that in order to meet commercial and tax record-keeping obligations, the legal basis is Art. 6(1)(c) GDPR.

Data is passed to third parties only where this is necessary for payout through our bank or for compliance with statutory obligations towards the tax authorities. Your participation request reaches us by e-mail.

7.7 Push notifications

If you wish, we provide the daily overview as a push notification on one or more devices enabled by you. Enabling is carried out by you, by granting the corresponding permission in your browser.

For this purpose we store, per enabled device, the delivery address (endpoint) provided by the browser, two associated public keys, the selected language, the browser and device identifier (user agent), and timestamps for enabling and for the last delivery. The legal basis for this processing is Art. 6(1)(b) GDPR; the storage of information on your device and access to it take place under Section 25(2)(2) TDDDG, as they are strictly necessary for providing the service you have expressly requested.

Delivery takes place technically via the push service of the respective browser or device manufacturer (for example Google, Apple, Mozilla or Microsoft). This service is determined by your browser and may operate its servers outside the European Union. The notification itself contains no content: the text displayed is retrieved from us by your device only after the notification has been received. The push service therefore learns neither the content of the notification nor your settings or search terms.

You can stop the push notifications at any time by withdrawing the permission in your browser settings. If the push service informs us that a delivery address is no longer valid, we deactivate it without undue delay. The stored device data is deleted when you switch off the notifications, when the delivery address becomes permanently invalid, or when your customer account is deleted.

For each delivery of the daily overview as a push notification we store the date of the overview, the number of notices and of devices, the status, the time and, where applicable, an error message. We delete this information at the latest 30 days after delivery.

7.8 VeraAlert Business

Contract and account data. If a business or another establishment orders VeraAlert Business, we process the details from the Order Form (in particular name and legal form of the business or establishment, address, VAT identification number or tax number, name and position of the person acting), the email address of the account owner, the product places ordered, invoice and payment data, as well as the time and version of the contract documents confirmed in the Business account. Processing takes place for the performance of the contract in accordance with Art. 6(1)(b) GDPR, insofar as you yourself are the contracting party. If you act for a business or an establishment, processing takes place in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in performing the contract with that business or that establishment and providing evidence of it.

Data in the Business account. We process the data that a customer enters in the Business account (monitored products, supplier details, notes and attached files), as well as the action log, change history, check archive and daily reports, on behalf of that customer on the basis of a data processing agreement in accordance with Art. 28 GDPR. In this respect, the controller is the customer. If you are affected by this processing as an employee, as a contact person at a supplier or as another person, please contact that customer to exercise your rights; we support the customer in doing so.

Daily reports by email. We send the daily reports, according to the schedule set in the Business account, to the email address of the account owner via the service provider named in section 5.2. The sending serves the performance of the contract; the legal bases named under “Contract and account data” apply. The opening of emails and the clicking of links are not tracked.

Storage duration. We store contract and invoicing data for the duration of the contract and beyond that insofar as statutory retention periods apply. The data in the Business account remains available for retrieval for 30 days after the end of the contract and is then deleted within 30 days, unless statutory retention obligations prevent this. Backup copies are overwritten in the regular backup cycle.

Operational monitoring. To monitor operation, we receive automatic fault notifications, which may contain the name of the Business account concerned. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure and fault-free operation.

7.9 Protection of the forms for termination, withdrawal and notices and of the registration and the password reset against misuse

To prevent the forms for termination, withdrawal and the notice of illegal content from being misused, for example to trigger confirmation emails to other people's addresses automatically, we limit how often these forms can be submitted from one internet connection. For this purpose, when a form is submitted we derive a hash value (a pseudonym) from your IP address using a secret key and store it together with the time, the type of form and the result of the misuse check. We do not store the IP address itself in this process. This information is used solely for the limit described and is deleted automatically after 48 hours at the latest. We also limit how often a link to reset the password can be requested: for this purpose we store, for each request that we carry out for an existing account, the time, the internal identifier of the account and the result of the misuse check, but in this process neither the IP address nor a hash value derived from it; this information, too, is used solely for the limit and is deleted automatically after 48 hours at the latest. We also limit the registration of a customer account: for this purpose we store a hash value of your email address formed with a secret key (not the address itself), the time and the result of the misuse check; this information, too, is used solely for the limit and is deleted automatically after 48 hours at the latest.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in keeping the functions required by law available and in protecting third parties from unwanted emails sent in our name.

