I General information
In the following, we inform you in accordance with Art. 13 DSGVO about the collection of personal data when using our website. Personal data is all data that can be related to you personally, e.g. name, address, e-mail addresses, user behavior.
The responsible party according to Art. 4 para. 7 of the EU General Data Protection Regulation (DSGVO) is
GEFASOFT Automation and Software GmbH Regensburg, Germany
see our imprint
You can reach our data protection officer at:
Bugl & Kollegen Gesellschaft für Datenschutz und Informationssicherheit mbH, Alexander Bugl, Sedanstraße 7, 93055 Regensburg, e-mail: kontakt@buglundkollegen.de

II Your rights

If personal data is processed by you as a user, you are considered a data subject in accordance with the GDPR. Data subjects are entitled to the following rights vis-à-vis the controller:
Right to information (Art. 15 DSGVO)
Right to correction or deletion of personal data (Art. 16, 17 DSGVO)
Right to restriction of processing (Art. 18 DSGVO)
Right to communication in connection with the rectification or erasure of your personal data or the restriction of processing (Art. 19 DSGVO)
Right to data portability (Art. 20 DSGVO)
Right to object (Art. 21 DSGVO)
Right to revoke declarations of consent given. The lawfulness of the data processing carried out until the revocation remains unaffected due to the consent valid to date. (Art. 7 para. 3 DSGVO)
Right to complain to the supervisory authority (Art. 77 DSGVO).

III Hosting
The hosting services used by us serve to provide the following services: Infrastructure and platform services, computing capacity, storage space and database services, e-mail dispatch, security services and technical maintenance services, which we use for the purpose of operating this online service.
In this context, we, or our hosting provider, process inventory data, contact data, content data, contract data, usage data, meta data and communication data of customers, interested parties and visitors of this online offer on the basis of our legitimate interests in an efficient and secure provision of this online offer pursuant to Art. 6 para. 1 lit. f DSGVO in conjunction with Art. 28 DSGVO. Art. 28 DSGVO (conclusion of order processing contract).

IV Contacting
a. Type and purpose of processing

The data you enter in the contact form will be stored for the purpose of individual communication with you. For this purpose, it is necessary to provide a valid e-mail address and your name. This is used for the assignment of the request and the subsequent response to the same. The provision of further data is optional.

If you also contact us by e-mail or telephone, we will process your contact data used to respond to your request.

b. Legal basis of the processing

The processing of your personal data is based on a legitimate interest (Art 6 (1) lit. f DSGVO). By providing the contact form, we would like to enable you to contact us in an uncomplicated manner. The information you provide will be stored for the purpose of processing the request and for possible follow-up questions. If you contact us to request a quote, the processing of the data provided is for the implementation of pre-contractual measures (Art 6 para 1 lit. b DSGVO).

c. Data categories
IP address, contact data, your message
d. Recipients

Recipients of the data are internal employees of the Marketing, Sales departments and, if applicable, order processors.

e. Storage periods

Data will be deleted no later than 6 months after the request has been processed. If there is a contractual relationship, we are subject to the statutory retention periods under the German Commercial Code (HGB) and delete your data after these periods have expired.

f. Legal / contractual requirement

The provision of your personal data is voluntary. However, we can only process your request if you provide us with your name, e-mail address and the reason for the request.

g. Third country transfer

Processing does not take place outside the European Union (EU) or the European Economic Area (EEA).

h. Right of objection

You have the right to object to the processing of your personal data at any time. You can notify us of your revocation at any time using the contact option provided at the beginning of this privacy notice.

i. Automated decision-making and profiling

As a responsible company, we do not use automated decision-making or profiling for this data processing.

