vifugo – Privacy Policy

This Privacy Notice is a notification by Next Big Thing GmbH, Bussardstr. 5.2, 82166 Gräfelfing, hereinafter referred to as „Next Big Thing“, „we“ or „us“ to the users, m/f/d (hereinafter referred to for ease of reading as „user“, „client“ or „you“) how we collect, process and store your personal information.

This Privacy Notice is available for view, saving and print out at any time using the Link „Privacy Notice“.

Data Controller:

Next Big Thing GmbH
Bussardstr. 5.2
82166 Gräfelfing
info@nextbigthing.de

§ 1 scope

Next Big Thing collects, processes and stores users personal information in order to enable and optimize use of Next Big Things services. Next Big Thing uses collected data in order to fulfil contracts and for advertising purposes as well as tracking if and what add by Next Big Thing user has reacted to.

§ 2 collecting of data

Next Big Thing collects, processes and stores the personal data of operators and interested parties (collectively also called "users"), either provided by themselves or generated by Next Big Thing.

Operators are people who have purchased or are purchasing a product or service from Next Big Thing.

Interested parties are all other persons from whom Next Big Thing processes data as a data controller. This includes, in particular, but not limited to, people who visit the websites of Next Big Thing or people who request information material from Next Big Thing or use another offer from Next Big Thing.

PERSONAL INFORMATION THAT NEXT BIG THING COLLECTS ABOUT USERS AND HOW NEXT BIG THING USES IT:

A) Information users provide to us

1. We collect personal information about users when user voluntarily submit information directly to us when user access, use or receive our services. This can include information users provide to us when user submit an enquiry through our website, register for and/or attend an event, correspond with us by phone, email or otherwise, subscribe to our mailing lists, newsletters or other forms of marketing communications, provide information requested by us to comply with our professional and legal obligations, or in connection with our provision of our services. We may also collect personal information from third parties, such as the retailer Digistore24 GmbH (St.-Godehard-Straße 32, 31139 Hildesheim) or social media networks.

2. If users choose not to provide personal data, we may not be able to provide some or all of the Services to such user or respond to such users other requests.

3. When users use our services, the categories of information we collect may include:

(1) contact information

(2) business information

(3) location information

(4) information provided by third parties

(5) comments and opinions that users express when user comment on a blog post, contact us by email, mail or phone.

We use this information to operate, maintain and provide to you the features and functionality of the services, to address users questions and concerns, to personalize users content so that it is relevant to the city or country where user is using its device in, to contact user, including sending news, alerts and marketing communications to user, and to help us develop new products and services.

4. When users use services that are offered for a fee, the categories of data we collect may also include:

(1) Identification information

(2) instructions and information about payment and transaction information

We use this information to provide you with the services we offer for a fee in accordance with our agreements; to communicate with you; to comply with our professional or legal obligations and to facilitate our internal business operations.

5. On its own initiative, Next Big Thing will not process any personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual orientation, union membership, information regarding health or sex life or other data enumerated in Art. 9 General data protection regulation (GDPR); unless the user concerned has made this data available themselves and has expressly consented to the processing of such data.

B) Information we collect about users automatically

1. We also automatically collect personal information about you indirectly about how users access and use our websites, blogs, mobile sites, applications, widgets and other interactive features (the "Online Services") and information about the device users use to access the Online Services. For example, we may collect:

(1) information about how users view the Online Services (e.g., the pages users view, the links users click);

(2) information about users browser and usage patterns (e.g., users IP address, browser type and language); and

(3) information about the device users use to access the Online Services (e.g., device identifier, device type, model and manufacturer)
We use this information to: present our Online Service to users on his device; determine news, alerts and other products and services that may be of interest to user for marketing purposes; and monitor and improve our Online Services and business, and to help us develop new products and services.

C) Processing data as a data processor

(1) Next Big Thing provides operators with the opportunity to publish on demand videos via the OP-Vifugo. In order to fulfil such obligation Next Big Thing is entitled to process the data of the operator’s customers and interested parties (hereinafter referred to as “participants”) on behalf of the operator.

(2) Furthermore, Next Big Thing provides operators with the opportunity to create access-protected member areas and manage contacts via the OKP-Membado. In order to fulfil such obligation Next Big Thing is entitled to process the data of the operator’s customers and interested parties (hereinafter referred to as “participants”) on behalf of the operator.

