1. Scope of the processing of personal data
As a general rule, we collect and process our users’ personal data only to the extent necessary to provide a fully functional website and our content and services. The processing of our users’ personal data generally takes place only with the user’s consent. An exception applies in cases where it is not possible to obtain consent in advance for practical reasons, where the data is publicly available, where the user provides it directly when making contact, or where the processing of the data is permitted by law.
2. Legal basis for the processing of personal data
Where we obtain the data subject’s consent for the processing of personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.
Where the processing of personal data is necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) of the GDPR serves as the legal basis. This also applies to processing operations necessary for the implementation of pre-contractual measures.
Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Article 6(1)(c) of the GDPR serves as the legal basis.
Where the processing of personal data is necessary to protect the vital interests of the data subject or of another natural person, Article 6(1)(d) of the GDPR serves as the legal basis.
Where processing is necessary to safeguard a legitimate interest of our company or a third party, and the interests, fundamental rights and freedoms of the data subject do not override the former interest, Article 6(1)(f) of the GDPR serves as the legal basis for the processing.
3. Data erasure and retention period
The data subject’s personal data will be erased or restricted as soon as the purpose for which it was stored no longer applies. Data may also be stored if this is provided for by European or national legislation in EU regulations, laws or other provisions to which the controller is subject. Data will also be blocked or deleted when a retention period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data for the conclusion or performance of a contract.
4. Rights of the data subject
The data subject has the right to request confirmation from the controller as to whether personal data concerning them is being processed; if this is the case, they have the right to access that personal data and to receive the following information:
a. the purposes of the processing;
b. the categories of personal data being processed;
c. the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular where recipients are in third countries or are international organisations;
d. where possible, the envisaged period for which the personal data will be stored, or, if this is not possible, the criteria used to determine that period;
e. the existence of a right to rectification or erasure of personal data concerning them, or to restriction of processing by the controller, or a right to object to such processing;
f. the existence of a right to lodge a complaint with a supervisory authority;
g. where the personal data are not collected from the data subject, any available information as to the source of the data;
You also have the right to restrict the processing of this data and the right to data portability. If you have given us your consent, you may withdraw it with effect from the future. You may contact the Data Protection Officer at any time regarding this matter or any other questions you may have about data protection. Furthermore, you have the right to lodge a complaint with the relevant supervisory authority.
Competent supervisory authority:
State Commissioner for Data Protection and Freedom of Information, North Rhine-Westphalia
Postfach 20 04 44
40102 Düsseldorf
Phone: 0211 / 38424-0
Fax: 0211 / 38424-10
poststelle@ldi.nrw.de
www.ldi.nrw.de
To exercise your data protection rights, please contact datenschutz@messe-essen.de
5. Disclosure of data to third parties
In order for us to process your data for the purposes mentioned above, we may need to pass your data on to selected partner companies. Where necessary, we have entered into a data processing agreement with the recipients. These services include, in particular, ticketing, mailings, stand construction services and catalogue listings.
Furthermore, we may pass your data on to third parties where this is necessary to fulfil our service offerings. These may include, in particular, the following partners: transport companies (for orders), banks and payment service providers, and credit reference agencies. Data may also be disclosed if we are obliged to do so to public authorities or pursuant to a court order.
We do not transfer any personal data to third parties outside the European Economic Area (EEA).
In the event of a credit risk, we will transfer your data (name, address, email address, company details and, where applicable, contract and debt details) to Coface Debitorenmanagement GmbH, Isaac-Fulda-Allee 1, 55124 Mainz, and, where applicable, to other cooperating credit reference agencies. The legal basis for this transfer is Article 6(1)(b) and Article 6(1)(f) of the GDPR. Transfers on the basis of Article 6(1)(f) of the GDPR may only take place insofar as this is necessary to pursue the legitimate interests of our company and does not override the interests or fundamental rights and freedoms of the data subject which require the protection of personal data. Detailed information about our contractual partner, Coface, within the meaning of Article 14 of the GDPR – namely, its business purpose, the purpose of data storage there, the legal basis, Coface’s data recipients, the right of access, the right to erasure and rectification, and profiling – can be found at http://www.coface.de/Home/Allgemeine-Informationen/Datenschutz