V Processing in the context of the business relationship
a. Type and purpose of processing
We may process the personal data of our customers, prospects, suppliers, vendors and partners for communication, planning, implementation of the contractual relationship, marketing, administration and security purposes.
b. Legal basis of the processing
The processing of the provided data is based on a legitimate interest (Art. 6 para. 1 lit. f DSGVO) and the performance of the contract (Art. 6 para. 1 lit. b DSGVO).
c. Data categories
Contact information (full name, job title, professional email address, professional phone number, professional address).
Billing information and payment data
Other necessary information in a project or contractual relationship or information provided to us voluntarily, such as personal data relating to orders, payments, inquiries and projects
If applicable, further information provided in the course of the business relationship
d. Recipients
Recipients of the data are the internal employees of the respective departments and, if applicable, the order processors of the departments.
e. Retention periods
We delete personal data when the storage of the personal data is no longer necessary for the purposes for which it was collected or processed or to fulfill legal obligations (e.g. HGB, AO).
f. Transfer to third countries
Your personal data may be transferred to third parties located outside the European Union (EU) or the European Economic Area (EEA) who provide hosting services for us, for example. To ensure the level of data protection in the third country, we have concluded so-called standard data protection clauses with our respective service providers.
g. Automated decision-making and profiling
As a responsible company, we do not use automated decision-making or profiling for this data processing.

VI Calling up the website
a. Nature and purpose of processing

When you access our website, i.e., when you do not register or otherwise submit information, information of a general nature is automatically collected. This information (server log files) includes, for example, the type of browser, the operating system used, the domain name of your Internet service provider, your IP address and the like. This is exclusively information that does not allow any conclusions to be drawn about your person. In particular, they are processed for the following purposes:
Ensuring a smooth connection setup of the website,
Ensuring a smooth use of our website,
evaluation of system security and stability, and
for other administrative purposes.
We do not use your data to draw conclusions about your person. Information of this kind is statistically evaluated by us, if necessary, in order to optimize our website and the technology behind it. Under certain circumstances, we also use another service provider in order to be able to present the data protection declaration. In this case, an embedding code is used, via which your IP address is transmitted to said service provider.
We process your data on the basis of our legitimate interest for a limited period of time, in order to initiate a derivation to personal data in the event of unauthorized access or attempted access to local servers and in order to be able to properly present the privacy policy.

b. Legal basis of the processing

The processing is carried out pursuant to Art. 6 (1) lit. f DSGVO on the basis of our legitimate interest in improving the stability and functionality of our website.

c. Data categories
Device, browser, operating system, location and IP address.
d. Recipients

Recipients of the data are internal employees of the Marketing, IT departments and, if applicable, order processors who act as order processors for the operation and maintenance of our website.

e. Storage periods

The data is deleted as soon as it is no longer required for the purpose for which it was collected. This is generally the case for data used to provide the website when the respective session has ended.

f. Legal / contractual requirement

The provision of the aforementioned personal data is neither legally nor contractually required. However, without the IP address, the service and functionality of our website is not guaranteed. In addition, individual services and services may not be available or may be limited.

g. Third country transfer

Processing does not take place outside the European Union (EU) or the European Economic Area (EEA).

h. Possibility to object
You have the right to object to the processing of your personal data at any time. You can notify us of your revocation at any time using the contact option provided at the beginning of this privacy notice.

i. Automated decision-making and profiling

As a responsible company, we do not use automated decision-making or profiling for this data processing.

VII Use of cookies
a. Type and purpose of processing
Like many other websites, we also use so-called "cookies".
Cookies are simple files that store information about our website and your use of it. These small files are optionally created by your browser automatically through the use of our website and stored locally on your respective end device. This does not mean that we have thereby gained immediate knowledge of your identity. The use of cookies serves to make the use of our offer more pleasant for you.

Most of the cookies we use are so-called "session cookies". They are automatically deleted after the end of your visit. Other cookies remain stored on your terminal device for longer. These cookies enable us to recognize your browser on your next visit.

We generally distinguish between technically necessary and non-necessary cookies:

Technically necessary cookies ("first party cookies")
are required for the operation of a website and are essential for navigating on it and using its functions.

Non-essential cookies, on the other hand, are mostly performance cookies and marketing & third party cookies that allow, for example, the number of visitors and traffic sources to be recorded and counted in order to measure and improve the performance of the website. They are also used to find out if certain pages are experiencing problems or errors, which pages are the most popular and how visitors navigate the site.

