Privacy policy for customers and suppliers

1. Preliminary remark

The following is intended to provide you with information about your data. The legislature has provided which information is necessary.
If you want to know more about this we refer to the basic data protection regulation, Articles 12 to 22 and 34. The text of the basic data protection regulation is available on the Internet under https://dsgvo-gesetz.de. If you have any further questions regarding the Basic Data Protection Regulation please contact the Data Protection Officer and/or the Administration at any time.

2. What are personal data?

All information relating to an identified or identifiable person. A person is identifiable if he or she can be identified directly or indirectly. This can be done, for example, by assigning an identification such as name, identification number, location data, online identification or one or more special features.

3. Basic information

3.1 Who is responsible for the processing of my data?
Responsible for data processing is:
Keller HCW GmbH
Carl-Keller-Str. 2-10, 49479 Ibbenbüren, Germany
Tel. +49 (0) 5451 850, E-Mail: info@keller.de

3.2 Which authority is responsible for the control and compliance of the data protection law?
Responsible data protection authority
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestr. 2-4, 40213 Düsseldorf
Telefon: +49 (0) 211 38424-0, E-Mail: poststelle@ldi.nrw.de

3.3 How can I contact the data protection officer of the company?
The data protection officer can be reached as follows:
Georg Möller, SK-Consulting Group GmbH
Osterweg 2, 32549 Bad Oeynhausen
E-Mail: datenschutz@SK-consulting.com.

4. Further important information

4.1 Data processing (why?)
We process your data for the fulfilment of mutual obligations arising from the contractual relationship (which may be in the process of being established) or for the fulfilment of legal obligations.

4.2 Why are we allowed to do this?
Data protection legislation allows us (in accordance with article 6 paragraph 1 sentence 1 lit. b DSGVO) the processing of data which are necessary for the performance of a contract or the implementation of pre-contractual measures. If you voluntarily provide us with information about yourself that goes beyond what is necessary, this is permitted by data protection law with approval (according to article 6 paragraph 1 sentence 1 lit. a DSGVO).Data protection law allows us to process you data according to article 6 paragraph 1 sentence 1 lit. c DSGVO, if there is a legal obligation to do so.

4.3 Who can receive my data?
In the course of processing your data may be transmitted to:

• Persons within our company who are directly involved in data processing (e.g. sales, purchasing)
• Service providers who are contractually bound and obliged to confidentiality and who perform partial tasks of data processing
• as well as other external bodies (companies, authorities, etc.), if this is necessary

4.4 Will you submit my data to countries outside the European Union?
This is not planned by us. An exception to this would only be possible if you were to arrange this, or if this would be necessary for the fulfilment of the contract. Legal basis: Article 6 paragraph 1 sentence 1 lit. b DSGVO, article 49 paragraph 1, lit. (b) DSGVO.

4.5 How long will you store my data?
We store your data for the time we need it to achieve the purposes described in 4.1. In addition, there are legal provisions (e.g. the tax code § 147) which force us to keep certain documents for six or ten years. After the storage period has expired, we delete data that is no longer required.

4.6 Do I have to provide my data?
In order to achieve the reasons described in point 4.1, it is necessary for you to provide us with your personal data.
For the fulfilment of the contract with you, this is absolutely necessary and/or required by law. If you do not provide the data, we will not be able to fulfil the contract with you.

4.7 Automated decision-making / profiling
An automatic decision making / profiling does not take place.

5. Which rights do I have?

5.1 Note on your rights
As a person affected of a data processing, you have the following rights under the Basic Data Protection Regulation (hereinafter also referred to as “rights of the persons affected”):

5.2 Information rights (according to the article 15 of DSGVO)
You have the right to request information as to whether or not we process your personal data. If we process personal data of you, you have the right to know,

• why we process your data (see also point 4.1);
• the type of data we process from you;
• what type of recipients receive or should receive data from you (see also point 4.3);  
• how long we will store your data; if it is not possible to specify the storage period, we must communicate when the storage period is determined (e.g. after expiry of statutory storage periods) (see also point 4.5);
• that you have the right to correct and delete the data concerning you, including the right to limit the processing and/or the right to object (see also the following points 5.2, 5.3 and following);
• that you have a right of appeal to a supervisory authority;
• where your data originated, if we did not collect it directly from you;
• whether your data will be used for an automatic decision and, if so, what logic has been applied for this decision and what impact and scope the automated decision may have for you;
• that if data about you is transferred to a country outside the European Union, you are entitled to information as to whether, and if so, on the basis of which guarantees, an adequate level of protection is ensured for the data recipient;
• that you have the right to request a copy of your personal data. Data copies are generally provided in electronic form.

The first copy is free of charge, a reasonable fee may be required for further copies. A copy can only be made available, if the rights of others are not affected.

5.3 Right for correction of data (according to Article 16 DSGVO)
You have the right to ask us to correct your data if it is incorrect and/or incomplete. This right also includes the right to be completed by supplementary declarations or communications. Corrections and/or addition must be made without undue delay.

