P R I V A ­C Y   P O ­L I C Y
according to EU General Data Protection Regulation (GDPR)

Status: 20. Mai 2018 | Last Update: 10. Oktober 2018 | Last Correction: 10. Oktober 2018

§ 1.1 | of the responsible

The responsible person, in the sense of the EU general data protection regulation, other national juridical and other data protection regulations, is the owner (hereinafter "Operator") of this web portal (hereinafter "Board") Audi RS3-Forum (www.audirs3.de, www.audirs3.ch, www.audirs3.eu):

• Name:
  RS3 Club International e.V.
• Address:
  Kapfackerstrasse 10
• ZIP/City:
  5628 Aristau
• Country:
  Switzerland
• E-mail:
  über Contact form

§ 1.2 | of the Data Protection Officer

Der Datenschutzbeauftragte des Verantwortlichen ist ebenfalls der Betreiber:

• Name:
  RS3 Club International e.V.
• Address:
  Kapfackerstrasse 10
• ZIP/City:
  5628 Aristau
• Country:
  Switzerland
• E-mail:
  über Contact form

§ 2.1 | Scope of the processing of personal data

This board processes the user's personal data only to the extent necessary to provide a functional website and its contents and services.
The processing of these data takes place only after consent of the user, which is implicitly given with the voluntary registration on this board.
An exception applies in those cases in which prior consent cannot be obtained for actual reasons and the processing of the data is permitted by law anyway.

§ 2.2 | Legal basis for the processing of personal data

As the operator obtains the user's consent for the processing of personal data, Art. 6 para. 1 lit. a of the EU General Data Protection Regulation (GDPR) serves as the legal basis. Art. 6 para. 1 lit. b GDPR serves as the legal basis for the processing of personal data necessary for the fulfilment of the contract between the operator and the user.
This also applies to processing operations which are necessary for the implementation of pre-contractual measures.

As far as a processing of the personal data is necessary for the fulfilment of a legal obligation, which is subject to operators or board, Art. 6 Abs. 1 lit. c GDPR serves as a legal basis.

In the event that the vital interests of the user, employees of the operator or other natural or legal persons make the processing of personal data necessary, Art. 6 para. 1 lit. d GDPR shall serve as the legal basis.

If the processing is necessary for the protection of a legitimate interest of this board or a third party and the interests, fundamental rights and fundamental freedoms of the user do not outweigh the first mentioned interests, then Art. 6 Abs. 1 lit. f GDPR serves as a legal basis for the processing.

§ 2.3 | Data erasure and storage duration

The personal data of the user will be deleted or blocked as soon as the purpose of storage no longer applies.

Storage beyond this can take place if this has been provided for by European or national legislators, in Union regulations, laws or other regulations to which the operator is subject.

Data shall also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless it is necessary for further storage of the data for the conclusion or performance of a contract.

§ 3.1 | Description and scope of data processing

In order to participate on this board, it is necessary for visiting users to register by providing personal data.
These data are recorded in an input mask, transmitted to the board and stored there.

The data will not be passed on to third parties under any circumstances.

The following data is collected and stored during the registration process:

1. The IP address of the computer used to register the user,
2. date and time of registration,
3. unique user abbreviation (nickname) assigned by the user himself or herself,
4. E-mail address of user,
5. user preferred language when displaying the board,
6. user preferred time zone,
7. date of birth of the user (voluntary),
8. user's city of residence (voluntary),
9. gender of user (voluntary),
10. occupation of the user (voluntary),
11. personal interests of the user (voluntary) as well as
12. further personal information (voluntary).

Within the scope of registration, the user's consent to the processing of this data is also obtained.
This consent can be viewed, modified or deleted by the user at any time via his user profile.

§ 3.2 | Legal basis for data processing

Legal basis for the processing of the data is through the existence of the consent of the user Art. 6 para. 1 lit. a GDPR.

§ 3.3 | Purpose of data processing

The registration of the user is mandatory for the provision of contents and services of the board created by the user.
Only by using this data in connection with the unique user abbreviation (nickname) active functions such as creating/commenting topics and/or profile conversations can be performed on the board.

§ 3.4 | Duration of storage

The registration of the user is required for the provision of content and services.
The user's registration may be terminated by the operator at the user's request or by exclusion of the user.
The data will then be deleted by the operator as they are no longer required for the purpose of their collection..