7.10 Notices of illegal content and other procedures under the Digital Services Act

If you notify us via the form at veraterms.com/meldung, by email or by phone of information that you consider illegal, we process the details you provide: the type of content reported, the details of where it is, your reasons, your good-faith statement, whether you indicate a danger to life or safety, the time and language of the notice, the result of the misuse check (without IP address) and, if you provide them, your name and email address. We use these details to examine the notice, to confirm receipt to you and to inform you of our decision (Article 16 DSA). Sections 7.9 and 8 (Cloudflare Turnstile) apply to protect the form against misuse.

If a notice or our own examination concerns a user account, we process the data of that account to the extent necessary for the examination and give the user the statement of reasons for a measure (Article 17 DSA). We disclose the identity of the person who submitted the notice to the user only where strictly necessary. The same applies to complaints against our decisions, to orders of authorities (Articles 9 and 10 DSA) and to informing law enforcement authorities of a suspicion of criminal offences involving a threat to the life or safety of persons; in Germany this is the Federal Criminal Police Office (Bundeskriminalamt) (Article 18 DSA, § 13 DDG). If a procedure concerns data that we process on behalf of a VeraAlert Business customer (section 7.8), we process it for this purpose only insofar as the VeraAlert Business Service Description (section 18) provides for this or legal provisions oblige us to do so, and we inform the customer in advance, insofar as this is legally permitted (Art. 28(3)(a) GDPR). We send the emails of these procedures via Resend (section 5.2) and keep their text with the case.

The legal basis for processing notices, giving statements of reasons, giving effect to orders of authorities and informing authorities of a suspicion of criminal offences is Art. 6(1)(c) GDPR in conjunction with Articles 9, 10, 16, 17 and 18 DSA. The legal basis for our own examinations and for carrying out measures is Art. 6(1)(b) GDPR insofar as they are based on the contract with the user concerned, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in preventing illegal content in our services. The legal basis for handling complaints is Art. 6(1)(b) GDPR for users and Art. 6(1)(f) GDPR for individuals and entities that submitted a notice; our legitimate interest lies in being able to review and correct our decisions. If a notice contains special categories of personal data or data relating to criminal offences, we process them only to the extent necessary for these procedures (Art. 9(2)(g) and Art. 10 GDPR in conjunction with Articles 16 to 18 DSA).

After a procedure has been concluded, we keep the details in order to be able to demonstrate compliance with these obligations and to defend legal claims; the legal basis for this is Art. 6(1)(f) GDPR. A procedure is concluded when no complaint is pending and six months have passed since the last decision or communication in the procedure. We delete the details at the end of the third calendar year after the procedure was concluded, unless proceedings before an authority or a court pending at that time require their further retention. Our yearly transparency report contains only figures without reference to persons.

7.11 (deleted)

7.12 Vera Personal: further recipients of the daily overview

In the Vera Personal plan we send the daily overview by email to up to three confirmed addresses (Service Description, section 5). The address of the customer account is entered automatically as the first one; the customer enters further addresses in the customer account. We receive these addresses from the customer, not from the recipients themselves. We ask the customer to inform the recipients beforehand and to refer them to this privacy policy.

To each further address we send one email with a confirmation link. This email and the confirmation page name the email address of the customer account that asked for the sending and refer to this privacy policy. Only after confirmation does the address receive the overview; it is the same overview the customer receives, including the matches for the customer's search terms. For each address we store the address, the times of entry and of confirmation and the code from the confirmation link (until confirmation) and the code for the link "Stop receiving this overview" (at the end of each overview).

For each overview sent we store, per recipient address, the date of the overview, the number of notices, the status and time of sending, the identifier of the message at the sending provider and, where applicable, an error message. This lets us deliver each overview only once and detect delivery errors. We send the emails via Resend (section 5.2).

The legal basis for the address of the customer account is Art. 6(1)(b) GDPR. We process the addresses of further recipients under Art. 6(1)(f) GDPR. The legitimate interest of the customer and our own lies in delivering the overview to the addresses the customer wishes, and only after the recipient has confirmed the address.

The customer can remove an address in the customer account at any time; it is then deleted from the list of recipients immediately. Every overview sent to a further address ends with the link "Stop receiving this overview". With the button on the page behind that link the address is deleted at once, together with the overviews not yet sent to it. Anyone who no longer wishes to receive the overview can also contact the customer or us (section 1.2), including by replying to an overview; we then delete the address from the list. We delete an address that is not confirmed at the latest 30 days after entry. We delete the details of the individual sendings at the latest 30 days after sending; per customer account we keep only the date of the last overview, without an address. Otherwise we store an address until it is removed or the customer account is deleted (section 6).