(3) Next Big Thing also offers users the opportunity to create and manage community areas with the OCP Membado. For this purpose, it may be necessary for Next Big Thing to process data from their customers and interested parties (hereinafter referred to as “participants”) on behalf of the users, for example, but not exclusively, to grant access to paid community areas.
In the cases (1), (2) and (3), the operator is solely responsible for the data.
The scope of the data and data processing is stipulated in our respective data processing agreement.

§ 3 RECIPIENTS OF PERSONAL INFORMATION

Next Big Thing will share users personal data with the following recipients:

3.1 Service providers and advisors. Third party vendors and other service providers that perform services for us, on our behalf, which may include providing mailing or email services, tax and accounting services, payments processing, data enhancement services, fraud prevention, web hosting, or providing analytic services.

3.2 The public. When users use our services, content and information that user post in communities, on message boards, blogs or other services on our website, or that user allow us to make public, may be available to other visitors to our websites and to the general public. When user use our services, to the extent user has given us consent to do so, we may also share users name together with comments and feedback on our services.

3.3 Social Media Networks. When users use our services, content that user share through social media may be shared with users social media account provider and its friends, followers or contacts on the connected social network.

3.4 Law enforcement, regulators and other parties for legal reasons. Third parties as required by law or if we reasonably believe that such action is necessary to (a) comply with the law and the reasonable requests of law enforcement; (b) comply with legal process; (c) respond to requests from public or government authorities, including public or government authorities outside users country of residence; (d) enforce the terms of our agreement (being, as applicable, our Terms and Conditions) and pursue available remedies or limit the damages that we might sustain; (e) protect the security or integrity of our services (as applicable); and/or (f) exercise or protect our rights, privacy, safety or that of others in particular other uses.
3.5 In the event that Next Big Thing is sold in whole or in part or a legal succession occurs, the data will also be passed on to the respective legal successor.

§ 4 MARKETING AND ADVERTISING

4.1 From time to time we may send to user legal updates, alerts, news and mailings relating to seminars, coachings, webinars, tutorials or events or products that we distribute such as in particular, books and audio books that we think may be of interest to user. Instead of sending a message we may also contact our clients by phone for the above mentioned reasons.

4.2 Most messages we send will be by email. For some messages and phone calls, we may use personal information we collect about user to help us determine the most relevant marketing information to share with user.

4.3 We will only send user marketing messages if user has given us his consent to do so. Likewise we contact users by phone for marketing reasons solely after having received its consent to do so. If users do not want to receive messages from us and/or do not want to be addresses by phone for marketing reasons, user will be able to tell us by selecting certain boxes on forms we use when we first collect users contact details or by refusing or withdrawing its consent. User can also change its preferences at a later date by clicking on the unsubscribe link at the bottom of our messages or by emailing us at info@nextbigthing.de.

4.4 Please note that if you do opt-out of or do not grant consent to receiving marketing related messages from us, we may still send you non-marketing messages or call you by phone for reasons other than marketing, such as communications relating to the provision of our services.

§ 5 LEGAL BASIS FOR PROCESSING OF PERSONAL DATA

a) Consent: As far as we have received users consent for data processing of its personal data, Art. 6 Abs. 1 lit. a General data protection regulation (GDPR) is the legal basis.

b) Contract including pre contractual phasis: As far as data is processed to fulfil a contract to which user is a party, legal basis for data processing is Art. 6 Abs. 1 lit. b GDPR. This also applies for data processing necessary for pre contractual measures.

c) legal obligation: As far as processing of data is necessary in order to fulfil one of Next Big Things legal obligations, legal basis for data processing is Art. 6 Abs. 1 lit. c GDPR.

d) Legitimate Interest: As far as processing of data is necessary for an legitimate interest of Next Big Thing or a third party and provided the legitimate interest, fundamental rights and freedoms of the person concerned do not outweigh the first mentioned interests, legal basis for such data processing is Art. 6 Abs. 1 lit. f GDPR.
INTENDED USE AND LEGAL BASIS IN DETAIL:

A) Next Big Thing uses contact information, in order to

(1) deal with enquiries and complaints made by or about users relating to the services.
The processing is necessary for our legitimate interests, namely administering the services and dealing with enquiries and complaints relating to the services..

