zetVisions

Privacy policy

zetVisions takes the protection of individual privacy seriously and wishes to underline its commitment to the protection of privacy rights with this privacy policy.

GENERAL INFORMATION
This privacy policy applies to personal data that you provide to us or that is derived from personal data as described below. The responsible entity is
zetVisions GmbH, Mittermaierstraße 31, 69115 Heidelberg, Germany,
Tel.: +49 (0) 62 21-339 38-0,
E-Mail: info@zetvisions.com,
Website: www.zetvisions.de
The data protection officer of zetVisions is Werner Willeke, address as above; e-mail: privacy@zetvisions.com

AUTOMATIC DATA PROCESSING ON THIS WEBSITE
When you access our Internet pages, information that your browser transmits to us is automatically stored in our "server log files". These are:

  • Browser type/version
  • Operating system used
  • Referrer URL (the previously visited page)
  • Host name of the accessing computer (IP address)
  • Date and time of the server request
  • Name and URL of the retrieved data
  • Transmitted data volume
  • Message whether the retrieval was successful (HTTP Status Code)
    This data cannot be technically assigned to specific persons by us. This data is not merged with other data sources (e.g. any registration data), and the data is deleted after a statistical evaluation and is not kept as a single data record.

IF YOU CONTACT US
Personal data is collected when you contact us (e.g. via contact form, e-mail, telephone, fax). Which data is collected in the case of a contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of answering your request or for contacting you and the associated technical administration of your request. Without this mandatory information, we cannot process your request. All other information is voluntary.

1. Purpose of the processing: To respond to your request

2. Legal basis: Art. 6 para. 1 lit. b DSGVO for pre- or contractual matters. Art. 6 para. 1 lit. a DSGVO for your voluntary information. Art. 6 para. 1 lit. f DSGVO for all other enquiries and the use of our technical service providers.

3. Legitimate interests: The processing using the service providers is based on our overriding legitimate interest in responding to your request in a secure, timely and professional manner.

4. Storage period: Your data will be deleted after your request has been processed. This is the case when the circumstances indicate that the matter in question has been conclusively clarified and provided that there are no statutory retention obligations to the contrary. In the case of pre-contractual and contractual matters, your enquiry will be stored until the end of the contract and then its processing will be restricted. If there is no longer a legal reason to store the data, it will be deleted.

SERVICES REQUIRING REGISTRATION (NEWSLETTER, CONTACT FORM, INFORMATION MATERIAL)

If you wish to use the personalised offers and services offered on the website, we may require further information from you in order to provide these services. This includes, in particular, your name, your (valid) e-mail address and other information (address, telephone number, etc.) that allows us to verify that you are, for example, the owner of the e-mail address provided or that the owner of the e-mail address agrees to receive the relevant services in order to be able to provide the services requested by you accordingly. The entry of a valid e-mail address is necessary so that we can prevent abusive registrations - for example for newsletters. The above-mentioned data is so-called personal data, i.e. data that can enable your identity to be established. In principle, however, you can use our access-free Internet offer as such without having to disclose your identity in whole or in part. Furthermore, you may provide us with further data - going beyond the data required for the provision of services (such as industry, professional group or similar) - on a voluntary basis, e.g. in the corresponding form fields during registration/login. This data will be used by us to tailor our offers to your needs, for product information for advertising and also for customer care. The data may be passed on to external service providers for the purposes described in the data protection declaration. Your personal data may be transferred to countries outside the EEA. In this case, also to countries where a level of data protection exists that is comparable to the level of data protection within the EEA or where the level of data protection corresponds to that of the European Union due to regulations.

1. Double opt-in procedure: Registration for our newsletter is always carried out using a so-called double opt-in procedure. After registering, you will receive an e-mail asking you to confirm your registration. This confirmation is necessary to check the accuracy of your e-mail address. Registrations for the newsletter are logged in order to be able to prove the registration process in accordance with legal requirements. This includes the storage of the registration and confirmation time as well as the IP address.

2. Purpose of processing: Direct marketing, customer communication Legal basis: When subscribing to our newsletter, the subscriber gives his/her consent (Art. 6 para. 1 p. 1 lit. a DSGVO).

