Information on the processing of customer/supplier data Information on the processing of customer/supplier data

1. General Information

The Erwin Hymer Group SE takes the protection of your personal data very seriously. Your privacy is important to us. We process your personal data in accordance with the applicable statutory data protection requirements for the following purposes. Personal data in the sense of this data protection information is all information that relates to you as an individual.

1.1 Controller of data processing

Erwin Hymer Group SE

Holzstraße 19

D-88339 Bad Waldsee

E-Mail: info@erwinhymergroup.com

Telefon: +49 7524 999-0

 

1.2 Data Protection Officer

We have appointed a Data Protection Officer. Our Data Protection Officer may be contacted at:

DDSK GmbH

– Dataprotectionofficer –

Dr.-Klein-Str. 29

D-88069 Tettnang

E-Mail: datenschutz@erwinhymergroup.com

 

2. Processing Framwork

2.1 Source of Data Collection 

We process personal data that we have collected directly from you.

Insofar, as this is necessary for the provision of our services, we process personal data that has been legitimately obtained from other companies or other third parties (e.g. credit agencies, address publishers).

2.2 Data Categories

Relevant categories of personal data may include, in particular:

  • Personal data (e. g. name, occupation/industry and similar data)
  • Contact data (address, e-mail address, telephone number and similar data)
  • Video and image recordings
  • Communication data (user details, content data, connection data as well as comparable data) within the scope of telephone conferences, video conferences and web meetings through the use of internet-based communication tools (hereinafter: web meetings)

2.3 Purposes and Legal Basis for processed Data

We process personal data in accordance with the provisions/regulations of the General Data Protection Regulation (GDPR), the Federal Data Protection Act of Germany (FDPA) and other applicable data protection regulations (details below). Which data are processed in detail and how they are used depends largely on the services requested or agreed/settled in each case. Further details or additions for the purposes of data processing can be found in the respective contractual documents, forms, a declaration of consent and/or other information provided to you (e.g in the context of the use of our website or our general terms and conditions).

2.3.1 Purposes for the Performance of a Contract or Pre-Contractual Measures (Art. 6 (1) b GDPR)

The processing of personal data takes place to fulfill our contracts with you and to carry out your orders as well as measures and activities within the framework of pre-contractual relationships, e. g. with interested parties. This essentially includes: contract-related communication with you, the corresponding billing and associated payment transactions, the traceability of orders and other agreements as well as quality control through appropriate documentation, measures to monitor and optimize business processes and to fulfill general duties of care, control and monitoring by affiliated companies; statistical evaluations for corporate control, cost recording and controlling, reporting, internal and external communication, emergency management, accounting and tax assessment of operational services, risk management, assertion of legal claims and defence in the event of a legal dispute; guarantee of IT security (e.g. system or plausibility tests) and general security, securing and exercising the right of admission (e.g. through access controls); guarantee of integrity, authenticity and availability of data, prevention and investigation of criminal offences and monitoring by supervisory bodies or control bodies (e.g. audit).

2.3.2 Purposes Within the Scope of a Legitimate Interest of Us or Third Parties (Art. 6 (1) f) GDPR)

Beyond the actual performance/fulfilment of the contract or preliminary contract, we process your data to pursue our own legitimate interests or those of a third party, in particular for purposes of

  • the evaluation of a group-wide deployment of service providers and suppliers and the associated communication with the contact persons provided by you
  • the further development of services and products as well as existing systems and processes
  • the assertion of legal claims and defence in legal disputes which are not directly attributable to the contractual relationship
  • the limited storage of data, if deletion is not possible or only possible with a disproportionate amount of effort due to the special nature of the storage
  • the prevention and investigation of criminal offences, if not exclusively for the fulfilment of legal requirements
  • building and system security (e. g. through access controls), if this goes beyond the general duty of care
  • internal and external investigations as well as security checks
  • the preservation and maintenance of certifications of a private law or official nature
  • securing and exercising the right of admission through appropriate measures (such as video surveillance) and to secure evidence of criminal offences and to prevent such
  • the effective and resource-saving conduct of web meetings through the use of Internet-based communication tools.
2.3.3 Purposes in the Context of Your Consent (Art. 6 (1) a) GDPR)

Your personal data may also be processed for certain purposes with your consent (e. g. use of your e-mail address for marketing purposes, recording of web meetings). Regularly, you can withdraw this consent at any time. You will be informed separately of the purpose and consequences of your withdrawal or non-issuance of consent in the corresponding consent text. The withdrawal of consent is generally only effective for the future. Processing that took place before the withdrawal, is not affected, and remains lawful.

2.3.4 Purposes for the Fulfillment of Legal Requirements (Art. 6 (1) c) GDPR) or in the Public Interest (Art. 6 (1) e) GDPR)

Like everyone who participates in economic activities, we’ re also subject to a large number of legal obligations/regulations. These are primarily statutory requirements (e. g. commercial and tax laws), but also, regulatory or other official requirements.  The purposes of the processing may include the fulfilment of fiscal control and reporting obligations, the archiving of data for the purposes of data protection and data security, and the examination by fiscal and other authorities. Furthermore, the disclosure of personal data within the framework of official/judicial measures may become necessary for the purpose of collecting evidence, criminal prosecution or enforcement of civil law claims.

2.4 Automated Individual Decision-Making (Including Profiling) (Art. 22 GDPR)

We do not use sole automated decision-making procedures. Nevertheless, if we should use such a procedure in individual cases in the future, we will inform you separately, if this is prescribed by law.

