The responsible party as defined by the General Data Protection Regulation and other national data privacy laws of EU member states as well as other data privacy regulations is:
nobilia-Werke J. Stickling GmbH & Co. KG
Waldstraße 53-57
33415 Verl
Deutschland
Tel.: + 49 (0) 5246 508 0
E-Mail: info@nobilia.de
Website: www.nobilia.de
The Data Protection Officer of the Organiser is:
Data Protection Officer
c/o nobilia-Werke J. Stickling GmbH & Co. KG
Waldstraße 53-57
33415 Verl
Deutschland
Tel.: + 49 (0) 5246 508 0
E-Mail: datenschutz@nobilia.de
a.) Scope and purpose of data processing
When participating in the Competition, the Organiser initially processes the following data from the Participants: Instagram account name
The Organiser processes the above data of the Participants to carry out the determination of the prize and to notify the respective winner.
After the winners have been determined, the Organiser will then process the following data from the Participants: Name, age and address.
The Organiser processes the aforementioned data of the Participants for the purpose of conducting the Competition, in particular to determine whether the Participants in fact are eligible to participate and to send the prizes.
If the above data is not provided, it will not be possible to send the prizes.
b.) Legal foundation of data processing
The data processing of the Participants in the Competition set out in this Privacy Policy serves the purpose of fulfilling a contract. The legal foundation for processing this legal data is Art. 6 para. 1 lit. b) GDPR.
c.) Storage period
The data collected as part of the Competition will be deleted 25 months after termination of the Competition.
The Organiser will not pass on the Participants' data to third parties unless this is necessary for the handling of the Competition (e.g. for mailing of prizes etc.).
In some cases, the Organiser uses external service providers to process data. They have been carefully selected and commissioned, are bound by the instructions of the Organiser and are regularly inspected.
a. Right of access
The Participant may request confirmation from the Organiser as to whether personal data concerning the Participant is being processed by the Organiser.
If such processing exists, the respective Participant may request information from the Organiser about the following:
(1) the purposes for which your personal data is processed;
(2) the categories of personal data processed;
(3) the recipients or categories of recipients to which the personal data concerning the Participant was disclosed or will still be disclosed;
(4) the planned duration of storage of the personal data concerning the Participant or, if concrete information on this is not possible, criteria for determining the storage period;
(5) the existence of a right to rectification or deletion of the personal data concerning the Participant or of a restriction of the processing by the Organiser or of a right to object to such processing;
(6) the existence of a right to submit a complaint to a supervisory authority;
(7) all available information about the origin of the data, if the personal data is not collected from the affected person;
(8) the existence of automated decision making including profiling in accordance with Art. 22 section 1 and 4 GDPR and - at least in these cases - meaningful information about the logic involved and the extent and envisaged effect of such a manner of processing on the affected person.
The Participant has the right to request information from the Organiser on whether the relevant personal data is transmitted to a third country or to an international organisation. In this context, the Participant can demand to be informed about appropriate safeguards in accordance with Art. 46 GDPR in the context of this transmission.
b. Right to rectification
The Participant has the right to demand that the Organiser rectify and/or complete any personal data concerning the Participant, if this data is incorrect or incomplete. The Organiser must make the correction as soon as possible.
c. Right to erasure
aa. Erasure obligation
The Participant has the right to request that his/her personal data be deleted immediately and the Organiser is obligated to delete this data immediately, if one of the following reasons applies:
The personal data concerning the Participant are no longer necessary for the purposes for which they were collected or otherwise processed. The Participant withdraws his/her consent on which the processing was based in accordance with Art. 6 section 1 a or Art. 9 section 2 a GDPR and there is no other legal foundation for processing. The Participant objects to the processing based on Art. 21 section 1 GDPR and there are no overriding legitimate reasons for processing, or the Participant objects to the processing based on Art. 21 section 2 GDPR. The personal data concerning the Participant has been processed unlawfully. Erasure of personal data concerning the Participant is required to meet a legal obligation according to European Union law or the law of EU member states to which the Organiser is subject. The personal data concerning the Participant was collected in relation to offered information society services according to Art. 8 section 1 GDPR.