5.4 Right to cancellation of personal data (according to article 17 DSGVO)
You have the right to demand the deletion of your personal data from us if

• The personal data are no longer necessary for the purposes for which they were collected and processed;
• The data processing is carried out on the basis of your consent and you have withdrawn your agreement; however, this does not apply if there is another legal permission for the data processing;
• You have objected to a data processing whose legal authorisation is in the so-called “legitimate interest” (under Article 6 paragraph 1, e or f); however, deletion is not necessary if there are overriding legitimate reasons for further processing;
• You have objected to data processing for the purpose of direct advertising;
• Your personal data has been processed unlawfully;It concerns data of a child which were collected for services of the information society (=electronic service) on the basis of the consent (according to Article 8 paragraph 1 DSGVO).

A right to the deletion of personal data does not exist, if

• The right to freedom of expression and information precludes the request for deletion;
• The processing of personal data
            - To fulfil a legal obligation (e.g. legal storage obligations),
            - To carry out public tasks and interests in accordance with applicable law (including “public health") or
            - Is required for archiving and/or research purposes;
• The personal data is necessary for the assertion, exercise or defence of legal claims.

The deletion must take place immediately (without culpable delay). If personal data has been made public by us (e.g. on the Internet), we must ensure within possible and reasonable scope that other data processors are also informed of the request for deletion, including the deletion of links, copies and/or replications.

5.5 Right to limit data processing (according to Article 18 DSGVO)
You have the right to have the processing of your personal data restricted in the following cases:
If you have raised objections as to the correctness of your personal data, you may request that we do not use your data for any other purpose during the period for checking the correctness, thereby limiting its processing.
In the event of unlawful data processing, you may request the restriction of data use instead of data deletion;
If you need your personal data to assert, exercise or defend legal claims, but we no longer need your personal data, you can demand that we restrict processing to the purposes of legal prosecution.
If you have objected to data processing (according to Article 21 paragraph 1 DSGVO) (see also item 5.7) and it is not yet clear whether our interests in a processing outweigh your interests, you can demand that your data are not used for other purposes for the duration of the checking and that their processing is therefore restricted.
Personal data whose processing has been restricted at their request may only be processed, with your approval,
to assert, exercise or defend legal claims,
to protect the rights of other natural or legal persons, or  
for reasons of important public interest.If a processing restriction is removed, you will be notified in advance.

5.6 Right to data portability (according to Article 20 DSGVO)
You have the right to request from us the data that you have provided to us in a common electronic format (e.g. as PDF or Excel document).
You may also request us to transfer this information directly to another (specific) company, if technically possible for us.
The prerequisite for you having this right is that the processing is carried out on the basis of an approval or for the execution of a contract and with the help of automated procedures.
The exercise of the right to data transfer does not affect the rights and freedoms of other persons.If you use the right to data transfer, you still have the right to data deletion in accordance with Article 17 DSGVO.

5.7 Right to object to certain data processing (according to Article 21 DSGVO)
If your data is processed for the purpose of performing public interest or legitimate interests, you may object to such processing. You must explain the reasons resulting from your particular situation for your objection. These can be, for example, special family circumstances or secrecy interests worthy of protection.
In the event of an objection, we shall refrain from any further processing of your data for the aforementioned purposes, unless, there are compelling legitimate reasons for processing which outweigh your interests, rights and freedoms, or the processing is necessary for the assertion, exercise or defence of legal claims.
You may object to the use of your data for the purpose of direct advertising at any time; this also applies to profiling as far as it is connected with direct advertising. In the event of objection, we may no longer use your data for the purpose of direct advertising.

5.8 Prohibition of automated decisions/profiling (according to Article 22 DSGVO)
Decisions made by us which have a legal consequence for you or which significantly affect you must not be based exclusively on automated processing of personal data. This also includes profiling. This prohibition does not apply as far as the automated decision
for the conclusion or performance of a contract with you is required
is permissible on the basis of legislation, if this legislation include appropriate measures to protect your rights and freedoms, as well as your interests, or with your explicit approval.
Decisions which are based exclusively on automated processing of special categories of personal data (=sensitive data) are only permissible if they are based on
your explicit approval, or
there is a substantial public interest in the processing operationand appropriate measures have been taken to protect your rights and freedoms and your legitimate interests.

5.9 Exercise of the rights concerned
In order to exercise your rights, please contact the body mentioned under 3.1. Requests that are submitted electronically are usually answered electronically. The information, communications and measures to be made available under the DSGVO, including the exercise of data subjects’ rights, are generally provided free of charge. Only in the case of manifestly unfounded or excessive claims, we are entitled to charge a reasonable fee for processing or to refrain from taking action (according to article 12 paragraph 5 DSGVO).
If there are justified doubts as to your identity, we may request additional information from you for the purpose of identification. If identification is not possible for us, we are entitled to refuse the processing of your request. If identification is not possible we will inform you separately - as far as possible. (see article 12, paragraph 6 and article 11 DSGVO).
Requests for information are usually processed immediately, within one month after receipt of the request. The deadline may be extended by a further two months if this is necessary in view of the complexity and/or the number of requests; in the event of an extension, we will inform you of the reasons for the delay within one month after receipt of your request. If we do not act on a request, we will inform you of the reasons for the delay immediately within one month after receipt of the request and will inform you of the possibility of filing a complaint with a supervisory authority or a judicial remedy. (see article 12, paragraph 3 and 4 DSGVO).Please note that you can only exercise your rights concerned within the limits of restrictions and limitations provided by the Union or the Member States. (Article 23 DSGVO)