General data protection information for data subjects

in accordance with Art. 13, 14 GDPR (General Data Protection Regulation)

Table of contents

1. General information
2. For applicants
3. For customers and interested parties
4. For suppliers and service providers
5. For (advertising) partner companies

Transparent handling with regard to the processing of personal data is very important to us. With the following general data protection information, we would like to inform you about how we handle your personal data in detail. For reasons of better readability, the language form of the generic masculine is used. It should be noted at this point that the exclusive use of the masculine form should be understood to be gender-independent.

We inform you about the processing of your personal data when using our website in our Privacy Policy page available there.

1. General information

- valid for all the following descriptions of data processing

1. name and contact details of the controller

The controller responsible for the processing of your personal data in the context of this contact is

TOPREGAL GmbH
Industriestr. 3
70794 Filderstadt
07158-9181-500
[email protected]
www.topregal.com

2. contact details of the data protection officer

You can reach our data protection officer as follows

DataCo GmbH
attn. TOPREGAL Data Protection Officer
Nymphenburger Str. 8
80636 Munich (Germany)
E-mail: [email protected]

3. rights of data subjects

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller

I. Right to information (Art. 15 GDPR)

If your personal data is processed, you have the right to obtain information from the controller about the personal data stored about you (Art. 15 GDPR). You can request confirmation from the controller as to whether personal data concerning you is being processed by the controller.

If such processing is taking place, you can request the following information from the controller

The purposes for which the personal data are processed;

• the categories of personal data being processed
• the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed
• the planned duration of the storage of your personal data or, if specific information on this is not possible, criteria for determining the storage period
• the existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the controller or a right to object to such processing
• the existence of a right to lodge a complaint with a supervisory authority
• all available information about the origin of the data if the personal data is not collected from the data subject
• the existence of automated decision-making, including profiling, referred to in Art. 22 (1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

II. Right to rectification (Art. 16 GDPR)

You have a right to rectification and/or completion vis-à-vis the controller if the processed personal data concerning you is incorrect or incomplete. The controller must carry out the rectification without undue delay.

III. Right to erasure (Art. 17 and 18 GDPR)

a) Obligation to erase 

You have the right to obtain from the controller the erasure of personal data concerning you without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies

• The personal data concerning you are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
• You revoke your consent on which the processing was based pursuant to Art. 6 para. 1, sentence 1 lit. a or Art. 9 para. 2 lit. a GDPR and there is no other legal basis for the processing.
• You object to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 para. 2 GDPR.
• Art. 21 para. 2 GDPR objection to the processing.
• The personal data concerning you has been processed unlawfully.
• The deletion of personal data concerning you is necessary to fulfill a legal obligation under Union law or the law of the Member States to which the controller is subject.
• The personal data concerning you have been collected in relation to the offer of information society services referred to in Art. 8 (1) GDPR.

b) Information to third parties 

Where the controller has made the personal data concerning you public and is obliged pursuant to Art. 17 (1) GDPR to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you as the data subject have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

c) Exceptions

The right to erasure does not apply if the processing is necessary

• to exercise the right to freedom of expression and information
• for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
• for reasons of public interest in the area of public health pursuant to Art. 9 (2) (h) and (i) and Art. 9 (3) GDPR
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 para. 1 GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
• for the establishment, exercise or defense of legal claims.

IV. Right to information (Art. 19 GDPR)

If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort. You have the right to be informed about these recipients by the controller (right to information, Art. 19 GDPR).

V. Right to data portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to which the personal data has been provided, where

• the processing is based on consent pursuant to Art. 6 para. 1, sentence 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract pursuant to Art. 6 para. 1, sentence 1 lit. b GDPR and
• the processing is carried out by automated means.

