Legal basis of processing
The Data Controller processes Personal Data relating to the User if one of the following conditions applies:

• the User has given consent for one or more specific purposes; Note: under some legislation, the Data Controller may be permitted to process Personal Data without the User’s consent or another of the legal bases specified below until the User objects (“opts out”) of such processing. This does not apply where the processing of Personal Data is subject to European data-protection law;
• processing is necessary for the performance of a contract with the User and/or for pre-contractual measures;
• processing is necessary to comply with a legal obligation to which the Data Controller is subject;
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;
• processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or a third party.

It is always possible to ask the Data Controller to clarify the specific legal basis for each processing operation and, in particular, whether the processing is based on law, required by a contract or necessary to enter into a contract.

Further information about retention time
Unless otherwise stated in this document, Personal Data are processed and stored for as long as required by the purpose for which they were collected and may be retained for a longer period due to legal obligations or on the basis of Users’ consent.

Therefore:

• Personal Data collected for purposes related to the performance of a contract between the Data Controller and the User will be retained until that contract has been fully performed.
• Personal Data collected for purposes related to the Data Controller’s legitimate interests will be retained until those interests have been satisfied. The User may obtain further information about the legitimate interests pursued by the Data Controller in the relevant sections of this document or by contacting the Data Controller.

Where processing is based on the User’s consent, the Data Controller may retain Personal Data for longer until that consent is withdrawn. The Data Controller may also be required to retain Personal Data for a longer period in order to comply with a legal obligation or an order from an authority.

At the end of the retention period, Personal Data will be deleted. Once that period has expired, the rights of access, erasure, rectification and data portability can no longer be exercised.

User rights
Users may exercise certain rights regarding Data processed by the Data Controller.

In particular, to the extent permitted by law, the User has the right to:

• withdraw consent at any time. The User may withdraw previously given consent to the processing of their Personal Data.
• object to the processing of their Data. The User may object to the processing of their Data where processing is carried out on a legal basis other than consent.
• access their Data. The User has the right to obtain information about the Data processed by the Data Controller, about certain aspects of the processing and to receive a copy of the Data being processed.
• verify and request rectification. The User may verify the accuracy of their Data and request that they be updated or corrected.
• obtain restriction of processing. The User may request the restriction of the processing of their Data. In this case, the Data Controller will not process the Data for any purpose other than storage.
• have their Personal Data erased or otherwise removed. The User may request that the Data Controller erase their Data.
• receive their Data or have them transferred to another controller. The User has the right to receive their Data in a structured, commonly used and machine-readable format and, where technically feasible, to have them transferred to another controller without hindrance.
• lodge a complaint. The User may lodge a complaint with the competent data-protection supervisory authority or seek judicial remedy.

Users have the right to obtain information about the legal basis for transfers of Data abroad, including transfers to any international organisation governed by international law or established by two or more countries, such as the United Nations, as well as information about the security measures taken by the Data Controller to protect their Data.

Details about the right to object
Where Personal Data are processed in the public interest, in the exercise of official authority vested in the Data Controller or for the purposes of the Data Controller’s legitimate interests, Users have the right to object to processing on grounds relating to their particular situation.

Users are informed that, where their Data are processed for direct marketing purposes, they may object to such processing at any time, free of charge and without providing any reason. Where Users object to processing for direct marketing purposes, the Personal Data will no longer be processed for those purposes. To find out whether the Data Controller processes Data for direct marketing purposes, Users may refer to the relevant sections of this document.

How to exercise these rights
To exercise their rights, Users may send a request to the Data Controller using the contact details provided in this document. The request may be submitted free of charge and the Data Controller will respond as soon as possible and in any event within one month, providing the User with all information required by law. Any rectification, erasure or restriction of processing will be communicated by the Data Controller to each recipient, if any, to whom the Personal Data have been disclosed, unless this proves impossible or involves disproportionate effort. The Data Controller will inform the User of those recipients if requested.