Privacy policy

1.    Information on the collection of personal data and contact details of the Controller
2.    Data collection when you visit our website
3.    Contact
4.    Cookies
5.    Data processing for order processing
6.    Data processing when opening a customer account and for contract processin
7.    Comments
8.    Use of your data for direct marketing
9.    Use of social media: Video
10.    Online-Marketing
11.    Web Analytics Services
12.    Rights of the data subject
13.    Duration of storage of personal data

1.  Information on the collection of personal data and contact details of the Controller

1.1 Thank you for visiting our website. In the following, we would like to inform you about the handling of your personal data when using our website. Personal data is basically all data with which you can be personally identified.

1.2 The controller responsible for the processing of data on our website within the meaning of the General Data Protection Regulation (GDPR) is:

Isabelle Murielle Kouoguem Tchuenche
Kollegstr. 2
44801 Bochum
Deutschland Tel.:+491788186964
E-Mail: isabelle.kouoguem@soulxpressiongallery.com.

1.3 In order to protect the security of your data during transmission, we use state-of-the-art encryption methods (e.g. SSL or TSL) via HTTPS.

2.  Data collection when you visit our website

Every time you visit our website, our system automatically collects data and information that your browser transmits to our server (so-called "server log files"). The following data, which is technically necessary for us, is collected:

-  Our visited website

-  Date and time at the time of access

-  Amount of data sent in bytes

-  Source/reference from which you came to the page

-  Operating system used

-  Browser used

-  IP address used (if applicable: in anonymized form)

The legal basis for the processing is Art. 6 (1) (f) GDPR on the basis of our legitimate interest in improving the stability and maintaining the functionality of our website. The data will not be passed on or used in any other way. The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's computer.

For this purpose, the user's IP address must be stored for the duration of the session.

We reserve the right to check the server log files retrospectively if there are concrete indications of illegal use. The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.

If the data is stored in log files, this is the case after seven days at the latest. Storage beyond this is possible. In this case, the IP addresses of the users are deleted or alienated so that it is no longer possible to assign the calling client. The collection of data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the website. Consequently, there is no possibility of objection on the part of the user.

3.  Contact

If you contact us via the contact form, the data entered in the input mask will be transmitted to us and stored. The data collected can be found in the respective input mask. If you contact us by e-mail, only the data you enter there will be transmitted to us.

The data will be used exclusively for the processing of the conversation and your request. The legal basis for the processing of the data is Art. 6 para. 1 lit.

a) GDPR. The legal basis for the processing of data transmitted in the course of sending an e-mail is Art. 6 para. 1 lit. f) GDPR. If the e-mail contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 (1) (b) GDPR. The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected and provided that there are no statutory retention obligations to the contrary. For the personal data from the input mask of the contact form and those sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the facts in question have been conclusively clarified. The user has the option of withdrawing his consent to the processing of personal data at any time. If the user contacts us by e-mail, he can object to the storage of his personal data at any time. In such a case, the conversation cannot be continued.

3.1 WhatsApp-Business

Visitors to our website have the option of communicating with us via WhatsApp (a service of Meta Inc., 1 Hacker Way, Menlo Park, CA 94025, USA).

We use the so-called "business version" of WhatsApp for this. If you contact us via Whatsapp on the occasion of a specific contract, we will store and use the mobile phone number you use on WhatsApp and – if published and/or transmitted – your first and last name (Art. 6 para. 1 lit. b. GDPR) for the purpose of processing your request.

If necessary, you will be asked to provide further data if this is necessary to process your request (Art. 6 para. 1 lit. b. GDPR).

If the contact via WhatsApp Business is used for general inquiries that do not concern a specific contract, we store and use the mobile phone number you use on WhatsApp and – if published and/or provided – your first and last name (in accordance with Art. 6 para. 1 lit. f. GDPR) for the purpose of processing your request.

Our legitimate interest lies in answering the questions of our customers or interested parties at short notice.

