Privacy Policy

We appreciate your interest in our company. The management of GripFactory B.V. places great importance on the protection of personal data. The website of GripFactory B.V. can generally be used without the need to provide personal data. To the extent that someone wishes to use special services from our company via our website, the processing of personal data may be necessary. When the processing of personal data is necessary and there is no legal basis, we usually ask for the consent of the data subject.

The processing of personal data, such as company name, name, address, email address, or phone number of a data subject, always takes place in accordance with the General Data Protection Regulation and with the country-specific data protection rules applicable to GripFactory B.V. With this privacy statement, our company informs the public about the nature, scope, and purpose of the personal data we collect, use, and process. Additionally, data subjects are informed about their rights through this privacy statement.

GripFactory B.V. has implemented various technical and organizational measures to ensure the most complete protection of personal data processed via this website. Nevertheless, internet-based data transfers may inherently pose security risks, meaning that absolute protection cannot be guaranteed. For this reason, every data subject is free to provide personal data to us in another way, for example, by phone.

1. Definitions

The privacy statement of GripFactory B.V. is based on the terminology used by the European legislator and supervisor in the establishment of the General Data Protection Regulation (GDPR). Our privacy policy should be easily readable and understandable for both the public and our customers and business partners. To ensure this, we explain the terminology used in advance.

In this privacy statement, we use, for example, the following concepts:

A) Personal data
Personal data is any information relating to an identified or identifiable natural person, hereinafter referred to as 'the data subject'. An identifiable natural person is considered to be one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more specific characteristics that are characteristic of the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

B) Data subject
The data subject is an identified or identifiable natural person whose personal data is processed by the data controller.

C) Processing
Processing is any operation or set of operations performed on personal data, whether or not by automated means. This includes, among other things, the collection, recording, organization, structuring, storage, alteration or adaptation, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, aligning or combining, as well as restricting, erasing or destroying personal data.

D) Restriction of processing
Restriction of processing is the marking of stored personal data with the aim of limiting its processing in the future.

E) Profiling
Profiling is any form of automated processing of personal data whereby this personal data is used to evaluate certain personal aspects of a natural person. This particularly concerns the analysis or prediction of aspects related to work performance, economic situation, health, personal preferences, interests, reliability, behavior, residence, or movements of this natural person.

F) Pseudonymization
Pseudonymization is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that this additional information is kept separately and is subject to technical and organizational measures that ensure that the personal data is not attributed to an identified or identifiable natural person.

G) Data controller
The data controller is the natural or legal person, public authority, service, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data. When the purposes and means of this processing are determined by the law of the European Union or the law of the member states, it may be specified who the data controller is or according to which criteria they are designated.

H) Processor
The processor is a natural person or legal entity, government agency, service, or other body that processes personal data on behalf of the data controller.

I) Recipient
The recipient is a natural person or legal entity, government agency, service, or other body to whom personal data is provided, regardless of whether it concerns a third party. However, government agencies that may receive personal data in the context of a specific investigation under the law of the European Union or the law of a member state are not considered recipients.

J) Third Party
A third party is a natural person or legal entity, government agency, service, or other body, other than the data subject, the data controller, the processor, or persons who are authorized to process personal data under the direct authority of the data controller or the processor.

K) Consent
Consent is any freely given, specific, informed, and unambiguous indication of the data subject's wishes, in the form of a statement or a clear affirmative action, by which the data subject signifies agreement to the processing of their personal data.

2. Name and address of the data controller

The data controller within the meaning of the General Data Protection Regulation, other data protection legislation in the member states of the European Union, and other provisions regarding data protection is:

GripFactory B.V.
Ravenswade 102
3439 LD Nieuwegein
Netherlands

Phone number: +31 348 20 3000
E-mail: info@gripfactory.nl
Website: www.gripfactoryantislip.com

3. Name and address of the privacy supervisor

The responsible Privacy Supervisor is:

Drs. Patrick Marc de Koning
GripFactory B.V.
Marinus van Elswijkkade 14
3059 SG Rotterdam
Netherlands

Phone Number: + 31 10 4764372
E-mail: patrick@gripfactory.nl
Website: https://portal.gripfactoryantislip.com/privacybeleid

4. Recipients

Within GripFactory B.V., only those persons or departments have access to the data that they need to provide the services of GripFactory B.V.

