With the following information, we would like to provide you as a customer, business partner, supplier, vendor or their employees with an overview of how we process your personal data and your rights under the General Data Protection Regulation (Regulation (EU) 2016/679 - GDPR). Please note that this general data protection information does not constitute the data protection declaration of our websites - you can find this at https://www.fette-compacting.com/en/data-protection.
Controller
The office named in the imprint is responsible for the data processing described below.
I. Data processing: Purpose and und legal bases
We collect and process personal data in accordance with the legal basis of Art. 6 (1) sentence 1 of the General Data Protection Regulation (GDPR), in particular on the following bases:
The data subject has given consent to the processing of personal data relating to him or her for one or more specific purposes (for the right of withdrawal, see "Your rights as a data subject");
Your personal data is processed for the purpose of carrying out pre-contractual measures that precede a contractually regulated business relationship or for the purpose of fulfilling the obligations arising from a concluded contract with you. This may include, for example, the processing of purchase orders, deliveries or invoicing or payments, or the preparation of and response to quotation requests, to determine the establishment or terms of a contractual relationship;
The processing is necessary for compliance with a legal obligation to which the controller is subject (e.g. tax law, commercial and foreign trade law or sanctions law regulations, assessment and management of risks within our company, legal regulations e.g. to combat money laundering or terrorism financing);
The processing is necessary to protect the legitimate interests of the Controller or a Third Party, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data. The legitimate interests are the optimal contact support/relationship with our business partners for whom you maintain contact with us and act as a contact person. Furthermore, legitimate interests include internal administrative purposes (e.g. for accounting), control and improvement of the efficiency and legal security of business processes, such as by maintaining a customer database, also within the framework of "customer relationship management" or ensuring IT security and IT operations as well as for carrying out compliance investigations, measures for building and facility security (e.g. access controls), measures for business management and further development of services and products of the assertion, exercise or defense of legal claims (For the right to object, see "Your rights as a data subject").
The data processing, if any, in detail:
1. Contract initiation and performance; sale of goods and services
We process your personal data in the context of the sale of goods and services for the purpose of carrying out pre-contractual measures and fulfilling the contract concluded with you or your company, for necessary correspondence in the context of the business relationship and for invoicing. The legal basis for this is Art. 6 para. 1 p. 1 lit. b GDPR. If you act as an employee or representative of our contractual partner, we process your personal data in our legitimate interest (Art. 6 para. 1 p. 1 lit f DSGVO) in a direct contact and smooth communication.
In particular, we process master data (name, address, contact data such as e-mail address, telephone number), identification data (e.g. ID card data), authentication data (e.g. access authorizations) and, if applicable, sales data, data on your position and function in the company.
Your personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the processing of your personal data in the context of the sale of goods or services, this is the case when the contract has been fulfilled and all claims arising from the contractual relationship have lapsed and there are no longer any statutory retention periods.
2. Entering your contract or business partner data and ongoing business relationship
The legal basis for the processing of your personal data as well as the personal data of the contact persons of your company in the context of entering your contract or business partner data and data of the ongoing business relationship is Art. 6 para. 1 p. 1 lit. b GDPR or Art. 6 para. 1 p. 1 lit. f GDPR. The purpose of processing the aforementioned personal data is the acceptance, execution and settlement of the respective order as well as our legitimate interest in considering you for future purchase enquiries (for the right to object in the event of data processing based on Art. 6 para. 1 p. 1 lit. f GDPR, see "Your rights as a data subject").
Your personal data as well as the personal data of the contact persons of your company will be deleted as soon as they are no longer required for the processing of purchase enquiries, execution and invoicing of the respective order, i.e. when the contract on which the order is based has been fulfilled and all claims arising from the contractual relationship have lapsed and there are no longer any statutory retention periods. In the event of consideration for future purchase enquiries, we will delete your personal data (contact details of the contact person) if your company is finally no longer interested in being considered for future purchase enquiries or tenders or has declared a corresponding objection to the data processing, at the latest however after 10 years.
3. Evaluations, direct marketing, newsletters, customer surveys
Based on the legal basis in Art. 6 para. 1 p. 1 lit. f GDPR, we carry out evaluations of your data in our legitimate interest to improve processes and reduce (compliance) risks.
If we receive your business or private e-mail address in connection with the sale of a good or service, we may use this address for direct advertising for our own similar goods or services, unless you have objected to the processing. When collecting your address and each time it is used, we clearly indicate that you can object to the use at any time without incurring any costs other than the transmission costs according to the basic rates.
