Data Subject Rights and Privacy Complaints Policy

1 Purpose and application

This policy explains how to exercise your data protection rights and raise concerns about the way Sodalytics handles your personal data. It also explains how we assess requests and complaints, communicate our response and help you understand the remedies available to you.

Sodalytics is the trading name of Medienbüro Björn Rohwer, a German sole proprietorship operated by Björn Rohwer. In this policy, “Sodalytics”, “we”, “us” and “our” refer to that business.

This policy applies to individuals whose personal data we process, including website visitors, people who contact us or request a Free Sample, subscribers, client contacts, authorised service users, and individuals whose publicly available social media information we analyse. Personal data may include information about someone acting professionally or through a business account. Information relating only to a company is not personal data unless it also concerns an identifiable individual.

This policy should be read alongside our Privacy Policy, which explains our processing activities, sources of information, purposes, legal bases, recipients, international transfers and retention arrangements. Your rights arise under applicable data protection law.

Where we determine why and how personal data is processed, we act as controller and are responsible for handling requests concerning that processing. Where we process personal data solely on a client’s documented instructions, the client is the controller and we assist that client in accordance with our legal and contractual obligations. We explain how this affects a request in section 4.

2 Your data protection rights

The rights available to you depend on the processing concerned, and the conditions established by law. You may exercise more than one right in the same request.

Information about processing

You have the right to receive clear information about how your personal data is processed. Our Privacy Policy provides this information, and you can contact us if you need an explanation or information relevant to your circumstances. Our responsibility to provide information where required by law does not depend on you first making a request.

Access

You can ask whether we process personal data concerning you and, if we do, obtain access to that data and a copy. You do not need to explain why you want access.

The response includes the information required by applicable data protection law about the processing, including its purposes, the categories of personal data, recipients, retention periods or criteria, available rights, relevant sources and applicable safeguards for international transfers. Information about automated decision-making is provided where required. Where recipient information must be supplied, we identify the actual recipients or, where legally permitted, provide recipient categories.

The copy must allow you to understand the personal data being processed. Where necessary to make that information understandable and enable you to exercise your rights effectively, this may include extracts from documents or copies of relevant documents, subject to the rights and freedoms of others.

Rectification

You can ask us to correct inaccurate personal data concerning you and complete information that is incomplete, taking account of the purpose for which it is processed. Please explain what you believe is inaccurate or incomplete and provide relevant supporting information where available. Required corrections will be made without undue delay.

Erasure

You can ask us to delete personal data where a ground for erasure applies. This includes circumstances where the data is no longer needed for its purpose, consent is withdrawn and there is no other legal ground for the processing, an applicable objection requires the processing to stop, the processing is unlawful, or deletion is required by law.

Erasure is subject to statutory exceptions. For example, particular information may need to be retained to comply with a legal obligation, establish, exercise or defend legal claims, or protect freedom of expression and information where the relevant legal conditions are met. Any exception must be assessed against the specific information and purpose concerned.

If we retain information despite an erasure request, we will explain the applicable reason and limit its use to the purpose that justifies retention. Exercising the right to erasure does not require you to waive your right to complain or pursue another statutory remedy.

Restriction of processing

You can ask us to restrict processing in the circumstances specified by applicable data protection law. These include a dispute about accuracy while it is checked; unlawful processing where you prefer restriction to deletion; information that we no longer need but you require for legal claims; and an objection awaiting assessment of whether our legitimate grounds override yours.

Restriction limits the use of the information while allowing it to be retained. Apart from storage, restricted information will be processed only where applicable data protection law permits, including where appropriate with your consent or for legal claims. We will inform you before lifting a restriction where required.

Data portability

Where we process personal data by automated means on the basis of your consent or a contract with you, you can request the qualifying data you provided in a structured, commonly used and machine-readable format. You can also request its direct transmission to another controller where technically feasible.

This right can include qualifying information observed through your use of a service. It does not generally cover assessments or inferences we create from that information, although those may fall within the right of access. Portability must respect other people’s rights and does not itself require deletion of the information we lawfully retain.

Objection

Where we process personal data on the basis of legitimate interests, you can object on grounds relating to your particular situation. We must stop that processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is necessary for legal claims.

You have an unconditional right to object to the use of your personal data for direct marketing, including profiling to the extent it relates to that marketing. Once you object, we will stop processing your personal data for those purposes. You do not need to provide a reason.

Our additional commitment to exclude individual creators and commenters from public social media analysis without requiring a reason is explained in section 5.

Withdrawal of consent

Where processing is based on consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it was withdrawn.

You can contact [email protected] to withdraw consent. For newsletters and marketing emails, you can also use the unsubscribe link in the relevant message. Withdrawing consent is as easy as giving it. If you wish to withdraw a particular consent, please identify that choice so we can apply your instruction accurately.