In exercising this right, you also have the right to obtain that the personal data concerning you be transferred directly from one controller to another controller, insofar as this is technically feasible. The freedoms and rights of other persons must not be affected by this. The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

If personal data is processed by us as the controller, you as the data subject have certain rights under Chapter III of the EU General Data Protection Regulation (GDPR), depending on the legal basis and purpose of the processing, in particular the right of access (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), the right to erasure (Art. 17 GDPR), the right to restriction of processing (Art. 18 GDPR), the right to data portability (Art. 20 GDPR) and the right to object (Art. 21 GDPR). If the processing of personal data is based on your consent, you have the right to withdraw this data protection consent in accordance with Art. 7 III GDPR. To assert your rights as a data subject in relation to the data processed in this online application process, please contact our data protection officer (see section 2).

VI. Right to object to processing (Art. 21 (1) GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions. The controller will no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims (Art. 21 (1) GDPR).

VII. Right to restriction of processing

Under the following conditions, you may request the restriction of the processing of personal data concerning you

• if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;
• the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead
• the controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims, or
• if you have objected to processing pursuant to Art. 21 (1) GDPR pending the verification whether the legitimate grounds of the controller override your grounds.

If the processing of personal data concerning you has been restricted, this data - apart from its storage - may only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

VIII. Right to object to direct marketing (Art. 21 para. 2 GDPR)

If the personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing (Art. 21 (2) GDPR). If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes

IX. Right to withdraw consent (Art. 7 para. 3 GDPR)

You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal (Art. 7 (3) GDPR).

X. Automated decisions in individual cases including profiling (Art. 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision is necessary for the conclusion or performance of a contract between you and the controller,

• is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
• with your express consent.

However, these decisions may not be based on special categories of personal data pursuant to Art. 9 para. 1 GDPR, unless Art. 9 para. 2 lit. a or b GDPR applies and appropriate measures have been taken to protect the rights and freedoms as well as your legitimate interests.

With regard to the cases referred to in 1. and 3. above, the controller shall take reasonable measures to safeguard the rights and freedoms and your legitimate interests, including at least the right to obtain the intervention of a person by the controller, to express his or her point of view and to contest the decision.

XI. Right to lodge a complaint (Art. 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data relating to you infringes the GDPR (Art. 77 GDPR). The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

2. For applicants

1. general information

We provide you with this privacy policy, which relates exclusively to the data collected as part of the online application process, to inform you about how we handle your personal data collected as part of the application process.

2. responsible body

See section "General information" under "1. name and contact details of the controller"

3. contact details of the data protection officer

See section "General information" there "2. Contact details of the data protection officer"

4. personal data in the context of the application process

Personal data is information about the personal or material circumstances of an identified or identifiable natural person. This includes information such as your name, your address, your telephone number and your date of birth, but also data about your specific career, etc., which can be assigned to a specific person with reasonable effort. However, information that is not (in)directly associated with your real identity is not personal data.

5. Principles and purposes of processing personal data for applications and in the application process

If you apply to us electronically, i.e. by e-mail, we will collect and process your personal data for the purpose of processing your application.

By submitting an application on our recruiting page, you express your interest in taking up employment with us. In this context, you provide us with personal data that we use and store exclusively for the purpose of your job search/application.

In particular, the following data will be collected

• Name (first name and surname)
• e-mail address
• Telephone/mobile phone number
• Channel, how you became aware of us

You also have the option of uploading informative documents such as a cover letter, your CV and references. These may contain further personal data such as date of birth, title, address, details of education and schooling, certificates, etc.

We only pass on your personal data within our company to those areas and persons who need this data to fulfill contractual and legal obligations or to implement our legitimate interest.

Personal data is stored exclusively for the purpose of filling the vacant position for which you have applied.

6. Legal basis for data processing

We process your personal data in accordance with the provisions of the European General Data Protection Regulation (EU GDPR) and the German Federal Data Protection Act (BDSG), insofar as this is necessary for the decision on the establishment of an employment relationship with us.

The legal basis for the processing of your data is the initiation of a contract at the request of the data subject, Art. 6 para. 1, sentence 1 lit. b Alt. 1 GDPR and § 26 para. 1 sentence 1 BDSG.

