What must be observed according to the EU GDPR?

The General Data Protection Regulation requires a legal basis for every processing of personal data (e.g. name, first name, address). In the context of an assignment by you, the legal basis results from Article 6 Paragraph 1 Letter (b).

This means that the legal basis for being allowed to process your data already arises from the law to establish and perform the contract.

In the following I would like to explain how I process your data:

Responsible as the person responsible for data processing

Alexandra Fischer, Drostestrasse 21, 70499 Stuttgart, connect@alexandra-fischer.com

How is data processed in detail?

So that you can get an idea of the data processing of my processes, you should find out in the following, among other things,

• what types of data I process from you,
• how and for what purposes I process the data you send me
• and what rights you have.

If you have any questions about certain points of this information, I am at your disposal.

The following information is based on the legal requirements of Art. 13 of the EU General Data Protection Regulation (hereinafter "GDPR").

The principle of data minimization applies in data protection law.

This means that I only process the data that is really necessary to be able to carry out your order professionally via Microsoft Office 365.

By using this service, data is transferred to Microsoft Office 365 in the USA. The ECJ sees the USA as a country with an insufficient level of data protection. In particular, there is the possibility that US counter-terrorism authorities may process personal data. A remedy may not be available. These features are offered by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. You can find more information in Microsoft's data protection declaration: https://privacy.microsoft.com/de-de/privacystatement. I have concluded an order processing contract with Microsoft in accordance with Art. 28 GDPR.

I use the service of ALL-INKL.COM for communication by e-mail.

The service is offered by ALL-INKL.COM - Neue Medien Münnich, owner: René Münnich, Hauptstraße 68, D-02742 Friedersdorf and I have concluded a contract for order processing in accordance with Article 28 GDPR with ALL-INKL.COM. You can find more information in the data protection declaration of ALL-INKL.COM at https://all-inkl.com/datenschutzinformation.

The legal basis is Art. 6 Para. 1 S.1 b) GDPR.

I use the Zoom service to hold meetings.

The Zoom service is provided by Zoom Video Communications Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA (hereinafter "Zoom"). When using the zoom link, the data entered is transferred to Zoom in the USA, which according to the GDPR is considered a third country with an insecure level of data protection, and processed there. I have no detailed knowledge of the type and scope of processing or the duration of storage by Zoom. I have concluded an order processing contract with Zoom in accordance with Art. 28 GDPR. The ECJ sees the USA as a country with an insufficient level of data protection. In particular, there is the possibility that US counter-terrorism authorities may process personal data. A remedy against this may not be available. The legal basis for this processing is Article 6 Paragraph 1 Sentence 1 lit. a) and b) GDPR. You can find further information in Zoom's data protection regulations at https://zoom.us/de-de/privacy.html

The following data is collected from you:

• First name / last nameStreet, zip code, city, countryTelephone / mobile phoneEmail

Purpose of processing your data

The data that you communicate to me as part of the order will only be processed by me for the purposes listed below:

• to be able to identify you as a participant,
• for the organisation, implementation and processing of the program or event you have booked,
• for correspondence with you,
• for invoicing,
• for processing any liability claims and asserting any claims arising from the conditions of participation,
• for networking the participants of a program or an event,
• by issuing name tags if necessary and displaying lists of participants to prove that I am allowed to process your data,
• in particular to send you information by e-mail,
• to fulfill my tax obligations and interests, including controlling,
• only if it is expressly pointed out, also for the documentation of the event by photo and film recordings, which can also be used for public relations, advertising in a newsletter, calendar entries.

Collection, processing and duration of data storage

In principle, I only process your data for the purpose of carrying out your order.

This means that once this purpose has been achieved, I will delete your data again, unless you have agreed to longer storage or there is a retention obligation based on tax, commercial or other laws.

The data processing takes place at your instigation as a participant/prospect and according to Art.6 Para. 1S.1 lit.b and Art.9 Para.2 lit.a and h DSGVO for the stated purposes of participation, interest inquiry and mutual fulfillment of obligations arising from the Conditions of Participation.

