Under the GDPR, you have comprehensive rights regarding your personal data. You can exercise these rights at any time by contacting us.

14.1 Right of Access (Art. 15 GDPR)

You have the right to request confirmation from us as to whether and what personal data we process about you. You can request information about:

• The purposes of processing

• The categories of personal data concerned

• The recipients or categories of recipients to whom the data has been or will be disclosed

• The envisaged period for which the data will be stored

• The existence of the right to rectification, erasure, restriction, or objection

• The right to lodge a complaint with a supervisory authority

• Where the data was not collected from you, any available information as to its source

• The existence of automated decision-making, including profiling

We will provide you with a copy of your personal data free of charge. For additional copies, we may charge a reasonable administrative fee.

14.2 Right to Rectification (Art. 16 GDPR)

You have the right to request the rectification of inaccurate personal data or the completion of incomplete personal data stored by us without undue delay.

How to exercise: Contact us with the corrected information, and we will update your data within one month.

14.3 Right to Erasure ("Right to be Forgotten") (Art. 17 GDPR)

You have the right to request the erasure of your personal data without undue delay if one of the following grounds applies:

• The data is no longer necessary for the purposes for which it was collected

• You withdraw your consent and there is no other legal ground for processing

• You object to the processing and there are no overriding legitimate grounds

• The data has been unlawfully processed

• Erasure is necessary to comply with a legal obligation

• The data was collected in relation to information society services offered to children

Exceptions: We may not be able to erase your data if retention is necessary for:

• Compliance with legal obligations

• Establishment, exercise, or defense of legal claims

• Archiving purposes in the public interest, scientific or historical research, or statistical purposes

14.4 Right to Restriction of Processing (Art. 18 GDPR)

You have the right to request the restriction of processing if:

• You contest the accuracy of the data (restriction during verification period)

• The processing is unlawful, but you oppose erasure and request restriction instead

• We no longer need the data, but you need it for legal claims

• You have objected to processing pending verification of whether our legitimate grounds override yours

During restriction, we may only process your data with your consent or for legal claims, protection of others' rights, or important public interests.

14.5 Right to Data Portability (Art. 20 GDPR)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit this data to another controller where:

• The processing is based on consent or contract

• The processing is carried out by automated means

We will provide your data in common formats such as CSV, JSON, or XML.

14.6 Right to Object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 (1) lit. e (public interest) or f (legitimate interests) GDPR, including profiling based on those provisions.

We will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

Direct Marketing: If your data is processed for direct marketing purposes, you have the right to object at any time. If you object, we will immediately stop processing your data for direct marketing purposes.

14.7 Right to Withdraw Consent (Art. 7 (3) GDPR)

Where processing is based on your consent, you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

How to withdraw consent:

• For cookies: Adjust your cookie preferences via our cookie banner

• For newsletter: Click unsubscribe link in any newsletter

• For all other processing: Contact us at cp@ecoefxsol.com

14.8 Right to Lodge a Complaint (Art. 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.

Competent supervisory authority for our company:

The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Straße 22
20459 Hamburg
Germany

Phone: +49 40 428 54-4040
Fax: +49 40 428 54-4000
Email: mailbox@datenschutz.hamburg.de
Website: https://datenschutz-hamburg.de

You can also contact the supervisory authority in your own country. A list of EU supervisory authorities is available at: https://edpb.europa.eu/about-edpb/board/members_en

14.9 Automated Individual Decision-Making, Including Profiling (Art. 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Our practice: We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you. Any analytics or personalization on our website does not result in automated decisions that affect your rights.

14.10 How to Exercise Your Rights

To exercise any of your rights, please contact us:

ECO EFX Solutions GmbH
Data Protection Officer: Sven-Oliver Robertson
Hamburger Straße 180
22083 Hamburg
Germany

Email: cp@ecoefxsol.com
Phone: +49-40-298 234 60

We will respond to your request:

• Without undue delay

• Within one month of receipt of the request

• Extended to two months if necessary due to complexity (we will inform you of the extension)

• Free of charge (we may charge a reasonable fee for repetitive or excessive requests)

To protect your privacy, we may ask you to verify your identity before responding to requests concerning your personal data.