3. Right of withdrawal/ opt-out: You can cancel receipt of our newsletter at any time, i.e. withdraw your consent, by informing us by e-mail (see above under Person responsible) or by clicking on the link that can be found at the end of each newsletter. The revocation does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

4. Obligation to provide: To send the newsletter, we need at least your valid e-mail address. Otherwise it will not be possible to send it to you.

5. Storage period: Your data will be stored until you revoke your consent. After that, they will be restricted in processing and stored for up to three years in order to be able to prove a formerly granted consent in a legally compliant manner. This is done on the basis of our legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO) in proving data protection compliance.

LINKS TO OTHER SITES
Our website also contains links to other third-party sites. zetVisions is not responsible for the privacy practices or the content of other websites.

COOKIES

1. COOKIES
The internet pages use so-called cookies in several places. These serve to make our offer more user-friendly, effective and secure. Cookies are small text files that are stored on your computer and saved by your browser. However, we would like to point out that in this case you may not be able to use all the functions of this website to their full extent. Cookies do not cause any damage to your computer and do not contain viruses. Personal data is not stored by us in connection with cookies.

Essential cookies
These cookies are always enabled as they are necessary for basic website functions. They contribute to the safe and compliant use of the site.

2. GOOGLE TAG MANAGER
We use the Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Google Tag Manager is a tool with the help of which we can integrate tracking or statistical tools and other technologies on our website. The Google Tag Manager itself does not create user profiles, does not store cookies and does not perform any independent analyses. It only serves to manage and deploy the tools integrated via it. However, the Google Tag Manager records your IP address, which may also be transmitted to Google's parent company in the United States. The use of the Google Tag Manager is based on Art. 6 para. 1 lit. f DSGVO. The website operator has a legitimate interest in a quick and uncomplicated integration and management of various tools on his website.

3. GOOGLE ANALYTICS
This website uses Google Analytics, a web analytics service provided by Google, Inc ("Google"). Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyse how users use the site. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. Our website uses Google Analytics exclusively with the extension "_anonymizeIp()", which ensures anonymisation of the IP address by shortening it and excludes direct personal reference. The extension means that your IP address is shortened beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to the parent company of Google in the USA and shortened there. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.

We use Google signals (Google Analytics function). When you visit our website, Google Analytics collects, among other things, your location, search history and YouTube history, as well as demographic data (visitor data). This data can be used for personalized advertising with the help of Google signal. If you have a Google account, Google Signal's visitor data is linked to your Google account and used for personalized advertising messages. The data is also used to create anonymized statistics on the user behavior of our users.

1. Purposes of processing: Tracking (e.g. interest/behavioural profiling), visit action evaluation, interest-based and behavioural marketing, profiling (creating user profiles), conversion measurement (measuring the effectiveness of marketing measures), reach measurement (e.g. access statistics, recognition of returning visitors). These purposes apply to us as well as to Google and its parent company. As far as we are aware, Google also uses the data collected in this way for its own purposes. In this respect, we refer to Google's privacy policy.

2. Legal basis: For the use of Google Analytics, you may give us your consent according to Art. 6 para. 1 p. 1 lit. a DSGVO, which you can revoke at any time with effect for the future by deselecting "Marketing" or "Google Analytics" in the cookie settings on our site. For the transmission of the full IP address to the USA, which may be required, this processing is carried out in accordance with Art. 6 para. 1 lit. f DSGVO on the basis of our legitimate interest in the statistical analysis of user behaviour for optimisation and marketing purposes.

3. Storage period: We store the anonymised data determined in this way for a maximum period of 14 months. After that, the data is automatically deleted. Regarding the storage period by Google, we refer to their privacy policy.

4. Data recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA Privacy policy of Google: https://policies.google.com/privacy

5. Third-country transfer: Insofar as non-anonymised data is processed in the USA, we would like to point out that a commissioned processing agreement has been concluded with Google in accordance with Art. 28 DSGVO and that this ensures compliance with European data protection law.

