The following information provides an overview of which personal data we process and what your corresponding rights are under the data protection legislation.

Right of access pursuant to Art. 15 – 21; right to lodge a complaint pursuant to Art. 77 GDPR

1. Your right to access pursuant to Art. 15 GDPR

You have the right to request details about which of your personal data we process. To do so, please contact the data protection officer, ideally in writing together with proof of ID, so that we can check that you are the person concerned. After verifying that your request is legitimate, we will send you the information (or the reason for rejecting your request) within one month. We will inform you if we are unable to do so within one month. 

2. Your right to rectification pursuant to Art. 16 GDPR

You have the right to have your personal data corrected by us, should it not (or no longer) be valid. If the data is incomplete, you have the right to have it completed. If we have shared your data with third parties, we will inform these third parties of your corrections if we have a legal obligation to do so.

3. Your right to erasure pursuant to Art. 17 GDPR

If there is no legitimate reason for processing your personal data, you are entitled to have your data deleted in the following cases:

• If your personal data is no longer needed for the purpose for which it was collected.
• If you revoke your consent and there are no further legal grounds for processing the data.
• If you object to your data being processed and we have no overriding or legitimate reason for processing it.
• If your data has been processed unlawfully.
• If your data must be deleted in order to meet the legal requirements.

4. Your right to restriction of processing pursuant to Art. 18 GDPR

You have the right to demand that the processing of your personal data is restricted for any one of the following reasons.

• If the accuracy of the data is being disputed by you and we had the opportunity to check that it was accurate.
• If it is not processed regularly and you request restricted usage instead of erasure.
• If we no longer need to process your data, but you need it to assert or defend a legal claim.
• If you have objected and it is not yet clear whether your interests will prevail.

5. Your right to object pursuant to Art. 21 GDPR

We are entitled to process your personal data in accordance with the legal provisions. Depending on your specific situation, you are entitled at any time to object to your personal data being processed in the public interest or on the basis of legitimate interests (Art. 6 para. 1 clause e and f GDPR). We will no longer process your personal data if you object, unless we are able to prove that there are compelling legitimate reasons for doing so that outweigh your interests, rights and freedoms, or that the data is being processed for the purpose of asserting or defending legal claims.

6. Your right to lodge a complaint pursuant to Art. 77 GDPR

Should you not be happy with our response to your request, you have the right to lodge a complaint with the data protection officer of ZAST or with the relevant data protection authorities. The responsible data protection authority for ZAST is the “Bayerischer Landesbeauftragte für den Datenschutz (BayLfD)”. For more information and contact please visit the authority’s website under: https://www.datenschutz-bayern.de/ .