(2) to operate, maintain and provide to you the services.
The processing is necessary for our legitimate interests, namely administering the services and dealing with enquiries and complaints relating to the services.

(3) to communicate with users, including sending service-related communications.
The processing is necessary for our legitimate interests, namely administering the services and communicating with users in connection with the services.

(4) to send users statements and invoices in relation to any agreement between us to provide user with any part of the Services.
The processing is necessary for the performance of a contract and/or to take steps at your request prior to entering into a contract.

(5) to send user news, alerts and marketing communications in accordance with its preferences.
We will only process your personal information in this way to the extent that you have given us consent to do so.

B) Instructions, comments and opinions. When user contact us directly, e.g. by email, phone, mail, when user post on message boards, blogs or complete an online form, we will record users comments and opinions. We use this information to

(1) provide the Services in accordance with our client's instructions and respond to users questions, issues and concerns.
Where you are the client, the processing is necessary for the performance of a contract between you and us, and/or to take steps at your request prior to entering into a contract.
Where you are not the client, the processing is necessary for our legitimate interests and those of our clients, namely administering the Services..

(2) tailor the services to users or our client's requirements, deal with complaints made by or about users relating to the Services and monitor and improve our Services.
The processing is necessary for our legitimate interests, namely communicating with clients, tailoring our service to clients and to improve our service generally, and for internal risk management purposes; the processing is also necessary for your legitimate interests and those of our clients, namely receiving the Services.

(3) We may use this information to promote our Services, such as disclosing your contact information to promotional publications or communications.
We will only process users personal data in this way to the extent that you have given us your consent.

C) Information regarding the products user have booked from us. Information regarding the issue or matter in respect of which we have been engaged to provide services may contain personal information about user. We use this information to

(1) provide the Services in accordance with our client's instructions and to tailor Services to users or our client's requirements.
Where you are the client, the processing is necessary for the performance of a contract between you and us, and/or to take steps at your request prior to entering into a contract.
Where you are not the client, the processing is necessary for our legitimate interests and those of our clients, namely administering the Services.

(2) We may use this information to promote our Services, such as disclosing your contact information to promotional publications or communications.
We will only process users personal data in this way to the extent that user has given us his consent.

D) Payment and transaction information. Payment information, such as your credit card or bank account details, and other information such as date and time of your transaction.

(1) We use this information to facilitate transactions made in connection with the provision of the Services.
Where you are the client, the processing is necessary for the performance of a contract between you and us, and/or to take steps at your request prior to entering into a contract.
Where you are not the client, the processing is necessary for our legitimate interests and those of our clients, namely administering Services.

(2) We use this information to detect and prevent fraud.
The processing is necessary for our legitimate interests, namely the detection and prevention of fraud.

E) Location Information. Information that you choose to provide to us, such as your address or business address, or country of residence. We may use this personal information to

(1) facilitate internal business operations, including fulfilling our legal requirements and professional obligations.
The processing is necessary for our legitimate interest, namely to comply with our legal obligations.
(2) Other than information user choose to provide to us, we do not collect information about users precise location. Users device’s IP address may help us determine an approximate location. We may use an approximate location to ensure content made available to user through our Services is relevant to the city or country user is using its device in.
The processing is necessary for our legitimate interest, namely to tailor our service to the user and to improve our service generally.
F) Information provided by third parties. From time to time, we may receive information about user from third parties and other users. We may obtain information from third parties to enhance or supplement our existing user information. We may also collect information about user that is publicly available. We may combine this information with the information we collect from user directly. We use this information to
(1) contact user and provide the Services in accordance with our client's instructions.
Where you are the client, the processing is necessary for the performance of a contract between user and us, and/or to take steps at users request prior to entering into a contract.
Where you are not the client, the processing is necessary for our legitimate interests and those of our clients, namely administering the Services.

(2) contact user, to send user advertising or promotional materials or to personalize the Services, to pre-populate forms, and to better understand the demographics of our users.
The processing is necessary for our legitimate interests, namely to tailor our service to the user and to improve our service generally.