2.5 Consequences of failure to provide data

In the context of the business relationship, you must provide the necessary personal data for the establishment, execution and termination of the legal transaction and the fulfilment of the associated contractual obligations or which we are legally obliged to collect. Without this data, we will not be able to execute the legal transaction with you.

3. Recipients of Data

3.1 Within the EU/the EAA

Within our institution, the internal departments or organisational units that receive your data are those which require these to fulfil our contractual and legal obligations or within the context of the processing and execution of our legitimate interest. In the case of central enquiries to us regarding cooperation, data of the contact person provided to us may also be forwarded within our group.

Your data will only be passed on to external bodies 

  • in connection with the execution of the contract
  • for the purpose of fulfilling legal requirements according to which we are obliged to provide information, to report or pass on data, or the passing on of data is in the public interest (see Section 2.3.4)
  • if external service providers process data on our behalf as processors or function providers (e.g. data centres, support / maintenance of EDP/IT applications, archiving, document processing, call centre services, compliance services, controlling, data validation or plausibility checks, data destruction, purchasing / procurement, customer administration, letter shops, marketing, research, risk controlling, billing, telephony, website management, auditing services, credit institutes, print shops or companies for data disposal, courier services, logistics)
  • on the basis of our legitimate interest or the legitimate interest of the third party for the purposes mentioned (e. g. to authorities, credit agencies, debt collectors, lawyers, courts, experts, subsidiaries and bodies and control bodies)
  • if you have given us your consent for transmission to third parties

In addition, we will not share your data with third parties. If we commission service providers as part of the order processing, your data there are subject to the same security standards. Recipients may only use the data for the purposes for which they were provided to them.

3.2 Outside the EU/the EAA

Data is transferred to bodies in countries outside the European Union (EU) or the European Economic Area (EEA) (so-called third countries).

3.3 Overview recipients

In the course of data processing, your data will be transferred to the following recipients:

Recipient: Microsoft One Microsoft Way, Redmond, WA 98052-6399, USA

Transfer to third countries:There is an adequacy decision for the transfer.

 

Recipient:SAP Deutschland SE & Co. KG, Hasso-Plattner-Ring 7, 69190 Walldorf, Germany

Transfer to third countries: Ein Drittstaattransfer findet nicht statt.

 

Recipient: Meltwater Deutschland GmbH, Jannowitz Centre, Brückenstrasse 6, 10179 Berlin, Germany

Transfer to third countries: No data transfer to a third country.

 

Recipient: Hymer GmbH & Co. KG, Holzstr. 19, 88339 Bad Waldsee, Germany

Transfer to third countries: No data transfer to a third country.

 

Recipient: Atlassian Pty Ltd, Level 6, 341 George Street, Sydney NSW 2000, Australia

Transfer to third countries: The transfer is based on Art. 46/47/ 49 (1) GDPR. The appropriate safeguards can be viewed here.

4. Storage Periods

We process and store your data for the duration of our business relationship. This also includes the initiation of a contract (pre-contractual legal relationship) and the execution of a contract.

In addition, we are subject to various storage and documentation obligations pursuant to, inter alia, the German Commercial Code (HGB) and the German Tax Code (AO). The deadlines for storage and / or documentation specified therein are up to ten years beyond the end of the business relationship or the pre-contractual legal relationship to the end of the calendar year.

Furthermore, special legal regulations may require a longer storage period, e. g. the preservation of evidence within the framework of the legal statute of limitations. Pursuant to Paragraph 195 et seq. of the German Civil Code (BGB), the regular limitation period is three years, but limitation periods of up to 30 years may also apply.

If the data is no longer required for the fulfilment of contractual or legal obligations and rights, they are deleted on a regular basis, unless their – limited – further processing is necessary to fulfil the purposes for a higher legitimate interest. Such an overriding legitimate interest also exists, for example, if erasure is not or only possible with a disproportionate amount of effort due to the special nature of the storage, and processing for other purposes by suitable technical and organizational measures is excluded.

5. Your rights

Under certain conditions, you can assert your data protection rights against us.

  • You have the right to receive information from us about your data stored by us pursuant to the rules of Art. 15 GDPR (possibly with restrictions pursuant to Section 34 Federal Data Protection Act of Germany (FDPA))
  • If you so request, we will correct the data stored about you pursuant to Art. 16 GDPR if they are inaccurate or incorrect.
  • If you so desire, we will erase your data pursuant to the principles of Art. 17 GDPR, provided that other legal regulations (e. g. legal storage obligations or the restrictions pursuant to Section 35 Federal Data Protection Act of Germany (FDPA)) or an overriding interest on our part (e. g. to defend our rights and claims) do not oppose this.
  • You may ask us to restrict the processing of your data, taking into account the requirements of Art. 18 GDPR.
  • Furthermore, you may object to the processing of your data pursuant to Art. 21 GDPR, which requires us to stop processing your data. However, this right to object only applies in the event of very special circumstances regarding your personal situation, whereby our company’s rights may conflict with your right to object.
  • You also have the right to receive your data in a structured, common and machine-readable format under the conditions of Art. 20 GDPR or to transmit them to a third party.
  • In addition, you have the right to withdraw the consent to the processing of personal data you granted at any time with future effect (see Section 2.3).
  • You also have a right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).  
  • If possible, your applications for the exercising of your rights should be addressed in writing or by e-mail to the above address or directly in writing or by e-mail to our Dataprotectionofficer
  • The data protection supervisory authority responsible for us is:
    • Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
    • Postbox 10 29 32, D-70025 Stuttgart
    • Phone: +49 (0) 711 6155410
    • Fax: +49 (0) 711 61554115
    • poststelle@lfdi.bwl.de

 

Ich bin ein Tooltip.