Data protection information for media use

1. General Information

We will process your personal data - including on the basis of this declaration of consent - in compliance with the General Data Protection Regulation (GDPR) and the relevant German data protection laws, e.g. the Federal Data Protection Act (BDSG). This Data Protection Statement serves to inform you about the legal basis of the data processing and your rights pursuant to the GDPR.

a) Controller for the purposes of the GDPR
METRO AG, Metro-Straße 1, 40235 Düsseldorf, Germany.

b) Data Protection Officer
DPO, Metro-Straße 1, 40235 Düsseldorf, Germany /// Email: datenschutz@metro.de

2. Legal basis for data processing and miscellaneous information

Your personal data will be used to the agreed extent for the presentation in the agreed media. If the agreement is based on a declaration of consent, the legal basis for your consent and the data processing based on this is Art. 6 para. 1 s. 1 lit. a) GDPR. If the agreement is based on a contract, the legal basis is the fulfillment of this contract and Art. 6 para. 1 s. 1 lit. b) GDPR.

Recipients may include the affiliated companies specified in the agreement, who may have their registered office in countries outside of the European Union (EU) or European Economic Area (EEA). METRO will warrant an adequate level of protection for your personal data within METRO Group.

3. Your rights

Data subjects wishing to exercise their rights under the GDPR may contact our Data Protection Officer at any time by sending an informal message using the contact details set out at 1. b) above. Data subjects have the following rights:

• the right to obtain information on data processing and a copy of the data that has been processed (right of access, Art. 15 GDPR),
• the right to request the rectification of inaccurate data or the completion of incomplete data (right to rectification, Art. 16 GDPR),
• the right to request the deletion of personal data and, if the personal data has been published, to inform other controllers about the request for deletion (right to be forgotten, Art. 17 GDPR),
• the right to request a restriction of the data processing (right to restriction of processing, Art. 18 GDPR),
• the right to receive the personal data relating to the data subject in a structured, commonly used and machine-readable format and the right to request that the data be transferred to another controller (right to data portability, Art. 20 GDPR),
• the right to object to data processing in order to halt processing (right to object, Art. 21 GDPR),
• the right to lodge a complaint with a supervisory authority (State Commissioner for Data Protection and Information Security in Nordrhein-Westfalen PO Box 20 04 44, 40102 Düsseldorf) if you consider that the processing of your personal data infringes the GDPR (right to lodge a complaint with a supervisory authority, Art. 77 GDPR).

Information about your revocation right (Art. 7 GDPR):

• You have the right to revoke a previously granted declaration of consent at any time and thereby prevent the processing of your data on the basis of that consent. A revocation of consent does not prejudice the lawfulness of any data processing based on your consent prior to your revocation of consent.