Performance cookies are used to track visits and individual activities on web pages. They are used to statistically record and evaluate the use of websites.
Marketing & Third Party Cookies originate, among others, from external advertising companies and are used to collect information about the websites visited by the user, for example, to create targeted advertising for the user.
The list of cookies used can be found in our cookie banner.

b. Legal basis of the processing
The use of technically necessary cookies ("first party cookies") is possible without the consent of the website visitor and is subject to a legitimate interest in the economic operation and optimization of our website and services within the meaning of Article 6 (1) sentence 1 lit. f DSGVO.

The use of cookies that are not necessary, such as performance cookies and marketing & third party cookies is subject to the consent of the website visitor in accordance with Art. 6 para. 1 p. 1 lit. a DSGVO.

c. Data categories
IP address
Browser used
Operating system and end device used
Internet connection
Session ID of the cookie
Time of the visit
d. Recipient
Named in the course of the privacy policy
e. Storage periods
The user can set his web browser in such a way that the storage of cookies on his end device is generally prevented or he is asked each time whether he agrees to the setting of cookies. Once cookies have been set, the user can delete them at any time. How this works is described in the help function of the respective web browser.
A general deactivation of cookies may lead to functional restrictions of this website.

f. Legal / contractual requirement
The provision of your personal data in cookies is voluntary in the case of non-essential cookies, solely on the basis of your consent (so-called opt-in cookies). You can also prevent the use of preset, technically necessary cookies (so-called opt-out cookies) via your browser settings. However, without consent, the service and functionality of our website is not guaranteed. In addition, individual services and services may not be available or may be limited.
g. Third country transfer
Processing also takes place outside the European Union (EU) or the European Economic Area (EEA). You can find more details in the following paragraphs.
h. Revocation of consent
You can implement the revocation to the consent of all cookies at any time with effect for the future in your browser settings or change the selection in the cookie banner. For this purpose, you can use the "Cookie Settings" button, which is displayed at the end of the Privacy Policy.

i. Automated decision making and profiling
As a responsible company, we do not use automated decision-making or profiling when collecting cookies.

VIII YouTube
a. Nature and purpose of processing

On some of our websites, we embed YouTube videos. The operator of the corresponding plugins is YouTube, Google Building Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland. When you visit a page with the YouTube plugin, a connection to YouTube servers is established. This tells YouTube which pages you are visiting. If you are logged into your YouTube account, YouTube can assign your surfing behavior to you personally. You can prevent this by logging out of your YouTube account beforehand. If a YouTube video is started, the provider uses cookies that collect information about user behavior. For more information on the purpose and scope of data collection and processing by YouTube, please refer to the provider's privacy policy, where you will also find further information on your rights in this regard and settings options for protecting your privacy (https://policies.google.com/privacy).

b. Legal basis of the processing

The legal basis for the integration of YouTube and the associated data transfer to Google is your consent (Art. 6 para. 1 lit. a DSGVO).

c. Data categories
Device information - IP address - Referrer URL - Videos viewed.
d. Recipients

Recipients of the data are internal employees of the Marketing and IT department and YouTube as service provider.

e. Storage periods

Those who have deactivated the storage of cookies for the Google Ad Program will not have to deal with any such cookies when watching YouTube videos. However, YouTube also stores non-personal usage information in other cookies. If you would like to prevent this, you must block the storage of cookies in the browser. For more information on data protection at "YouTube", please refer to the provider's privacy policy at:https://www.google.de/intl/de/policies/privacy/

f. Legal / contractual requirement

The provision of your personal data is voluntary, based solely on your consent. If you prevent access, this may result in functional restrictions on the website.

g. Third country transfer

Processing also takes place outside the European Union (EU) or the European Economic Area (EEA). To ensure the level of data protection in this third country, we have concluded standard data protection clauses with Google.

h. Revocation of consent

You can revoke your consent to the storage of your personal data at any time with effect for the future.

i. Automated decision-making and profiling

As a responsible company, we do not use automated decision-making or profiling for this data processing.