4. GOOGLE RECAPTCHA
Our primary goal is to ensure that our website is as protected and secure as possible for you and for us. To ensure this, we use Google reCAPTCHA from Google Inc. (1600 Amphitheatre Parkway Mountain View, CA 94043, USA). With reCAPTCHA, we can determine whether you really are a flesh-and-blood human being and not a robot or other spam software.
By spam we mean any unsolicited information that comes to us electronically without being asked. With the classic CAPTCHAS, you usually had to solve text or image puzzles to check. With reCAPTCHA from Google, we usually don't have to bother you with such puzzles. Here, in most cases, it is enough to simply tick a box and thus confirm that you are not a bot. With the new Invisible reCAPTCHA version, you don't even have to set a tick anymore. You will find out exactly how this works and, above all, what data is used for this purpose in the course of this privacy policy.
The legal basis for the use is Article 6 (1) f DSGVO (lawfulness of processing), because there is a legitimate interest in protecting this website from bots and spam software.

MARKETING AND REMARKETING

1. GOOGLE REMARKETING
Our website uses the functions of Google Remarketing, with which we advertise for this website in the Google search results, as well as on third-party websites. The integration of Google Remarketing thus allows a company to create user-related advertising and consequently to display interest-relevant advertisements to the internet user. For this purpose, Google sets cookies on the user's computer. The cookie enables Google to recognise the visitor to our website when he or she subsequently visits websites that are also members of the Google advertising network. Each time a website is accessed on which the Google Remarketing service has been integrated, the internet browser of the person concerned automatically identifies itself to Google.
If you are logged in to Google while visiting our website, Google will use your data together with Google Analytics data to create and define target group lists for cross-device remarketing.

Purposes of processing: tracking (e.g. interest/behavioural profiling, use of cookies), remarketing, visit action evaluation, interest-based and behavioural marketing, profiling (creation of user profiles), conversion measurement (measurement of the effectiveness of marketing measures), reach measurement (e.g. access statistics, recognition of returning visitors), targeting (determination of target groups relevant for marketing purposes or other output of content), cross-device tracking (cross-device processing of user data for marketing purposes). These purposes apply to us as well as to Google and its parent company. As far as we are aware, Google also uses the data collected in this way for its own purposes. In this respect, we refer to Google's privacy policy.

Legal basis: For the use of Google Remarketing, you may give us your consent in accordance with Art. 6 para. 1 p. 1 lit. a DSGVO, which you can revoke at any time with effect for the future by unselecting "Remove cookies" in the cookie settings on our site.

Alternatively, you can obtain information about the setting of cookies from the Digital Advertising Alliance at the Internet address - www.aboutads.info and make settings in this regard. Finally, you can set your browser so that you are informed about the setting of cookies and decide individually about their acceptance or exclude the acceptance of cookies for certain cases or in general.

Storage period: We store the anonymised data determined in this way for a maximum period of 14 months. After that, the data is automatically deleted. Regarding the storage period by Google, we refer to their privacy policy.

Data recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Google privacy policy: https://policies.google.com/privacy?hl=en

Terms of use for advertising: https://policies.google.com/technologies/ads?hl=en

Third-country transfer: Insofar as non-anonymised data is processed in the USA, we would like to point out that a commissioned processing agreement has been concluded with Google in accordance with Art. 28 DSGVO and that this ensures compliance with European data protection law.

2. GOOGLE AD AND CONVERSION TRACKING
Our website uses the online advertising programme "Google Ads" and, as part of Google Ads, Google's conversion tracking. Conversion tracking works by means of a cookie. If a Google Ads ad is clicked on, a cookie is set for this purpose. These actions are visible in the Google Ads account.

1. Purposes of processing: tracking (e.g. interest/behavioural profiling, use of cookies), remarketing, visit action evaluation, interest-based and behavioural marketing, profiling (creation of user profiles), conversion measurement (measurement of the effectiveness of marketing measures), reach measurement (e.g. access statistics, recognition of returning visitors), targeting (determination of target groups relevant for marketing purposes or other output of content), cross-device tracking (cross-device processing of user data for marketing purposes). These purposes apply to us as well as to Google and its parent company. As far as we are aware, Google also uses the data collected in this way for its own purposes. In this respect, we refer to Google's privacy policy.

2. Legal basis: For the use of Google Remarketing, you may give us your consent in accordance with Art. 6 para. 1 p. 1 lit. a DSGVO, which you can revoke at any time with effect for the future.

