Information on data protection about our processing of customer and supplier data according to articles 13, 14 and 21 of the General Data Protection Regulation (GDPR)

According to the guidelines in articles 13, 14 and 21 of the general data protection regulation (GDPR) we hereby inform  you about the processing of your personal data as our business partner and the rights granted to you. The kind of data and the way of data processing depends largely on the services requested or agreed upon. In order to ensure complete information about the processing of your personal data within the framework of fulfilment of a contract or the implementation of pre-contractual measures please take note of the following information.

1. RESPONSIBLE AUTHORITY IN THE SENSE OF DATA PROTECTION LAW

Glienke-Hemmerlein Metall GmbH
Heilbronner Straße 93
D-74348 Lauffen a.N.

Phone: +49 7133 97479-0
Fax:       +49 7133 97479-10
Email: info@gh-metall.de

2. CONTACT DETAILS OF THE DATA PROTECTION OFFICER

Andreas Hemmerlein
E-Mail:  andreas.hemmerlein@gh-metall.de

3. PURPOSES AND LEGAL BASIS OF THE PROCESSING

We process your personal data which we have legitimately received from our customers or suppliers or other third parties for the purpose of contract initiation or in the course of our business relationship or which we have obtained from publicly accessible sources (e.g. commercial register, credit agencies, internet) and are permitted to process such as name, address, telephone, fax, e-mail, tax ID, etc. in accordance with the provisions of the European Data Protection Basic Regulation (EU-GDPR) and the German Federal Data Protection Act (BDSG), insofar as these are necessary for the establishment, execution and performance of the contract and for the implementation of pre-contractual measures which are carried out at the request of the customers or suppliers. Insofar as the provision of personal data is necessary for the initiation or execution of a contractual relationship or in the context of the implementation of pre-contractual measures, processing is lawful under Art. 6 para. 1 lit. b GDPR. The purposes of the processing depend in detail on the contractual services and the respective contractual documents and include the analysis of requirements, consulting and order processing including the preparation of offers, delivery notes and invoices

On the basis of your consent to process personal data for specific purposes (e.g. transfer to third parties, evaluation for marketing purposes or advertising), the lawfulness of this processing is based on your consent in accordance with Art. 6 para. 1 lit. A GDPR. A granted consent can be revoked at any time, with effect for the future (see paragraph 11 of this data protection information), without affecting the legality of the processing carried out on the basis of the consent until revocation. If necessary and legally permissible, we process your data beyond the actual contractual purposes in order to fulfil legal obligations in accordance with Art. 6 para. 1 lit. C DSGVO. If necessary, we will inform you separately, stating the legitimate interest, insofar as this is required by law.

4. CATEGORIES OF PERSONAL DATA

We only process such data that are connected with the contract foundation or the pre-contractual measures. This can be general data about your person or persons of your company (name, address, contact data, etc.) as well as, if applicable, other data that you provide us within the context of the establishment of the contract.

5. SOURCES OF THE DATA

We process personal data which we receive from you within the scope of establishing contact or a contractual relationship or within the scope of pre-contractual measures.

6. RECIPIENT OF THE DATA

Within our company, we only pass on your personal data to those areas and persons who need this data to fulfil contractual and legal obligations or to implement our legitimate interests.

Affiliated companies, service providers, contract processors and vicarious agents and other third parties employed by us in particular to provide services may also receive data for the aforementioned purposes in accordance with the provisions of the GDPR. These are e.g. companies in the categories of IT service providers, accounting services, telecommunications, logistics, debt collection, public bodies/institutions (e.g. finance + customs authorities, law enforcement agencies, courts) if there is a legal or official obligation, insolvency administrators in the course of insolvency proceedings, insurance companies, auditors, tax consultants, lawyers.

7. TRANSMISSION OF DATA TO A THIRD COUNTRY

A transfer of data to countries outside the EU or the EEA (the so-called third countries) is not intended.

Personal data will only be transferred to countries outside the EEA (European Economic Area) or to an international organization if this is necessary for the processing and thus the fulfilment of the contract or, at your request, for the implementation of pre-contractual measures, if the transfer is required by law or if you have given us your consent. However, the transfer will only take place if an adequate level of data protection has been confirmed to the third country by the EU Commission, if other adequate data protection guarantees (such as standard contractual clauses) are in place or if an exception in the sense of Art. 49 GDPR exists.

8. DURATION OF DATA STORAGE

Where necessary, we process and store your personal data for the duration of our business relationship or for the fulfilment of contractual purposes. This also includes the initiation and processing of a contract.

In addition, we are subject to various legal obligations for the storage and documentation of data, in particular with regard to commercial and tax retention periods (up to 10 years), which make the retention of data necessary for the assertion, exercise or defense of legal claims within the scope of the applicable statute of limitations (up to 30 years) or if there is a justified interest of the person responsible.

9. NECESSITY OF THE RETENTION OF PERSONAL DATA

The provision of personal data for the purpose of establishing, implementing or fulfilling contracts or for the performance of pre-contractual measures is generally neither required by law nor by contract. You are therefore not obliged to provide information on personal data. Please note, however, that these are usually necessary for the decision on the conclusion of a contract, the performance of a contract or for pre-contractual measures. If you do not provide us with personal data, we may not be able to make a decision within the scope of contractual measures. We recommend that you always only provide personal data that is necessary for the conclusion of the contract, the fulfilment of the contract or pre-contractual measures.

10. AUTOMATED DECISION MAKING

We do not use purely automated processing to make decision in regard of establishing, fulfilling or implementing business relationship or for pre-contractual measures.

11. YOUR RIGHTS

You have the right of access to information in accordance with Art. 15 GDPR, the right to rectification in accordance with Art. 16 GDPR, the right to erasure in accordance with Art. 17 GDPR, the right to restrict processing in accordance with Art. 18 GDPR, the right to notification in accordance with Art. 19 GDPR, the right of objection to the processing in accordance with Art. 21 GDPR,  and the right to data transferability in accordance with Art. 20 GDPR.

The right of information and the right of deletion are subject to the restrictions of §§ 34, 35 BDSG. To assert your rights, please contact the data protection officer mentioned above.

If the processing of personal data is based on your consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of the processing carried out on the basis of the consent until the withdrawal.

In addition, there is the option to lodge a complaint with the above mentioned data protection officer or a data protection supervisory authority according to Art. 77 GDPR.

****************************************************************************

RIGHT OF OBJECTION

If the processing of your personal data acc. to Art. 6, para. 1, lit. f) GDPR is carried out to protect legitimate interests, you have the right, acc. to Art. 21 GDPR to object at any time, for reasons arising from your particular situation, to the processing of data relating to you which is based on Art. 6, para. 1, lit. E or lit. F GDPR. We then no longer process this personal data unless we can prove compelling reasons for processing worthy of protection that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

If personal data are processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data relating to you for the purpose of such marketing. If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes.

The respective objection can be addressed to the above-mentioned data protection officer in any form