IX Google Maps
a. Type and purpose of processing

On this website, we use the offer of Google Maps. Google Maps is operated by Google Cloud EMEA ltd,. This allows us to display interactive maps directly on the website and enables you to use the map function conveniently. You can find more information about data processing by Google in the Google privacy policy. There you can also change your personal privacy settings in the Privacy Center. By visiting the website, Google receives information that you have called up the corresponding sub-page of our website. This occurs regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be directly assigned to your account. If you do not want the assignment in your profile at Google, you must log out of Google before activating the button. Google stores your data as usage profiles and uses them for the purposes of advertising, market research and/or demand-oriented design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact Google to exercise this right.

b. Legal basis of the processing

The legal basis for the integration of Google Maps and the associated data transfer to Google is your consent (Art. 6 para. 1 lit. a DSGVO).

c. Data categories

IP address - location information - usage data - date and time of visit - URLs.

d. Recipients

Recipients of the data are internal employees of the Marketing and IT departments and Google as a processor.

e. Storage periods

Data will only be processed in this context as long as the corresponding consent has been given. After that, they will be deleted unless there are legal retention obligations to the contrary. To contact us in this context, please use the contact details provided at the beginning of this privacy policy.

f. Legal / contractual requirement

The provision of your personal data is voluntary, based solely on your consent. If you prevent access, this may result in functional restrictions on the website.

g. Third country transfer

Processing also takes place outside the European Union (EU) or the European Economic Area (EEA). To ensure the level of data protection in this third country, we have concluded standard data protection clauses with Google.

h. Withdrawal of consent

If you do not want Google to collect, process or use data about you via our website, you can deactivate JavaScript in your browser settings. In this case, however, you will not be able to use our website or only to a limited extent. You can revoke your consent to the storage of your personal data at any time with effect for the future.

i. Automated decision making and profiling

As a responsible company, we do not use automated decision-making or profiling for this data processing.

j. Use of the Google Maps Static API.

The use of Google Maps may result in a call to the Google Maps Static API (gstatic.com).

X Google Analytics
a. Type and purpose of processing
This website uses Google Analytics, a web analytics service provided by Google Building Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland. Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of the website will be transmitted to and stored by Google on servers in the United States. However, due to the activation of IP anonymization on these websites, your IP address will be truncated beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google. The purposes of data processing are to evaluate the use of the website and to compile reports on website activities. Based on the use of the website and the Internet, other related services shall then be provided.
b. Legal basis of the processing
The processing of the entered data is based on the user's consent (Art. 6 para. 1 lit. a DSGVO).
c. Data categories
IP address (shortened/anonymized)
Date and time of visit - Usage data - Click path - App updates - Browser information - Device information - JavaScript support - Pages visited - Referrer URL - Downloads - Flash version - Location information - Purchase activity - Widget interactions.
d. Recipients
Employees of your own company's IT and marketing departments.
Google Building Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland

e. Storage periods
Data will only be processed in this context as long as the relevant consent has been obtained. Afterwards, they will be deleted, provided that there are no legal retention obligations to the contrary. To contact us in this context, please use the contact details provided at the beginning of this Privacy Policy.
f. Legal / contractual requirement
The provision of your personal data is voluntary, based solely on your consent. If you prevent access, this may result in functional restrictions on the website.
g. Third country transfer
Processing also takes place outside the European Union (EU) or the European Economic Area (EEA). To ensure the level of data protection in this third country, we have concluded standard data protection clauses with Google (Analytics).
h. Revocation of consent
You can revoke your consent to the storage of your personal data at any time with effect for the future.
You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the available browser plugin: "Browser Add On to disable Google Analytics".
i. Automatic decision-making and profiling
With the help of the tracking tool Google Analytics, the behavior of visitors to the website can be evaluated and interests can be analyzed. For this purpose, we create a pseudonymous user profile.