Customer and user data is only provided to subcontractors when this is necessary to optimally perform our services. Our subcontractors are required to comply with data protection legislation and are bound to confidentiality.

Data from interested parties, customers, and users is provided to other service providers that support GripFactory B.V., for example, within the following categories:

IT services,
logistics,
printing services,
archiving,
mail and telecommunications,
consulting,
legal assistance,
research and consultancy,
compliance and data protection,
distribution,
as well as communication and customer service.

Our service providers are required to comply with data protection legislation and are bound to confidentiality.

In certain circumstances, data is provided to credit information agencies. Accurate information about the data processing by the credit information agency can be found in their privacy statements.

5. Cookies

The web pages of GripFactory B.V. use cookies. Cookies are small text files that are assigned to a computer system via a web browser and stored on it.

Many websites and servers use cookies. Many cookies contain a so-called cookie ID. A cookie ID is a unique identification of the cookie. It consists of a series of characters that can link web pages and servers to the specific web browser in which the cookie is stored. This allows visited websites and servers to distinguish the user's browser from other web browsers that contain different cookies. A specific web browser can be recognized and identified via the unique cookie ID.

By using cookies, GripFactory B.V. can offer users of this website more user-friendly services that would not be possible without placing cookies.

With the help of a cookie, the information and offers on our website can be optimized for the user. As mentioned earlier, cookies allow us to recognize the users of our website. The purpose of this recognition is to make the use of our website easier for users. For example, a user of a website that uses cookies does not have to re-enter their login details with each visit, as this is taken over by the website and the cookie stored on the user's computer system. Another example is the cookie of a shopping cart in the webshop. The webshop remembers via a cookie which items a customer has placed in the virtual shopping cart.

The data subject can prevent the placement of cookies by our website at any time by adjusting the settings of the web browser used accordingly and thereby permanently refusing the use of cookies. In addition, already placed cookies can be deleted at any time via a web browser or other software programs. This is possible in all common web browsers. When the data subject disables the placement of cookies in the web browser used, not all functions of our website may be fully usable.

6. Collection of general data and information

Each time the website is visited by a data subject or an automated system, the website of GripFactory B.V. collects a range of general data and information. This general data and information is stored in the server's log files. This may include: (1) the type and version of the browser used, (2) the operating system of the system seeking access, (3) the website from which a visitor has come to our website, the so-called referrer, (4) the subpages of our website that are visited by the access system, (5) the date and time of access to the website, (6) an internet protocol address, or IP address, (7) the internet provider of the access system, and (8) other similar data and information that are necessary for the security in the event of attacks on our IT systems.

GripFactory B.V. uses this general data and information without identifying the data subject. This information is necessary to (1) correctly present the content of our website, (2) optimize the content of our website and the information displayed on it, (3) ensure the continued operation of our information technology systems and the technology of our website, and (4) provide law enforcement agencies with the necessary information for criminal prosecution in the event of a cyber attack. The data and information collected anonymously by GripFactory B.V. are therefore statistically evaluated on one hand and used to enhance data protection and data security within our company on the other hand, so that in the long term an optimal level of protection for the personal data we process can be ensured. The anonymous data from the server log files are stored separately from all personal data provided by a data subject.

7. Registration on our website

The data subject has the option to register on the website of the data controller by providing personal data. Which personal data are passed on to the data controller is evident from the relevant input form used for registration. The personal data provided by the data subject are collected and stored exclusively for internal use by the data controller and for its own purposes. The data controller may pass the data on to one or more processors, such as a package service, which process the personal data exclusively for internal use and whose processing must be attributed to the data controller.

Upon registration on the website of the data controller, the IP address assigned to the data subject by the internet service provider (ISP), as well as the date and time of registration, are also stored. The storage of this data takes place against the background that only in this way can abuse of our services be prevented and this data makes it possible, if necessary, to clarify previous violations. In this respect, the storage of this data is necessary for the protection of the data controller. In principle, this data is not passed on to third parties unless there is a legal obligation to provide it or the transfer is necessary for criminal prosecution.