The data will not be passed on to third parties.

WhatsApp Business will have access to the address book of the mobile device used for this purpose. Phone numbers stored there are automatically transmitted to a Facebook server in the USA.

The mobile device we use for WhatsApp business contains only the WhatsApp contact details of those users who have already contacted us via WhatsApp.

For data transfers from the European Economic Area to the USA, Whatsapp relies on standard contractual clauses of the EU Commission. For further details on the handling of data by Whatsapp, please refer  to WhatsApp's privacy policy: https://www.whatsapp.com/legal/?eea=1#privacy- policy

4.  Cookies

Our website uses cookies.

Cookies are text files that are stored on the user's end device. When a user visits a website, a cookie may be stored on the user's operating system. Some functions of our website cannot be offered without the use of cookies. For this purpose, it is necessary that the browser is recognized even after a page change. The user data collected by technically necessary cookies is not used to create user profiles. In the above-mentioned purposes, our legitimate interest also lies in the processing of personal data in accordance with Art. 6 para. 1 lit. f) GDPR.

In addition, our website may use cookies that enable an analysis of users' surfing behaviour (so-called third-party cookies). You can find more detailed information on the scope, purpose, legal basis and objection options in the respective sections of the respective chapter of this data protection declaration.

As a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can disable, restrict or delete the transmission of cookies. If you disable cookies for our website, you may not be able to take full advantage of all the features of the website. You can prevent the transmission of Flash cookies by changing the settings of the Flash Player.

You can find help with the settings in the respective help menu of your browser or under the following links:

Internet Explorer: http://windows.microsoft.com/de-DE/windows-vista/Block-or-allow-cookies
Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Chrome: http://support.google.com/chrome/bin/answer.py?hl=de&hlrm=en&answer=95647
Safari: https://support.apple.com/de-de/guide/safari/sfri11471/mac
Opera: https://help.opera.com/en/latest/web-preferences/#cookies

Some of the cookies used here are deleted after you close your browser (so-called session cookies). Other cookies remain on your device and enable us or our partner companies (third-party cookies) to recognize your browser the next time you visit (persistent cookies). If cookies are set, they collect and process certain user information such as browser and location data as well as IP address values to an individual extent. Persistent cookies are automatically deleted after a specified period of time, which may differ depending on the cookie.

5.  Data processing for order processing

5.1 If you want to order in our webshop, it is necessary for you to provide your personal data, which we need to process your order, in order to conclude the contract. We process the data you provide to process your order.

In some cases, we work together with external service providers to process your order. For this purpose, we must pass on the personal data required for this purpose.

If we commission transport companies to deliver your goods, we will pass on your data required for the delivery of the goods to the respective transport company. For the processing of payments, we will pass on your data to the commissioned credit institution within the scope of what is necessary. If we use payment service providers, you will also be informed below.

The legal basis for the disclosure of your data is Art. 6 (1) (b) GDPR.

5.2 In order to fulfil our contractual obligations, we work together with external shipping partners. We will pass on your name and delivery address (if necessary also other data) to a shipping partner selected by us exclusively for the purpose of delivering the ordered goods in accordance with Art. 6 (1) (b) GDPR.

5.3 Use of payment service providers

5.4   Apple Pay

If you select the payment method "Apple Pay" (a service provided by Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland), payment is processed via the "Apple Pay" function of your iOS, watchOS or macOS device by charging a payment card you have stored with "Apple Pay".

The protection of your transaction is provided by the security functions of the hardware and software of your device. If a payment is to be approved, it must be approved by entering a code and verifying it using the "Face ID" or "Touch ID" function of your device.

Your information provided during the checkout process, along with information about your order, will be shared with Apple in encrypted form for payment processing. This data is then encrypted again by Apple and then transmitted to the payment service provider of the payment card stored in Apple Pay for the execution of the payment. The encryption ensures that only the website on which the order was placed can access the payment data.

After payment, Apple sends the device account number and a transaction-specific dynamic security code to the store website to confirm the payment.