3. Storage period: We store the anonymised data determined in this way for a maximum period of 14 months. After that, the data is automatically deleted. Regarding the storage period by Google, we refer to their privacy policy.

4. Data recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA Privacy policy of Google: https://policies.google.com/privacy?hl=en
Terms of use for advertising: https://policies.google.com/technologies/ads?hl=en

5. Third-country transfer: Insofar as non-anonymised data is processed in the USA, we would like to point out that a commissioned processing agreement has been concluded with Google in accordance with Art. 28 DSGVO and that this ensures compliance with European data protection law.

3. HUBSPOT
Our website uses the services of HubSpot, a software-based marketing service of HubSpot Ireland Ltd. HubSpot aims to generate initial contacts. These are visitors to zetVisions websites, blogs or landing pages. Through calls-to-action, personalised data is collected in the HubSpot CRM, which is then used for marketing purposes, such as email marketing and social media marketing.
This involves the use of so-called "web beacons" and the setting of "cookies", which are stored on your computer and enable us to analyse your use of the website. HubSpot analyses the information collected (e.g. IP address, geographical location, type of browser, duration of visit and pages viewed) on behalf of zetVisions in order to generate reports about the visit and the pages visited by zetVisions.
When subscribing to the zetVisions newsletter and obtaining studies and other documents, HubSpot also allows us to link a user's visits to zetVisions websites with personal information (especially name/email address) on the basis of consent given, thus recording personal information and informing users individually and in a targeted manner about preferred subject areas.

1. Data recipient: HubSpot Ireland Ltd, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland, parent company: HubSpot, Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141 USA, https://www.hubspot.com
HubSpot privacy policy: https://legal.hubspot.com/privacy-policy

2. Legal basis and legitimate interests: The data transfer is based on our overriding legitimate interest (Art. 6 para. 1 lit. f DSGVO) in the security and stability of a professional customer management system.

3. Third-country transfer: Insofar as non-anonymised data is processed in the USA, we would like to point out that HubSpot Inc. has entered into a commissioned processing agreement with Hubspot Inc. in accordance with Art. 28 of the Data Protection Regulation (DSGVO), thereby assuring compliance with European data protection law.

4. Storage period: with regard to the storage period at HubSpot, we refer to their privacy policy.

4. SALESFORCE SALES CLOUD
We use Salesforce Sales Cloud to manage customer data. The provider is salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 Munich (hereinafter "Salesforce").

1. Purpose of the processing: Salesforce Sales Cloud is a CRM system and enables us, among other things, to manage existing and potential customers and customer contacts and to organise sales and communication processes. The use of the CRM system also enables us to analyse our customer-related processes. Customer data is stored on Salesforce servers. In the process, personal data may also be transmitted to the parent company of salesforce.com Germany GmbH, salesforce.com inc., Salesforce Tower, 415 Mission Street, San Francisco, CA 94105, USA. Details on the functions of Salesforce Sales Cloud can be found here: https://www.salesforce.com/products/sales-cloud/

2. Data recipient: salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 Munich, Germany, parent company: salesforce.com inc., Salesforce Tower, 415 Mission Street, San Francisco, CA 94105, USA, [https://www.salesforce.com] (https://www.salesforce.com)
Privacy policy of salesforce.com Germany GmbH: https://www.salesforce.com/company/privacy/full_privacy/

3. Legal basis and legitimate interests: The data transfer is based on our overriding legitimate interest (Art. 6 para. 1 lit. f DSGVO) in the security and stability of a professional customer management system. Insofar as a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a DSGVO and § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TTDSG. The consent can be revoked at any time.

4. Third-country transfer: We have concluded a contract on order processing (AVV) for the use of the above-mentioned service. This is a contract required by data protection law and ensures that it only processes the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR. Salesforce has Binding Corporate Rules (BCR) approved by the French Data Protection Authority. These are binding corporate rules that legitimise corporate data transfers to third countries outside the EU and EEA. Details can be found here: https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/Salesforce-Processor-BCR.pdf

5. Storage period: with regard to the storage period with Salesforce, we refer to their privacy policy.

5. LINKEDIN INSIGHT DAY
Our website uses the services of LinkedIn, a software-based marketing service provided by LinkedIn Ireland Unlimited Company ("LinkedIn"). The LinkedIn Insight tag is a JavaScript that allows us to use LinkedIn features such as website targeting, conversion tracking and demographics. The insight tag is part of the website. It collects data such as URL, IP address and user agent about your visit to the site.

