DATA PROTECTION

I. Name and address of the data controller

The data controller as defined in the General Data Protection Regulation and other data protection legislation passed by the member states as well as other data protection regulations is:

ROCKHAL
Centre de Musiques Amplifiées
5, Avenue de Rock ‘n’ Roll
L-4361 Esch/Alzette
E-Mail: mydata[at]rockhal.lu

II. General information on data processing

1. Processing of personal data – Scope

We collect, and process personal data provided by our users only as far as this is necessary for providing a functioning website as well as for presenting our content and services. Regular collection and usage of personal data provided by users is always subject to the user giving consent. An exception applies to cases, where obtaining a prior consent was impossible for actual reasons and data processing is authorized by applicable law.

2. Legal basis for the processing of personal data

The legal basis for personal data processing will be art. 6 sec. 1 lit. a of the EU General Data Protection Regulation, where we obtain consent for the processing of personal data from the data subject.

The legal basis for personal data processing will be art. 6 sec. 1 lit. b of the EU General Data Protection Regulation, where the processing of the personal data serves the purpose of fulfilling a contract to which the data subject is a party. This also applies to processing steps, which are necessary to take precontractual measures.

The legal basis for personal data processing will be art. 6 sec. 1 lit c of the EU General Data Protection Regulation, where the processing of personal data is required to fulfil a legal requirement, which applies to our company.

The legal basis for personal data processing will be art. 6 sec. 1 lit. d of the EU General Data Protection Regulation in case the processing of personal data becomes necessary due to the vital interest of the data subject or any other individual.

The legal basis for data processing will be art. 6 sec. 1 lit. f of the EU General Data Protection Regulation where processing is necessary for our company or a third party to maintain a legitimate interest and the basic rights and fundamental freedoms of the data subject do not outweigh the former.

3. Data erasure and storage period

Personal data of any data subject will be deleted or blocked as soon as the purpose for storage becomes invalid. Further storage may occur, where the data controller is subject to European or national legislature having adopted union-wide regulations, laws or other provisions to stipulate for such extended storage. Data will also be blocked or deleted where the storage period prescribed in one of the foregoing rules expires unless there is a need for further data storage in connection with the conclusion or the fulfilment of a contract.

III. Website provision and logfile creation

1. Data processing – description and scope

When a user accesses our website, our system will automatically collect data and information from the computer system used to gain access.

The collected data consist of the following:

Information concerning type of browser and version used
The user’s operating system
The user’s internet service provider
The user’s IP address
Date and time of access to the internet site
The websites, from which the user’s system gains access to our website

This data will also be saved in the logfiles of our system. It will not be saved together with any other personal data of the user.

2. Legal basis for data processing

The legal basis for temporary storage of data and for logfiles is art. 6 sec. 1 lit. f of the EU General Data Protection Regulation.

3. Data processing – purpose

It is necessary to temporarily save the IP address on our system to enable provision of our website to the user’s computer. To do so, the user’s IP address needs to be saved for as long as the session continues.

To ensure the proper functioning of our website, this data is saved to logfiles. This data also enables us to optimise our website and to ensure the safety of our information technology. We do not evaluate this data for marketing purposes.

These purposes are also part of our legitimate interest in personal data processing according to art. 6 Abs. 1 lit. f of the EU General Data Protection Regulation.

4. Storage period

Data will be deleted as soon as they are no longer required to accomplish the purposes, for which they have originally been collected. In case of data collection for website provision, this is the case once the respective session is terminated.

For data saved to logfiles, such data will be deleted after a maximum period of seven days. Further storage of this data is possible. In this case, the user’s IP address will be deleted or alienated, making it impossible to establish any connection with the accessing client.

5. Options for objection and erasure

The collection of this data for providing the website and saving it to logfiles is a mandatory requirement for operating the website. Consequently, the user cannot object to this form of data processing.

IV. Cookie policy

a) Data processing – description and scope

Our website uses cookies. Cookies are small text files, which the internet browser places or saves on the user’s computer. When a user accesses any given website, a cookie may be saved to the user’s operating system. This cookie contains a character string to enable a unique identification of the browser when the website is called up again at a later stage.

b) Legal basis for data processing

The legal basis for the processing of personal data with technically mandatory cookies is art. 6 sec. 1 lit. f of the EU General Data Protection Regulation.