G) Information provided by social networks user connects to the Service. If user connect a social network, such as LinkedIn or Facebook, to our Services we will collect personal information from the social network in accordance with users privacy settings on that social network. The connected social network may provide us with information such as users name, Facebook ID, profile picture, network, gender, username, user ID, age or age range, language, country, friends list, follower list and any other information such user has agreed it can share or that the social network provides to us

(1) We will use the personal information provided to allow user to assist user in sharing content from our Services, or user experiences on our Services, with users friends, followers or contacts on the connected social network.
The processing is necessary for our legitimate interest, namely to tailor our service to the user and to improve our service generally.

H) Preferences. Preferences set for notifications, marketing communications and how our website is displayed. We use this information to

(1) provide notifications, send news, alerts and marketing communications and provide our Services in accordance with users choices.
The processing is necessary for our legitimate interest, namely ensuring the user receives the correct marketing and other communications.

(2) We use this information to ensure that we comply with our legal obligation to send only those marketing communications to which user has consented.
The processing is necessary for compliance with a legal obligation to which we are subject.

I) Information about how user access and use the Online Services. For example, the website from which user came and the website to which user is going when user leaves our website, how frequently user access the Online Services, the time user access the Online Services and how long user use them for, whether user open emails or click the links contained in emails, whether user access the Online Services from multiple devices, and other actions user take on the Online Services. We use this information to

(1) present our Online Service to you on your device.
The processing is necessary for our legitimate interests, namely to tailor our Online Services to the user.

(2) determine news, alerts and other products and services that may be of interest to user for marketing purposes.
The processing is necessary for our legitimate interests, namely to inform our direct marketing.

(3) monitor and improve our Online Services and business, and to help us develop new products and services.
The processing is necessary for our legitimate interests, namely to improve our Online Services generally; to monitor and resolve issues; and for the detection and prevention of fraud.

J) Information about your device. We also collect information about the computer, tablet, smartphone or other electronic device you use to connect to our Online Services. This information can include details about the type of device, unique device identifying numbers, operating systems, browsers and applications connected to our Online Services through the device, your Internet service provider or mobile network, your IP address and your device’s telephone number (if it has one). We use this information to

(1) present our Online Service to users on users device.
Die Verarbeitung ist notwendig für unsere berechtigten Interessen, namentlich die Abstimmung unserer Online-Dienste auf den Nutzer.

(3) We use this information to monitor and improve our Online Services and business, and to help us develop new products and services.
The processing is necessary for our legitimate interests, namely to improve our Online Services generally; to monitor and resolve issues; and for the detection and prevention of fraud.

K) All personal information set out above: We use this information to

(1) We will use all the personal information we collect to operate, maintain and provide user the features and functionality of the Services, to communicate with user, to monitor and improve the Services and business, and to help us develop new products and services.
The processing is necessary for our legitimate interest, namely to administer and improve the Public Services..

(2) comply with any professional or legal obligation to which we may be subject, such as disclosure of information to comply with a court order or at the request of a regulator.
The processing is necessary for compliance with a legal obligation to which we are subject.

(3) facilitate our internal business operations that are put in place for compliance with our legal obligations.
The processing is necessary for our legitimate interests, namely the detection and prevention of fraud and the fulfilment of professional obligations.
If you are based in the European Economic Area (EEA) or if the respective data processor who is in charge of using your data for this purpose is based in the EEA we will process your personal data only insofar as you have granted your consent.
In the event that neither you nor the person in charge of data processing is based in the EEA processing of data is necessary for our legitimate interests, in particular marketing purposes.

§ 6 DATA ERASURE AND STORAGE PERIOD

The personal data of users will be erased or blocked as soon as such personal data are no longer necessary in relation to the purposes for which they were collected. A storage can take place for a extended period if this is requested by the European or national legislator in EU regulations, statutes or other regulations that are binding for the data processor. The data will also be blocked or deleted if a storage period pursuant to the above mentioned regulations expires, unless there is need for further storage of data for the conclusion or execution of a contract.
If a user has been blocked from Next Big Thing or one of our platforms, their data will be processed insofar as this is necessary to prevent re-registration. Next Big Thing also complies with the statutory retention requirements.

§ 7 COOKIES AND SIMILAR TECHNOLOGIES

7.1 Our Websites and the platforms OP-Vifugo and OP-Membado use Cookies, in order to differentiate the respective user from other users of our Website. This helps us in offering a positive experience to each individual user when surfing on our Website or access another of our Websites and it also enables us to improve our Websites.