§ 3.5 | Possibility of opposition and removal

The user has at any time the possibility to ask the operator to dissolve the registration in order to terminate the participation on the board.
The data stored on the user can be viewed by the user at any time via his user profile and in most cases can be changed or deleted independently.

§ 4.1 | Description and scope of data processing

Each time this board is called, the system automatically collects data and information from the user's calling computer system.

The following data will be collected:

1. Information about the browser type and the version used,
2. user's operating system,
3. Internet service provider of the user,
4. IP address of the user,
5. date and time of access,
6. websites from which the user's system got on this board, and
7. websites that are accessed from this board by the user's system or via which this board was exited.

This data is stored in system log files.
These data will not be stored in a comprehensible connection with other personal data of the user.

§ 4.2 | Legal basis for data processing

The legal basis for the temporary storage of these data and log files is Art. 6 para. 1 lit. f GDPR.

§ 4.3 | Purpose of data processing

The temporary storage of the IP address by the system is necessary to be able to "deliver" the web pages of the board to the user's computer.
For this purpose, the IP address of the user must remain known and stored for the duration of the session.

The storage in logfiles is done to ensure the basic functionality of the board.
In addition, the data serve the operator to optimize the board and to ensure the security of its information technology systems.
An evaluation of the data for marketing purposes does not take place in this context.

These purposes shall also include the legitimate interest of the operator in the processing of data pursuant to Art. 6 para. 1 lit. f GDPR.

§ 4.4 | Duration of storage

The data will be deleted as soon as they are no longer necessary to achieve the purpose for which they were collected.

In the case of the collection of data to provide the board, this is the case as soon as the session in question has ended.
If IP addresses are stored in log files, this is the case after seven days at the latest.

In individual cases, storage beyond this is possible, whereby the IP addresses of the user are deleted or at least altered in such a way that an assignment to him is no longer possible.

§ 4.5 | Opposition and elimination

The collection of the data for the provision of the board and the storage of the data in log files is mandatory for the operation of the website.
Consequently, there is no possibility for the user to object.

§ 5.1 | Description and scope of data processing

The board allows the user to be notified automatically via e-mail of changes and additions to topics (threads) and profile discussions (personal messages) free of charge.
When this function is booked, the e-mail address specified by the user with his or her user profile is used for this purpose.
In addition, the following data is collected with each booking:

1. IP address of the calling computer (visiting user)
2. date and time of booking

The processing of the data takes place within the framework of the voluntary booking process initiated by the user.

In connection with the processing of data for the sending of notifications, the user's personal data will in no case be passed on to third parties.
The data will be used exclusively for sending notifications.

§ 5.2 | Legal basis for data processing

The legal basis for the processing of the data following the booking of notifications by the user (with the consent thereby implied) is Art. 6 para. 1 lit. a GDPR.

§ 5.3 | Purpose of data processing

The collection of personal data within the framework of booking notifications serves to prevent misuse of this service or the user's e-mail address.

§ 5.4 | Duration of storage

The data will be deleted as soon as they are no longer necessary to achieve the purpose for which they were collected.
The user's e-mail address is therefore stored for at least as long as the user is included in the list of booked notifications

§ 5.5 | Opposition and elimination

The user can terminate the subscriptions of his booked notifications at any time independently.
This is done via the settings in the user profile of the use

§ 6.1 | Description and scope of data processing

For direct contact with the operator, the board provides the Contact form.
If a visitor or a registered and logged in user contacts the operator in this way, only the data visible in the input mask is transmitted to the board and stored.

In detail these are:

1. Name or user abbreviation of the logged in user specified by the visitor and
2. e-mail address provided by the visitor or stored in the user profile.

With the sending of the message to the board the following data are also collected and stored:

1. IP address of the computer from which the form was sent, and
2. date and time of contact.

For reasons of spam protection and other security concerns of the operator, a direct, public contact with indication of an e-mail address of the operator is not intended.
The data collected in this context will under no circumstances be passed on to third parties. They are collected and used exclusively for the processing of contact.

§ 6.2 | Legal basis for data processing

The legal basis for the processing of the data is Art. 6 para. 1 lit. a GDPR.