Which notices belong to which daily overview we store per customer account and overview day (assignments, withheld and further notices as well as the links to the web view of the overview). We delete this information 90 days after the overview day.

7.13 Vera Personal: the "Family Peace" function

Persons involved. With the "Family Peace" function (Service Description, section 4) the customer sets up a button for up to three persons, with which the person confirms, at the intervals set, that they are well (confirming person). For each confirming person the customer enters up to three trusted contacts. The customer can also enter themselves as a confirming person. We receive the details of confirming persons and trusted contacts from the customer. We ask the customer to inform these persons beforehand and to refer them to this privacy policy.

Stored details. For each confirming person we store what the customer enters: name, email address, language, the interval between confirmations in days and the grace period in hours. In addition, we store two personal codes for the links to the page for agreeing and to the page with the button, the times of the invitation, of the agreement, of the last press, of the last reminder and of the last notification of the trusted contacts and, where applicable, the end of a pause and the time of a withdrawal. For each trusted contact we store name, email address and language. For each step (invitation, agreement, press, reminder, notification of the trusted contacts, message about a later press) we store its type, its channel (page or email) and its time.

Procedure and recipients. If the confirming person is not the customer, we send them an invitation by email that names the email address of the customer account. Reminders and notifications start only once the person has agreed on the linked page; if the customer enters themselves, no invitation is sent. After that we record each press of the button with its time. If no press is recorded by the due time, we send the person a reminder by email and, if they have switched on notifications on their device, a push notification as well. If no press is recorded by the end of the grace period either, we send each trusted contact an email with the person's name and the missed due time; if a press is recorded later, we tell them so, with its time. As soon as the customer has entered a trusted contact, we send them one email that names the email address of the customer account and the name of the confirming person and describes the procedure. The invitation, the reminder and all emails to trusted contacts, as well as the pages for agreeing and for the button, refer to this privacy policy. During a pause set by the customer we send neither reminders nor emails to the trusted contacts. In the customer account the customer sees, for each confirming person, the status, the next due time and the latest steps with their times. We send all emails of this function via Resend (section 5.2).

Push notifications. If a confirming person switches on notifications on their page, we store per device the details listed in section 7.7 (delivery address, two public keys, language, browser and device identifier, times of enabling and of the last delivery) as well as the number of failed delivery attempts and the last error message. Delivery via the push service of the browser or device manufacturer is governed by section 7.7; the notification itself contains no content. If the push service informs us that a delivery address is no longer valid, we deactivate it. The storage of information on the device and access to it take place under Section 25(2)(2) TDDDG.

Legal bases. The legal basis for the customer's details is Art. 6(1)(b) GDPR; this also applies where the customer enters themselves as a confirming person. We process the details of other confirming persons and of trusted contacts under Art. 6(1)(f) GDPR. The legitimate interest of the customer and our own lies in providing the agreed function: the trusted contacts are to learn when a confirming person has not pressed their button.

Storage period. If the customer withdraws a confirming person, the function ends for that person; if the customer removes a trusted contact, that contact receives no further messages. In both cases we delete the details of that person at the latest 30 days later, for a confirming person together with their steps and device details. We delete deactivated device details at the latest 30 days after the device was last used. Otherwise we store the details of confirming persons and trusted contacts, the steps and the device details until the customer account is deleted (section 6); they are then deleted with it. If the Vera Personal plan ends, we no longer send invitations, reminders or notifications; the details then remain stored until the customer account is deleted.

Rights of these persons. Confirming persons and trusted contacts can exercise their rights under section 9 against us (contact details in section 1.2), in particular the right to object under section 9.2. Anyone who no longer wishes to take part can also contact the customer; in the customer account the customer can withdraw a confirming person and remove a trusted contact.