Withdrawal stops the processing that depends on that consent. Limited information may still need to be retained for a separate lawful purpose, such as documenting the withdrawal or ensuring that unwanted marketing is not resumed.

Automated decisions

We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects.

3 Submitting a request or complaint

You can send a rights request or privacy complaint to [email protected], or write to Medienbüro Björn Rohwer, trading as Sodalytics, Seminarstr. 12a, 25436 Uetersen, Germany.

You can contact our Data Protection Officer directly at [email protected]. Objections to public social media analysis can also be submitted through sodalytics.com/data-objection.

You do not have to use a particular form, refer to legislation or use legal terminology. We assess the substance of your communication. A request received through another available official contact channel, including an oral request where such a channel is available, will be recognised and directed appropriately.

Please describe what you would like us to do or what concerns you. Information that helps us identify the relevant processing may include the email address used to contact us, an account or service involved, a platform and account handle, a link to relevant content, or an approximate date. Provide only information relevant to the matter.

If you are making a complaint, please explain what happened, how it concerns your personal data and any relevant previous correspondence. You may include supporting material and explain the outcome you seek, but you do not need to establish a legal violation before raising a concern.

You may act through an authorised representative or another person legally entitled to act for you. Where necessary, we may request proportionate evidence of that person’s identity and authority before disclosing personal data or acting on instructions affecting your information.

We may also request additional information where we have reasonable doubts about your identity. The checks will reflect the nature of the request, the information involved and the risk of disclosing or changing someone else’s data.

Please do not send an identity document unless we request one. If additional verification is necessary, we will explain what is needed and how to provide it securely. We will seek to use information already available to us where that provides sufficient assurance.

If you need assistance or an accessible communication format, please tell us. We will communicate in clear language and take reasonable steps to facilitate your request.

4 Responding to rights requests

Assessment and response

We will record your request, assess which rights it engages and take reasonable steps to locate the relevant personal data across the records and systems concerned. We will consider information held by providers processing data on our behalf where relevant.

If clarification is needed, we will explain what information would help us respond. A request for clarification will not be used to require you to narrow an access request where you wish to receive all personal data covered by that right.

Where we cannot identify information relating to you, we will explain this and, where appropriate, identify the additional information that could help us locate it. We are not required to collect or retain additional identifying information solely to identify someone for a rights request. Information is not treated as anonymous merely because direct identifiers have been replaced.

We will take appropriate steps to prevent deletion of relevant information during the handling of an access request in a way that would defeat that request. If information has already been lawfully deleted or irreversibly anonymised and is no longer available, we cannot provide it and will explain the position.

Our response will explain the action taken and any relevant limitations. Information will be provided securely, clearly and in an appropriate format. An electronic access request will ordinarily receive a response in a commonly used electronic form unless you request otherwise.

Where another person’s rights or protected information are affected, we will assess the specific issue and consider measures such as redaction or providing an appropriate extract. A limitation affecting part of the information will not automatically justify withholding the remainder.

Where a client is the controller

If a request concerns data we process solely on a client’s instructions, we will identify the relevant controller where possible and promptly direct or pass the request to that controller as appropriate. We will assist it in handling the request under the applicable data processing agreement.

We will respond directly to any part concerning processing for which Sodalytics is itself controller. A connection with a client engagement does not, by itself, mean that the client controls every use of the information.

Where we are joint controller

Where we determine the purposes and means of processing together with another controller, including for statistics about our social media pages, you can exercise your rights against us or the other controller. We will handle the part of the request that concerns our processing and coordinate with the other controller as required by the applicable arrangement.

Response periods

We will respond without undue delay and, in any event, within one month of receiving your request, subject to the applicable rules for calculating that period.

Where necessary because of the complexity or number of requests, we may extend this period by up to two further months. If we use that extension, we will inform you within the initial month and explain the reasons. An acknowledgement alone does not constitute a substantive response.

Where applicable law allows the response period to start later or be suspended, for example while we wait for information needed to verify your identity or to locate your data, we will request that information promptly and tell you how it affects the deadline.

If essential information remains unavailable, we will explain why we cannot complete the affected part of the request and how you can proceed.

Charges and limitations

Rights requests are normally handled free of charge, including the first copy supplied in response to an access request.

Where legally permitted, we may charge a reasonable fee based on administrative costs for additional copies. If a request is manifestly unfounded or excessive, we may also charge a reasonable fee or refuse to act.

Before applying a fee, we will explain its basis and amount. If we decline to act, apply a statutory exception or comply only in part, we will explain the relevant reasons and inform you of your right to complain to a supervisory authority and seek a judicial remedy. A decision not to act will be communicated without delay and within the applicable one-month period.