The registration of the data subject, in which personal data is voluntarily provided, is intended to enable the data controller to offer the data subject content or services that, given their nature, can only be offered to registered users. Registered individuals are free at any time to modify the personal data provided during registration or to have it completely removed from the database of the data controller.

The data controller provides any data subject, upon request, with information at any time about the personal data stored about the data subject. In addition, the data controller corrects or deletes personal data at the request or instruction of the data subject, as long as this does not conflict with legal retention obligations. In this regard, the privacy regulator mentioned in this privacy statement and all employees of the data controller are available as a contact person for the data subject.

8. Subscription to our newsletter

On the website of GripFactory B.V., users are given the opportunity to subscribe to the newsletter of our company. During the subscription, the input form used determines which personal data is sent to the data controller.

GripFactory B.V. periodically informs its customers and business partners via a newsletter about business offers. The newsletter of our company can only be received by the data subject if (1) the data subject has a valid email address and (2) the data subject registers for the newsletter. For legal reasons, a confirmation email is sent via the double opt-in procedure to the email address that was first provided by the data subject for receiving newsletters. This confirmation email is used to verify whether the owner of the email address has given consent to receive the newsletter.

When registering for the newsletter, we also store the IP address of the computer system used by the data subject at the time of registration, as well as the date and time of registration, as assigned by the internet service provider (ISP). The collection of this data is necessary to trace any misuse of a data subject's email address at a later time and therefore serves as a legal precaution for the data controller.

Personal data collected in connection with a subscription to the newsletter will only be used for sending our newsletter. In addition, subscribers to the newsletter may be informed by email if this is necessary for the operation of the newsletter service or for a related registration, for example in the case of changes to the newsletter service or changes in the technical circumstances. The personal data collected in the context of the newsletter service will not be passed on to third parties. The data subject can terminate their subscription to our newsletter at any time. The consent for the storage of personal data that the data subject has provided to us for sending the newsletter can be withdrawn at any time. A corresponding link for withdrawing this consent is included in every newsletter. Additionally, it is possible to unsubscribe from the newsletter directly on the website of the data controller at any time or to inform the data controller about this in another way.

9. Newsletter tracking

The newsletters from GripFactory B.V. contain so-called tracking pixels. A tracking pixel is a small image file that is embedded in emails sent in HTML format to enable registration and analysis via a log file. This allows for a statistical evaluation of the success or failure of online marketing campaigns. Using the embedded tracking pixels, GripFactory B.V. can see whether and when an email has been opened by a data subject and which links in the email have been clicked by the data subject.

The personal data collected via the tracking pixel in the newsletters is stored and evaluated by the data controller to optimize the sending of newsletters and to better tailor the content of future newsletters to the interests of the data subject. This personal data is not shared with third parties. Data subjects can withdraw the consent given through the double opt-in procedure at any time. After withdrawal, the personal data will be deleted by the data controller. Unsubscribing from receiving the newsletter is automatically considered by GripFactory B.V. as a withdrawal of consent.

10. Contact options via the website

Contact form and general contact
The data controller processes the following data about you to handle your request, to the extent that you provide this data via the contact form: salutation, first name, last name, email address, street, postal code, city, phone number, and the content of your request. We provide your personal data to recipients when this is necessary to fulfill your request. The legal basis for processing your personal data depends on your request and may arise from a contract with you article 6 paragraph 1 sub b GDPR, your consent article 6 paragraph 1 sub a GDPR, or from a balancing of interests article 6 paragraph 1 sub f GDPR based on our legitimate interest in providing you with good service.

We are supported by our IT service providers when using our contact form, who act as processors. We process your data, if the processing is based on your consent, until you withdraw your consent. If the processing is based on a balancing of interests, we process your data until you object or until your request has been handled. If you do not provide contact details or give us insufficient information to understand and process your request, we cannot process your request. The other data is voluntary. This service is intended solely for individuals over 18 years old.

When we process your personal data based on your consent article 6 paragraph 1 sub a GDPR, you can withdraw this consent at any time with effect for the future. When we process your personal data based on a balancing of interests article 6 paragraph 1 sub f GDPR, you can object to the processing at any time with effect for the future.