Personal data may be processed with the aforementioned curtains. In this case, this is done for the purpose of payment processing in accordance with Art. 6 (1) (b) GDPR.

When you use Apple Pay on your iPhone or Apple Watch to complete a purchase you made through Safari on your Mac, your Mac and the authorization device communicate through an encrypted channel on Apple's servers. Apple can process or store data. However, this is done in a format that does not identify you.

Information on Apple Pay privacy can be found here: https://support.apple.com/de-de/HT203027

5.5 Google Pay

When selecting the payment method "Google Pay" (a service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google")), the payment processing is mediated via the "Google Pay" application of your mobile device operated by Android (at least 4.4 "KitKat") and equipped with an NFC function. Payment is made via one of your payment cards stored with Google Pay or a payment system verified there (e.g. PayPal). To approve a payment via Google Pay of more than 25 EUR, you must first unlock your mobile device. The information you provide when you place your order will be shared with Google for the purpose of processing payments. Google generates a one-time transaction number that is transmitted to the order website to process the payment.

verify. This transaction number is merely a numeric token that does not contain any information about your data. The actual transaction is carried out between the user and the order website by debiting the means of payment stored with Google Pay. Personal data may be processed in the processes described. In this case, the processing is carried out for the purpose of payment processing in accordance with Art. 6 (1) (b) GDPR.

The terms of use of Google Pay can be found here:https://payments.google.com/payments/apis- secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=deFurther information on data protection at Google Pay can be found at the following internet address:https://payments.google.com/payments/apis- secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de

- PayPal

If you select the payment method PayPal, credit card via PayPal, direct debit via PayPal or – if offered – "purchase on account" via PayPal, the payment will be processed via PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter referred to as "PayPal").

We pass on your personal data to PayPal in accordance with Art. 6 (1) (b) GDPR within the scope of necessity. PayPal reserves the right to carry out a credit check for the payment methods credit card via PayPal, direct debit via PayPal or - if offered - "purchase on account" via PayPal.

For this purpose, your payment data may be passed on to credit agencies in accordance with Art. 6 (1) (f) GDPR on the basis of PayPal's legitimate interest in determining your solvency. PayPal uses the result of the credit check in relation to the statistical probability of payment default for the purpose of deciding whether to provide the respective payment method.

The credit report can contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. Among other things, but not exclusively, address data is included in the calculation of the score values.

The other data collected by PayPal can be found in the respective privacy policy of PayPal. This can be found at: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for contractual payment processing.

- Shopify Payments

We use the payment service provider "Shopify Payments", 3rd Floor, Europa House, Harcourt Building, Harcourt Street, Dublin 2. If you choose a payment method offered by the payment service provider Shopify Payments, the payment will be processed by the technical service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to whom we will transfer the information provided during the order process along with the information about your order (name, address, account number, sort code, credit card number, credit card number, etc.).  invoice amount, currency and transaction number) in accordance with Art. 6 (1) (b) GDPR. Your data will be passed on exclusively for the purpose of processing payments with Stripe Payments Europe Ltd. and only to the extent necessary for this purpose. For more information about Shopify Payments' privacy, please visit the following web address: https://www.shopify.com/legal/privacy

Data protection information about Stripe Payments Europe Ltd. can be found here: https://stripe.com/de/privacy

6.  Data processing when opening a customer account and for contract processing

If you open a customer account with us, personal data will be collected and processed in accordance with Art. 6 (1) (b) GDPR. The scope of the data can be seen from the input form. The data you enter will be stored and used by us for the purpose of processing the contract.

You can delete your customer account at any time. This can be done by sending a message to the Controller's address or, if offered, directly in the customer account. In this case, we will also block your data in consideration of retention periods under tax and commercial law and delete it after these periods have expired. This can only be opposed by your consent to permanent storage or a legally permitted further use of data on our part.