Giving effect to the outcome

Where required by law, we will communicate rectification, erasure or restriction to recipients to whom the affected personal data has been disclosed, unless this proves impossible or involves disproportionate effort. We will inform you about those recipients if you request it.

Where we have made personal data public and are required to erase it, we will take reasonable steps to inform other controllers processing that data that you have asked for any links to it, and copies or reproductions of it, to be erased, taking account of available technology and implementation costs.

5 Objections to public social media analysis

Individual creators and commenters can request exclusion from public social media analysis for which Sodalytics is controller through sodalytics.com/data-objection or by emailing [email protected].

Under this voluntary exclusion process, we do not require you to give a reason. This commitment operates alongside your statutory rights and does not reduce them.

Please identify the relevant platform and account handle and, where helpful, provide links or examples that allow us to locate the information. We will use the information supplied to stop future inclusion of the matching account in our public-data analysis and take reasonable steps to remove matching information from previously collected datasets.

To honour the exclusion, we retain a limited entry identifying the platform and account handle. Where necessary, we use the identifiers associated with earlier datasets to locate matching information. These limited records are maintained to respect the exclusion and document its handling.

Account-handle changes can affect matching. If your handle changes, please tell us the previous and current handles so that the exclusion entry can be updated.

Requests affecting completed reports, material already delivered to clients or published content will be assessed under the applicable rights and legal requirements. We will explain the action taken and any information that must be retained, and make recipient notifications where required.

Exclusion or deletion by Sodalytics does not remove the original post, comment or account from the social media platform. Removal of the original content must be addressed through that platform’s controls or procedures.

Information relating only to a company is not personal data. Identifiable individuals associated with company, brand or professional accounts remain entitled to exercise their rights concerning their personal data.

6 Privacy complaints and further remedies

You can complain if you believe that we have handled your personal data improperly or are dissatisfied with our handling of a rights request. This includes concerns about accuracy, collection, disclosure, retention, security or the information we have provided about processing.

Complaints can be sent through the contact channels in section 3. You can approach the Data Protection Officer directly. Raising a privacy complaint with us is free of charge.

We will acknowledge and assess your complaint without undue delay. We will consider the information provided, examine relevant records and processing, and seek any further information reasonably needed to understand the concern. Complaints will be considered objectively, with involvement of the Data Protection Officer where appropriate.

If the complaint indicates a possible security incident, we will assess it under our incident-response arrangements and take any action and notifications required by law.

We will explain our findings, any action taken or proposed, and the reasons for the outcome. Where an investigation requires further time, we will explain the position and provide appropriate progress updates.

A communication may be both a complaint and a rights request. For example, a concern that information is inaccurate may also request rectification. We will recognise the rights engaged and apply the relevant statutory response requirements; a complaints review does not replace or restart those requirements.

If you remain dissatisfied, you may ask us to reconsider the response or contact the Data Protection Officer. Further review is optional and does not restrict your external remedies.

Complaining to a supervisory authority

You have the right to lodge a complaint with a competent data protection supervisory authority, particularly in the country of your habitual residence, place of work or the alleged infringement.

You do not have to contact Sodalytics first or wait for our response or internal review before approaching an authority.

The supervisory authority responsible for Sodalytics is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany; email: [email protected]; website: www.datenschutzzentrum.de. This does not restrict your ability to approach another competent authority.

You may also pursue available judicial remedies and, where the applicable legal conditions are met, seek compensation for material or non-material damage resulting from an infringement. Nothing in this policy limits those statutory rights.

7 Confidentiality and records

We use information supplied with a request or complaint to identify the relevant processing, verify identity or authority where necessary, assess the matter, communicate with you and document its handling.

We process this information where necessary to comply with our legal obligations. Where appropriate, including for investigating concerns or establishing, exercising or defending legal claims, we rely on our legitimate interests.

Information is shared only where necessary and lawful, including with relevant service providers, a client acting as controller, professional advisers or an authority. We apply appropriate security measures and limit disclosure to the information needed for the matter concerned.

We retain correspondence, decisions and supporting records for as long as necessary to handle the matter, demonstrate compliance and meet applicable legal requirements or specific legal claims. A limited exclusion or suppression entry may need to be retained for longer to ensure that an objection or withdrawal continues to be respected.

Identity-verification material is retained only as long as necessary for the verification or another specific lawful requirement. Where sufficient, we retain a record that verification occurred rather than an unnecessary copy of an identity document.

Information no longer needed is deleted or irreversibly anonymised as appropriate. Our Privacy Policy provides further information about recipients, international transfers, retention and the rights applying to these records.

8 Changes to this policy and language versions

We update this policy when our procedures, systems or legal obligations change. The date above shows the latest revision. Changes do not affect requests or complaints already being handled.

This policy is available in English and German. The German version is provided for convenience of reading. In the event of any inconsistency, the English version prevails.