1. Data Recipient: LinkedIn Ireland Unlimited Company, Wilton Place Dublin 2, Ireland ("LinkedIn").

2. LinkedIn privacy policy: https://www.linkedin.com/legal/privacy-policy

3. Legal basis: For the use of LinkedIn, you may give us your consent in accordance with Art. 6 para. 1 p. 1 lit. a DSGVO, which you can revoke at any time with effect for the future by deselecting cookies in the cookie settings on our site. Data processing agreement with LinkedIn: https://de.linkedin.com/legal/l/dpa

4. Third-country transfer: Insofar as non-anonymised data is processed by the parent company in the USA, we would like to point out that a commissioned processing agreement has been concluded with LinkedIn Corp. in accordance with Art. 28 of the Data Protection Regulation and that this ensures compliance with European data protection law.

SOCIAL MEDIA
Within the company, access to your data is granted to those departments that need it to fulfil our contractual and legal obligations. A transfer to external service providers that we use within the framework of order processing relationships may also take place. Our website uses social plugins from various social networks. In order to increase the protection of your data when visiting our website, these buttons are not fully integrated as plugins, but only using an HTML link on the page. This type of integration ensures that when you call up a page of our website that contains such buttons, no connection is established with the servers of the respective social network. When you click on the button, a new browser window opens and calls up the page of the social network. If applicable, after entering your login data, you can then perform the function provided (e.g. "like" or "share"). By clicking on the respective plugin, you give us your personal consent to the transmission of data to the respective social network. In particular, your IP address will be transmitted to the respective social network. The legal basis for this is Art. 6 para. 1 lit. a DSGVO. You have the right to revoke your consent at any time. The data processing remains lawful until the revocation. The revocation only applies for the future.

LEGAL BASIS OF THE PROCESSING
Article 6 I lit. a DSGVO serves as the legal basis for our company for processing operations in which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is a party, as is the case, for example, with processing operations that are necessary for the delivery of goods or the provision of another service or consideration, the processing is based on Article 6 I lit. b DSGVO. The same applies to processing operations that are necessary for the implementation of pre-contractual measures, for example in the case of enquiries about our products or services. If our company is subject to a legal obligation by which the processing of personal data becomes necessary, such as for the fulfilment of tax obligations, the processing is based on Art. 6 I lit. c DSVO. Finally, processing operations could be based on Art. 6 I lit. f DSGVO. Processing operations which are not covered by any other legal basis are based on this legal basis if the processing is necessary for the protection of a legitimate interest of our company or a third party, provided that the interests, fundamental rights and freedoms of the data subject are not overridden. Such processing operations are permitted to us in particular because they have been specifically mentioned by the European legislator.

DURATION FOR WHICH THE PERSONAL DATA ARE STORED
The criterion for the duration of the storage of personal data is the respective statutory retention period. After expiry of the period, the corresponding data is routinely deleted if it is no longer required for the fulfilment or initiation of the contract.

EXISTENCE OF AUTOMATED DECISION MAKING
Automated decision-making does not take place.

RIGHTS OF THE DATA SUBJECT

1. Right to information
Any person concerned by the processing of personal data has the right, granted by the European Directive and Regulation, to obtain from the controller, at any time and free of charge, information about the personal data stored about him or her and a copy of that information. Furthermore, the European Directive and Regulation has granted the data subject access to the following information:

  • the processing purposes
  • the categories of personal data that are processed
  • the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular in the case of recipients in third countries or international organisations
  • if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration
  • the existence of a right to obtain the rectification or erasure of personal data concerning them or to obtain the restriction of processing by the controller or a right to object to such processing
  • the existence of a right of appeal to a supervisory authority
  • if the personal data are not collected from the data subject: All available information on the origin of the data
  • the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR and, at least in these cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject

Furthermore, the data subject has the right to be informed whether personal data have been transferred to a third country or to an international organisation. If this is the case, the data subject also has the right to obtain information on the appropriate safeguards in connection with the transfer.