7.  Comments

If you use the comment function on our website, in addition to your comment content, information about the time of creation of the comment and the commenter name you have chosen will be stored and published on the website. It also logs and stores your IP address. The legal basis for the storage of your data is Art. 6 (1) (b) and (f) GDPR. The IP address is stored for security reasons and in the event that the data subject violates the rights of third parties or publishes illegal content through a comment submitted. Your email address is required to contact you in case a third party objects to your published content as illegal. We reserve the right to delete comments if they are objected to by third parties as illegal.

8.  Use of your data for direct marketing

8.1 Newsletter

On our website it is possible to subscribe to a free newsletter. When registering for the newsletter, the data from the input mask is transmitted to us. Only your email address is mandatory. If you make further voluntary entries, they will only be used for personal contact.

The legal basis for the processing of your data after subscribing to the newsletter is Art. 6 para. 1 lit. a GDPR if the user has consented. We obtain this information by sending you a confirmation email after subscribing to the newsletter, which contains a confirmation link. If you click on this link, you also give your consent to receive the newsletter.

When you register for the newsletter, we store your IP address as well as the date and time of registration. This storage serves to track possible misuse of your e-mail address.

We use the data collected by us when registering for the newsletter exclusively for the purpose of sending the newsletter.

You can cancel your subscription to the newsletter at any time. For this purpose, there is a corresponding link in every newsletter. This also enables a revocation of consent to the storage of personal data collected during the registration process.

8.2 Newsletter for existing customers

If you purchase goods or services on our website and provide your e-mail address, this may subsequently be used by us to send you a newsletter. In such a case, the newsletter will only be used to send direct advertising for its own similar goods or services.

The legal basis for sending the newsletter as a result of the sale of goods or services is Section 7 (3) UWG and Art. 6 (1) (f) GDPR. In this respect, data processing is carried out solely on the basis of our legitimate interest in personalized direct advertising.

If you have already objected to the use of your email address for direct marketing purposes, you will not receive this newsletter. However, you also have the option at a later date and at any time to object to the use of your e-mail address for the advertising purpose specified here with effect for the future by notifying us. After receipt of your objection, the use of your email address for advertising purposes will be stopped immediately.

9.  Use of social media: Video

Use of Youtube videos

On this website, we use the YouTube embed function to display and play videos from the provider "Youtube", which belongs to Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). In doing so, we use the extended data protection mode, which, according to the provider, only initiates the storage of user information when the video(s) is played. When you start playing embedded YouTube videos, the provider "Youtube" uses cookies to collect information about your user behavior. According to "Youtube", these serve, among other things, to collect video statistics, improve user-friendliness and prevent abusive practices. If you are logged in to Google, your data will be assigned directly to your account.

If you do not wish to be associated with your YouTube profile, you must log out before activating the button. Google stores your data (even for users who are not logged in) as usage profiles and evaluates them.

Such an evaluation is carried out in particular in accordance with Art. 6 (1) (a) GDPR on the basis of your express consent.

You have the right to object to the creation of these user profiles, whereby you must contact YouTube to exercise this. Regardless of whether the embedded videos are played, a connection to the Google network "DoubleClick" is established every time this website is accessed, which can trigger further data processing processes without our influence.

Data may also be transmitted to the servers of Google LLC. in the USA. Further information on data protection at "YouTube" can be found in the provider's privacy policy at: https://policies.google.com/privacy?hl=de  Settings for personalized advertising are possible at: https://adssettings.google.com/authenticated.

Google LLC, based in the USA, is certified for the US-European data protection agreement "EU-U.S. Data Privacy Framework", which ensures compliance with the level of data protection applicable in the EU. Details can be found here: https://privacy.google.com/businesses/gdprcontrollerterms/

10.  Online-Marketing

Use of Google Ads Conversion Tracking

This website uses the online advertising program "Google Ads" and, within the framework of Google Ads, the conversion tracking of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").

