Additional Information for Users

Legal Basis for Processing

The Owner processes Personal Data relating to the User if one of the following conditions applies:

• The User has given consent for one or more specific purposes.
• Processing is necessary for the performance of a contract with the User and/or for any pre-contractual obligations thereof.
• Processing is necessary for compliance with a legal obligation to which the Owner is subject.
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Owner.
• Processing is necessary for the purposes of the legitimate interests pursued by the Owner or by a third party.

Users can always request the Data Controller to clarify the specific legal basis that applies to each processing operation, especially if the processing is based on a legal requirement, is provided for by a contract, or is necessary to enter into a contract.

Additional Information on Data Retention

Unless otherwise stated in this document, Personal Data is processed and stored for the time required for the purpose for which it was collected and may be retained for a longer period due to legal obligations or based on the User's consent.

Therefore:

• Personal Data collected for purposes related to the performance of a contract between the Owner and the User will be retained until such contract has been fully performed.
• Personal Data collected for the purposes of the Owner’s legitimate interests will be retained as long as needed to fulfill such purposes. Users can obtain further information regarding the legitimate interests pursued by the Owner within the relevant sections of this document or by contacting the Owner.

When the processing is based on the User's consent, the Owner may retain Personal Data for a longer period until such consent is revoked. Furthermore, the Owner may be obliged to retain Personal Data for a longer period whenever required to do so for compliance with a legal obligation or upon order of an authority.

At the end of the retention period, Personal Data will be deleted. Therefore, the rights to access, delete, rectify, and the right to data portability cannot be enforced after expiration of the retention period.

User Rights Under US Privacy Laws

Users can exercise certain rights regarding their Data processed by the Owner.

In particular, within the limits provided by law, the User has the right to:

• Withdraw consent at any time. Users have the right to withdraw consent where they have previously given their consent to the processing of their Personal Data.
• Object to the processing of their Data. Users have the right to object to the processing of their Data if the processing is carried out on a legal basis other than consent.
• Access their Data. Users have the right to learn if Data is being processed by the Owner, obtain disclosure regarding certain aspects of the processing, and obtain a copy of the Data undergoing processing.
• Verify and seek rectification. Users have the right to verify the accuracy of their Data and ask for it to be updated or corrected.
• Restrict the processing of their Data. Users have the right, under certain circumstances, to restrict the processing of their Data. In this case, the Owner will not process their Data for any purpose other than storing it.
• Have their Personal Data deleted or otherwise removed. Users have the right, under certain circumstances, to obtain the erasure of their Data from the Owner.
• Receive their Data and have it transferred to another controller. Users have the right to receive their Data in a structured, commonly used, and machine-readable format and, if technically feasible, to have it transmitted to another controller without any hindrance. This provision is applicable provided that the Data is processed by automated means and that the processing is based on the User's consent, on a contract which the User is part of, or on pre-contractual obligations thereof.
• Lodge a complaint. Users have the right to bring a claim before their competent data protection authority or seek legal action.

Users have the right to obtain information regarding the legal basis for the transfer of Data to a country outside the United States or to any international organization governed by public international law or set up by two or more countries, such as the United Nations, as well as regarding the security measures taken by the Owner to safeguard their Data.

Details on the Right to Object

When Personal Data is processed for the public interest, in the exercise of an official authority vested in the Owner, or for the purposes of the legitimate interests pursued by the Owner, Users may object to such processing by providing a ground related to their particular situation to justify the objection.

Users should know that if their Personal Data is processed for direct marketing purposes, they can object to that processing at any time without providing any justification. If Users object to the processing for direct marketing purposes, their Personal Data will no longer be processed for such purposes. To determine whether the Owner is processing Personal Data for direct marketing purposes, Users may refer to the relevant sections of this document.

How to Exercise These Rights

To exercise their rights, Users may send a request to the contact details provided in this document. These requests are free of charge and will be addressed by the Owner as early as possible and always within one month. Any rectifications, deletions, or restrictions on processing will be communicated by the Owner to each recipient to whom the Personal Data has been disclosed, unless this proves impossible or involves disproportionate effort. The Owner will inform the User about those recipients if the User requests it.