bb. Transmission to third parties
If the Organiser has published the personal data concerning the Participant and is obligated to delete it according to Art. 17 section 1 GDPR, the Organiser will take adequate measures, including of a technical nature, taking into account the available technology and implementation costs, to inform those responsible for data processing, who are processing the personal data in question, that the Participant as data subject has demanded that all links to this personal data or copies and duplicates of this personal data must be deleted.
cc. Exceptions
There is no right to erasure, if processing is required
(1) for exercising the right to free speech and information;
(2) to meet a legal obligation which requires processing according to European Union law or the law of one of its member states, to which the responsible party is subject, or to fulfil a task that is in the public interest or a task of official authority assigned to the responsible party;
(3) for reasons of public interest with regard to public health according to Art. Art. 9 section 2 (h) and (i) as well as Art. 9 section 3 GDPR;
(4) for archival purposes in the public interest, scientific or historical research purposes or for statistical purposes in accordance with Art. 89 section 1 GDPR, provided that the right to erasure is expected to make achieving these aims of processing impossible or to severely impact them, or
(5) to assert, exercise or defend legal claims.
d. Right to restriction of processing
Under the following circumstances, a Participant can demand that processing of his/her personal data be restricted if:
(1) the Participant disputes the correctness of his/her personal data for a period of time, which enables the Organiser to review the correctness of the personal data;
(2) processing is unlawful and the Participant does not wish for his/her personal data to be deleted, but instead requests restriction of the use of the personal data;
(3) the Organiser no longer requires the personal data for processing purposes, the Participant requires the data for asserting, exercising or defending legal claims, or
(4) the Participant filed an objection to the processing based on Art. 21 section 1 GDPR and it is not yet clear whether the Organiser's legitimate interests override his/her interests.
If processing of personal data concerning the Participant was restricted, the personal data may only - with the exception of storage - be used with his/her consent or to assert, exercise or defend legal claims or to protect the rights of another natural or legal person or for reasons of important public interest of the European Union or a member state.
If processing was restricted according to the above-mentioned prerequisites, the Organiser will inform the Participant before this restriction is lifted.
e. Right to information
If the Participant has exercised his/her right to rectification, deletion or restriction of processing against the Organiser, the Organiser is obligated to report this rectification or deletion of data or processing restriction to all recipients to whom the relevant personal data has been disclosed, unless this proves to be impossible or involves disproportionate effort.
The Participant has the right to request that the Organiser informs him about these recipients.
f. Right to object
The Participant has the right to object to processing of his/her personal data at any time on grounds relating to his/her particular situation, if this processing is based on Art. 6 section 1 (e) or (f) GDPR; this also applies to profiling based on these provisions.
The Organiser will discontinue processing the personal data concerning the Participant unless they can prove compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Participant, or the processing serves the purpose of asserting, exercising or defending legal claims.
If the personal data concerning the Participant is being processed for the purpose of targeted advertisement, the Participant has the right to object to the processing of the personal data concerning the Participant for the purpose of this type of advertising at any point; this also applies to profiling related to such targeted advertisement.
If the Participant objects to the processing of his/her personal data for the purpose of targeted advertising, the personal data concerning the Participant will no longer be processed for this purpose.
The Participant has the option of exercising his/her right to object in the context of use of information society services - irrespective of directive 2002/58/EC - by means of automated processes using technical specifications.
g. Right to withdraw the declaration of consent under data protection law
The Participant may withdraw his/her declaration of consent under data protection law at any point. Withdrawal of the consent does not affect the legitimacy of the data processing performed up to that point based on the Participants consent.
h. Right to file complaint with a supervisory authority
Without prejudice to other legal remedies based on administrative law or court decisions, the Participant has the right to file a complaint with a supervisory authority, especially in the member state that is the Participants location, the location of the Participants workplace or the location of the alleged breach, if the Participant believes that processing of his/her personal data violates GDPR.
The supervisory authority with which the complaint has been filed informs the complainant about the status and result of the complaint including the option of legal remedy according to Art. 78 GDPR.
The responsible supervisory authority is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44
40102 Düsseldorf
Deutschland
Tel.: +49 (0) 211 38424-0
Fax: +49 (0) 211 38424-10
E-Mail: poststelle@ldi.nrw.de