Controller

The controller responsible for the described data collection and processing is named in the imprint.

We collect and process personal data in accordance with the legal basis of Art. 6 Para. 1 S. 1 General Data Protection Regulation (GDPR), in particular on the following bases:

the data subject has given consent to the processing of his or her personal data for one or more specific purposes (right of withdrawal see "Your rights as a data subject"); 

the processing of your personal data is necessary to carry out pre-contractual measures that precede a contractually regulated business relationship or to fulfill the obligations arising from a contract concluded with you. This can include, for example, the processing of purchase orders, deliveries or payments, or the preparation and answering of requests for quotations from individuals, to determine the establishment or conditions of a contractual relationship;

processing is necessary for compliance with a legal obligation to which the controller is subject (e.g. tax, commercial and foreign trade or sanctions law); 

the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. The legitimate interests are in particular the conclusion or implementation of contracts and other business relationships with our business partners, suppliers or interested parties for whom you may act as a representative or as an employee. Furthermore, legitimate interests are internal administrative purposes (e.g. for accounting) or to ensure IT security and IT operations as well as to carry out compliance investigations, to guarantee building and system security or to assert, exercise or defend of legal claims (right to object see "Your rights as a data subject").

Regarding any data processing in detail:

If we receive your business or private e-mail address or postal address in connection with our business relationship through consulting or the sale of a product or service, we can use this address for direct advertising for our own similar products or services, provided you have not objected to the processing. When collecting your address and every time it is used, we clearly point out that you can object to its use at any time without incurring any costs other than the transmission costs according to the basic tariffs.

It is used on the basis of Art. 6 Para. 1 S. 1 lit. f GDPR and in the interest of promoting the sale of our goods or services. If you do not want direct mail, you can object to data processing for this purpose by contacting the office named in the imprint. If we are not allowed to process your data on the basis of Art. 6 Para. 1 S. 1 lit. f GDPR, we will only do so on the basis of your previously declared voluntary consent (right to withdrawal see "Your rights as a data subject").

We process your data that you transmit to us in connection with the establishment of contact via contact form, telephone, fax, e-mail or post mail exclusively to process your request.

Depending on the content of your request, the legal basis here is, among other things, Art. 6 Para. 1 S. 1 lit. f GDPR. Our legitimate interest follows from the aforementioned purpose of processing and answering your request. If your request is aimed at the conclusion of a contract, the legal basis for processing can also be Art. 6 Para. 1 S. 1 lit. b GDPR.

If your contact is aimed at concluding a contract with us or if we already have a business relationship with you, we do not delete your data immediately, but store it in our (CRM) system until the contractual and/or legal obligations have been fulfilled and legal retention periods do not prevent deletion.

We process your personal data respectively personal data of the contact persons of your company in the context of consulting and the sale respectively purchasing of goods and services for the purpose of performing pre-contractual measures and fulfilling the contract as well as for the continuous business relationship. The legal basis for this is Art. 6 Para. 1 S. 1 lit. b GDPR resp. Art. 6 Para. 1 S. 1 lit f GDPR. We process the following categories of data:

• Master data (e.g. surname, first name, address, position)
• Contact data (e.g. telephone/fax number, e-mail address)
• Communication data (e.g. call/consultation logs, offers)
• Contract/banking data (e.g. subject matter of contract, contract history, bank details)

The purpose of the processing of the aforementioned personal data is the initiation, implementation and fulfillment of the respective contractual relationship as well as our legitimate interest in maintaining an active business relationship with you (for the right to object in the event of data processing based on Art. 6 Para 1 S. 1 lit. f GDPR, see "Your rights as a data subject").

Your personal data as well as the personal data of the contact persons of your company will be deleted as soon as they are no longer required for achieving the purpose for which they were collected, i.e. when the contract on which the order is based has been fulfilled and all claims from the contractual relationship are statute-barred or there are no longer any statutory retention periods. In the case of continuous business relationship, we will delete your personal data (contact details of the contact person) if there is finally no longer interest in a continuous relationship and a business contact over a certain period of time no longer exists or your part has declared a corresponding objection to data processing, at the latest however after 10 years.