The use is based on Art. 6 para. 1 p. 1 lit. f GDPR in conjunction with § 7 (3) UWG (GERMAN ACT AGAINST UNFAIR COMPETITION) and in the interest of promoting the sale of our goods or services. In addition, we may inform you and advertise our products and services via direct mail in our legitimate interest in providing commercial information. The legal basis for data processing is also Art. 6 para. 1 p. 1 lit. f GDPR. If you do not wish to receive direct advertising, including direct mail, you can object to data processing for this purpose to the office named in the imprint and in the respective advertising e-mail or direct mail.
Unless we process your data on the basis of Art. 6 para. 1 p. 1 lit. f GDPR in conjunction with § 7 (3) UWG and in particular vis-à-vis consumers (e.g. newsletters or advertising calls), this will only be done with the express consent of the data subject in accordance with Art. 6 (1) sentence 1 lit. a GDPR in connection with UWG, which can be revoked at any time and with effect for the future (regarding the right of revocation, see "Your rights as a data subject"). In the event of express consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Art. 49 (1) lit. a GDPR. If you have consented to the storage of cookies or to the access to information in your terminal device, the data processing is additionally carried out on the basis of Section 25 (1) GERMAN TELECOMMUNICATIONS-TELEMEDIA DATA PROTECTION ACT (abbreviated in German TTDSG).
Thus, when creating new customer data or updating data, we can also ask you whether you would like to receive marketing information and/or our newsletter by email in the future. After the selection you will receive a final confirmation email with a confirmation link. Alternatively, you can register for the newsletter on our website. (so-called double opt-in). Both the newsletter dispatch and the data processing for the purpose of the selectable marketing and information measures are based on your voluntary consent. You can revoke your consent at any time. An uncomplicated option for revocation is provided, for example, via the unsubscribe link provided in every newsletter.
Within the scope of the newsletter registration, we store additional data beyond the data already mentioned, insofar as this is necessary so that we can prove that you have consented to the registration for newsletter dispatch. This may include the storage of the confirmation of the newsletter, as well as a copy of the confirmation email sent by us. The corresponding data processing is based on Art. 6 para. 1 p. 1 lit. f GDPR and is carried out in the interest of being able to account for the legality of the newsletter dispatch.
4. Data processing in context of first communication
We process your data, which you transmit to us in connection with contacting us, exclusively for processing your request.
Depending on the content of your enquiry, the legal basis for this is, among other things, Art. 6 (1) sentence 1 lit. f GDPR. Our legitimate interest follows from the aforementioned purpose of processing and answering your request. If your request is aimed at concluding a contract, the legal basis for processing may also be Art. 6 (1) sentence 1 lit. b GDPR.
5. Data processing in the context of audio and video conferencing
For communication with our customers, we use online conferencing tools. If you communicate with us via video or audio conference via internet, your personal data will be collected and processed by us and the provider of the respective conference tool.
In doing so, the tools collect all data that you provide/enter to use the tools (e-mail address and/or your telephone number). Furthermore, the tools process the duration of the conference, start and end (time) of participation in the conference, number of participants and other information related to the communication process (metadata).
Furthermore, the provider of the tool processes all technical data required to handle the online communication. This includes, in particular, IP addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or speaker, and the type of connection. If content is exchanged, uploaded or otherwise made available within the tool, this is also stored on the servers of the tool providers. Please note that we do not have full influence on the data processing. For further information on data processing, please refer to the data protection policy of the respective tools used, which we have listed below this text.
The tools are used to communicate with prospective and existing contractual partners or to process your request. If your request is aimed at concluding a contract, the legal basis for the processing may be Art. 6 (1) p. 1 lit. b DSGVO. Furthermore, the use of the tools serves the general simplification and acceleration of communication with us or our company (Art. 6 para. 1 p. 1 lit. f DSGVO). Our legitimate interest follows from the aforementioned purpose of processing and answering your request. Insofar as consent has been requested, the tool in question is used on the basis of consent. The consent can be revoked at any time with effect for the future.
