DATA PROTECTION INFORMATION
REGARDING PHOTOGRAPHY, VIDEO, AND AUDIO RECORDING AT EVENTS
NAME AND ADDRESS OF THE CONTROLLER
The controller, as defined by the General Data Protection Regulation and other national data protection laws of the member states, as well as other data protection regulations, is the
FFT Produktionssysteme GmbH & Co. KG
Industriepark Fulda-West
Schleyerstraße 1
36041 Fulda
Germany
Tel.: +49 661 2926-0
E-Mail: info[at]fft.de
Website: www.fft.de
ADDRESS OF THE DATA PROTECTION OFFICER
The data protection officer of the controller is
BerIsDa GmbH
Telephone: +49 661 – 29698090
Mail: dsb(at)fft.de
GENERAL INFORMATION ON DATA PROCESSING
1. Description and Scope of Data Processing
This mandatory information pertains to the creation, editing, storage, and publication of photographs, videos, and audio recordings in which you are recognizable, taken at events organized by FFT Produktionssysteme GmbH & Co.KG. FFT Produktionssysteme GmbH & Co.KG takes photographs to document the event and for public relations purposes.
If you do not wish to be photographed, please let us or the photographer know immediately before or upon entering the event so that we can accommodate your request.
The provision of your personal data is not required by law or by contract. There is no obligation to provide such data. No fully automated decision-making (including profiling) pursuant to Article 22 of the GDPR is used in the processing of the data you provide.
2 Legal basis and purpose of processing
The legal basis for the creation, storage, and use of photos, videos, and audio recordings is Article 6(1), first sentence, subparagraph (f) of the GDPR. The photos are stored, processed, and published for the purpose of documenting the event and as part of our public relations efforts. These purposes constitute our legitimate interest
The legal basis for the extended use of photo, video, and audio recordings is your consent pursuant to Article 6(1), sentence 1, subparagraph (a) of the GDPR. We explicitly request this consent from you. This applies, for example, to the intra-group transfer of the recordings to China for public relations purposes and publication on EASUN’s communication platforms and social media channels.
The storage of any objection is also based on Article 6(1), first sentence, subparagraph (f) of the GDPR for evidentiary purposes and to defend against liability claims.
3. Duration of Storage, Right to Object, and Right to Erasure
We will process the data you provide for as long as it is necessary to safeguard our legitimate interests or until you object to our processing of the data. Once our legitimate interests no longer apply, your data will be deleted.
Photos, videos, and audio recordings that are not used following the event will be stored for a period of two years and then deleted; published photos will be removed from our website and deleted once they are no longer needed.
By publishing the data on our website and on social media, it is made accessible to third parties, meaning that once published, we have only limited ability to delete the data. If you object, we will remove the data from the online platforms directly accessible to us (our website, our social media profiles). We have no control over how long the data is retained by other third parties who have gained access to it through publication. If you do not wish to be photographed, please inform us or the photographer immediately before or upon entering the event so that your request can be accommodated.
4. Recipients of the Data and Transfer to a Third Country or an International Organization
Within our company, access to the images is granted to those departments and divisions that require them to fulfill the purposes mentioned above and that are authorized to process this data. An external photographer may be commissioned to take the images. In the event of publication, images may be shared with affiliated service providers (e.g., editorial offices or agencies).
As part of our service provision, we engage data processors. These service providers act solely in accordance with the instructions of FFT Produktionssysteme GmbH & Co. KG and are contractually obligated to comply with applicable data protection requirements. To this end, we enter into written data processing agreements with these service providers. These agreements are required under data protection law and ensure that our service providers process the personal data of our data subjects only in accordance with our instructions and in compliance with data protection regulations (GDPR, BDSG, etc.).
The photos, videos, and audio recordings will be published on the intranet, on our website www.fft.de, and on social media (LinkedIn, Facebook, Instagram, YouTube). With your consent, EASUN Technologies Co., Ltd. will publish the recordings on its social media channels, WeChat and Weixin.
Publications in online media and information from the Internet are accessible worldwide and can be linked to other information to create personal profiles. Please note that information (including photos, videos, and audio recordings) on the Internet can be accessed by anyone. It cannot be ruled out that such individuals may reuse the recordings or share them with others. There are specialized archiving services whose purpose is to permanently document the state of certain websites on specific dates. This may result in information published on the Internet remaining accessible elsewhere even after it has been deleted from the original page. Posts on the FFT Produktionssysteme GmbH & Co. KG social media pages may no longer be deletable at all, but may only be hidden from public view.