Our offers are advertised with the help of advertising materials (so-called Google Adwords) on external websites. Our legitimate interest lies in the display of advertising that is interesting for you and in achieving a fair calculation of advertising costs. The legal basis is Art. 6 (1) (a) GDPR, namely your express consent.

Google Ads uses cookies for conversion tracking, which are set when you click on an AdWords ad placed by Google.

These cookies usually expire after 30 days and are not used for personal identification. Each Google Ads customer receives a different cookie, so cookies cannot be served through the

Ads customer websites are tracked.

The information obtained in this way is used to compile conversion statistics for ads customers about the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag.

You cannot be personally identified with it.

If you want to prevent tracking, you can deactivate the Google Conversion Tracking cookie via your Internet browser under User Settings.

Google LLC, based in the USA, is certified for the US-European data protection agreement "EU-U.S. Data Privacy Framework", which ensures compliance with the level of data protection applicable in the EU. You can find more information about Google's privacy policy at the following internet address :http://www.google.de/policies/privacy/You can permanently deactivate the conversion cookies by setting your browser accordingly or download and install the browser plug-in available at the following link :http://www.google.com/settings/ads/plugin?hl=de

In this case, certain functions of this website may not be able to be used or can only be used to a limited extent.

11.  Web Analytics Services

11.1  Google Analytics 4

On our website, we use Google Analytics 4, a web analysis service provided by Google Ireland Limited (Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland) (hereinafter referred to as "GA4").

Google Analytics uses "cookies". These are small text files that are stored on your device and enable an analysis of your use of the website. The information generated in this way about your use of this website (including the abbreviated IP address) will be transmitted to a Google server, where it will be stored and further processed, whereby a transfer to the USA is possible. The IP addresses are anonymized by default. For IPv4 addresses, the last octet and for IPv6 addresses the last 80 bits in memory are set to zero and thus "anonymized". A personal reference is excluded. A transfer to servers of Google LLC based in the USA is not excluded.

During your visit to the website, GA4 records your user behaviour in the form of "events", such as: page views, first visit to the website, start of the session, your "click path", interaction with the website, scrolls, clicks on external links, internal search queries, interaction with videos, file downloads, viewed / clicked ads, language preference. In addition, GA4 collects your approximate location (region), your IP address (in anonymized form), technical information about your browser and the devices you use (e.g. language settings, screen resolution), your Internet provider, the referrer URL (via which website/advertising medium you came to this website).

On our behalf, Google uses this information to evaluate your website usage, to compile reports on website activity and to provide us with other services related to website and internet usage. There will be no combination of your anonymized IP collected in this context with other data from Google.

The data collected in this context will be stored for two months.

The legal basis for the data processing described here, as well as for the setting of cookies, is your

explicit consent in accordance with Art. 6 (1) (a) GDPR. This consent can be revoked at any time with effect for the future, for example by deactivating this Google service via the cookie consent tool in which you have already given your consent.

Without your consent, Google Analytics 4 will not be used during your visit to the site. You can revoke your consent at any time with effect for the future. To exercise your right of withdrawal, please deactivate this service via the "Cookie Consent Tool" provided on the Website.

Google LLC, based in the USA, is certified for the US-European data protection agreement "EU-U.S. Data Privacy Framework", which ensures compliance with the level of data protection applicable in the EU. We have also concluded a data processing agreement with Google.

Further information on data protection by Google Analytics 4 can be found on the following websites: https://policies.google.com/technologies/partner-sites

und https://policies.google.com/privacy?hl=de&gl=de

Demographic Merkmale

GA4's "Demographics" feature can generate statistics about it, which can be used to make statements about the age, gender, and interests of site visitors. For this purpose, advertising and information from third-party providers are analysed and target groups for certain marketing activities are identified. However, there is no personal assignment of data in this case. The data will be deleted after two months.

UserIDs

If we use the extended function "UserIDs", your activities (including conversions) can be analyzed across devices. In this case, the analysis is not pseudonymous.

