Information on data protection regarding our data processing according to article 13 and article 21 of the General Data Protection Regulation (GDPR)

We take data protection seriously and we wish to inform you about how we process your data and about the claims and rights to which you are entitled according to the data protection regulations.

1. Data controller in the meaning of the data protection law and contact details of the data protection officer

Data controller in the meaning of the data protection law is:

GEFA Processtechnikh GmbH
Germaniastraße 28
Phone +49 231 - 610090
Fax +49 231 – 6100980
eMail: This email address is being protected from spambots. You need JavaScript enabled to view it.

You can reach our data protection officer at the following contact details:

AGAD Service GmbH
Waldring 43-47
44789 Bochum
Phone 0234 282 533 20
Fax 0234 282 533 10
eMail: This email address is being protected from spambots. You need JavaScript enabled to view it.

2. Purpose and legal foundation upon which we process your data
We process personal data in accordance with the provisions of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG) and other applicable data protection provisions. Which data is processed in detail and how it is used primarily depends on the respectively requested or agreed services. Further details or additions to the purposes of data processing can be found in the respective contract documents, forms, the declaration of consent and/or other information provided to you (e.g. within the framework of the use of our website or our General Terms and Conditions).

2.1 Purposes for the fulfilment of a contract or pre-contractual measures (art. 6 section 1 b of the GDPR)
Your personal data is processed for the fulfilment of our contracts with you and for the execution of your orders as well as for the implementation of measures and activities within the framework of pre-contractual relationships, e.g. with interested parties. Your personal data is thus particularly processed for the preparation of invoices according to your orders and it includes the necessary services, measures and activities. These basically include the contract-related communication with you, the verifiability of transactions, orders and other agreements as well as quality control by means of appropriate documentation, measures for the control and optimisation of business processes as well as for the fulfilment of the general duties of care, the management and control by affiliated companies (e.g. parent company); statistical evaluations for corporate management, cost recording and controlling, reporting, internal and external communication, emergency management, accounting and tax assessment of operational services, risk management, assertion of legal claims and defence in the event of legal disputes.

2.2 Purposes within the framework of a legitimate interest on our part or of third parties (art. 6 section 1 f of the GDPR)
Above and beyond the actual fulfilment of the contract or per-contract, we process your data whenever this is necessary to protect the legitimate interests of our own or of third parties, in particular for the following purposes:

• advertisement or market and opinion research provided that you have not objected to the use of your data;
• obtaining of information as well as data exchange with credit agencies, provided that this goes beyond our economic risk;
• examination and optimisation of procedures for needs analysis;
• further development of services and products as well as of existing systems and processes;
• enrichment of our data, e.g. by using or researching publicly accessible data;
• statistical evaluations or market analysis;
• benchmarking;
• assertion of legal claims and defence in the event of legal disputes which cannot be directly assigned to the contractual relationship;
• limited storage of the data if it is not possible to delete the data due to the special type of storage or if this is only possible at an unreasonably great expense;
• prevention and investigation of crimes, insofar as this is not exclusively for the fulfilment of legal requirements;
• building and plant security (e.g. by means of access controls and video surveillance), insofar as this goes beyond the general duties of care;
• internal and external investigations, safety reviews;

assurance and exercise of domestic authority by means of appropriate measures as well as by means of video surveillance for the protection of our customers and employees as well as for the preservation of evidence in case of crimes and for the prevention of crimes.

2.3 Purposes within the frame of your consent (art. 6 section 1 a of the GDPR)
With your consent, you can subscribe to our newsletter by means of which we will inform you about our current interesting offers. The only mandatory information for the sending of the newsletter is your e-mail address. We will store your e-mail address for the purpose of sending the newsletter. The legal foundation for this is art. 6 section 1 clause 1 a of the GDPR. You can revoke your consent to the sending of the newsletter at any time and unsubscribe the newsletter. You can revoke your consent by clicking on the link provided in each newsletter e-mail or via a message to the contact details mentioned above under data controller.

2.4 Purposes relating to the adherence to statutory requirements (art. 6 section 1 c of the GDPR) or in the public interest (art. 6 section 1 e of the GDPR)
We are subject to numerous legal obligations (e.g. commercial and tax laws), but also supervisory or other requirements set out by government authorities. The purposes of processing may also include identity and age checks, prevention of fraud and money laundering, prevention, fight against and investigation of terrorist financing and crimes endangering company assets, comparison with European and international antiterror lists, compliance with control and notification obligations under tax law as well as the archiving of data for the purposes of data protection and data security and for audits by fiscal and other government authorities. In addition, it may be necessary to disclose personal data within the framework of official government/court measures for the purposes of collecting evidence, law enforcement and criminal prosecution or the enforcement of civil law claims.

3. The categories of data that we process as long as we do not receive data directly from you, and its origin
If necessary for the provision of our services, we may process data which we lawfully receive from other companies or other third parties (e.g. credit agencies). In addition, we process personal data that we have lawfully collected, received or acquired from publicly accessible sources (such as, for example, telephone directories, commercial and association registers, civil registers, debtor registers, land registers, the press, internet and other media).