7.2 Cookies are small files that allow personalization of our Website experience by saving information regarding the user such as user -ID and other settings. A cookie is a small file that we transfer to users hard drive of users end device for the purpose of saving settings (e.g. on its Computer, Tablet or Smartphone).

7.3 we use the following Cookies:

(a) Cookies that are absolutely necessary. Those are Cookies, that we need for operating the Websites. Amongst those are for instance Cookies, that enable user registration in a save space at our Websites.

(b) Analytic-/Performance-Cookies. Those Cookies enable us to track the numbers of person who access the websites and identify how such user move on the Website. This helps us to improve the functions of our Websites, by making sure, for instance, that users find what they are searching for. We can as the case may be implement third parties analytic tools such as Google Analytics, in order to measure traffic and user trends of the Online services and to find out about users demographic characteristics. We refer to https://policies.google.com/technologies/partner-sites?hl=de for more information regarding Googles procedure. Options currently available to deactivate cookies can be accessed at https://tools.google.com/dlpage/gaoptout?hl=de.

(c) Function cookies. Those cookies are used in order to recognize such user when he returns to our Website. Hereby we are able to personalize our content fort he respective user and save users preferences (e.g. choice of language or region).

7.4 Cookies we use are aims at supporting users to have the most beneficial experience of our Website. If user does not want to receive cookies, most Browsers allow change of cookie settings. We notify user that they might not be able to use all functions of our website when they forbid cookies. The settings for changing cookies are usually accessible in the browsers menu under „Options“ or „settings“.

7.5 it may be the case that erasure or blocking of cookies is not possible for all kinds of tracking-Technologies, e.g. Local Storage Objects (LSOs) such as Flash-Objects or HTML5.

7.6 At this point in time we are not able to reacts to Do-Not-Track-Signals which are set at a users browser.

§ 8 INTEREST BASED ADVERTISING

8.1 We permit third party online advertising networks, social media companies and other third party services to collect information about your use of our Online Services over time so that they may play or display personalized or interest-based ads on our Online Services, on other websites, apps or services you may use, and on other devices you may use. Typically, though not always, the information used for interest-based advertising is collected through cookies or similar data collection technologies. We and our third party partners use this information to make the advertisements you see online more relevant to your interests, as well as to provide advertising-related services such as reporting, attribution, analytics and market research. We offer you a “Cookie Banner” through which you can exercise certain control over the use of cookies on the Online Services.

8.2 We also may use certain forms of display advertising and other advanced features through Google Universal Analytics, such as Remarketing with Google Analytics, Google Display Network Impression Reporting, the DoubleClick Campaign Manager Integration, and Google Analytics Demographics and Interest Reporting. These features enable us to use first-party cookies (such as the Google Analytics cookie) and third-party cookies (such as the Doubleclick advertising cookie) or other third party cookies together to inform, optimize, and display ads based on your past visits to the Online Services. Users can set their advertising preferences or opt-out of certain Google advertising products by visiting the Google Ads Preferences Manager, currently available at https://myadcenter.google.com/home, or by using the NAI online resources at http: //www.networkadvertising.org/choices.

8.3 In order to learn more about behavioral advertising and how users are able to deactivate some of those adds, user can refer to online-resources of Network Advertising Initiative (NAI) at http://www.networkadvertising.org/choices, the resources of DAA at www.aboutads.info/choices und/or Your Online Choices at www.youronlinechoices.com/uk. If you want to opt out of interest-based advertisements across all your browsers and devices, you will need to opt out on each browser on each device you actively use. If you delete cookies on your device generally, you will need to opt out again. And some of these opt-outs may not be effective unless your browser is set to accept cookies. If you delete cookies, change your browser settings, switch browsers or computers, or use another operating system, you will need to opt-out again.

8.4 Please note that some of these opt-outs may not be effective unless your browser is set to accept cookies. If you delete cookies, change your browser settings, switch browsers or computers, or use another operating system, you will need to opt-out again.

§ 9 LINKS TO THIRD PARTY SITES

The Services may, from time to time, contain links to and from third party websites, including those of other users and news publications. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for their policies. Please check the individual policies before you submit any information to those websites.

§ 10 NOTICE TO USER

If we need to provide you with information about something, whether for legal, marketing or other business related purposes, we will select what we believe is the best way to get in contact with user. We will usually do this through email or by placing a notice on the Online Services. The fact that we may send notices to you will not stop you from being able to opt out of certain types of contact as described in this Privacy Notice.

