Thank you for visiting our IAV Merida Signals website. With the help of this Privacy Notice, you can obtain an overview of the personal data (“Data”) processed when you visit our website, register for and use IAV Merida Signals, and what rights you have related to the processing of your Data according to the EU General Data Protection Regulation (“GDPR”). For further information please see our Privacy Notice for Business Partners.

We,

IAV GmbH
Ingenieurgesellschaft Auto und Verkehr („IAV“)
Carnotstraße 1
10587 Berlin

are responsible for protecting your Data.

If you have any questions regarding the processing of data, regarding your rights or this Privacy Notice, please do not hesitate to contact our Data Protection Officer. He can be reached by email at: datenschutzbeauftragter@iav.de.

Insofar as the Telecommunication-Telemedia-Data-Protection-Act ("TDDDG") applies to the technologies used on our website, no consent is obtained (Sec. 25 (1) TDDDG), if data processing is technically necessary for the operation of the website, in particular to ensure the permanent functionality and security of our website and our information technology systems or it is necessary to meet legal requirements.

Log files

Description and scope of data processing:

When you visit our website your browser automatically transmits the following Data:

• information about the browser type and the version used,
• the user's operating system,
• the Internet service provider of the user,
• the IP address of the user,
• date and time of access,
• websites from which the user's system accesses our website (referrer URL),
• Websites accessed by the user's system from our website.

Purposes of data processing:

The temporary storage of the IP address by the system is necessary in order to enable the user's electronic device to receive the requested Data. For this purpose, the IP address of the user must be stored for the duration of the session. Other Data is stored in log files to ensure the functionality of the website. The data is also used to optimize the content of our website, to help us prevent malfunctions and misuse of our systems, to ensure the long-term functionality and security of our website and information technology systems, and to provide prosecuting authorities with the information necessary for prosecution in the event of a cyber attack.

Legal basis:

We store this Data temporarily on the basis of legitimate interests (Art. 6 sec. 1 f GDPR). Our legitimate interest lies in achieving the purposes described above.

Term of storage and control options:

The Data will be erased if they are no longer necessary to achieve the purposes. Log files are erased after 30 days at the latest, unless a longer storage period is necessary to comply with contractual or legal obligations. The IP address is stored for the duration of the session. Data, the further storage of which is needed for evidence purposes, are excluded from erasure until the respective incident has been finally clarified.

(De-)registration

Description and scope of data processing:

You must register to use IAV Merda Signals. For this purpose, a connection to the IAV Merida Signals backend is initiated and a user profile with the following data is generated:

• User name,
• Email address,
• Computer name,
• Unique hardware characteristics (motherboard, chipset serial number, etc.),
• Password.

You provide your name and email address during the registration process.

We also process your User-ID, rights/role, login data as well as the cookie data specified below when you use IAV Merida Signals:

Purposes of data processing:

The processing of this data is necessary to enable your use of IAV Merida Signals.

Legal basis:

We store the data to enable you to use IAV Merida Signals in accordance with the agreed license terms (Sec. 25 (2) No. 2 Telecommunications Digital Services Data Protection Act; performance of a contract pursuant to Art. 6 (1) b GDPR.

Term of storage and control options:

Your user profile will be stored until you deregister. As soon as you close your browser, session cookies are automatically deleted by default, unless you have chosen a different setting in the cookie settings of your browser.

Email newsletter

Description and scope of data processing:

When you register for IAV Merida Signals, we process your name and email address in order to send you information about IAV products and services similar to IAV Merida Signals by email. If you do not agree to receive such emails, you can untick the checkbox during registration as well as object at any time via the link at the end of the emails.

In addition, you will receive technical system messages about IAV Merida Signals as necessary.

Purposes of data processing:

The email is sent to draw your attention to similar IAV products and services as well as updates and, for example.

Legal basis:

The e-mailing follows the requirements of Section 7 (3) UWG and is used to achieve the purpose described above (Art. 6 Sec. 1 f GDPR).

Term of storage and control options:

Your data will be processed for advertising purposes until you object to receiving emails, i.e. unsubscribe from the newsletter using the link at the end of the emails, or deregister from IAV Merida Signals. Please note that you will continue to receive technical system messages for IAV Merida Signals even after you have objected.

