Privacy policy – Connectric
Thank you for your interest in our company. Data protection is a high priority for the management of connectric GmbH. Our website can generally be used without providing personal data. However, processing may become necessary if a data subject wishes to use particular services through our website. Where processing is necessary and there is no statutory basis for it, we generally obtain the data subject’s consent.
Personal data, such as a data subject’s name, address, email address or telephone number, is processed in accordance with the General Data Protection Regulation and the national data protection provisions applicable to connectric GmbH. This privacy policy explains the nature, scope and purpose of the personal data we collect, use and process, and informs data subjects of their rights.
As controller, connectric GmbH has implemented numerous technical and organisational measures to protect the personal data processed through this website as comprehensively as possible. Nevertheless, internet-based data transmission may have security vulnerabilities and absolute protection cannot be guaranteed. Data subjects may therefore provide personal data to us by alternative means, for example by telephone.
1. Definitions
This privacy policy uses the terminology adopted by the European legislator in the General Data Protection Regulation (GDPR). To make it understandable to the public, customers and business partners, we first explain the terms used.
a) Personal data
Personal data means any information relating to an identified or identifiable natural person (the ‘data subject’). An identifiable person is one who can be identified directly or indirectly, particularly by reference to an identifier such as a name, identification number, location data, online identifier, or factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
b) Data subject
A data subject is any identified or identifiable natural person whose personal data is processed by the controller.
c) Processing
Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or other provision, alignment, combination, restriction, erasure or destruction.
d) Restriction of processing
Restriction of processing means marking stored personal data with the aim of limiting its future processing.
e) Profiling
Profiling means any form of automated processing that uses personal data to evaluate personal aspects relating to a natural person, particularly to analyse or predict aspects of their work performance, economic situation, health, preferences, interests, reliability, behaviour, location or movements.
f) Pseudonymisation
Pseudonymisation means processing personal data so that it can no longer be attributed to a particular data subject without additional information, provided that this information is kept separately and protected by technical and organisational measures that prevent attribution to an identified or identifiable natural person.
g) Controller
The controller is the natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of processing personal data. Where these purposes and means are determined by EU or Member State law, that law may specify the controller or the criteria for its nomination.
h) Processor
A processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.
i) Recipient
A recipient is a natural or legal person, public authority, agency or other body to which personal data is disclosed, whether or not it is a third party. Public authorities that may receive personal data in the framework of a particular inquiry under EU or Member State law are not considered recipients.
j) Third party
A third party is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons authorised to process personal data under the direct authority of the controller or processor.
k) Consent
Consent is any freely given, specific, informed and unambiguous indication of the data subject’s wishes by a statement or clear affirmative action signifying agreement to the processing of their personal data.
2. Name and address of the controller
The controller for the purposes of the GDPR, other data protection laws applicable in EU Member States and other data protection provisions is: connectric GmbH Pappelring 48 23923 Selmsdorf, Germany Telephone: +49 (0) 177 422 6577 Email: [email protected] Website: http://www.connectric.de
3. Collection of general data and information
Whenever a data subject or automated system visits the website, connectric GmbH collects general data and information that may be stored in server log files. This may include: (1) browser types and versions; (2) the accessing system’s operating system; (3) the referring website; (4) subpages accessed on our website; (5) the date and time of access; (6) the internet protocol (IP) address; (7) the accessing system’s internet service provider; and (8) similar data and information used to protect our IT systems against attacks.
connectric GmbH does not use this general information to draw conclusions about the data subject. It is needed to (1) deliver website content correctly; (2) optimise the website’s content and its advertising; (3) ensure the ongoing functioning of our IT systems and website technology; and (4) provide law enforcement authorities with the information necessary to investigate a cyberattack. Anonymous data and information are evaluated statistically and to improve data protection and security, with the aim of protecting the personal data we process. Anonymous server log data is stored separately from personal data provided by a data subject.
4. Routine erasure and blocking of personal data
The controller processes and stores personal data only for the period necessary to achieve the purpose of storage, or for the period required by European or other applicable legislation.
When the purpose of storage ceases to apply or a statutory retention period expires, personal data is routinely blocked or erased in accordance with legal requirements.
Rights of the data subject
a) Right to confirmation
Every data subject has the right granted by the European legislator to obtain confirmation from the controller as to whether their personal data is being processed. To exercise this right, they may contact an employee of the controller at any time.
b) Right of access
Every data subject has the right to receive, free of charge and at any time, information about their stored personal data and a copy of that information. This includes: • the purposes of processing; • the categories of personal data concerned; • recipients or categories of recipients to whom the data has been or will be disclosed, particularly in third countries or international organisations; • where possible, the planned retention period or the criteria used to determine it; • the right to request rectification, erasure, restriction of processing or to object to processing; • the right to lodge a complaint with a supervisory authority; • where data was not obtained from the data subject, available information about its source; • the existence of automated decision-making, including profiling, under Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved and the significance and envisaged consequences of the processing.
Data subjects also have the right to know whether personal data has been transferred to a third country or international organisation and, if so, to be informed of the appropriate safeguards relating to that transfer. To exercise the right of access, they may contact an employee of the controller at any time.
c) Right to rectification
Every data subject has the right to obtain the rectification of inaccurate personal data concerning them without undue delay. Taking account of the purposes of processing, they also have the right to have incomplete data completed, including by a supplementary statement. To exercise this right, they may contact an employee of the controller at any time.
d) Right to erasure (‘right to be forgotten’)
Every data subject has the right to request erasure of their personal data without undue delay where processing is not necessary and one of the following grounds applies: • the data is no longer necessary for the purposes for which it was collected or otherwise processed; • consent under Article 6(1)(a) or Article 9(2)(a) GDPR is withdrawn and there is no other legal ground for processing; • the data subject objects under Article 21(1) GDPR and there are no overriding legitimate grounds, or objects under Article 21(2); • the data has been unlawfully processed; • erasure is necessary to comply with an obligation under EU or Member State law applicable to the controller; • the data was collected in connection with information society services under Article 8(1) GDPR.