In addition, we process the information about the "referrer" in the context of your use of the contact form article 6 paragraph 1 sub b GDPR. This information will be deleted no later than four weeks. Without the registration of this information, the use of the contact form is technically not possible.

Form for product information, appointment and quote request
The data controller processes the following data about you in order to handle your request, to the extent that you provide this data via the contact form: salutation, first name, last name, email address, street, postal code, city, phone number, and the content of your request. We provide your personal data to recipients when this is necessary to fulfill your request. The legal basis for the processing of your personal data depends on your request and may arise from a contract with you Article 6(1)(b) GDPR, your consent Article 6(1)(a) GDPR, or from a balancing of interests Article 6(1)(f) GDPR based on our legitimate interest in providing you with good service.

11. Routine deletion and blocking of personal data

The data controller processes and retains personal data of the data subject only for the period that is necessary for the purpose of storage, or, if applicable, for the period established by the European legislator and supervisor or another legislator in laws or regulations to which the data controller must comply.

When the purpose of storage ceases or when the retention period prescribed by the European legislator and supervisor or another competent legislator expires, the personal data is routinely blocked or deleted in accordance with legal provisions.

12. Rights of the data subject

A) Right to confirmation
Every data subject has the right, as granted by the European legislator and supervisor, to obtain confirmation from the data controller as to whether personal data concerning him or her is being processed. If a data subject wishes to exercise this right to confirmation, he or she can contact our privacy supervisor or another employee of the data controller at any time.

B) Right to information
Every data subject whose personal data is processed has the right granted by the European legislator and supervisor to obtain information free of charge at any time about the personal data stored about him or her, as well as a copy of this information. In addition, the European legislator and supervisor have determined that the data subject has the right to the following information:

The purposes of processing;
the categories of personal data being processed;
the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organizations;
if possible, the intended period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
the existence of a right to rectification or erasure of personal data concerning him or her, or to restriction of processing by the data controller, or the right to object to such processing;
the existence of a right to lodge a complaint with a supervisory authority;
if the personal data has not been collected from the data subject: all available information about the source of the data;
the existence of automated decision-making, including profiling in accordance with Article 22 paragraph 1 and paragraph 4 GDPR, and, at least in those cases, useful information about the underlying logic, as well as the significance and expected consequences of such processing for the data subject.

In addition, the data subject has the right to obtain information about whether personal data has been provided to a third country or an international organization. If this is the case, the data subject also has the right to obtain information about the appropriate safeguards in relation to this provision.

If a data subject wishes to exercise this right to information, he or she can contact our privacy supervisor or another employee of the data controller at any time.

C) Right to rectification
Every data subject has the right granted by the European legislator and supervisor to have inaccurate personal data concerning him or her rectified without delay. In addition, the data subject, taking into account the purposes of the processing, has the right to request the completion of incomplete personal data, including by means of a supplementary statement.

If a data subject wishes to exercise this right to rectification, he or she can contact our privacy supervisor or another employee of the data controller at any time.

D) Right to erasure, or the right to be forgotten
Every data subject has the right granted by the European legislator and supervisor to request the data controller to erase personal data concerning him or her without delay, if one of the following reasons applies and the processing is no longer necessary:

The personal data has been collected or otherwise processed for purposes for which it is no longer needed.
The data subject withdraws the consent on which the processing was based in accordance with Article 6(1)(a) GDPR or Article 9(2)(a) GDPR, and there is no other legal basis for the processing.
The data subject objects to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) GDPR.
The personal data has been processed unlawfully.
The erasure of personal data is necessary to comply with a legal obligation under the law of the European Union or the law of a member state to which the data controller is subject.
The personal data has been collected in connection with the provision of services of the information society pursuant to Article 8(1) GDPR.

If a data subject wishes to exercise this right to erasure, he or she may contact our privacy supervisor or another employee of the data controller at any time. The privacy supervisor of GripFactory B.V. or another employee will ensure that the request for erasure is carried out immediately.

If the personal data has been made public by GripFactory B.V. and our company, as the data controller, is obliged under Article 17 paragraph 1 GDPR to delete this personal data, GripFactory B.V., taking into account the available technology and the implementation costs, will take appropriate measures, including technical measures, to inform other data controllers processing the publicly disclosed personal data that the data subject has requested the deletion of all links to this personal data, or copies or reproductions thereof, insofar as processing is no longer required. The privacy supervisor of GripFactory B.V. or another employee will take the necessary measures in individual cases.