7. duration of storage

Your data will be stored for a period of up to six months after the end of the application process. This is usually done to fulfill legal obligations or to defend against any claims arising from legal regulations. We are then obliged to delete or anonymize your data. In this case, the data will only be available to us as so-called metadata without direct personal reference for statistical evaluations (e.g. proportion of women or men in applications, number of applications per period, etc.).

If you receive an offer of employment with us during the application process and accept it, we will store the personal data collected during the application process for at least the duration of the employment relationship.

8. inclusion in our talent pool through consent

Following the application process, you may receive an invitation to join our talent pool. This allows us to consider you for suitable vacancies in our applicant selection process in the future. If we have your consent to do so, we will store your application data in our talent pool in accordance with your consent or any future consents.

You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

9. Disclosure of data to third parties and transfer to a third country

The data transmitted as part of your application will be transferred using TLS encryption and stored in a database. This database is operated by Personio SE & Co. KG, which offers personnel administration and applicant management software (www.personio.de/impressum). In this context, Personio is our processor in accordance with Art. 28 GDPR. The basis for the processing is an order processing contract between us as the controller and Personio.

A transfer to a third country is not intended.

10. possibility of objection and removal

As the applicant, you have the option to object to the processing of your personal data at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. You can send your objection by email to our data protection officer ([email protected]). In such a case, the application can no longer be considered.

All personal data stored in the course of electronic applications will be deleted in this case, unless there are demonstrably compelling legitimate grounds for processing on our part. If such compelling interests worthy of protection exist, these must outweigh your interests, rights and freedoms or the processing must serve the assertion, exercise or defense of legal claims (e.g. under the AGG).

11. rights of data subjects

See section "General information" there "3. rights of data subjects"

12. necessity of the provision of personal data

The provision of personal data in the context of application processes is neither legally nor contractually required. You are therefore not obliged to provide your personal data. However, please note that this is necessary for the decision on an application or the conclusion of a contract in relation to an employment relationship with us. If you do not provide us with any personal data, we cannot make a decision on the establishment of an employment relationship. We recommend that you only provide the personal data that is required to complete your application.

13. Automated decision-making

Since the decision on your application is not based exclusively on automated processing, no automated decision is made in individual cases within the meaning of Art. 22 GDPR.

3. For customers and interested parties

1. processing of your personal data

I. Your personal data that is processed by us

As part of the existing customer relationship and contract initiation, we process the following personal data about you

• First name
• Surname
• Salutation
• Company name
• Business address
• Bank details
• Tax ID
• Customer number
• Your e-mail address
• Your telephone number
• All personal data provided to us in the course of customer communication
• Creditworthiness data

TOPREGAL collects data from interested persons and customers in the following ways:

• Inquiries via the contact form on the TOPREGAL GmbH website
• Inquiries by message to TOPREGAL employees, e.g. by email, online chat, LinkedIn messages or other communication channels
• Conclusion of purchase in the online store

II. Purposes of the data processing

Your personal data will be processed for the following purposes as part of the existing customer relationship and contract initiation:

• To process your inquiry as an interested party. For this purpose, we use your contact details in order to be able to respond to your inquiry.
• To prepare and carry out pre-contractual measures - this includes, for example, the preparation and sending of an individual offer or individual agreement of services, such as testing, installation, etc.
• To add your contact details to our customer and contact database.
• Making contact (e-mail, telephone)
• Customer administration and customer care - in particular the processing of customer enquiries
• To provide you with the best possible information about our products and services. This also includes sending (direct) advertising by e-mail.
• To provide you, our customer, with the best possible service. In particular, this includes communicating with you by e-mail, telephone including messenger services or fax.
• To ensure smooth billing. For this purpose, your personal data is processed in order to be able to issue invoices. In addition, we forward your personal data to our external service providers:
  • ALBIS Leasing Group (Ifflandstraße 4, 22087 Hamburg),
  • Credireform Stuttgart Strahler KG (Königstraße 42, 70173 Stuttgart) or
  • Creditsafe Deutschland GmbH (Schreiberhauer Str. 30, 10317 Berlin)
• for the purpose of debt collection if the invoices are not paid within the payment period.
• To comply with our legal obligations. This includes, for example, the transmission of your personal data to the tax office.
• For the purpose of carrying out marketing initiatives such as: Newsletter dispatch, mailings, etc.
• For the fulfillment of post-contractual measures.
• For the assertion, exercise or defense of legal claims.
• For the purpose of carrying out credit checks
• To ascertain your satisfaction with our products and services. For this purpose, your personal data in connection with a product purchase will be passed on to our external service provider Trusted Shops AG, Colonius Carré, Subbelrather Straße 15c, 50823 Cologne, Germany for the purpose of the voluntary evaluation request of the shopping service and the purchased products.