The General Data Protection Regulation (GDPR) stipulates that the transfer of personal data—whether already being processed or to be processed after its transfer to a third country or an international organization—is permissible only if a level of data protection comparable to that required by the GDPR is guaranteed. This means that compliance with the provisions of the GDPR must be ensured. This may include, for example, the existence of an adequacy decision by the European Commission within the meaning of Article 45(1) and (3) of the GDPR or the implementation of internal company data protection policies approved by a supervisory authority (so-called “appropriate safeguards,” Article 46(2) and (3) of the GDPR).
Facebook and Instagram: These are services provided by Meta Platforms Ireland Limited. They are certified under the EU-U.S. Data Privacy Framework and have committed to complying with European data protection standards. For more information, please see Meta’s Privacy Policy at: https://instagram.com/about/legal/privacy/
LinkedIn Corporation is certified under the EU-U.S. Data Privacy Framework and has committed to complying with European data protection standards. For more information on how user data is handled, please see LinkedIn’s Privacy Policy at: //www.linkedin.com/legal/privacy-policy
The Chinese platform Weixin is operated by Shenzhen Tencent Computer Systems Co., Ltd., 35/F, Tencent Building, Kejizhong 1st Road, Maling Community, Yuehai Subdistrict, Nanshan District, Shenzhen, China. China does not have a level of data protection comparable to the requirements of the GDPR; effective legal enforcement is not expected to be possible. For more information on how user data is handled, please see Weixin’s privacy policy at: Privacy Policy
As the operator of this website, we cannot rule out the transfer and further processing of users’ personal data to third countries, such as the United States or China, or the potential risks this may pose to users. These countries do not have a level of data protection comparable to the requirements of the GDPR. It is unlikely that you will be able to effectively enforce your rights. It is also possible that government agencies may access the personal data provided without either you or us being aware of it.
III Rights of the data subject
If your personal data is being processed, you are a data subject within the meaning of the GDPR, and you have the following rights vis-à-vis the controller:
1. RIGHT TO INFORMATION
You can request confirmation from the controller as to whether personal data concerning you is being processed by us.
If such processing is taking place, you may request the following information from the controller:
(1) the purposes for which the personal data is being processed;
(2) the categories of personal data that are processed;
(3) the recipients or categories of recipients to whom your personal data has been or will be disclosed;
(4) the planned duration of storage of your personal data or, if specific details cannot be provided, the criteria used to determine the storage period;
(5) the existence of a right to have personal data concerning you rectified or erased, a right to restrict processing by the controller, or a right to object to such processing;
(6) the existence of a right to lodge a complaint with a supervisory authority;
(7) all available information regarding the origin of the data, if the personal data is not collected from the data subject;
(8) the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR and—at least in such cases—meaningful information about the logic involved, as well as the scope and intended effects of such processing on the data subject.
You have the right to request information regarding whether personal data concerning you is transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate safeguards pursuant to Article 46 of the GDPR in connection with the transfer.
2. RIGHT TO RECTIFICATION
You have the right to request that the controller correct and/or complete your personal data if the processed personal data concerning you is inaccurate or incomplete. The controller must make the correction without delay.
3. RIGHT TO RESTRICTION OF PROCESSING
Under the following conditions, you may request that the processing of your personal data be restricted:
(1) if you contest the accuracy of your personal data for a period that allows the controller to verify the accuracy of the personal data;
(2) the processing is unlawful, and you object to the erasure of the personal data and instead request the restriction of its use;
(3) the controller no longer needs the personal data for the purposes of the processing, but you need it to assert, exercise, or defend legal claims; or
(4) if you have objected to the processing pursuant to Article 21(1) of the GDPR and it has not yet been determined whether the controller’s legitimate grounds override your interests.
If the processing of your personal data has been restricted, such data—with the exception of its storage—may be processed only with your consent, or for the purpose of asserting, exercising, or defending legal claims, or to protect the rights of another natural or legal person, or for reasons of an important public interest of the Union or a Member State.
If the restriction on processing has been imposed in accordance with the above conditions, the controller will notify you before the restriction is lifted.