Relevant personal data categories may in particular be:

• personal data (name, date of birth, place of birth, nationality, marital status, job / business sector and similar data)
• contact data (address, e-mail address, phone number and similar data)
• address data (population register data and similar data)
• payment / cover confirmation of bank and credit cards
• information concerning your financial situation (creditworthiness data including scoring, i.e. data for the evaluation of the economic risk)
• customer history
• data about your use of the telemedia provided by us (e.g. time of your visit to our websites, apps or newsletters, clicked pages or entries by us and similar data)
• video data

Recipients or categories of recipients of your data
At our company, your data is received by those internal offices or organisational units that need your data to fulfil our contractual and statutory obligations or that require your data within the framework of processing and implementing our legitimate interests. Your data is disclosed/passed on to external offices and persons solely

• in connection with the fulfilment of the contract;
• for purposes of compliance with statutory provisions according to which we are obliged to give information, notification or forward data or where the forwarding of data is in the public interest;
• to the extent that external service providers commissioned by us process data as contract processors or parties that assume certain functions (e.g. external data centres, support / maintenance of EDV / IT applications, archiving, document processing, call centre services, compliance services, controlling, data screening for anti-money laundering purposes, data validation or plausibility check, data destruction, purchasing / procurement, customer administration, lettershop, marketing, media technology, research, risk controlling, accounting, telephone services, website management, auditing services, credit institutions, printing plants or companies for data disposal, courier services, logistics);
• as a result of our legitimate interest or the legitimate interest of the third party within the framework of the purposes mentioned under number 2.2 (e.g. to government authorities, credit agencies, debt collection, attorneys, courts of law, appraisers, companies belonging to company groups and bodies and supervisory authorities);
• if you have given us your consent to transmit the data to third parties.

We shall moreover refrain from transmitting your data to third parties. If we commission service providers within the framework of processing an order, your data will be subject to the same security standards as at our company. In all other cases, the recipients may only use the data for purposes for which the data has been transmitted to them.

4. Length of time your data is stored
We process and store your data for the duration of our business relationship. This also includes the initiation of a contract (pre-contractual legal relationship) and the fulfilment of a contract.

Furthermore, we are subject to various retention and documentation obligations that emanate from the German Commercial Code (Handelsgesetzbuch - HGB) and the German Tax Code (Abgabenordnung - AO), among others. The periods and deadlines for retention and/or documentation stipulated therein are up to ten years beyond the end of the business relationship or the pre-contractual legal relationship.

In addition, special statutory provisions may require a longer retention period, such as the preservation of evidence in the framework of statutory limitation periods. According to §§ 195 ff. of the German Civil Code (Bürgerliches Gesetzbuch – BGB), the regular limitation period is three years, but it is also possible that periods of up to 30 years are applicable.

If the data is no longer required to meet contractual or statutory obligations and rights, it is deleted regularly, unless its further processing – for a limited period – is necessary to fulfil the purposes listed under number 2.2 due to an overriding legitimate interest. Such an overriding legitimate interest is deemed to exist, for example, if it is not possible to delete the data due to the special type of storage or if this is only possible at an unreasonably great expense and if processing is not possible for other purposes by means of appropriate technical and organisational measures.

5. Processing of your data in a third country or by an international organisation
Data may be transmitted to offices in countries outside the European Union (EU) or the European Economic Area (EEA) (so-called third countries) whenever this is necessary to fulfil a contract/order by you, if it is prescribed by law (e.g. reporting obligations under tax law), if this is in the legitimate interest of us or of a third party or if you have granted us your consent to this.

At the same time, your data may also be processed in a third country in connection with the involvement of service providers within the framework of processing the order. If no decision has been issued by the EU Commission regarding the presence of a reasonable level of data protection for the respective country, we warrant that your rights and freedoms will be protected and guaranteed reasonably in accordance with EU data protection requirements by means of contractual agreements to this effect.

6. Your data protection rights
You have the following rights towards us:

• You have the right to request information regarding the data stored by us according to the provisions of art. 15 of the GDPR (possibly with limitations according to § 34 of the German Federal Data Protection Act (BDSG)).
• Upon your request, we will correct your personal data stored by us according to art. 16 of the GDPR, if these are incorrect or incomplete.
• Upon request, we will delete your data according to the principles of art. 17 of the GDPR, unless this is opposed by other statutory regulations (e.g. statutory retention obligations or the limitations according to § 35 BDSG) or by an overriding legitimate interest of us (e.g. for the defence of our rights and claims).
• In accordance with the provisions of art. 18 of the GDPR, you can request us to limit the processing of your data.
• You can object to the processing of your data according to art. 21 of the GDPR, due to which we have to stop the processing of your data. This right of objection, however, shall only apply if special circumstances of your personal situation exist, while our rights may oppose to your right of objection.
• Moreover, you have the right to receive your data in a structured, conventional and machine-readable format or to transfer the data to a third party, if the conditions of art. 20 of the GDPR apply.
• Furthermore, you are entitled to file a complaint with a supervisory authority (art. 77 of the GDPR). In addition to this, your also have the right to contact our data protection officer.