This is possible if you give your consent to the use of Google Analytics 4 in accordance with Art. 6 (1) (a) GDPR, you have set up an account on this website and log in with this account on different devices.

Google Flags

If we use the "Google Signals" extension, we may have cross-device reports on your usage behavior made. However, we only receive statistics and no personal data. This analysis is only possible if you have activated personalized ads in your Google Account and linked your devices to a Google Account. You must also have your consent to the use of Google Analytics in accordance with Art. 6 (1) (a) GDPR. You can opt out of cross-device analytics by disabling the Personalized Ads feature in your Google Account. You can find more information about Google Signals here: https://support.google.com/analytics/answer/7532985?hl=de

11.2  Shopify Analytics

We use Shopify's web analytics service (Shopify International Limited, Victoria Buildings, 2nd floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland).

In order to safeguard our legitimate interest in the statistical analysis of user behavior for optimization and marketing purposes, Shopify collects, evaluates and stores pseudonymized visitor data, from which pseudonymized user profiles can be created and evaluated. Shopify uses cookies to recognize the browser and thus enable a more accurate determination of statistical data. Your IP address is also collected, but immediately after the collection before

of the storage, so that a personal reference is excluded. The legal basis is Art. 6 (1) (a) GDPR, namely your express consent. Shopify does not associate your IP address with any other data held by Shopify.

In order to object to the collection of data and the creation of pseudonymised user profiles and the setting of cookies in the future, you can generally deactivate the use of cookies on your computer by setting your internet browser so that no more cookies can be stored on your computer in the future or cookies that have already been stored are deleted. However, switching off all cookies may mean that some functions on our websites can no longer be fully used.

Shopify's privacy policy can also be found at: https://www.shopify.de/legal/datenschutz

12.   Rights of the data subject

12.1  The applicable data protection law grants you comprehensive rights as a data subject vis-à-vis the controller with regard to the processing of your personal data (rights of information and intervention), about which we inform you below:

-  Right of access according to Art. 15 GDPR:

You may request confirmation from the Controller as to whether personal data concerning you is being processed by the Controller. In addition, you have the right to information about the purpose, the categories of personal data, the recipients, the planned duration of storage and the existence of other rights such as correction of the data or the existence of a right to lodge a complaint with a supervisory authority, the origin of your data, if it has not been collected by us, the existence of automated decision-making including profiling and, if applicable, meaningful information about the data involved. the logic and scope of such processing and the intended effects of such processing, as well as your right to be informed of the guarantees in accordance with Article 46 of the GDPR in the event of the transfer of your data to third countries;

-  Right to rectification pursuant to Art. 16 GDPR:

You have the right to have the inaccurate data concerning you rectified without undue delay and/or to have your incomplete data stored by us completed; the correction or completion must be made without delay.

-  Right to restriction of processing pursuant to Art. 18 GDPR:

You have the right to request the restriction of the processing of your personal data as long as the accuracy of your data that you contest is verified, if you refuse to delete your data due to unlawful data processing and instead request the restriction of the processing of your data, if you need your data to assert, exercise or defend legal claims after we no longer need this data after the purpose has been achieved, or if you have lodged an objection on grounds relating to your particular situation, pending the determination of whether our legitimate reasons prevail;

Where the processing of personal data concerning you has been restricted, such data may only be processed with your consent or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State. If the restriction of processing has been restricted, you will be informed by the controller before the restriction is lifted.

-  Right to erasure in accordance with Art. 17 GDPR:

You have the right to request the immediate deletion of your personal data if the requirements of Art. 17 (1) GDPR are met. However, this right to erasure does not apply in particular - not exclusively - if the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the assertion, exercise or defence of legal claims

-  Right to information pursuant to Art. 19 GDPR:

If you have exercised your right to rectification, erasure or restriction of processing, the Controller is obliged to notify all recipients to whom your personal data has been disclosed of this rectification or erasure of the data or restriction of processing, unless this is impossible or involves disproportionate effort. You also have the right to be informed about these recipients.