2. Right of rectification
Any person concerned by the processing of personal data shall have the right granted by the European Directive and the Regulation to obtain the rectification without delay of inaccurate personal data relating to him or her. Furthermore, the data subject has the right to request the completion of incomplete personal data, including by means of a supplementary declaration, taking into account the purposes of the processing.

3. Right to erasure (right to be forgotten)
Any person concerned by the processing of personal data shall have the right, granted by the European Directive and the Regulation, to obtain from the controller the erasure without delay of personal data concerning him or her, where one of the following grounds applies and insofar as the processing is not necessary:

  • The personal data were collected or otherwise processed for purposes for which they are no longer necessary.
  • The data subject revokes the consent on which the processing was based pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR and there is no other legal basis for the processing.
  • The data subject objects to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) of the GDPR.
  • The personal data have been processed unlawfully.
  • The deletion of the personal data is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
  • The personal data was collected in relation to information society services offered pursuant to Art. 8(1) DSGVO.
    If the personal data has been made public by zetVisions and our company as the responsible party is obliged to delete the personal data pursuant to Art. 17 Para. 1 DSGVO to erase the personal data, zetVisions shall implement reasonable measures, including technical measures, taking into account the available technology and the cost of implementation, in order to inform other data controllers which process the published personal data that the data subject has requested from those other data controllers to erase all links to or copies or replications of the personal data, unless the processing is necessary.

4. Right to restriction of processing
Any person concerned by the processing of personal data has the right, granted by the European Directive and the Regulation, to obtain from the controller the restriction of processing where one of the following conditions is met:

  • The accuracy of the personal data is contested by the data subject for a period enabling the controller to verify the accuracy of the personal data.
  • The processing is unlawful, the data subject objects to the erasure of the personal data and requests instead the restriction of the use of the personal data.
  • The controller no longer needs the personal data for the purposes of processing, but the data subject needs it for the establishment, exercise or defence of legal claims.
  • The data subject has objected to the processing pursuant to Article 21(1) of the GDPR and it is not yet clear whether the legitimate grounds of the controller override those of the data subject.

5. Data portability
Any person concerned by the processing of personal data shall have the right, granted by the European Directive and the Regulation, to receive the personal data concerning him or her, which have been provided by the data subject to a controller, in a structured, commonly used and machine-readable format. The data subject shall also have the right to transmit such data to another controller without hindrance from the controller to whom the personal data have been provided, provided that the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR or on a contract pursuant to Article 6(1)(b) of the GDPR and the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Furthermore, when exercising his or her right to data portability pursuant to Article 20(1) of the GDPR, the data subject shall have the right to obtain that the personal data be transferred directly from one controller to another controller, to the extent that this is technically feasible and provided that this does not adversely affect the rights and freedoms of other individuals.

6. Right to object
Any person affected by the processing of personal data shall have the right granted by the European Directive and Regulation to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her which is carried out on the basis of Article 6(1)(e) or (f) DSGVO. This also applies to profiling based on these provisions. zetVisions shall no longer process the personal data in the event of the objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the assertion, exercise or defence of legal claims.
If the zetVisions processes personal data for the purpose of direct marketing, the data subject shall have the right to object at any time to processing of personal data processed for such marketing. This also applies to the profiling, insofar as it is related to such direct marketing. If the data subject objects to zetVisions to the processing for direct marketing purposes, zetVisions will no longer process the personal data for these purposes.

7. Automated decisions in individual cases including profiling
Any person concerned by the processing of personal data shall have the right, granted by the European Directive and the Regulation, not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, provided that the decision (1) is not necessary for entering into, or the performance of, a contract between the data subject and the controller, or (2) is authorised by Union or Member State law to which the controller is subject and that such law lays down appropriate measures to safeguard the data subject's rights and freedoms and legitimate interests, or (3) is made with the data subject's explicit consent.

8. Right to revoke consent under data protection law
Any person affected by the processing of personal data has the right granted by the European Directive and Regulation to withdraw consent to the processing of personal data at any time. If you wish to assert any of the rights described as a data subject, please contact the responsible body or its data protection officer. You will find the contact details at the top of this page.