Information obligations pursuant to gem. Art.13 GDPR
The protection of personal data is of particular importance for us. We therefore only process your personal data (or short: “data”) based on legal provisions. This privacy notice is supposed to inform you in detail of how our company processes your data and what your entitlements and rights are under data protection law in terms of Art. 13 of the European General Data Protection Regulation (GDPR).
1. Who is the data controller and whom can you contact?
The data controller is
VRPE Team GmbH
Georg-Knorr-Straße 8
85662 Hohenbrunn
E-Mail: info@vrpe.de
Tel.: 08102/8967-0
The company data protection officer is
Matthias Haßler (LL.M.)
Projekt 29 GmbH & Co. KG
Ostengasse 14
93047 Regensburg
E-Mail: anfragen@projekt29.de
Tel.: 0941-2986930
2. What data is processed and what sources do they come from?
We process data that we have obtained from you during contract preparation and execution, based on consent or as part of your application or employment with us.
Personal data:
Your master/contact details; for customers these include, for example, first name and surname, address, contact details (e-mail address, phone number, fax), bank details.
For applicants and employees these include, for example, first name and surname, address, contact details (e-mail address, phone number, fax), date of birth, information from the CV and job references, bank details, religious affiliation, images.
For business partners these include, for example, the name of their legal representative, company name, commercial register number, VAT ID number, company number, address, contact partner and contact details (e-mail address, phone number, fax), bank details.
For visitors of our company, these include name and signature.
For journalists these include first name and surname, e-mail address, fax number.
Furthermore, we also process the following other personal data:
- information on type and content of contract data, order details, sales and receipt details, customer and supplier history and consultation documents;
- advertisement and sales data;
- information from your electronic communication with us (e.g. IP address, log in details);
- other data that we received as part of our business relationship (e.g. in customer meetings);
- data that we generate from master data / contact details, such as by way of customer requirements and customer potential analyses;
- photographic images during events.
3. For which purposes and on what legal basis are the data processed?
We process your data in accordance with the provisions of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (Bundesdatenschutzgesetz) 2018 as amended:
- to comply with pre-contractual obligations (Art 6(1) point b GDPR):
Your data are processed to complete a contract online or in one of our branches, to complete your contract for employment in our company. In particular, data are processed when initiating business and executing the contracts concluded with you.
- to comply with legal obligations (Art 6(1) point c GDPR):
Processing of your data is required for compliance with various legal obligations, for example under the Commercial Code or the Fiscal Code.
- to safeguard legitimate interests (Art 6(1) point f GDPR):
Based on a balancing of interests, data processing may exceed the mere execution of a contract in order to safeguard our legitimate interests or that of third parties. Data are processed to safeguard legitimate interest in the following cases, for example:
- advertisement or marketing (see no 4);
- business management measures and measures to develop services and products further;
- maintaining a company-wide customer database to improve customer service;
- for legal prosecution
- with your consent (Art 6(1) point a GDPR):
If you have granted us permission for processing your data, for example publication of photographs
4. Processing personal data for advertisement purposes
You may at any time object to the use of your personal data, either summarily or in individual cases, without incurring any costs other than transmission under base rates.
Pursuant to the legal provisions of section 7 clause 3 UWG (German Unfair Competition Act), we have the right to use the e-mail address you provide when concluding the contract to directly market own similar goods or services. You will receive these product recommendations from us irrespective of whether you have subscribed to a newsletter. If you do not want to receive any such recommendations from us by e-mail, you can object to this use of your e-mail address at any time without incurring any costs other than transmission under base rates. A notification in written form is sufficient. Naturally, each e-mail will also include an unsubscribe link.
5. Who receives my data?
If we do use a service provider in terms of contract processing, we still remain responsible for the protection of your personal data. Any and all contract processors are obliged by contract to treat your data as confidential and to only process these as part of their services. The service providers used by us will receive your data insofar as they require these to provide their respective service. These may be IT services providers whom we require for the operation and security of our IT system as well as advertisement and marketing publishers for own advertisement campaigns.
If legal obligations apply and as part of prosecution, public authorities and courts as well as external auditors may be recipients of your data.
Furthermore, insurances, banks, credit rating agencies, and service providers may be recipients of your data for contract initiation and execution purposes.
6. How long will my data be stored for?
We process your data until the business relationship has ended or until the end of statutory retention periods (such as under the Commercial Code, Fiscal Code, or Working Time Act); apart from that, until the end of any legal disputes in which the data are required as evidence.
7. Are personal data transmitted to a third country?
In principle, we do not transmit data to a third country. In individual cases, any transmission will be based on an adequacy decision of the European Commission, standard contractual clauses, suitable guarantees or your express consent.
8. What are my data protection rights?
You have at all times the right to access, rectification, erasure or restriction of processing of the data stored concerning you, a right to object to processing and a right to data portability and the right to lodge a complaint in accordance with the provisions of data protection law.
Right to access:
You can request information from us as to whether and to what extent we process your personal data.
Right to rectification:
If we process data of yours that are incomplete or incorrect, you can demand us to rectify or complete these at any time.
Right to erasure:
You can demand us to erase your data if we process these unlawfully or if processing interferes with your legitimate protection rights to a disproportionate degree. Please note that reasons may apply that prevent an immediate erasure, e.g. in case of statutory retention periods. Irrespective of your right to erasure being exercised, we will delete your data immediately and in their entirety insofar as no associated business-related or legal retention periods prevent such erasure.
Right to limitation of processing:
You may demand us to restrict the processing of your data if
- you contest the accuracy of the data, namely for a period allowing us to review accuracy of the data;
- processing of the data is unlawful, but if you object to erasure and request restriction of use thereof instead;
- we do no longer require the data for the intended purpose, but you require the data in order to assert or safeguard legal claims; or
- you have objected to processing of the data.
Right to data portability:
You may ask us to make your data that you provided to us available in a structured, standard and machine-readable format and that you may transmit such data to another data controller without interference from us, provided that
- we process such data based on a revocable consent granted by you or for the purpose of fulfilling a contract concluded between us; and
- such processing took place using automated means.
If feasible from a technical point of view, you may ask us to transmit your data directly to the other data controller.
Right to objection:
If we process your data based on a legitimate interest, you may object to such processing at any time; this would also apply to any profiling based on these provisions. We will then no longer process your data, unless we can prove compelling protectable reasons for processing that take precedence over your interests, rights, and freedoms of if the purpose of such processing is the assertion, exercising or defence of legal claims. You may object to the processing of your data for the purpose of direct marketing at any time without stating reasons.
Right to lodge a complaint:
If you are of the opinion that we are violating German or European data protection law when processing your data, please contact us in order to settle any questions. Of course, you also have the right to contact the supervisory authority, the respective Landesamt für Datenschutzaufsicht (Regional Office for Data Protection Supervision), with competence for you. If you would like to exercise one of the above rights towards us, please contact our data protection officer. In cases of doubt, we may request further information in order to confirm your identity.
9. Am I obliged to provide data?
It is necessary to process your data in order to conclude and/or execute the contract concluded with us. If you do not provide us with these data, we will usually have to refuse conclusion of the contract or we will no longer be able to execute an existing contract and will therefore have to cancel any such. You are not, however, obliged to grant consent for the processing of data that are not relevant and/or not legally required for completion of the contract.