XI Online presences in social media
We maintain online presences within social networks in order to inform users active there about our services and to communicate directly via the platforms if they are interested. We are currently represented in the following networks:

LinkedIn: de.linkedin.com/company/gefasoft-automatisierung-und-software-gmbh
Facebook: de-de.facebook.com/gefasoft/
YouTube: www.youtube.com/user/Gefasoft2012
Xing: www.xing.com/pages/gefasoftautomatisierungundsoftwaregmbh

All of our social media channels can only be accessed by visitors to the website via an external link. We do not use plugins or other interfaces on our website that the respective networks offer for embedding the offers on websites.
We have no influence on the data collection and its further use by the social networks. Thus, there is no knowledge about the extent to which, where and for how long the data is stored, to what extent the networks comply with existing deletion obligations, what evaluations and links are made with the data and to whom the data is passed on. We therefore expressly draw attention to the fact that user data (e.g. personal information, IP address) is stored by the operators of the networks in accordance with their data usage guidelines and used for business purposes.
We process the data of users in the social media presences insofar as they contact and communicate with us via, for example, comments or direct messages.
The legal basis for the processing of the user's data is Art. 6 (1) lit. b and f DSGVO.
LinkedIn
Facebook
YouTube
Xing
No functions and content of the LinkedIn service, offered by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, are integrated within our online offer. The LinkedIn channels are only accessible via an external link. If visitors to our website are members of the LinkedIn platform, LinkedIn can assign the call to the social media channel to the user's profile there if the user visits the LinkedIn profile while logged in. We point out that we have no influence on the content, scope of use of the data collected by LinkedIn. For further information in this regard, we refer to the privacy policy of LinkedIn: www.linkedin.com/legal/privacy-policy.
You can access the social media network Facebook via external links on our website. All functions in the social media network are offered by Meta Platforms Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland. The Facebook channels can only be accessed via an external link. If you are logged in to Facebook with your own profile and access our social media channel, Facebook can assign your visit to your logged-in profile. If you do not wish your user account to be associated with your IP address, please log out of your Facebook account before using our website.
For more information on the processing of your data, please refer to Facebook's privacy policy: facebook.com/privacy/explanation and to our Facebook Fanpage Data Policy, which can be found below.

No functions and contents of the YouTube service, offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, are integrated within our online offer. The YouTube channels can only be accessed via an external link. If visitors to the website are members of the YouTube platform, YouTube can assign the call to the social media channel to the user's profile if the user visits our YouTube profile while logged in. We point out that we have no influence on the content, scope of use, of the data collected by YouTube. For further information in this regard, please refer to YouTube's privacy policy: policies.google.com/privacy. Furthermore, we would like to point out that you can make appropriate changes to your YouTube account to protect your privacy.
Within our online offer, no functions and contents of the service Xing, offered by New Work SE, Dammtorstraße 29-32, 20354 Hamburg, Germany, are integrated. The Xing channels are only accessible via an external link. If visitors to our website are members of the Xing platform, Xing can assign the call to the social media channel to the user's profile there if the user visits the Xing profile while logged in. We point out that we have no influence on the content, scope of use of the data collected by Xing. For further information in this regard, please refer to Xing's privacy policy: www.xing.com/app/share

XII Data Policy Facebook Fanpage
GEFASOFT Automatisierung und Software GmbH Regensburg operates an online presence on Facebook, a so-called Facebook Fanpage. The following supplementary data processing information applies to visits to our fan page. Information on data protection on Facebook in general can be found here (https://www.facebook.com/about/privacy/).
1. joint responsibility, contact details, company data protection officer:
We are jointly responsible with Facebook for the operation of our Facebook Fanpage pursuant to Art. 26 DSGVO. For this purpose, we have stipulated in an agreement with Facebook who fulfills which obligations with regard to data protection. This agreement can be accessed here (https://www.facebook.com/legal/terms/page_controller_addendum). Accordingly, Facebook is primarily responsible for providing the data subject with information about the joint processing and enabling him or her to exercise his or her data protection rights. Notwithstanding the above, we hereby inform you about your visit to our Fanpage.
Our contact details are:
GEFASOFT Automatisierung und Software GmbH Regensburg, Germany.
Franz-Mayer-Strasse 10, 93053 Regensburg, Germany
info@gefasoft.com

You can reach Facebook at:
Meta Platforms Ireland Ltd.
4 Grand Canal Square,
Grand Canal Harbour,
Dublin 2, Ireland
You can reach Facebook online here (https://www.facebook.com/help/contact/2061665240770586)
You can reach our company data protection officer at:
Bugl & Kollegen Gesellschaft für Datenschutz und Informationssicherheit mbH
Alexander Bugl
Sedan Street 7
93055 Regensburg
E-mail: kontakt@buglundkollegen.de

You can reach Facebook's data protection officer at
www.facebook.com/help/contact/540977946302970.