Visualization of measurement data

The measurement data is visualized exclusively on your device used.

Description and scope of data processing:

We collect and process the Data provided by you, such as contact data, your name and your query, when you contact us via e-mail. All Data that you provide to us is transferred between your browser and our servers in encrypted form. If your request relates to the functionality of IAV Merida Signals, i.e. in particular error reporting, it will be processed in our ticket system. In our ticket system the receipt (time stamp), processing steps and duration of ticket handling as well as the request itself are documented.

Purposes of data processing:

We process your Data to handle your inquiry including troubleshooting.

Legal basis:

We process your Data to perform precontractual and contractual measures, that occur on the basis of your inquiry (Art. 6 sec. 1 b GDPR). In all other cases, the processing is based on our legitimate interest in the effective processing of the queries addressed to us (Art. 6 sec. 1 f GDPR).

Term of storage and control options:

We store your Data for as long as we need it for the specific processing purpose. Software-related (error) requests are stored in our ticket system for the duration of handling and afterwards archived. In addition, we store certain Data for the duration of the statutory limitation periods (usually three years, in individual cases up to 30 years) and for as long as is prescribed by statutory retention periods (e.g. as defined in the Commercial Code (HGB), the Fiscal Code [AO]) (usually ten years).

Departments within IAV

Within IAV, your Data is processed according to the need-to-know-principle by persons who require the data for the purposes described.

Third parties

The backend of IAV Merida Signals as well as the website runs on Microsoft Azure servers and therefore your data is stored on the Microsoft Azure servers temporarily. For further information on Microsoft data processing, see the Microsoft Privacy Notice.

To the extent necessary we might also transfer your data to other suppliers, e.g. in the field of IT services and applications, advisory, compliance and legal. These suppliers are contractually obliged to maintain confidentiality and fulfill the requirements under data protection law. Microsoft as well as other suppliers that are data processors have signed a contract to ensure that Data will be processed strictly according to our instructions.

Withdrawal of consent

You can withdraw any consent you have granted to the processing of your Data at any time and with effect for the future. Please note that the withdrawal will have no impact on the legality of the previous data processing and that it does not extend to such data processing for which statutory authorisation exists and which can therefore be performed without your consent.

Other rights of data subjects

According to Art. 15 to 21 and 77 GDPR and if the conditions are met, you are furthermore entitled to the following rights. To assert your rights, please contact: datenschutzbeauftragter@iav.de.

Access:

You can at any time demand provision of information on the Data of yours that we process and demand a copy of the Data stored on you, Art. 15 GDPR. Please note that further copies of the Data stored on you may be subject to a charge.

Correction:

You can demand the correction of incorrect Data as well as the completion of incomplete Data according to Art. 16 GDPR.

Erasure:

You can demand the erasure of your Data. Please note that the erasure does not include Data required for the execution and processing of contracts and to assert, exercise and defend against legal claims as well as Data for which statutory, supervisory or contractual retention obligations exist, Art. 17 GDPR.

Restriction of processing:

You can under certain circumstances demand the restriction of the processing, e.g. if you believe that your Data is incorrect, if the processing is illegal or you have raised a complaint about the data processing. This will mean that without your consent your Data may only be processed in a very restricted way, e.g. to assert, exercise or defend against legal claims or to protect the rights of other natural or legal entities, Art. 18 GDPR.

Objection to the data processing:

You have the option to object to the data processing for direct advertising purposes at any time. In addition, you can object at any time to data processing performed on the basis of a legitimate interest if there is particular reason for doing so, Article 21 GDPR.

Data portability:

You have the right to receive the Data provided by you, which was processed based on your consent or in order to fulfill a contract, in a structured, commonly used and machine-readable format and the right to demand a direct transfer of this Data to third parties within the realms of what is technically possible, Article 20 GDPR.

Right to appeal to the competent data protection supervisory authority

If you, for example, consider that the processing of your Data is illegal or that your rights described above are not granted to you to the required extent, you have the right to file a complaint to the competent data protection supervisory authority. An overview of the supervisory authorities including contact details can be found here.