III. Legal basis for data processing

Processing of your personal data on the basis of consent 

Insofar as we obtain your consent for the processing of your personal data, the processing of your personal data is carried out on the basis of Art. 6 para. 1, sentence 1 lit. a GDPR i. in conjunction with Art. 5, 7 GDPR.

Processing for the purpose of performing the contract with you

Insofar as we process your personal data for the purpose of fulfilling the contract, Art. 6 para. 1, sentence 1 lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary for the performance of pre- and post-contractual measures.

Processing for the fulfillment of a legal obligation 

Insofar as the processing of your personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 para. 1, sentence 1 lit. c GDPR serves as the legal basis. Our legal obligation to process data arises, for example, from retention obligations under tax and/or commercial law.

Processing on the basis of legitimate interest 

The legal basis for the purpose of direct advertising can be Art. 6 para. 1, sentence 1 lit. f GDPR if our legitimate interests are present, unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, prevail. The legitimate interests pursued by us in this regard - in addition to the purposes listed under 1.2 - include

• To be able to inform you optimally about our products, offers and services by means of direct marketing;
• In communicating with you, in particular to be able to answer your inquiries by email, telephone and/or fax;
• We carry out credit checks on business customers who wish to purchase "on account". Our legitimate interest lies in the avoidance of payment defaults.
• To obtain customer feedback to improve the customer experience, improve our products and services

The legal basis for processing activities in connection with the assertion, exercise or defense of legal claims is also our legitimate interest pursuant to Art. 6 para. 1, sentence 1 lit. f GDPR.

2. recipients or categories of recipients of the personal data

As part of the processing of your personal data, we may disclose your personal data to the following recipients. We only transfer your personal data to external recipients if you have given your consent or if this is permitted by law.

External recipients of your personal data are in particular

• Installation & customer service partner companies
• Processors
• Authorities e.g. tax offices, courts, trade supervisory office, data protection supervisory authorities, Federal Office of Economics and Export Control (BAFA)
• Billing partners
• Debt collection companies
• Credit institutions
• Parcel service providers
• Forwarding companies
• Post Office
• Lawyer, tax consultant
• Auditors
• Associated companies

In order to offer you more payment methods and to simplify payments for you, we use the following payment processing service providers:

• Mollie B.V. Headquarters: Keizersgracht 126, 1015 CW Amsterdam, The Netherlands
  You can find more information about the processing of your personal data by Mollie here: https://www.mollie.com/de/privacy
• Mondu GmbH Alexanderstraße 36, 10179 Berlin
  Further information about the processing of your personal data by Mondu can be found here: https://www.mondu.ai/de/gdpr-notification-for-buyers/
• ALBIS Leasing Group, Ifflandstraße 4, 22087 Hamburg
  Further information on the processing of your personal data by Albis can be found here: https://www.albis-leasing.de/datenschutz

Your personal data will be transmitted to the following service providers

• OXID eSales AG, Bertoldstraße 48, 79098 Freiburg, Germany
• Userlike UG, Probsteigasse 44-46, 50670 Cologne
• Odoo SA, Stromstraße 18, 10551 Berlin, Germany
• Google Ireland Ltd, Gordon House, Barrow Street, D04 E5W5, Dublin, Ireland
• Mouseflow ApS, Flaesketorvet 68, 1711 Copenhagen, Denmark
• Trusted Shops GmbH, Subbelrather Str. 15C, 50823 Cologne, Germany

TOPREGAL uses the Office 365 service, including Microsoft Teams, for the purpose of business communication with customers and interested parties.