To conduct online meetings and events or job interviews via telephone / video conferences (hereinafter: "Online Meetings"), we use the tool "Teams" of the US provider Microsoft Corporation.
The processing of your data takes place on the basis of Art. 6 Para. 1 S. 1 lit. b GDPR, if your participation as an external participant ("guest") in the Online Meeting is necessary for the fulfillment of a contract concluded with you or for the implementation of pre-contractual measures or on the basis of Art. 6 Para. 1 S. 1 lit. f GDPR in our legitimate interest of maintaining location-independent communication, the maintenance of business contacts and the provision of services owed. If you also voluntarily provide information about yourself when using the tool or voluntarily use functions that are not absolutely necessary, the associated data processing will take place on the basis of your revocable consent in accordance with Art. 6 Para. 1 S. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future. Please note that processing carried out before the revocation is not affected.

Depending on the type and scope of use of "Teams", different types of data are collected or processed. This includes in particular

• Information about your person (e. g. first and last name, e-mail address, profile picture),
• Meeting metadata (e. g. date, time and duration of communication, participant IP address, MAC address, other device IDs (UDID), device type, operating system type and version, client version, camera type, microphone or speaker, type of connection),
• Text, audio and video data (e. g. chat histories, video and audio playback),
• Connection data (e. g. phone numbers, country names, start and end times, IP addresses).

If you participate in an Online Meeting as an external participant ("guest"), you will receive an access link from the host (schülke) by e-mail or calendar entry. You can join Online Meetings directly from the browser without installing the "Teams" app. The service is then provided via the website of Microsoft Corporation, whereby Microsoft Corporation as the provider of "Teams" is responsible for data processing. You are free to use the chat functions during the Online Meeting. You can also turn your camera and microphone on, off or mute yourself. If you use the chat function, the text entries you make will be processed in order to display them in the Online Meeting and, if necessary, to log them. When you turn on your camera or microphone, the data from your device's microphone and any video camera from your device will be processed for the duration of the meeting.

Please note that your personal details are visible to all other participants and any information that you or others upload, provide or create during an Online Meeting will be processed for the duration of the meeting and will remain stored in "Teams" after the end of the Online Meeting. There is no possibility of central deletion of the Online Meeting by the host in "Teams". We therefore recommend that you as a participant do not use the chat function if you want to prevent storage in the Online Meeting.

In certain circumstances, we may record individual Online Meetings (primarily events) for the purpose of documentation or further publication afterwards. Both the audio track and the camera view of the participants can be recorded. You are free to activate the camera and microphone. Before the start of the recording, we will inform you of this and of the intended place of publication, if applicable. By continuing to participate under the settings you have selected, you hereby declare your consent to the recording and further use. If you participate without activating the camera and/or microphone, none of your personal data (except for your username or pseudonym) will be recorded. You can then also place questions via the chat. The chat content is not part of the recording. If the recording is published on the Intranet or Internet, we would like to point out that it is then accessible worldwide and at any time and can be found with search engines and linked to other information. In principle, therefore, any information that is placed on the Internet can be copied and disseminated without any problems. A revocation of your consent with effect for the future is conditionally possible, provided that it is technically possible to remove your personal data from the recording.

Microsoft Corporation supports us in the processing of your data as an external service provider and processor within the meaning of Art. 28 GDPR. Further information on order processing and data transfer can be found in Section III of this privacy policy and on the use of "Teams" at: https://docs.microsoft.com/en-us/MicrosoftTeams/teams-privacy

We are regularly active at exhibitions, congresses and other events as exhibitor and occasional organizer. During planning, implementation and follow-up, we process personal data if you are already in an active business relationship with us or if such a relationship is in the offing. In doing so, we process your personal data required in each case, e. g. in the context of registration for the event, on the basis of your participation in competitions or surveys offered by us and/or on the basis of personal contact or consultation.

If you register for one of our exclusive, possibly participant-limited events, your data will be processed on the basis of Art. 6 Para. 1 S. 1 lit. b GDPR for the purpose of planning and carrying out the event and, if necessary, issuing a proof of participation. An individual approach in the run-up to or after the event (e. g. as part of feedback or information about other similar events) is based on our legitimate interest in accordance with Art. 6 Para. 1 S. 1 lit. f GDPR. We process further voluntarily provided data on the basis of your consent in accordance with Art. 6 Para. 1 S. 1 lit a GDPR.