§ 6.3 | Purpose of data processing

The processing of the personal data from the input mask serves the sole purpose of establishing contact.
The other data collected during the sending process is used to prevent misuse of the contact form and to ensure the security of the board's information technology systems.

§ 6.4 | Dauer der Speicherung

The data are deleted as soon as they are no longer necessary for the purpose of their collection.
For the personal data from the input mask of the contact form, this is the case when the respective conversation with the visitor/user has ended.
A conversation is ended when the context of the communication concerned indicates that the matter in question has been resolved.

The additional data collected during the sending process shall be deleted after a period of seven days at the latest.

§ 6.5 | Possibility of opposition and removal

The user can revoke his consent to the processing of his personal data at any time.
In this case, all personal data stored in the course of establishing contact will be deleted.
The conversation cannot be continued afterwards.

§ 7.1 | Right to information

The user can request confirmation from the operator as to whether his personal data will be processed on the board.

If such processing exists, the user can request information from the operator about the following information:

1. The purposes for which the personal data will be processed,
   
   
2. the categories of personal data processed,
   
   
3. the recipients or categories of recipients to whom the personal data relating to the user has been or will be disclosed,
   
   
4. the planned duration of the storage of personal data relating to the user or, if this is not possible, criteria for determining the duration of the storage,
   
   
5. the existence of a right to rectification or erasure of personal data relating to the user, a right to limit the processing carried out by the controller or a right to object to such processing,
   
   
6. the existence of a right of appeal to a supervisory authority,
   
   
7. all available information about the origin of the data, if the personal data are not collected from the user himself,
   
   
8. the existence of automated decision making, including profiling, in accordance with Art. 22 para. 1 and 4 GDPR and, at least in these cases, meaningful information on the logic involved and the scope and intended impact of such processing for the user concerned.
   

The user has the right to request information as to whether personal data concerning him or her will be transferred to a third country or to an international organisation

In this context, the user can request to be informed about the appropriate guarantees according to Art. 46 GDPR in connection with the transmission.

§ 7.2 | Right to rectification

The user has a right to correction and/or completion of his personal data vis-à-vis the operator, if these are incorrect or incomplete.
. The operator must carry out the correction immediately.

§ 7.3 | Right to limitation of processing

Under the following conditions, the user may request that the processing of his personal data be restricted,

1. if the user contests the accuracy of the personal data concerning him for a period of time which enables the operator to verify the accuracy of the personal data,
2. the processing is unlawful and the user refuses to delete his/her personal data and instead requests the restriction of the use of the personal data,
3. the operator no longer needs the personal data for the purposes of processing, but the user needs them to assert, exercise or defend legal claims, or
4. if the user has lodged an objection against the processing according to Art. 21 para. 1 GDPR and it is not yet clear whether the legitimate reasons of the operator outweigh the reasons of the user.
   

Where the processing of personal data relating to the user has been restricted, such data may not be processed, other than with the user's consent or for the purpose of asserting, exercising or defending a right or protecting the rights of another natural or legal person or for reasons of an important public interest of the Union or of a Member State, apart from their storage.

If the restriction of processing has been restricted in accordance with the above conditions, the user will be informed by the operator before the restriction is lifted.

§ 7.4 | Right to deletion

1. Deletion obligation
   The user may request the operator to delete the personal data relating to the user immediately and the operator is obliged to delete this data immediately if one of the following reasons applies:

   1. Personal data relating to the user are no longer necessary for the purposes for which they were collected or otherwise processed,
   2. the user revokes the consent on which the processing is based pursuant to Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR, and there is no other legal basis for the processing,
   3. the user objects to the processing in accordance with Art. 21 para. 1 GDPR and there are no prior legitimate reasons for the processing, or the user objects to the processing in accordance with Art. 21 para. 2 GDPR,
   4. the personal data concerning the user have been processed unlawfully,
   5. the deletion of personal data relating to the user is necessary to fulfil a legal obligation under Union law or the law of the Member States to which the operator is subject, or
   6. the personal data relating to the user have been collected in relation to information society services offered in accordance with Art. 8 para. 1 GDPR.

   
   
2. Information to third parties
   If the operator has made the personal data concerning the user public and if he is obliged to delete them in accordance with Art. 17 para. 1 GDPR, he shall take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform those responsible for data processing who process the personal data that the user, as the person concerned, has requested the deletion of all links to these personal data or copies or replications of these personal data from them.



