Privacy policy

Data transfer to other companies within and outside the Roto Group
Certain data processing operations are undertaken by companies within the Roto Group. It is possible that your data will be transferred for this purpose. As a rule, this transfer is based on an agreement on commissioned data processing. In individual cases, it is also possible that the legal basis for the transfer is our legitimate interest in accordance with Article 6 (1f) GDPR, whereby our legitimate interest lies in the efficient organisation of our internal processes.

As a general rule, your data is not transmitted to third parties outside of the Roto Group unless we are legally obligated to do so or the data transfer is required to perform the contract or you have expressly given your prior consent to the transfer of your data.

Data transfer to external service providers (processors)
Your data will be passed on to service partners to the extent that they are acting on our behalf and supporting Roto in the provision of its services.

Any processing of your personal data by commissioned service providers is carried out within the scope of commissioned data processing in accordance with Article 28 GDPR. Insofar as external service providers come into contact with your personal data, we have taken legal, technical and organisational measures and perform regular checks to ensure that these service providers also comply with the applicable data protection regulations.

The website itself is hosted on a processor's servers.

Data erasure and storage period
The personal data of data subjects is erased or blocked as soon the purpose of storage no longer applies. The data may continue to be stored beyond this period if stipulated by European or national legislators in regulations or legislation under Union law or other regulations to which the controller is subject. The data will likewise then be blocked or erased once a storage period prescribed by the specified regulations expires, unless the data needs to be retained further for the purposes of concluding or executing a contract.

Rights of the data subject
If personal data concerning you is processed, you are a data subject as defined in the GDPR and you have the following rights with respect to the above-mentioned controller:

Right of access by the data subject
You can request confirmation from us on whether we are processing personal data that concerns you. If we have processed data relating to you, you are entitled to other rights of access as specified in Article 15 GDPR.

Right to rectification
If the data that we have collected relating to you is incorrect or incomplete, you can request that we promptly rectify it in accordance with Article 16 GDPR.

Right to restriction of processing
In accordance with the requirements of Article 18 GDPR, you can, under certain circumstances, also request that the processing of your personal data is restricted.

Once processing has been restricted, your data must only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State. We will notify you before lifting the restriction.

Right to erasure
You have the right to ask us to erase the personal data concerning you without undue delay where one of the grounds defined in Article 17(1) GDPR applies, unless there is an exemption to the erasure obligation in accordance with Article 17(3) GDPR.

Right to data portability
Furthermore, in accordance with Article 20 GDPR, you have the right to receive the personal data concerning you in a machine-readable format and to transmit the data to another controller without hindrance, provided that the requirements defined in Article 20(1a) GDPR are met, or to have your personal data transmitted directly by us to another controller, where this is technically feasible and does not impair the rights and freedoms of others. This right does not apply to the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

Right to object
You have the right to object to the processing of the personal data concerning you by the above-mentioned controller at any time in accordance with Article 6(1a) or 6(f) GDPR.

We will then cease processing your personal data unless there are compelling legitimate reasons for doing so which outweigh your interests, rights and freedoms, or unless the processing is used to establish, exercise or defend legal claims

Right to lodge a complaint with a supervisory authority
If you consider that the processing of the personal data concerning you infringes the GDPR, you have the right – without prejudice to any other administrative or legal remedy – to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement at any time.

Changes to the privacy policy
This privacy policy will be updated on an ongoing basis as the Internet and our website evolves. We will announce any changes on this page in good time. For information on our current data protection regulations, you should check this page on a regular basis.