Where one of these grounds applies, data subjects may contact an employee of connectric GmbH at any time to request erasure of stored personal data. The employee will arrange for the request to be fulfilled without undue delay.
Where connectric GmbH has made personal data public and is obliged to erase it under Article 17(1) GDPR, we take reasonable steps, including technical measures, taking account of available technology and implementation costs, to inform other controllers processing the published data that the data subject has requested erasure of any links, copies or replications, insofar as processing is not necessary. An employee of connectric GmbH will arrange the necessary measures in each case.
e) Right to restriction of processing
Every data subject has the right to request restriction of processing where: • the accuracy of the data is contested, for a period enabling verification by the controller; • processing is unlawful and the data subject opposes erasure and requests restriction instead; • the controller no longer needs the data, but the data subject requires it to establish, exercise or defend legal claims; • the data subject has objected under Article 21(1) GDPR and verification of whether the controller’s legitimate grounds override those of the data subject is pending.
Where one of these conditions applies, data subjects may contact an employee of connectric GmbH at any time to request restriction of their stored personal data. The employee will arrange the restriction.
f) Right to data portability
Every data subject has the right to receive personal data they have provided to a controller in a structured, commonly used and machine-readable format, and to transmit it to another controller without hindrance. This applies where processing is based on consent under Article 6(1)(a) or Article 9(2)(a) GDPR or on a contract under Article 6(1)(b), is carried out by automated means, and is not necessary for a task in the public interest or the exercise of official authority vested in the controller.
Under Article 20(1) GDPR, the data subject also has the right to have data transmitted directly from one controller to another where technically feasible and where this does not adversely affect the rights and freedoms of others. To exercise data portability rights, data subjects may contact an employee of connectric GmbH at any time.
g) Right to object
Every data subject has the right to object at any time, on grounds relating to their particular situation, to processing based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions.
In the event of an objection, connectric GmbH will no longer process the data unless we demonstrate compelling legitimate grounds that override the data subject’s interests, rights and freedoms, or processing serves to establish, exercise or defend legal claims.
Where connectric GmbH processes personal data for direct marketing, the data subject may object at any time to processing for that purpose, including related profiling. If the data subject objects, connectric GmbH will stop processing their data for direct marketing.
Data subjects may also object, on grounds relating to their particular situation, to processing by connectric GmbH for scientific or historical research or statistical purposes under Article 89(1) GDPR, unless processing is necessary for a task carried out for reasons of public interest.
To exercise the right to object, data subjects may contact an employee of connectric GmbH or another employee directly. In connection with information society services, and notwithstanding Directive 2002/58/EC, they may exercise their right to object by automated means using technical specifications.
h) Automated individual decision-making, including profiling
Every data subject has the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, subject to the exceptions concerning contractual necessity, authorisation by EU or Member State law with appropriate safeguards, or the data subject’s explicit consent.
Where such a decision is necessary to enter into or perform a contract, or is based on explicit consent, connectric GmbH implements suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests. These include at least the right to human intervention by the controller, to express their point of view and to contest the decision. Data subjects may contact an employee of the controller at any time to exercise these rights.
i) Right to withdraw consent
Every data subject has the right to withdraw consent to the processing of personal data at any time. To exercise this right, they may contact an employee of the controller at any time.
5. Legal basis for processing
Article 6(1)(a) GDPR is the legal basis where we obtain consent for a specific processing purpose. Processing necessary to perform a contract with the data subject, such as delivering goods or providing services, is based on Article 6(1)(b). This also applies to necessary pre-contractual measures, such as enquiries about our products or services.
Where processing is required to comply with a legal obligation, such as tax obligations, the basis is Article 6(1)(c) GDPR. In rare cases, processing may be necessary to protect the vital interests of the data subject or another natural person, for example where a visitor is injured and essential information must be provided to a doctor, hospital or third party. The basis would then be Article 6(1)(d).
Processing may also be based on Article 6(1)(f) GDPR where necessary for legitimate interests pursued by our company or a third party, provided that the data subject’s interests, fundamental rights and freedoms do not override those interests. The European legislator specifically recognised that a legitimate interest may exist where the data subject is a client of the controller (Recital 47, sentence 2).
6. Legitimate interests pursued by the controller or a third party
Where processing is based on Article 6(1)(f) GDPR, our legitimate interest is conducting our business for the benefit of our employees and shareholders.
7. Retention periods
The relevant statutory retention period determines how long personal data is stored. Once it expires, the data is routinely erased unless still necessary to perform or initiate a contract.
8. Statutory or contractual requirements to provide personal data
Providing personal data may be required by law, for example tax rules, or by contractual provisions, for example information about a contractual partner. Providing data that we must subsequently process may sometimes be necessary to conclude a contract. Failure to provide it may prevent the contract from being concluded.
Before providing personal data, the data subject should contact an employee. The employee will explain in the individual case whether provision is legally or contractually required or necessary to conclude a contract, whether there is an obligation to provide it, and the possible consequences of not doing so.
9. Automated decision-making
As a responsible company, we do not use automated decision-making or profiling.
The original German privacy policy was created using the privacy policy generator of DGD Deutsche Gesellschaft für Datenschutz GmbH.