Privacy Notice pursuant to Article 13 GDPR
regarding the creation, storage, and publication of photographic images
The protection of personal data is an important concern for us. For this reason, AMS Technologies AG processes personal data in accordance with applicable legal provisions on data protection and data security.
I. Contact Details of the Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states as well as other data protection regulations is:
AMS Technologies AG
Represented by:
Chief Executive Officer: Jan Meise
Chief Operating Officer / Chief Financial Officer: Philipp Weber
Fraunhoferstrasse 22
82152 Planegg / Martinsried
Germany
Phone: +49 89 895 77-0
Email: info@amstechnologies.com
Website: www.amstechnologies.com
II. Contact Details of the (External) Data Protection Officer
We have appointed an external data protection officer:
BerIsDa GmbH | Website: www.berisda.de
You can contact the data protection officer by mail at AMS Technologies AG, Attn: Data Protection Officer, Fraunhoferstrasse 22, 82152 Planegg / Martinsried, or by email at datenschutz@berisda.de
III. Description of Processing
1. Description and Scope of Data Processing
As part of our presence at events such as trade fairs, images and audio recordings of speakers, employees, and visitors may be taken. These recordings may be publicly distributed by us for press and public relations purposes, to promote similar events and our activities, and may also be shared with third parties for journalistic purposes. Additionally, these recordings may be used internally for post-event presentations. This privacy notice pertains to the creation, processing, storage, and publication of photographs taken at events in which AMS Technologies AG participates. AMS Technologies AG creates photographic images to document the event and for public relations purposes. If you do not wish to be photographed, please inform us or the photographer directly so that your request can be respected. The provision of your personal data is neither legally nor contractually required. There is no obligation to provide it. No fully automated decision-making (including profiling) as per Article 22 GDPR is used in processing the data you provide.
2. Legal Basis and Purpose of Processing
The legal basis for the creation, storage, and use of photographic images is Article 6(1)(f) GDPR and Sections 22, 23 of the German Art Copyright Act (KUG). The photos are stored, processed, and published for the purpose of documenting the event and for our public relations work. This includes taking photos, image and audio recordings at events and distributing these recordings on our website, on our LinkedIn channel, for post-event review, or for editorial and journalistic use by third parties. These purposes are based on our legitimate interest in public relations and in presenting the activities of the controller, increasing awareness of the controller, promoting participation in similar events, and conducting internal post-event reviews. The storage of any objection is also based on Article 6(1)(f) GDPR for documentation purposes and to defend against liability claims. If the images are portrait photos or clearly identifiable photos of you, our legal basis is your consent pursuant to Article 6(1)(a) GDPR. If these images reveal special categories of personal data under Article 9(1) GDPR, then Article 9(2)(a) GDPR applies as the legal basis. These legal bases also apply if we publish portrait or clearly identifiable photos of you on our LinkedIn channel or website. We also obtain your consent if we use such images for internal presentations.
3. Duration of Storage, Objection and Deletion Options
The data you provide will be processed as long as necessary to protect our legitimate interests or until you object to the processing. Once our legitimate interests no longer apply, your data will be deleted. Photos not used after the event will be stored for two years and then deleted. Published photos will be removed from our online presence and deleted after a maximum of two years. If processing is based on consent, it will continue until the purpose is fulfilled or you withdraw your consent. By publishing on our website and social media, the data becomes accessible to third parties, so we can only delete the data to a limited extent after publication. In the event of an objection, we will remove the data from platforms directly accessible to us (our website, our social media profiles). We cannot influence the storage duration by other third parties who gained access through publication.
4. Right to Object
If you do not wish to be photographed, please inform us or the photographer directly so that your request can be respected. Every data subject has the right to object to the processing. The objection can be directed to the contact details mentioned above. However, in balancing interests, it is generally assumed that the controller’s interest in creating and using the recordings does not excessively interfere with the rights and freedoms of the data subject, as the recordings are made visibly and in the “social sphere,” i.e., in public spaces during generally accessible events, and this is explicitly stated during registration and at the event itself. It is also explicitly stated that you can indicate if you do not wish to be photographed. When creating the recordings, care is taken not to violate the legitimate interests of the individuals depicted, and freedom of expression and information prevails. If, in individual cases, the rights and freedoms of a depicted person outweigh our interests, we will cease further processing upon a justified objection. Deletion of recordings from online media will be carried out within the scope of technical possibilities.