7.14 Administration and communication tools

For email correspondence via info@veraterms.com and ceo@flydropglobal.com we use Google Workspace provided by Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland; a data processing agreement pursuant to Art. 28 GDPR (Cloud Data Processing Addendum) is in place with Google. In this process, data may also be processed in the United States; Google LLC is certified under the EU-US Data Privacy Framework. Emails received up to 16.10.2026 were received via IONOS SE, Germany (data processing agreement pursuant to Art. 28 GDPR), and forwarded to a mailbox at Google (Gmail), where they are still stored; we store documents in Google Drive. The provider of Gmail and Google Drive is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; here, too, data may be processed in the United States. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in handling correspondence and documents securely and in one place. To support the administration of the service, database analyses and the handling of emails and documents, we use the AI tool Claude by Anthropic Ireland, Limited, Ireland. Insofar as personal data is processed in this context, such as customer data displayed during administration, this is done from 01.11.2026 under the “Team” plan pursuant to Anthropic's Commercial Terms of Service and a data processing agreement (Data Processing Addendum); Anthropic acts as a processor. Use of the contents for training the models is excluded. Anthropic stores the data in the United States; the basis for the transfer is the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914, Modules 2 and 3). The data is stored for the term of the contract and deleted within 30 days of the end of the contract, unless a statutory retention obligation exists. The legal basis is that of the respective underlying processing.

7.15 Logging of administrative operations

For traceability of administrative operations, such as the activation, extension and deactivation of plans, the creation and status of Business accounts, orders, assignments at Stripe and email dispatch, we keep a log. It contains the type and time of the operation, the identifier of the user account concerned and associated technical details. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in traceable and secure operation and in providing evidence of operations. We delete the entries after 12 months.

8) Website functions

- Cloudflare Turnstile

On this website we use the CAPTCHA service of the following provider: Cloudflare, Inc., 101 Townsend St. San Francisco, CA 94107, USA.

The service checks whether an input is made by a natural person or abusively through mechanical and automated processing, and blocks spam, DDoS attacks and similar automated malicious access. To ensure that an action is carried out by a human and not by an automated bot, Cloudflare Turnstile collects the IP address of the device used, identification data on the browser type and operating system used, as well as the date and duration of the visit, and transmits it for evaluation to the provider's servers.

The legal basis is our legitimate interest in establishing individual accountability on the internet and preventing abuse and spam, in accordance with Art. 6(1)(f) GDPR.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

9) Rights of the data subject

9.1 Applicable data protection law grants you, vis-à-vis the controller, with regard to the processing of your personal data, the following rights of the data subject (rights to information and intervention), for the respective conditions of exercise of which we refer to the legal basis cited:

• Right of access in accordance with Art. 15 GDPR;
• Right to rectification in accordance with Art. 16 GDPR;
• Right to erasure in accordance with Art. 17 GDPR;
• Right to restriction of processing in accordance with Art. 18 GDPR;
• Right to notification in accordance with Art. 19 GDPR;
• Right to data portability in accordance with Art. 20 GDPR;
• Right to withdraw consent given in accordance with Art. 7(3) GDPR;
• Right to lodge a complaint in accordance with Art. 77 GDPR.

9.2 RIGHT TO OBJECT

WHERE WE PROCESS YOUR PERSONAL DATA, IN THE CONTEXT OF A BALANCING OF INTERESTS, ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, TO SUCH PROCESSING, WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. WE RESERVE THE RIGHT TO CONTINUE PROCESSING, HOWEVER, IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

WHERE YOUR PERSONAL DATA IS PROCESSED BY US FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR THE PURPOSES OF DIRECT MARKETING.

10) Duration of storage of personal data

The duration of storage of personal data is determined based on the respective legal basis, the purpose of processing and — where applicable — additionally based on the respective statutory retention period (e.g. commercial and tax retention periods).

Where personal data is processed on the basis of explicit consent in accordance with Art. 6(1)(a) GDPR, the relevant data is stored until you withdraw your consent.

Where statutory retention periods apply to data processed in connection with contractual or quasi-contractual obligations under Art. 6(1)(b) GDPR, such data is regularly deleted after expiry of the retention periods, provided it is no longer required for the performance or preparation of a contract and/or there is no longer any legitimate interest of ours in further storage.

Where personal data is processed on the basis of Art. 6(1)(f) GDPR, such data is stored until you exercise your right to object in accordance with Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where personal data is processed for the purposes of direct marketing on the basis of Art. 6(1)(f) GDPR, such data is stored until you exercise your right to object in accordance with Art. 21(2) GDPR.

Unless otherwise indicated by the other information in this statement regarding specific processing situations, stored personal data is otherwise deleted where it is no longer necessary for the purposes for which it was collected or otherwise processed.