Where the user has given consent to such processing, the legal basis for the processing of personal data with analytics cookies will be art. 6 sec. 1 lit. a of the EU General Data Protection Regulation.

c) Data processing – purpose

The purpose for placing technically mandatory cookies is to simplify the user’s experience when using the website. Several functionalities of our website depend on cookies and could not be offered without them. These functionalities also require that the browser can also be identified after the site has been changed.

We require cookies for following applications:

Remembering search queries

The user data collected by technically mandatory cookies will not be used to create user profiles. These purposes are also part of our legitimate interest in personal data processing according to art. 6 Abs. 1 lit. f of the EU General Data Protection Regulation.

d) Storage duration, options for objection and erasure

Cookies are saved on the user’s computer and will then be transmitted from this computer to our website. Consequently, the user enjoys full control over the applied cookies. By changing the settings in your internet browser, you may choose to deactivate or limit cookie transmission. Previously saved cookies may be deleted at any time. You may also use an automated process to do so. In case you decide to deactivate cookies for our website, this may entail that you can no longer make complete use of all the functions included in our website.

V. Newsletter

1. Data processing – description and scope

You may use our website to subscribe to our newsletter free of charge. Doing so will transmit the data you entered into the subscription form to us for subscription processing.

The following data will be transmitted:

The user’s e-mail address
The user’s name (optional)

Additionally, we collect the following data upon subscription:

Language settings
Country
Date and time of your registration

Should you use our website to purchase goods or services and provide an e-mail address during this purchase, we may use this e-mail address at a later stage to send you a newsletter. In this case, the newsletter will only contain direct marketing for comparable goods or services we offer.

For our newsletter, we use the “Mailchimp” service offered by The Rocket Science Group, LLC (675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA). This data will exclusively be processed for sending out our newsletters.

2. Legal basis for data processing

Where the user has subscribed to our newsletter and has given consent to such processing, the legal basis for data processing is art. 6 sec. 1 lit. a of the EU General Data Protection Regulation.

The legal basis for sending out our newsletter after having sold goods or services is art. 7 sec. 3 of the German act against unfair competition, UWG.

3. Data processing – purpose

We collect the user’s e-mail address to send out our newsletter.

We collect additional personal data during the subscription process to prevent any abuse of our services or the e-mail address provided.

4. Storage period

Data will be deleted as soon as they are no longer required to accomplish the purposes, for which they have originally been collected. Consequently, the user’s e-mail address will be saved for as long as the user actively maintains their subscription to our newsletter.

5. Options for objection and erasure

The user may terminate their newsletter subscription at any time. Each newsletter contains a corresponding link to do so.

VI. Web enquiry form and e-mail contact

1. Data processing – description and scope

Our website includes a web enquiry form, which may be used to contacting us by electronic means. Where a user takes this opportunity to contact us, the data they enter into the interface will be transmitted to and consequently saved by us. This concerns the following data:

Academic title
Last name
Given name
Country
E-mail address
Organisation (optional)
Enquiry/comment (optional)

When transmitting your data, we also request that you give your consent to us processing your data and we advise you about the present privacy policy.

Alternatively, you may contact us on one of the e-mail addresses provided. In this case, the user’s personal data as transmitted in the e-mail will be saved.

We do not share any data with third parties in this context. Such data will exclusively be used for processing our conversation with the corresponding user.

2. Legal basis for data processing

To process data provided during the transmission of an e-mail, the legal basis for data processing is art. 6 sec. 1 lit. f of the EU General Data Protection Regulation. Where the purpose of contacting us by e-mail is the closing of a contract, the additional legal basis for data processing is art. 6 sec. 1 lit. b of the EU General Data Protection Regulation.

3. Data processing – purpose

We shall exclusively process data entered into the interface for processing the user’s contacting. In the case of e-mail contacting, this also forms the necessary legitimate interest in processing the corresponding data.

The personal data additionally processed during transmission help prevent abuse of the enquiry form and to ensure the safety of our information technology.

4. Storage duration

Data will be deleted as soon as they are no longer required to accomplish the purposes, for which they have originally been collected. For personal data from the enquiry form and personal data transmitted by e-mail, this is the case, once the corresponding communication with the user has come to an end. A conversation may be considered as terminated when the circumstances allow for the respective matter to be regarded as fully settled.

The personal data additionally processed during transmission will be deleted after a maximum period of seven days.

5. Options for objection and erasure

The user may withdraw their consent to processing of the personal data at any time. Where the user contacts us via e-mail, they may object to their data being saved at any time. In such a case, the conversation with the user cannot be continued.

Please send corresponding requests to mydata[at]rockhal.lu.