5. Recipients of the Data and Transfer to a Third Country or International Organization
Within our company, only those departments and individuals who need access to the photographic images to fulfill the above-mentioned purposes and who are authorized to process this data will receive access. An external photographer may be commissioned to take the photos. In the event of publication, the images may be shared with involved service providers (e.g., editorial offices or agencies). As part of our service delivery, we engage data processors. These service providers act only on the instructions of AMS Technologies AG and are contractually obligated to comply with applicable data protection requirements. We conclude written data processing agreements with these service providers. These are legally required contracts that ensure our service providers process the personal data of data subjects only in accordance with our instructions and in compliance with data protection regulations (GDPR, BDSG, etc.). The photos may be published on our website (https://shop.amstechnologies.com/) and on our LinkedIn channel. Publications in online media or information from the internet are accessible worldwide and may be linked with other information to create personality profiles. Please note that information (including photo and video recordings) on the internet can be accessed by anyone. It cannot be ruled out that such individuals may reuse or share the images or photos. There are specialized archiving services whose goal is to permanently document the state of certain websites at specific times. This may result in information published on the internet continuing to be found elsewhere even after it has been deleted from the original site. Publications on AMS Technologies AG’s social media pages may not be deletable at all, but only hidden from public view. The European General Data Protection Regulation (GDPR) requires that the transfer of personal data that is already being processed or is to be processed after transfer to a third country or international organization is only permissible if a level of data protection comparable to the GDPR is ensured. This can be ensured, for example, by an adequacy decision of the EU Commission pursuant to Art. 45(1), (3) GDPR or the implementation of internal company data protection rules approved by a supervisory authority (so-called “appropriate safeguards,” Art. 46(2), (3) GDPR). LinkedIn: LinkedIn Corporation is a company based in the USA. LinkedIn Corporation is certified under the “EU-US Data Privacy Framework” (DPF).
IV. Rights of the Data Subject
If we process personal data about you, you as the data subject have the following rights against us as the controller:
1. Right of Access (Art. 15 GDPR)
You have the right, within the scope of applicable legal provisions, to receive free information at any time about your collected and stored personal data. This includes, among other things, information about the purposes of processing, the origin and recipients of the data, the storage period, and the existence of various rights.
2. Right to Rectification (Art. 16 GDPR)
You have the right to request the correction (including completion) of your data if the personal data processed about you is incorrect or incomplete for the purposes of processing. The controller must make the correction without delay.
3. Right to Erasure (Art. 17 GDPR)
You may request the deletion of your personal data at any time under the conditions of Art. 17 GDPR, unless there are circumstances that entitle or oblige the controller to continue processing your personal data (e.g., legal retention obligations).
4. Right to Restriction of Processing (Art. 18 GDPR)
If the legal requirements are met, you may request the restriction of the processing of your personal data to the extent provided by Art. 18 GDPR.
5. Right to Data Portability (Art. 20 GDPR)
If you have provided us with personal data and the processing is carried out automatically based on your consent or a contract, you have the right under Art. 20 GDPR to receive the data you provided in a commonly used, machine-readable format, provided this does not adversely affect the rights and freedoms of others. If you request the direct transfer of the data to another controller, this will only be done if technically feasible.
6. Right to Object (Art. 21 GDPR)
You have the right to object to processing under Art. 21 GDPR, particularly if the data is processed for direct marketing or profiling purposes. You may also object to processing based on a balancing of interests by providing reasons arising from your particular situation. 7
7. Right to Withdraw Consent (Art. 7(3) GDPR)
You have the right to withdraw your consent to data processing at any time. The lawfulness of the processing carried out until the withdrawal remains unaffected. You can submit the withdrawal by email or post.
8. Right to Lodge a Complaint with a Supervisory Authority
Regardless of any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, particularly in the member state of your residence, workplace, or the location of the alleged violation, if you believe that the processing of your personal data violates the GDPR. The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision. If you reside in another federal state or outside Germany, you may also contact the data protection authority there.