§ 11 RIGHT TO INFORMATION

The user is entitled to request confirmation from Next Big Thing as to whether personal data concerning him is being processed by Next Big Thing.
If such processing takes place, the user is entitled to request from Next Big Thing information with regard to the following:

(1) the purposes for which the personal data is processed;

(2) the categories of personal data that is processed;

(3) the recipients or the categories of recipients to whom the personal data relating to the user has been or will be disclosed;

(4) the planned duration of storage of the personal data relating to the user or, if specific information on this is not possible, criteria for determining the storage period;

(5) the existence of a right to correction or deletion of the personal data relating to the user, a right to restriction of processing by the responsible party or a right to object to this processing;

(6) the right to file a complaint with a supervisory authority;

(7) all available information about the origin of the data if the personal data is not collected from the user;

(8) the existence of automated decision-making, including profiling, in accordance with Art. 22 Para. 1 and 4 GDPR and - at least in these cases - informative notification about the logic involved and the scope and intended effects of such processing for the user.

The user has the right to request information as to whether the personal data relating to him is transferred to a third country or to an international organization. In this context, the user can request information on the applicable transfer guarantees in accordance with Art. 46 GDPR.

§ 12 RIGHT TO RECTIFICATION

The user has the right to rectification and / or completion if the processed personal data concerning him is incorrect or incomplete. Next Big Thing must make the correction immediately.

§ 13 RIGHT TO RESTRICTION OF PROCESSING

The user can request that the processing of personal data concerning him is restricted under the following conditions:

(1) if he disputes the accuracy of the personal data concerning him for a period that enables Next Big Thing to verify the accuracy of the personal data;

(2) the processing is unlawful and the user declines deletion of personal data and instead requests restriction of the use of personal data;

(3) Next Big Thing no longer needs the personal data for the purposes of processing, but the user needs them to assert, exercise or defend legal claims, or

(4) if the user has objected to processing in accordance with Art. 21 Para. 1 GDPR and it is not yet certain whether the legitimate reasons of Next Big Thing outweigh the reasons of the user.

If the processing of the personal data relating to the user has been restricted, this data - apart from its storage - may only be processed with the consent of the user or to assert, exercise or defend legal claims or to protect the rights of another natural or legal person or for reasons of an important public interest of the European Union or a Member State.

Should processing have been restricted according to the above, Next Big Thing will inform the user prior to cancelling the restriction.

§ 14 RIGHT TO ERASURE

I. Obligation to erasure

The user can request that Next Big Thing erases their personal data immediately, and Next Big Thing is obliged to erase such data immediately if one of the following reasons exists:

(1) The personal data relating to the user is no longer necessary for the purposes for which it was collected or otherwise processed.

(2) The user revokes its consent on which the processing is based in accordance with Art. 6 para. 1 lit. a or Art. 9 Para. 2 lit. a GDPR and there is no other legal basis for processing.

(3) The user raises an objection against data processing in accordance with Art. 21 para. 1 GDPR and there is no overriding legitimate reason for data processing, or the user raises an objection to data processing in accordance with Art. 21 para. 2 GDPR.

(4) The personal data relating to the user was processed unlawfully.

(5) Erasure of personal data relating to the user is necessary to fulfill a legal obligation pursuant to European Union law or the law of the member states to which Next Big Thing is subject.

(6) The personal data relating to the user was collected in relation to information society services offered in accordance with Article 8 (1) GDPR.

II. Information to third parties

Should Next Big Thing have made personal data relating to the user public and be obliged according to Art. 17 para. 1 GDPR to erase them, Next Big Thing will take appropriate measures including technical ones, taking into account available technology and implementation costs, to inform those responsible for processing the personal data that the user as affected subject has asked Next Big Thing to delete all links to such personal data or to copies or replications of such personal data.

III. Exceptions

The right to erasure does not exist if processing is necessary

(1) to exercise the right to freedom of expression and information;

(2) to fulfill a legal obligation which requires processing in accordance with the law of the European Union or the Member States to which Next Big Thing is subject, or to perform a task which is in the public interest;

(3) for reasons of public interest in the area of public health in accordance with Art. 9 Para. 2 lit. h and i and Art. 9 Para. 3 GDPR;

(4) for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes pursuant to Art. 89 Para. 1 GDPR, insofar as the right mentioned under section a) is likely to render impossible or seriously impair the achievement of the objectives of this processing, or

(5) to assert, exercise or defend legal claims.