4. RIGHT TO ERASURE
A) OBLIGATION TO ERASE
You may request that the controller delete your personal data without delay, and the controller is obligated to delete such data without delay if any of the following grounds apply:
(1) Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
(2) You withdraw your consent on which the processing was based pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing.
(3) You object to the processing pursuant to Article 21(1) of the GDPR, and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR.
(4) The personal data concerning you has been processed unlawfully.
(5) The erasure of your personal data is necessary to comply with a legal obligation under Union law or the law of the Member States to which the controller is subject.
(6) Your personal data was collected in connection with information society services offered pursuant to Article 8(1) of the GDPR.
B) INFORMATION TO THIRD PARTIES
If the controller has made the personal data concerning you public and is obligated to erase it pursuant to Article 17(1) of the GDPR, the controller shall take appropriate measures, including technical measures, taking into account the available technology and the cost of implementation, to inform the controllers who process the personal data that you, as the data subject, have requested that they erase all links to such personal data or any copies or replicas of such personal data.
C) EXCEPTIONS
The right to erasure does not apply to the extent that the processing is necessary
(1) for the exercise of the right to freedom of expression and information;
(2) for compliance with a legal obligation that requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
(3) for reasons of public interest in the area of public health pursuant to Article 9(2)(h) and (i) and Article 9(3) of the GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes, or for statistical purposes pursuant to Article 89(1) of the GDPR, to the extent that the right referred to in subsection (a) is likely to render impossible or seriously impair the achievement of the objectives of such processing; or
(5) for the establishment, exercise, or defense of legal claims.
5. RIGHT TO INFORMATION
If you have exercised your right to rectification, erasure, or restriction of processing with the controller, the controller is obligated to notify all recipients to whom your personal data has been disclosed of such rectification, erasure, or restriction of processing, unless this proves impossible or involves disproportionate effort.
You have the right to request that the data controller inform you of these recipients.
6. RIGHT TO DATA PORTABILITY
You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that
(1) the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, or on a contract pursuant to Article 6(1)(b) of the GDPR, and
(2) the processing is carried out by automated means.
In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, to the extent that this is technically feasible. The freedoms and rights of other individuals must not be adversely affected by this.
The right to data portability does not apply to the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
7. RIGHT TO OBJECT
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data that is carried out pursuant to Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions.
The controller will no longer process your personal data unless it can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.
If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling to the extent that it is related to such direct marketing.
If you object to the processing of your personal data for direct marketing purposes, your personal data will no longer be processed for those purposes.
In connection with the use of information society services—notwithstanding Directive 2002/58/EC—you have the option to exercise your right to object through automated procedures that use technical specifications.
8. RIGHT TO WITHDRAW CONSENT UNDER DATA PROTECTION LAW
You have the right to withdraw your consent to the processing of your personal data at any time. Withdrawing your consent does not affect the lawfulness of any processing carried out on the basis of your consent prior to its withdrawal. You may submit your withdrawal of consent to the data controller by mail, email, or fax.
9. AUTOMATED DECISIONS IN INDIVIDUAL CASES, INCLUDING PROFILING
You have the right not to be subject to a decision based solely on automated processing—including profiling—that produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision
(1) is necessary for the conclusion or performance of a contract between you and the controller,
(2) is permitted under Union or Member State law to which the controller is subject, and such law provides for appropriate measures to safeguard your rights and freedoms as well as your legitimate interests, or
(3) is based on your explicit consent.
However, these decisions may not be based on special categories of personal data as defined in Article 9(1) of the GDPR, unless Article 9(2)(a) or (g) applies and appropriate measures have been taken to protect your rights and freedoms as well as your legitimate interests.
With regard to the cases referred to in (1) and (3), the controller shall take appropriate measures to safeguard your rights and freedoms as well as your legitimate interests, including, at a minimum, the right to request that the controller involve a person, to state your position, and to challenge the decision.
10. RIGHT TO FILE A COMPLAINT WITH A REGULATORY AUTHORITY
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority—in particular in the Member State of your residence, your workplace, or the location of the alleged infringement—if you believe that the processing of your personal data violates the GDPR.
The supervisory authority to which the complaint was submitted shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR.
The competent supervisory authority is:
The Hessian Commissioner for Data Protection and Freedom of Information
Gustav-Stresemann-Ring 1
65189 Wiesbaden