In the case of freely accessible marketing events that are purely informational and at which, for example, no proof of participation is issued, we process the data required for this (names, contact details) on the basis of Art. 6 Para. 1 S. 1 lit. f GDPR in the interest of providing information about our products or services. We process further voluntarily provided data on the basis of your consent in accordance with Art. 6 Para. 1 S. 1 lit. a GDPR.

The legal basis for participation in competitions and surveys is Art. 6 Para. 1 S. 1 lit. a GDPR. Contact requests are processed on the basis of Art. 6 Para. 1 S. 1 lit. f GDPR. The purpose of the processing of your personal data is the execution and fulfilment of the respective activities as well as our legitimate interest in establishing or maintaining an active business relationship with you (information on your rights can be found under "Your rights as a data subject").

Unless we have already informed you in detail about the storage period, we delete personal data when it is no longer required for the aforementioned processing purposes, you have revoked your consent to data processing and there are no statutory retention requirements to prevent deletion.

We pass on your personal data within our company to the areas and persons who need this data to fulfil the respective purpose. Insofar as this is necessary within the scope of the purposes set out above, we may also transfer your personal data to companies affiliated with us.

Your data will not be transferred to third parties, i. e. outside the schülke group, or only if this is permitted under data protection law. We can also pass on your data to external service providers (a. o. providers for IT service, marketing, sales, data and document destruction) who support us with data processing in the context of order processing, strictly bound by instructions and on the basis of an order processing contract. We make sure that the data processing is limited as far as possible to within the European Union (EU) or the European Economic Area (EEA), e. g. by selecting storage locations on corresponding data centers in the European Union. However, it cannot be ruled out that your data may also be processed outside the EU or the EEA or transmitted to third-country service providers. Should we transfer personal data to recipients outside the European Economic Area (EEA), the transfer will only take place if the EU Commission has confirmed an appropriate level of data protection for the third country, an appropriate level of data protection has been agreed with the data recipient (for example by means of standard contractual clauses) and further measures required to ensure an adequate level of data protection have been taken or you have given us your consent in accordance with the requirements of Art. 49 Para. 1 S. 1 lit. a GDPR.

As a data subject, the GDPR grants you certain rights when processing your personal data.

Right of access (Art. 15 GDPR)
You have the right to obtain confirmation as to whether or not personal data concerning you is being processed, and, where that is the case to obtain access to the personal data and the information specified in Art. 15 GDPR.

Right to rectification (Art. 16 GDPR)
You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you and, if necessary, the right to have incomplete personal data completed.

Right to erasure (Art. 17 GDPR)
You have the right to obtain an erasure of the personal data concerning you without undue delay, if one of the reasons listed in Art. 17 GDPR applies.

Right to restriction of processing (Art. 18 GDPR)
If one of the conditions set forth in Art. 18 GDPR applies, you shall have the right to restrict the processing of your data to mere storage, e.g. if you revoke consent, to the processing, for the duration of a possible examination.

Right to data portability (Art. 20 GDPR)
In certain situations, listed in Art. 20 GDPR, you have the right to receive the personal data concerning you in a structured, common and machine-readable format or demand a transmission of the data to another third party.

Right of withdrawal (Art. 7 GDPR)
If the processing of data takes place on the basis of your consent, you are entitled according to Art. 7 Para. 3 GDPR to revoke your consent to the use of your personal data at any time. Please note that the revocation will only take effect in the future. Processing that took place before the revocation is not affected.

Right to object (Art. 21 GDPR)
If the data is processed pursuant to Art. 6 Para. 1 S. 1 lit. f GDPR (data processing for the purposes of the legitimate interests), you have the right to object to the processing at any time for reasons arising out of your particular situation. We will then no longer process personal data, unless there are demonstrably compelling legitimate grounds for processing, which override the interests, rights and freedoms of the person concerned, or the processing serves the purpose of asserting, exercising or defending legal claims.

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you consider the processing of the data concerning you infringes data protection regulations. The right to lodge a complaint may be invoked in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.

Asserting your rights
Unless otherwise described above, please contact the office named in the imprint to assert your rights as a data subject.

Please contact our data protection officer if you have any further questions, suggestions or wishes regarding data protection:

datenschutz nord GmbH
Sechslingspforte 2
22087 Hamburg 
Germany
www.datenschutz-nord-gruppe.de 
schlkdtnschtz-nrdd 

If you contact our data protection officer, please also indicate the responsible body that is named in the imprint.