3. Exemptions
   The right to deletion does not exist if the processing is necessary

   1. on the exercise of the right to freedom of expression and information,
   2. to fulfil a legal obligation which the processing requires under the law of the Union or of the Member States to which the operator is subject or to perform a task carried out in the public interest or in the exercise of official authority vested in the operator,
   3. for reasons of public interest in the field of public health pursuant to Art. 9 para. 2 lit. h and i as well as Art. 9 para. 3 GDPR,
   4. for archive purposes lying in the public interest, scientific or historical research purposes or for statistical purposes according to Art. 89 para. 1 GDPR, as far as the right mentioned under section a) presumably makes the realisation of the goals of this processing impossible or seriously impairs, or
   5. for the assertion, exercise or defence of legal claims.

§ 7.5 | Right to information

If the user has asserted the right to rectification, cancellation or limitation of processing to the operator, the operator is obliged to inform all recipients to whom personal data concerning the user have been disclosed of this rectification or cancellation of data or limitation of processing, unless this proves impossible or involves a disproportionate effort.
The user has the right vis-à-vis the operator to be informed about these recipients.

§ 7.6 | Right to data transferability

The user has the right to receive the personal data concerning him which he has provided to the operator in a structured, common and machine-readable format.
In addition, the user has the right to transfer this data to another operator without being hindered by the operator to whom the personal data was provided, provided that

1. the processing is based on a consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract pursuant to Art. 6 para. 1 lit. b GDPR and
2. processing is carried out using automated procedures.
   

In exercising this right, the user also has the right to obtain that the personal data relating to him be transferred directly from one operator to another operator, insofar as this is technically feasible. Freedoms and rights of other persons must not be affected by this.

The right to data transfer does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

§ 7.7 | Right of opposition

The user has the right to object at any time, for reasons related to his/her particular situation, to the processing of personal data concerning him/her carried out on the basis of Art. 6 para. 1 lit. e or f GDPR, including profiling based on these provisions.

The operator no longer processes personal data relating to the user unless he can prove compelling reasons for processing worthy of protection which outweigh the user's interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

Where personal data relating to the user are processed for the purpose of direct marketing, the user shall have the right to object at any time to the processing of personal data relating to him for the purposes of such advertising, including profiling in so far as it is linked to such direct marketing.
If the user objects to the processing for direct marketing purposes, the personal data concerning him will no longer be processed for these purposes.

The user has the possibility to exercise his right of objection in relation to the use of Information Society services, notwithstanding Directive 2002/58/EC, by means of automated procedures using technical specifications.

§ 7.8 | Right to revoke the declaration of consent

The user has the right to revoke his data protection declaration of consent at any time.
The revocation of the consent does not affect the legality of the processing carried out on the basis of the consent up to the revocation.

§ 7.9 | Automated decision in individual cases including profiling

The user has the right not to be subjected to a decision based exclusively on automated processing - including profiling - which has legal effect on him or significantly affects him in a similar manner.
This shall not apply if the decision

1. is necessary for the conclusion or performance of a contract between users and the person responsible,
2. is permitted by national law, Union law or the laws of the Member States to which the operator is subject, and those laws contain appropriate measures to safeguard the rights and freedoms of the user and the legitimate interests of the user, or
3. with their express consent.

However, these decisions may not be based on special categories of personal data under Art. 9 para. 1 GDPR, unless Art. 9 para. 2 lit. a applies and appropriate measures have been taken to protect the rights and freedoms and legitimate interests of the user.

In the cases referred to in (1) and (3), the Operator shall take reasonable measures to safeguard the rights and freedoms and the legitimate interests of the User, including at least the right of the Operator to obtain the intervention of a person, to state its position and to contest the decision.

§ 7.10 | Right of appeal to a supervisory authority

Without prejudice to any other administrative or judicial remedy, the user shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State in which he/she is staying, at his/her place of work or at the place where the alleged infringement is suspected, if he/she considers that the processing of his/her personal data is in breach of the GDPR.

The supervisory authority with which the complaint was filed shall inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy under Art. 78 GDPR.

Information about how this board handles cookies is described in Cookie Usage.

The conditions under which the use of this board is permitted are described in Terms of Use.