Information obligations pursuant to Art. 13 GDPR for correspondence in the context of asserting your rights as a data subject

1. Who is responsible for processing my data?

AZ Direct GmbH
Carl-Bertelsmann-Str. 161s
33311 Gütersloh
Germany
E-Mail: az(at)bertelsmann.de

is responsible for the processing of your data mentioned below. When reference is made below to “we” or “us”, this always refers to AZ Direct GmbH. We process personal data in accordance with the provisions of the European General Data Protection Regulation (hereinafter referred to as “GDPR”) and the German Federal Data Protection Act (hereinafter referred to as “BDSG”).

You can reach our data protection officer at the above postal address, with the addition “To the data protection officer” or at the e-mail address: datenschutz(at)az-direct.com.

2. What is my data processed for (purpose of processing) and on what legal basis?

We process the correspondence conducted to fulfill the data subject rights to which you are entitled under the General Data Protection Regulation and to document the fulfillment of our obligations under the GDPR in accordance with Art. 6 (1) c GDPR on the basis of the data subject right asserted by you and for the purpose of providing evidence in this regard.

If you have contacted us as an employee of a supervisory authority, your personal data will be processed to handle the matter in accordance with Art. 6 (1) c GDPR.

3. Am I obliged to provide the data?

In order to comply with your right as a data subject, in particular your right to information, Recital 64 GDPR stipulates that we must use all reasonable means to verify your identity. Without clarification of your identity, we are not in a position to comply with your right as a data subject.

4. Who receives my data?

a) If your address was already stored by us and you have objected to the further receipt of advertising, we have marked your address with a corresponding blocking indicator. This ensures that your address will no longer be used for direct advertising in the future.

b) As part of the digital processing of your data, we use a data center that is ISO 27001 certified, among other things, and is bound by our instructions.

c) If we can clearly identify one or more suppliers of your address, we will automatically transmit your blocking request to them.

d) If you have requested a review of data processing by another person or body (for example, our data protection officer or the responsible data protection supervisory authority), we will transfer your data to this person or body.

5. How long will my data be stored?

We store correspondence with you regarding the assertion of data subject rights for a period of 3 years. Copies of identity cards sent to us will be deleted immediately after your identity has been established.

If your address has been entered in our internal advertising block file (no advertising), we will store this entry permanently unless you object to it.

If correspondence is subject to statutory retention periods (e.g. business letters), we will retain this information until the end of the statutory period, usually 6 years.

6. What rights do I have in relation to my data?

You have the right to information about your personal data stored by us at any time. If your personal data is incorrect or no longer up to date, you have the right to request that it be corrected. You also have the right to request the erasure or restriction of the processing of your data in accordance with Article 17 or 18 GDPR. If you have provided us with data and the processing by means of automated procedures is based on your consent or on a contract with you, you have the right to receive this data provided by you in a structured, commonly used and machine-readable format (right to data portability).

In this case, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, as in the case of correspondence with you to assert your rights as a data subject. In addition, the storage of this correspondence serves the defense of potential legal claims.

If you wish to exercise your rights or if you have general questions about data protection in relation to correspondence concerning your rights as a data subject, you can contact us at any time using the contact details in section 1 with the addition “To the data protection officer”.

You also have the option of contacting a data protection authority and lodging a complaint there. Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestr. 2-4, 40213 Düsseldorf, phone:0211/38424-0, fax:0211/38424-10, e-mail: poststelle(at)ldi.nrw.de.

You can also contact the data protection authority responsible for your place of residence, which will then forward your request to the responsible authority.