Data processor
Name and contact details of the controller:
DEWE Brünofix GmbH
Fabrik für Metallchemie
Pruppacher Weg 8
D-91126 Rednitzhembach
Tel.: +49 9122 9868-100
Fax: +49 9122 9868-130
Email: info@bruenofix.de
Managing Director:
Ralf S. Schmidt
Nuremberg District Court HRB 2775
VAT registration number: DE133509734
Name and contact details of the data protection officers:
Mrs Gisela Pöllinger
Datenschutz Pöllinger GmbH
Dresdner Str. 38
92318 Neumarkt
Tel.: 09181/2705770
Email: datenschutz@datenschutz-poellinger.de
Scope and origin of the data
Purpose and legal basis for the processing Art. 6, paragraph 1, lit. a, b, c, f DSGVO
Supplier data:
Personal data is collected, processed or used for the purpose of fulfilling the business purpose of ordering offers, order confirmations, invoices, goods and services, as well as maintaining business contacts and information by the supplier (Art. 6 para. 1 lit. a, b, f EU-DSGVO. Furthermore, there is a legal obligation to process data, e.g. due to tax law requirements (Art. 6 para. 1 lit. c EU-DS-GVO).
Categories of personal data that are processed:
Essential data categories are:
- Name
- Address
- Contact details of contact persons in the company (first name, last name)
- Communication data (telephone number, mobile number, email address, fax number)
- customer number, as well as order and delivery data for the purpose of initiation
- order and contract data
Origin (source) of the data
The stored data was collected in the context of our contractual relationship and for the purpose of initiating a contract, or it was created in the context of business relationships and business initiation. The data is stored for the purpose of fulfilling and processing the orders placed with us, as well as for the purposes of commercial and tax law documentation and archiving obligations.
Recipients (categories) of personal data
Public authorities that receive data in accordance with legal requirements:
- Tax authorities
Internal departments that are involved in the execution of the respective business processes:
- management, accounting, controlling, production, documentation, sales, purchasing, technology and IT.
External bodies (contractual partners) insofar as these are necessary for the fulfilment of the contract. External contractors (service companies) in accordance with Art. 28 DSGVO for the processing of data on our behalf:
- IT service providers, software providers, disposal companies, Google Analytics, website providers
Other external bodies: group-affiliated companies or other external bodies for the fulfilment of the above-mentioned purposes, insofar as the data subject has given his written consent, this is necessary for the fulfilment of the contract or a transmission is permissible for reasons of overriding legitimate interest:
- credit institution for supplier payments, tax consultant
Transfer to third countries
Personal data will not be transferred outside the European Union.
Duration of storage / Deletion
- 10 years: Annual financial statements, opening balance sheets, commercial and business books, records, work instructions, organisational documents, invoices and accounting vouchers (HGB, AO, EStG, KStG, GewStG, UStG, AktG, GmbHG, GenG)
- 6 years: Commercial and business letters and other documents (HGB, BGB)
- 30 years: Enforceable titles
The following data will be deleted in accordance with Art. 17 GDPR:
- If the storage of the data is no longer necessary
- If the data subject has revoked his consent to the data processing
- If the data has been processed unlawfully
- If there is a legal obligation to delete under EU or national law
Restriction of processing in accordance with Article 18
If, in the case of non-automated data processing, deletion is not possible or only possible with a disproportionately high effort due to the special type of storage and if the interest of the data subject in the deletion is to be regarded as low, the right of the data subject to and the obligation of the controller to delete personal data in accordance with Article 17 (1) of Regulation (EU) 2016/679 does not apply in addition to the exceptions mentioned in Article 17 ( 3 of Regulation (EU) 2016/679. In this case, the restriction of processing in accordance with Article 18 of Regulation (EU) 2016/679 shall apply instead of erasure. The first and second sentences shall not apply if the personal data have been unlawfully processed.
Rights of the data subject
- Information about the personal data stored about you (Art. 15 GDPR). In particular, you may request information about the purposes of the processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your data if it has not been collected by us, and the existence of automated decision-making including profiling and, if applicable, meaningful information about the details.
- Rectification – If incorrect personal data is processed (Art. 16 GDPR)
- Erasure and restriction as well as objection to processing (Art. 17, 18 and 21 GDPR)
- Right to data portability (Art. 20 GDPR) to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format or to request its transmission to another controller.
- Withdrawal of consent (Art. 7 (3) GDPR). As a result, we are no longer allowed to continue the data processing based on this consent in the future
- Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
Right to object
If your personal data is processed on the basis of legitimate interests in accordance with Art. 6 (1) sentence 1 point f GDPR, you have the right to object to the processing of your personal data in accordance with Art. 21 GDPR if there are reasons for doing so that arise from your particular situation or if the objection is to direct advertising. In the latter case, you have a general right of objection, which we will implement without you having to specify a particular situation.
Right to revoke consent
Every data subject has the right, within the meaning of Art. 6 (1) (a) or Art. 9 (2) (a), to revoke at any time and without detriment to himself or herself any or all consents granted for the purpose of, for example, fulfilling a contract, without affecting the lawfulness of the processing carried out on the basis of the consent up to the point of revocation.
Please address the revocation of consent and objection in writing to:
DEWE Brünofix GmbH
Fabrik für Metallchemie
Pruppacher Weg 8
D-91126 Rednitzhembach
E-Mail: datenschutz@bruenofix.de
Automated decision-making and profiling
No automated decision-making processes as per Art. 22 GDPR or other profiling measures as per Art. 4 No. GDPR are used.
Validity of and changes to this information obligation in accordance with Art. 13 and Art. 14 GDPR.
This data protection information obligation is currently valid and is dated July 2019.
It may be necessary to change this information due to, among other things, changes in legal or official requirements. You can access and print out the current data protection information at any time on the website www.bruenofix.de.