The protection of personal data is important to GROB-WERKE GmbH & Co. KG and also a legal requirement. This Privacy Policy will give you an overview of how we process your personal data and of your rights under data protection law. The data individually processed and the way in which they are used depends largely on the agreed services. Therefore, not all parts of this report will apply to you.

Name and contact data of the responsible party pursuant to the General Data Protection Regulation:

GROB-WERKE GmbH & Co. KG
represented by Managing Director Mr. Wolfram Weber
Industriestraße 4
87719 Mindelheim

Name and contact data of our Data Protection Officer:

GROB-WERKE GmbH & Co. KG
Industriestraße 4
87719 Mindelheim
E-mail: datenschutz@grob.de

Which data are processed?

We process personal data which we receive, under the terms of our business relationship, from our partners and other affected parties. We also process – where required to provision our service – personal data which we lawfully obtain from publicly accessible sources (e.g. records of debtors, land registers, registers of companies and associations, press, Internet) or which are legitimately transmitted to us by other third parties.

Which data categories are processed?

The following data are processed in compliance with the provisions of the EU General Data Protection Regulation (DS-GVO) and the Federal Data Protection Act (BDSG):

To fulfil contractual obligations (Art. 6, para. 1 b DS-GVO)

• Name of the company
• Business address and other delivery addresses
• Names of contact persons
• Telephone numbers
• Fax numbers
• email addresses
• Bank details
• VAT ID number
• Correspondence for executing the contractual relationship
• Data ensuing from the fulfilment of our contractual obligations

Personal data are also processed for the balancing of interests (Art. 6, para. 1 f DS-GVO). These are:

• Credit checks (by Schufa for example)
• Advertising, insofar as you have not objected to the use of your data
• Assertion of legal claims and defence in case of legal disputes
• Guaranteeing IT security and IT operation
• Prevention and clarification of criminal offences
• Measures for building and plant security (e.g. access controls)
• Measures for safeguarding domiciliary rights
• Risk control within our company

Processing in order to comply with legal requirements (Art. 6, para. 1 c DS-GVO) or in the public interest (Art. 6, para. 1 e DS-GVO) is a legitimate reason for the processing of personal data.

Why do we process your data (purpose of processing)?

Data are processed in order to provision our services to honor our agreements with our business partners or to implement pre-contractual measures upon request. The purpose of data processing depends first and foremost on the specific product or service. In particular, data are processed

• to be able to identify you as our business partner;
• to be able to provide you with appropriate advice;
• to correspond with you;
• for billing purposes;

to safeguard our legitimate interests or those of third parties. Examples:

• Advertising, insofar as you have not objected to the use of your data;
• Assertion of legal claims and defence in case of legal disputes;
• Guaranteeing IT security and IT operation;
• Prevention and clarification of criminal offences;
• Measures for building and plant security (e.g. access controls);
• Measures for safeguarding domiciliary rights, measures for business management and for the further development of products and services, risk control within our company.

The consent you grant (Art. 6, para. 1 a DS-GVO) allows us to process your personal data. If such consent forms the basis of processing, we shall provide you with detailed information on the purposes of such processing. You can revoke your consent at any time.

We, as a company, are governed by various legal obligations, i.e. statutory requirements (e.g. taxation laws). The purposes of processing include the fulfilment of tax reporting obligations, as well as the assessment and control of risks within our company.

Personal data are not disclosed to third parties, with the exception of

• Within our company, those departments that require your data in order to fulfil our contractual and legal obligations have access to such data;
• Transmissions to third parties engaged by us in order to fulfil the terms of contractual and delivery relationships, examples include to banking institutes/payment service providers which process payments, and also to transport companies/shipping companies which handle shipments;
• Transmissions to third parties engaged by us for the purpose of marketing and advertising our in-house products and services, examples include marketing service providers and printing companies;
• Transmissions to specialized service providers which, on our instruction and under our responsibility, furnish services for us as part of the aforementioned purposes (order processing Art. 28 DS-GVO), examples include IT service providers;
• Transmissions to third parties to whom we have a legal obligation;
• Transmissions to third parties for the purpose of fulfilling our commercial and tax obligations, examples include our tax consultant.