The legal basis for data processing for the organisation, implementation and execution of the programs and events is Article 6 Paragraph 1 Subparagraph 1 Letter b GDPR.

The legal basis for data processing for the purpose of networking the participants of the event is Article 6 Paragraph 1 Subparagraph 1 Letter f GDPR. In this respect, legitimate interests are the interests of the organizers and participants in specialized networking.

The legal basis for data processing for the purpose of proving permission is Article 6 Paragraph 1 Subparagraph 1 Letter c in conjunction with Article 5 Paragraph 2 GDPR and Article 24 Paragraph 1 GDPR as well as Article 6 Paragraph 1 Subparagraph 1 Letter f GDPR . Legitimate interest is the defense against legal claims.

The legal basis for storage under tax law is Article 6 Paragraph 1 Subparagraph 1 Letter c GDPR in conjunction with Section 147 AO.

The legal basis for the production of photos and films and the subsequent processing is Article 6 Paragraph 1 Subparagraph 1 Letter f GDPR. Legitimate interests are the documentation and publication of my work, in the case of suitable events also the documentation and public dissemination of the entire or essential content of the event.

For the purpose of documenting the event by means of photos and film recordings and for public relations, processing is generally for an unlimited period.

Recipients of your data and disclosure to third parties

The persons entrusted with the organisation, implementation and execution of the program or event have access to your data.

For the purpose of networking, your name is also accessible to the other participants.

Photographs and film recordings that are published or otherwise processed for documentation or public relations purposes may be accessible to everyone.

In individual cases, it may happen that I use a processor for certain activities, who uses your data exclusively for these activities on my behalf. He is strictly bound by my instructions and may not process or pass on the data for his own purposes.

Your personal data will not be transmitted to third parties for purposes other than those listed.

Your personal data will be passed on to third parties insofar as this is required according to Art.6 Para.1 S.1 lit.b DSGVO for the processing of your participation. This includes passing it on to professionals, courts and insurance companies in the event of legal disputes (e.g. liability issues or disputes over claims).

The data passed on may only be used by third parties for the stated purposes.

Your rights as a so-called "data subject"

Since I process your data, as shown, you also have rights as a data subject, unless these are restricted or excluded by law.

In particular, these are the rights listed below:

• to request information about your personal data processed by me in accordance with Art. 15 GDPR. In the case of a request for information that is not made in writing, I ask for your understanding that I may then require evidence from you that proves that you are the person you claim to be.
• Pursuant to Art. 16 GDPR, the correction of incorrect or to request the completion of your personal data stored by me.
• according to Art. 17 GDPR to demand the deletion of your personal data stored by me.
• according to Art. 18 GDPR to demand the restriction of the processing of your personal data.
• according to Art. 20 GDPR your personal data, that you have provided to me in a structured, common and machine-readable format or to request transmission to another person responsible.
• Pursuant to Art. 7 Para. 3 DSGVO, to revoke any consent given at any time. However, this revocation only relates to future data processing. The lawfulness of the processing based on this legal basis is not affected.
• Pursuant to Art. 77 GDPR to complain to a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or that of my company.

The supervisory authority responsible for data protection for my company is:

State representative for data protection and freedom of information in Baden-Württemberg

PO Box 10 29 32, 70025 Stuttgart Tel.: 0711/615541-0 E-Mail: poststelle@lfdi.bwl.de

It is very important to me to protect you and your data as well as possible. For this reason, I have taken measures to protect your data from unauthorized access as far as possible (cf. Art. 32 GDPR).

In this regard, I have taken what I consider to be appropriate technical and organizational security measures to prevent accidental or intentional manipulation, partial or complete loss, destruction or unauthorized access by third parties to your data. My security measures are continuously checked for their effectiveness in line with technological developments and improved if necessary.

Updates and changes to this information

This information is currently valid and has the status of 01/2023.

Due to changed legal or official requirements or due to changed processing conditions, it may be necessary to change any of the information provided. I will then inform you about it.