2. collection and storage of personal data and the type and purpose and use thereof:
a) Data collected by Facebook:
If you are a Facebook user, Facebook collects the data described in the Facebook Data Policy under "What types of information do we collect?". If you are not a Facebook user, cookies provided with identifiers, small text files, may still be stored in your browser, which enable so-called tracking of your user behavior.
As a rule, the user data during a visit to Facebook is also processed by Facebook for market research and advertising purposes. Based on the user behavior (including when visiting our Fanpage), complex user profiles are created, which Facebook can use to play personalized advertisements to the visitor within and outside of Facebook. More information on this can also be found in the Facebook data policy.
If you do not agree with this, you can object here (opt-out).
b) Data used by us ("Page Insights") and legal basis:
Facebook provides us with statistics and usage data that we can use to analyze the use of our Fanpage (so-called "Page Insights"). This enables us to continuously improve our offer on Facebook. We, as the operator, do not make any decisions regarding the processing of Insights data and any other information resulting from Art. 13 of the GDPR, such as the storage duration of cookies on user devices. The primary responsibility under the GDPR for the processing of Insights Data lies with Facebook and Facebook fulfills all obligations under the GDPR with respect to the processing of Insights Data.
We as the site administrator have no other way, not even via user tracking, to evaluate user behavior on our Fanpage. It is also fundamentally not possible for us to identify the visitor to the Fanpage on the basis of the page insights. In particular, we have no right under the agreement to require Facebook to disclose individual visitor data. Identification is only possible for us if we are able to assign individual profile pictures to "Like" Page Views; however, this is only possible to the extent that our Fanpage has been marked with "Like" by the corresponding visitor and the "Like" is set to "public".
What information Facebook uses to create page insights can be found here.
The operation of the Facebook fan page and the use of the page insights serves our legitimate interest in effective external presentation and efficient communication with our customers and interested parties. This interest justifies the operation of the page both to the legitimate interests of Facebook users, as well as to visitors to our fan page who do not have a Facebook account. Accordingly, the legal basis is Art. 6 para. 1 lit. f) DSGVO.
3. transfer of data to third parties:
Data collected by Facebook is exchanged and processed within the entire Facebook group. The Facebook Group also includes, for example, Instagram, WhatsApp and Oculus. For example, information collected through Facebook is used to display personalized ads to users on Instagram, or information from WhatsApp is used to take action against accounts that send spam through WhatsApp on Facebook. This information can be found in the Facebook Data Policy under "How do Facebook companies work together?".
The processing of data by Facebook may involve the transfer of user data outside the European Economic Area (EEA), in particular the USA.
4. right to object:
If your personal data is processed on the basis of legitimate interests pursuant to Article 6 (1) (f) DSGVO, you have the right to object to the processing of your personal data pursuant to Article 21 DSGVO, provided that there are grounds for doing so that arise from your particular situation or the objection is directed against direct marketing. In the latter case, you have a general right of objection, which is implemented by us without specifying a particular situation. If you would like to exercise your right of revocation or objection, an e-mail to info@gefasoft.com is sufficient.
5. data subject rights:
You have the right to revoke your consent to us at any time. This has the consequence that we may no longer continue the data processing based on this consent for the future. Furthermore, you have the right to information according to Art. 15 DSGVO, the right to correction according to Art. 16 DSGVO, the right to deletion according to Art. 17 DSGVO, the right to restriction of processing according to Art. 18 DSGVO, as well as the right from data portability from Art. 21 DSGVO. Furthermore, you have the right to lodge a complaint with a competent data protection supervisory authority (Art. 77 DSGVO).
In principle, you can assert your data subject rights against Facebook as well as against us. Since only Facebook has direct access to your user data, you can most effectively assert your data protection rights against Facebook.