The tools are used to communicate with prospective and existing contractual partners or to process your request. If your request is aimed at concluding a contract, the legal basis for the processing may be Art. 6 (1) p. 1 lit. b GDPR. Furthermore, the use of the tools serves the general simplification and acceleration of communication with us or our company (Art. 6 para. 1 p. 1 lit. f GDPR). Our legitimate interest follows from the aforementioned purpose of processing and answering your request. Insofar as consent has been requested, the tool in question is used on the basis of consent. The consent can be revoked at any time with effect for the future.
II. Data sources
Personal data that we have not collected directly from you may be taken from publicly accessible sources (e.g. trade register, website, press) or collected from the following sources: other persons in your company, if we need your personal data to process a specific request or in the context of an ongoing business relationship; credit agencies.
III. Storage period
Unless we have already informed you in detail about the duration of data processing, we delete personal data when it is no longer required for the aforementioned processing purposes, you have revoked your consent to data processing and there are no statutory retention obligations that prevent deletion/destruction. The statutory retention and documentation obligations generally result from the German Commercial Code, the German Fiscal Code and the German Civil Code and can amount to 3-30 years, depending on the processing purpose.
IV. Data recipient
We only transfer your data to third parties if this is permitted under data protection law. We may also pass on your data to external service providers (IT service providers, data/shredders, logistics, printing services, telecommunications, debt collection, consulting and advisory services as well as sales and marketing, service providers for advertising mailings), which support us in data processing within the framework of order processing strictly bound by instructions and on the basis of an order processing agreement. If we transfer personal data to recipients outside the European Economic Area (EEA), the transfer will only take place if the third country has been confirmed by the EU Commission as having an adequate level of data protection, if an adequate level of data protection has been agreed with the data recipient (for example, by means of standard contractual clauses), if other necessary measures have been taken to ensure an adequate level of data protection, or if you have given us your consent to do so in accordance with the requirements of Article 49 (1) sentence 1 lit. a GDPR.
V. Your rights as a data subject
When processing your personal data, the GDPR grants you certain rights as a data subject:
Right of access (Art. 15 GDPR)
You have the right to request confirmation as to whether personal data concerning you is being processed; if this is the case, you have a right to information about this personal data and to the information listed in detail in Art. 15 GDPR.
Right of rectification (Art. 16 GDPR)
You have the right to request without undue delay the rectification of any inaccurate personal data concerning you and, where applicable, the completion of any incomplete data.
Right to erasure (Art. 17 GDPR)
You have the right to request that personal data concerning you be erased without delay, provided that one of the reasons listed in detail in Art. 17 GDPR applies.
Right to restriction of processing (Art. 18 GDPR)
You have the right to request the restriction of processing if one of the conditions listed in Art. 18 GDPR applies, e.g. if you have objected to the processing, for the duration of the review by the controller.
Right to data portability (Art. 20 GDPR)
In certain cases, which are detailed in Art. 20 GDPR, you have the right to receive the personal data concerning you in a structured, common and machine-readable format or to request the transfer of this data to a third party.
Right of withdrawal (Art. 7 GDPR)
If the processing of data is based on your consent, you are entitled to revoke your consent to the use of your personal data at any time in accordance with Art. 7 (3) GDPR. Please note that the revocation is only effective for the future. Processing that took place before the revocation is not affected.
Right of objection (Art. 21 GDPR)
If data is collected on the basis of Art. 6 (1) sentence 1 lit. f GDPR (data processing for the protection of legitimate interests) or on the basis of Art. 6 (1) sentence 1 lit. e GDPR (data processing for the protection of public interest or in the exercise of official authority), you have the right to object to the processing at any time for reasons arising from your particular situation. We will then no longer process the personal data unless there are demonstrably compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you are of the opinion that the processing of data concerning you violates data protection provisions. The right of complaint can be asserted in particular before a supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement.
Assertion of your rights
Unless otherwise described above, please contact the office mentioned in the imprint to assert your data subject rights.
VI. Contact details oft he data protection officer
Our external data protection officer will be happy to provide you with information on the subject of data protection under the following contact details:
datenschutz nord GmbH
Konsul-Smidt-Straße 88
28217 Bremen
Web: www.datenschutz-nord-gruppe.de
E-Mail: office@datenschutz-nord.de
If you contact our data protection officer, please also indicate the responsible office in the imprint.
Status of the data protection declaration: May 2023.
The further development of our company may also affect the scope with personal data. We therefore reserve the right to change this data protection declaration in the future within the framework of the applicable data protection laws and, if necessary, to adapt it to changed data processing realities. We will notify you separately of any significant changes to the content.