Privacy Policy

1) Controller contact details

Dermatest GmbH Dermatological test institute Nevinghoff 30 48147 Münster

Phone: +49 251 4816370 Email: info@dermatest.de

2) Data Protection Officer contact details

DSB Münster GmbH Martin-Luther-King-Weg 42-44 48155 Münster

Phone: 0251 718 79 - 0 Email: info@dsb-ms.de

3) Purposes of processing and legal basis for the processing of personal data

- Our legitimate interest (Art. 6 para. 1 lit. f GDPR) – management of customer data - Initiation of a contract or conclusion of a contract as well as performance of the contract (delivery of goods, processing of payments) (Art. 6 para. 1 lit. b GDPR)

If the controller intends to process personal data for a purpose other than that for which it was collected, the data subject will be informed in accordance with Art. 13 para. 3 GDPR.

4) Recipients or categories of recipients of the personal data

The controller transfers personal data exclusively on the basis of statutory provisions or with the consent of the data subject. Data is transferred to the following third parties:

- Company-owned ERP system for further processing of the data - Invitation emails: via Brevo

5) Storage period

Your data is processed and stored in connection with the performance of the contract. After processing/contract performance has been completed, your personal data will be stored in accordance with the applicable statutory retention periods. After contract performance and expiry of the statutory retention periods, your data will be deleted in a manner compliant with data protection law.

6) Your rights

- Right of access (Art. 15 GDPR) - Right to rectification (Art. 16 GDPR) - Right to erasure (Art. 17 GDPR) - Right to restriction of processing (Art. 18 GDPR) - Right to data portability (Art. 20 GDPR) - Right to lodge a complaint with the (competent) supervisory authority (Art. 77 GDPR)

7) Notification of personal data breaches

In the event of a personal data breach, the controller will notify the competent data protection supervisory authority. If the breach is likely to result in a high risk to the rights and freedoms of a natural person, the controller will also notify the data subject (you).

8) Right to object

You may object to the processing of your personal data at any time pursuant to Art. 21 para. 1 GDPR.

9) Automated decision-making including profiling

There is no automated decision-making including profiling.