In addition, your personal data may be transmitted to the following service providers (or exclusion cannot be guaranteed), which are based in a country outside the EU/EEA (European Economic Area):

• Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
• Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA
• Cloudflare, Inc, 101 Townsend St, San Francisco, CA 94107, USA

In order to make the transfer to third countries as data protection-friendly as possible, standard contractual clauses have been concluded with providers in unsafe third countries in accordance with Art. 46 para. 2 lit. c GDPR. A copy of the standard contractual clauses can be requested by sending an informal email to [email protected].

3. duration of the storage of personal data

We do not store your personal data for longer than is necessary for the purpose for which it was collected. This means that data is destroyed or deleted from our systems as soon as it is no longer required. We take appropriate measures to ensure that your personal data is only processed under the following conditions:

• For the duration that the data is used to provide you with a service
• As required by applicable law, contract or with regard to our legal obligations
• Only for as long as necessary for the purpose for which the data was collected or longer if required by contract, applicable law, using appropriate safeguards.
• A requirement may exist in particular if the data is still needed to fulfill contractual services, to check and grant or defend against warranty and, if applicable, guarantee claims. If the data is no longer required for the fulfillment of contractual or legal obligations, it is regularly deleted, unless its - temporary - retention is still necessary, in particular to fulfill legal retention periods of up to ten years (e.g. from the German Commercial Code, the German Fiscal Code and the German Money Laundering Act). In the case of statutory retention obligations, deletion will only be considered after expiry of the respective retention obligation.

4. obligation to provide the data

For a (planned) conclusion and execution of the contract with you, you must provide the personal data that is necessary for the establishment and execution of the contractual relationship and the fulfillment of the associated contractual obligations or that we are legally obliged to collect (see in particular the standards listed under "3.3."). This obligation also arises from the law, e.g. § 14 UstG. Without this data, we will generally not be able to conclude and execute the contract with you.

4. For suppliers and service providers

1. processing of your personal data

I. Your personal data that is processed by us

TOPREGAL processes personal data of suppliers and service providers. This is necessary for business operations. The following data is processed:

• First name
• Surname
• Business address
• Company name
• Bank details
• Your e-mail address
• Your mobile phone number
• Your landline number
• Your fax number
• Title and academic degrees
• Position in the company

All personal data provided to us in the course of communication

TOPREGAL collects personal data in the following ways:

• Obtaining personal data directly from the data subject by contacting suppliers / service providers
• Receipt of personal data directly from the data subject through contact by TOPREGAL
• Research in business directories or websites

II. Purposes of data processing

We process your data for the following purposes:

• Initiation, execution and termination of a contractual relationship
• Execution of orders
• Examination and optimization of procedures for needs analysis
• Consultation of and data exchange with credit agencies to determine creditworthiness and default risks
• Market and opinion research, provided you have not objected to the use of this data for these purposes
• Assertion, exercise or defense of legal claims
• Measures for business management and further development of our products

III. Legal basis for data processing

Processing of your personal data on the basis of consent 

Insofar as we obtain your consent for the processing of your personal data, the processing of your personal data is carried out on the basis of Art. 6 para. 1, sentence 1 lit. a GDPR i. in conjunction with Art. 5, 7 GDPR.

Processing for the purpose of performing the contract with you 

Insofar as we process your personal data for the purpose of fulfilling the contract, Art. 6 para. 1, sentence 1 lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary for the performance of pre- and post-contractual measures.

Processing for the fulfillment of a legal obligation 

Insofar as the processing of your personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 para. 1, sentence 1 lit. c GDPR serves as the legal basis. Our legal obligation to process data arises, for example, from retention obligations under tax and/or commercial law.