§ 15 RIGHT TO NOTIFICATION

If the user has asserted their right to rectification, erasure or restriction of processing against Next Big Thing, Next Big Thing is obliged to notify all recipients to whom the personal data concerning the user has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves to be impossible or involves disproportionate effort.

The user has the right to notification about these recipients by Next Big Thing.

§ 16 RIGHT TO DATA PORTABILITY

The user has the right to receive the personal data they have provided to Next Big Thing in a structured, common and machine-readable format. They also have the right to transfer this data to another responsible party without hindrance from Next Big Thing, to whom the personal data has been provided, provided that

(1) the processing is based on consent in accordance with Art. 6 para. 1 lit. a GDPR or Art. 9 Para. 2 lit. a GDPR or is based on a contract according to Art. 6 para. 1 lit. b GDPR and

(2) the processing is carried out using automated processes.
In exercising this right, the user also has the right to have personal data concerning them transmitted directly from Next Big Thing to another responsible party, insofar as this is technically feasible. The freedoms and rights of other people must not be impaired by this.

The right to data portability does not apply to the processing of personal data necessary for the performance of a task that is in the public interest.

§ 17 RIGHT TO OBJECT

The user has the right, for reasons arising from their particular situation, to raise an objection at any time against the processing of their personal data according to Art. 6 Para. 1 lit. e or f GDPR; this also applies to profiling based on these provisions.

Next Big Thing will no longer process personal data relating to the user, unless Next Big Thing can prove compelling legitimate reasons for the processing that clearly outweigh the interests, rights and freedoms of the user, or the processing serves to assert, exercise or defend legal claims through Next Big Thing.

If the personal data relating to the user is processed in order to operate direct advertising, the user has the right to object at any time to the processing of the personal data relating to them for the purpose of such advertising; this also applies to profiling insofar as it is connected to direct advertising.

If user objects any processing for direct marketing purposes, the personal data relating to such user will no longer be processed for these purposes.

Regarding the use of information society services, the user has the option of exercising his right to object using automated procedures that use technical specifications, irrespective of Directive 2002/58/EG.

§ 18 RIGHT TO WITHDRAW THE DECLARATION OF CONSENT TO DATA PROTECTION DECLARATION

The user has the right to withdraw his declaration of consent to data protection declaration at any time. Withdrawing consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

§ 19 RIGHT TO FILE A COMPLAINT WITH A SUPERVISORY AUTHORITY

Without prejudice to any other administrative or judicial remedy, the user has the right to file a complaint with the competent supervisory authority.
The supervisory authority to which the complaint was submitted informs the complainant about the status and the results of the complaint, including the possibility of a judicial remedy according to Art. 78 GDPR.

§ 20 Automated decision in individual cases including profiling

The user has the right not to be subject to a decision based solely on automated processing - including profiling - which legally affects him or her or similarly affects him or her significantly. This does not apply when the decision

(1) is necessary for the conclusion or performance of a contract between user and the responsible party,

(2) is permissible on the basis of legal provisions of the European Union or the member states to which the responsible party is subject and these legal provisions contain appropriate measures to safeguard your rights and freedoms and the legitimate interests of the user or

(3) is made with the explicit consent of the user.
However, these decisions may not be based on special categories of personal data according to Art. 9 Para. 1 GDPR, unless Art. 9 Para. 2 lit. a or g applies and appropriate measures have been taken to protect the rights and freedoms as well as the legitimate interests of the user.

With regard to the cases mentioned in (1) and (3), the responsible party takes appropriate measures to safeguard the rights and freedoms and the legitimate interests of the user, including at least the right to obtain human intervention on the part of the responsible party, to express his or her point of view and to contest the decision.

§ 21 CHANGES TO THIS NOTICE

We may update this Privacy Notice from time to time and so you should review this page periodically. When we change this Privacy Notice in a material way, we will update the "Last Updated" date at the top of this Privacy Notice. Changes to this Privacy Notice are effective when they are posted on this page.

§ 22 LANGUAGE VERSION

The English translation is for your convenience only. In the event that English language version differs from the German language version the German language version prevails.

Date: May 2024