Essentially, we disclose information about our business partners only if statutory provisions so require or the partner has given their consent. Under these prerequisites, recipients of personal data include:

• public bodies and institutions;
• other companies within the Group;
• service providers we engage in order to fulfil the terms of order processing relationships.

Other data recipients include those bodies for which you have granted your consent to data transmission or waived consent or to which we are authorized to transmit personal data for the balancing of interests. Data will be transmitted to a third-party country outside of the European Union, which is not a contracting state to the Agreement on the European Economic Area, only if such data transmission is required to fulfil the terms of a contract existing between yourselves and ourselves (delivery to a third-party country, for example).

Data storage

We process and store your personal data for as long as this is required to fulfil our contractual and legal obligations. It should be noted that our contractual relationship constitutes a continuing obligation, effective for several years.

If the data are no longer required to fulfil contractual or legal obligations, they will be deleted on a regular basis, unless – short-term – further processing is required for the following purposes:

• to fulfil retention obligations under commercial and taxation law that can ensue, e.g. from: the Commercial Code (HGB), Fiscal Code (AO). The periods for storage and/or documentation are usually six to ten years.
• the preservation of evidence under the statutory limitation regulations. In accordance with Section 195 et seq. of the Civil Code (BGB), these statutory limitation periods can be up to 30 years, the regular period of limitation being 3 years.

Legal remedy

You have the right, to demand from the responsible party a confirmation as to whether your personal data are being processed; if this is the case, you have a right to information about these personal data and to the information individually listed in Art. 15 DS-GVO (General Data Protection Regulation).

The affected person has the right to demand from the responsible party an immediate correction to any incorrect personal data and, where applicable, the completion of incomplete personal data (Art. 16 DS-GVO).

The affected person has the right to demand from the responsible party the immediate deletion of their personal data, insofar as one of the reasons individually listed in Art. 17 DS-GVO applies, e.g. if the data is no longer required for the pursued purpose (right to deletion).

The affected person has the right to demand from the responsible party the limitation of processing if one of the prerequisites listed in Art. 18 DS-GVO is met, e.g. if the affected person has lodged an objection to processing, for the duration of the review by the responsible party.

Each affected party, notwithstanding any other administrative or judicial remedies, has the right to complain to a supervisory authority, if the affected person believes that the processing of their personal data is in contravention of the DS-GVO (Art. 77 DS-GVO). The affected person can exercise this right at a supervisory authority in the member state of their place of residency, their place or work or the place of the presumed infringement.

Information on your right to object in accordance with Article 21 DS-GVO

Case-by-case right to object

You have the right, for reasons ensuing from your particular situation, to object at any time to the processing of your personal data, which occurs pursuant to Article 6, para. 1, letter e DS-GVO (Data processing in the public interest) and Article 6, para. 1, letter f DS-GVO (Data processing for the balancing of interests).

Should you object, we will cease to process your personal data unless we are able to demonstrate legitimate grounds for such processing that outweigh your interests, rights or freedoms, or the processing serves to assert, exercise or defend legal claims.

Right to object against the processing of data for the purposes of direct advertising

In isolated cases, we will process your personal data for the purpose of direct advertising. You have the right to object, at any time, to the processing of your personal data for the purposes of direct advertising, insofar as it this is in direct connection with such direct advertising.

If you object to processing for the purposes of direct advertising, we will no longer process your personal data for such purposes.

Recipient of an objection

The objection can be made informally with the reference "Objection" stating your name and address and should be sent to:

GROB-WERKE GmbH & Co. KG
Industriestraße 4
87719 Mindelheim
E-mail: info@de.grobgroup.com