Processing on the basis of legitimate interest 

The legal basis for direct marketing purposes can be Art. 6 para. 1, sentence 1 lit. f GDPR if our legitimate interests exist, unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, prevail. The legitimate interests pursued by us in this regard - in addition to the purposes listed under b. - include

• To be able to inform you optimally about our products, offers and services by means of direct marketing;
• In communicating with you, in particular to be able to answer your inquiries by email or telephone;

The legal basis for processing activities in connection with the assertion, exercise or defense of legal claims is also our legitimate interest pursuant to Art. 6 para. 1, sentence 1 lit. f GDPR.

2. recipients or categories of recipients of the personal data and transfer to third countries

As part of the processing of your personal data, we may pass on your personal data to the following recipients. We only transfer your personal data to external recipients if you have given your consent or if this is permitted by law.

External recipients of your personal data are in particular

• Freelancers
• Processors
• Authorities e.g. tax offices, courts, trade supervisory office
• Billing partners
• Credit institutions
• Parcel service providers
• Post office
• Lawyer, tax consultant
• Auditor
• Associated companies

We use the Microsoft 365 service, including Microsoft Teams from the service provider Microsoft Operations Ltd. in Dublin, Ireland, for the transmission of emails and storage of contacts from suppliers and service providers. Further information on data processing by Microsoft can be found at: https://privacy.microsoft.com/de-de/privacystatement

3. duration of the storage of personal data

We do not store your personal data for longer than is necessary for the purpose for which it was collected. This means that data is destroyed or deleted from our systems as soon as it is no longer required. We will take reasonable steps to ensure that your personal data is only processed under the following conditions:

• As required by applicable law, contract or in light of our legal obligations
• Only for as long as necessary for the purpose for which the data was collected or longer if required by contract, applicable law, using appropriate safeguards.

A requirement may exist in particular if the data is still needed to fulfill contractual services, to check and grant or defend against warranty and guarantee claims. If the data is no longer required for the fulfillment of contractual or legal obligations, it is regularly deleted, unless its - temporary - retention is still necessary, in particular to fulfill legal retention periods of up to ten years (e.g. from the German Commercial Code, the German Fiscal Code and the German Money Laundering Act). In the case of statutory retention obligations, deletion will only be considered after expiry of the respective retention obligation.

4. obligation to provide the data

For a (planned) conclusion and execution of the contract with you, you must provide the personal data that is necessary for the establishment and execution of the contractual relationship and the fulfillment of the associated contractual obligations or that we are legally obliged to collect (see in particular the standards listed under "III.3."). Without this data, we will generally not be able to conclude and execute the contract with you.

5. For (advertising) partner companies

In addition, your personal data may be transmitted to the following service providers as part of the publication of film and video recordings for marketing purposes, provided you have given your consent:

• LinkedIn Ireland Unlimited Company, Dublin, Ireland
• Xing and New Work SE ("Kununu"), Am Strandkai 1, 20457 Hamburg, Germany
• Facebook and Instagram (Facebook Ireland Ltd, 4 Grand Canal Square Grand Canal Harbour, Dublin 2, Ireland)
• YouTube: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland
• X: X Inc, San Francisco, USA

In order to make the transfer to third countries as data protection-friendly as possible, standard contractual clauses have been concluded with providers in unsafe third countries in accordance with Art. 46 para. 2 lit. c GDPR. A copy of the standard contractual clauses can be requested by sending an informal email to [email protected].

We would like to point out that we have no influence on the data collection and its further use by the providers of the social networks. Further information on objection and removal options vis-à-vis the social network providers can be found here:

• LinkedIn: https://de.linkedin.com/legal/privacy-policy
• YouTube: https: //policies.google.com/privacy
• X: https: //x.com/de/privacy
• Xing & Kununu: https: //privacy.xing.com/de/datenschutzerklaerung
• Facebook & Instagram: https: //de-de.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0