In such a case, all personal data saved in connection with the user’s contacting will be deleted.

VII. Rights of the data subject

Where your personal data is being processed, for the purposes of the EU General Data Protection Regulation you are considered a data subject and consequently you have the following rights towards the data controller:

1. The right to information

You may request a confirmation from the data controller, whether we process any personal data concerning you as the data subject.

Where such a processing is the case, you may request information from the data controller concerning the following:

(1) purposes, for which personal data is being processed;

(2) categories of personal data that are being processed;

(3) recipients or categories of recipients with whom the corresponding personal data either have already been shared or will still be shared;

(4) the planned storage duration of the personal data concerning you as the data subject or where it proves to be impossible to provide a precise statement to this regard, what criteria apply to determine the storage duration;

(5) the existence of rights to rectification or erasure of the personal data concerning you as the data subject, any right to restrict the processing at the data controller or any objection right against such processing;

(6) the existence of a right to file a complaint with a competent supervisory authority;

(7) any available information on where the data was obtained from, where the personal data have not been collected from the data subject;

(8) the existence of an automated decision-making process including profiling according to art. 22 sec. 1 and 4 of the EU General Data Protection Regulation and – at least in such cases – meaningful information on the logic involved as well as the bearing and the effects sought with such a processing for the person concerned.

You also have the right to request information on whether any of the personal information relating to you as a data subject are being transmitted to a third country or to an international organisation. In the context of such transmission, you may request to be informed about the appropriate safeguards according to art. 46 of the EU General Data Protection Regulation.

2. The right to rectification

You have a right to rectify and/or complete your data towards the data controller, where the processed personal data concerning you as a data subject are either incorrect or incomplete. The data controller shall apply such rectification without undue delay.

3. The right to restrict data processing

You may request that we restrict processing of the personal data concerning you as a data subject in the following circumstances:

(1) where you dispute the correctness of the personal data concerning you as a data subject for a time period, which allows the data controller to verify whether the personal data are correct;

(2) where the processing is unlawful and you object to the personal data being deleted and instead request that use of the personal data be restricted;

(3) where the data controller no longer needs the personal data for the purposes of processing, however, you need them to enforce, exercise or defend legal claims; or

(4) where you have objected against processing according to art. 21 sec. 1 of the EU General Data Protection Regulation and it has not yet been fully assessed, whether the data controller’s legitimate reasons outweigh your reasoning.

Where the processing of the personal data concerning you as a data subject has been restricted, such data – except storage – may only be processed with your consent or to enforce, exercise or defend legal claims or to protect the rights of any other individual or entity or for significant public cause of the Union or a member state.

Where the processing has been restricted in line with the above-mentioned circumstances, you will receive information from the data controller prior to this restriction being lifted.

4. Right to erasure

a) The obligation to delete

You may require the data controller to delete any personal data concerning you as a data subject without undue delay and the data controller has an obligation to delete such data without undue delay provided one of the following situations apply:

(1) The personal data concerning you as a data subject are no longer needed for the purposes, for which they have originally been collected or processed in any other way.

(2) You withdraw your consent, which served as the basis for processing according to art. 6 sec. 1 lit. a or art. 9 sec. 2 lit. a of the EU General Data Protection Regulation and there is no other legal basis for data processing available.

(3) You object against data processing according to art. 21 sec. 1 of the EU General Data Protection Regulation and there are no overriding legitimate reasons for processing or you object against data processing according to art. 21 sec. 2 of the EU General Data Protection Regulation.

(4) The processing of personal data concerning you as a data subject has been unlawful.

(5) Erasure of the personal data concerning you as a data subject is required to meet the legal obligations according to union law or to the law of a member state that applies to the data controller.

(6) The personal data concerning you as a data subject have been collected in connection with services offered by the information society according to art. 8 sec. 1 of the EU General Data Protection Regulation.

b) Information to third parties

Where the data controller has disclosed the personal data concerning you as a data subject and holds an obligation according to art. 17 sec. 1 of the EU General Data Protection Regulation to delete such data, the data controller shall in consideration of available technology and the cost of implementation take appropriate measures, also of technical nature, to inform the parties responsible for data processing that you as a data subject have requested them to delete any link to such personal data or to copies or duplicates of such personal data.

c) Exceptions

The right to erasure does not exist, where processing is necessary

(1) to exercise the freedom of expression and information;

(2) to fulfil any legal obligations, according to which processing is necessary according to union law or the law of a member state that applies to the data controller or to fulfil a duty, which is part of the public domain or which is exercised under public authority transferred to the data controller;

(3) for reasons of public interest in the domain of public health according to art. 9 sec. 2 lit. h and i as well as art. 9 sec. 3 of the EU General Data Protection Regulation;

(4) for archiving purposes within the public domain, for scientific or historic research purposes or for statistical purposes according to art. 89 sec. 1 of the EU General Data Protection Regulation, where the rights stated under paragraph a) will likely render it impossible to realise the aims of such processing or will provide a major obstacle to the said realisation; or

(5) to enforce, exercise or defend any legal claim.

5. Right to notification

Where you have exercised your right to rectification, erasure or restriction towards the data controller, the latter holds an obligation to inform any recipients, who have received the personal data concerning you as a data subject about such rectification or erasure of data or restricted processing, unless this either proves to be impossible or would entail an inappropriate effort.

You have the right to be notified about such recipients by the data controller.

6. Right to data portability

You have the right to obtain the personal data concerning you as a data subject that you have provided to the data controller in a structured, established and machine-readable format. Additionally, you have the right to transfer this data to a different data controller without interference from the data controller, to which the personal data have been provided where

(1) the processing is based on consent given according to art. 6 sec. 1 lit. a of the EU General Data Protection Regulation or art. 9 sec. 2 lit. a of the EU General Data Protection Regulation or a contract according to art. 6 sec. 1 lit. b of the EU General Data Protection Regulation and

(2) the processing makes use of automated procedures.

When exercising this right, you also have the right to have personal data concerning you as the data subject directly transferred from one data controller to another data controller, where this is technically feasible. The freedoms and rights of other persons may not be compromised in doing so.

The right to data portability does not apply to any processing of personal data necessary to fulfil a duty, which is part of the public domain or which is exercised under public authority transferred to the data controller.

7. Right to object

You have the right to object against the processing of personal data concerning you as a data subject at any time and for reasons that arise due to your particular situation where such processing occurs according to art. 6 sec. 1 lit. e or f of the EU General Data Protection Regulation; this also applies to profiling activities based on the stated regulations

The data controller shall not continue to process the personal data concerning you as a data subject, unless they can prove compelling reasons for processing worthy of protection, which outweigh your interests, rights and freedoms or such processing is necessary to enforce, exercise or defend any legal claim.

Where the personal data concerning you as a data subject is used for direct marketing, you have the right, to object against such processing of the personal data concerning you as a data subject for such advertising purposes; this also applies to any profiling activities in connection with such direct marketing.

Where you object to such processing for the purposes of direct marketing, the personal data concerning you as a data subject shall no longer be used for such purposes.

In connection with using information society services – and regardless of Directive 2002/58/EC – you have the option to exercise your right to objection via automated procedures using technical specifications.

8. Right to withdraw your consent given for privacy protection purposes

You have the right to withdraw your consent given for privacy protection purposes at any time. Withdrawing your consent will not affect the lawfulness of data processing, which occurred prior to the withdrawal and based on the consent previously given.

9. Automated individual decisions including profiling

You have the right not to be subjected to any decision exclusively based on automated processing – including profiling – that will have a legal effect on you or that will significantly affect you in a comparable way. This does not apply, where such a decision

(1) is required to conclude or to fulfil a contract by and between you and the data controller,

(2) is permitted according to union law or the law of a member that applies to the data controller and such legal provision contains appropriate measures to maintain your rights and freedoms as well as your legitimate interest or

(3) is taken with your express consent.

These decisions may, however, not be based on special categories of personal data according to art. 9 sec. 1 of the EU General Data Protection Regulation, unless either art. 9 sec. 2 lit. a or g are applicable and appropriate measures to maintain your rights and freedoms as well as your legitimate interest have been taken.

In light of the cases stated in (1) and (3), the data controller shall take appropriate measures to maintain your rights and freedoms as well as your legitimate interest, which at least includes requesting a person from the part of the data controller intervene in the process, being able to present your own standpoint and to dispute the decision.

10. Right to file a complaint with a supervisory authority

Notwithstanding any other administrative or legal remedy, you have the right to file a complaint with a supervisory authority, especially in the member state, in which you reside, work or in which any alleged violation occurred, when you believe the processing of personal data concerning you as a data subject occurs in violation of the EU General Data Protection Regulation.

The supervisory authority receiving such complaint shall inform the complainant about the status and the results of their complaint including the option to seek legal remedy according to art. 78 of the EU General Data Protection Regulation.