E) Right to restriction of processing
Every data subject has the right granted by the European legislator and supervisor to request the data controller to restrict processing if one of the following conditions applies:

The accuracy of the personal data is contested by the data subject, for a period that allows the data controller to verify the accuracy of the personal data.
The processing is unlawful and the data subject opposes the deletion of the personal data and instead requests the restriction of the use of his or her personal data.
The data controller no longer needs the personal data for the processing purposes, but the data subject still needs it for the establishment, exercise, or defense of a legal claim.
The data subject has objected to the processing in accordance with Article 21 paragraph 1 GDPR and it has not yet been determined whether the legitimate grounds of the data controller outweigh those of the data subject.

If one of the above conditions is met and a data subject wishes to restrict the personal data stored by GripFactory B.V., he or she can contact our privacy supervisor or another employee of the data controller at any time. The privacy supervisor of GripFactory B.V. or another employee will ensure that the processing is restricted.

F) Right to data portability
Every data subject has the right granted by the European legislator and supervisor to receive the personal data that he or she has provided to the data controller in a structured, commonly used, and machine-readable format. In addition, the data subject has the right to transfer this data to another data controller, without being hindered by the data controller to whom the personal data has been provided, insofar as the processing is based on consent in accordance with Article 6 paragraph 1 sub a GDPR or Article 9 paragraph 2 sub a GDPR, or on a contract in accordance with Article 6 paragraph 1 sub b GDPR, and the processing is carried out by automated means. This applies insofar as the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.

Furthermore, the data subject, in exercising his or her right to data portability in accordance with Article 20(1) GDPR, has the right to have his or her personal data transmitted directly from one controller to another, where technically feasible and without adversely affecting the rights and freedoms of others.

To exercise the right to data portability, the data subject may contact the privacy supervisor or another employee designated by GripFactory B.V. at any time.

G) Right to object
Every data subject has the right granted by the European legislator and supervisor to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her, when the processing is based on Article 6(1)(e) or (f) GDPR. This also applies to profiling based on these provisions.

GripFactory B.V. will cease processing personal data in the event of an objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or when the processing is necessary for the establishment, exercise, or defense of legal claims.

If GripFactory B.V. processes personal data for direct marketing, the data subject has the right to object at any time to the processing of personal data for such marketing purposes. This also applies to profiling to the extent that it is related to direct marketing. If the data subject objects to processing by GripFactory B.V. for direct marketing purposes, GripFactory B.V. will no longer process the personal data for this purpose.

In addition, the data subject has the right to object to the processing of personal data by GripFactory B.V. for scientific or historical research or for statistical purposes in accordance with Article 89(1) GDPR, unless this processing is necessary for the performance of a task carried out in the public interest.

To exercise the right to object, the data subject can contact the privacy supervisor of GripFactory B.V. or another employee directly. The data subject is also free to exercise his or her right to object through automated procedures using technical specifications in the context of using services of the information society and notwithstanding Directive 2002/58/EC.

H) Automated decision-making in individual cases, including profiling
Every data subject has the right granted by the European legislator and supervisor not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning him or her or similarly significantly affects him or her, unless the decision (1) is necessary for the conclusion or performance of a contract between the data subject and the data controller, (2) is authorized by Union law or the law of a Member State to which the data controller is subject and which includes appropriate measures to safeguard the rights, freedoms, and legitimate interests of the data subject, or (3) is based on the explicit consent of the data subject.

If the decision (1) is necessary for the establishment or execution of a contract between the data subject and the data controller, or (2) takes place with the explicit consent of the data subject, GripFactory B.V. takes appropriate measures to protect the rights, freedoms, and legitimate interests of the data subject. This includes at least the right to human intervention on behalf of the data controller, the right to express one's own opinion, and the right to contest the decision.

If a data subject wishes to exercise rights regarding automated decision-making, he or she can contact our privacy supervisor or another employee of the data controller at any time.

I) Right to withdraw consent for data protection
Every data subject has the right granted by the European legislator and supervisor to withdraw consent for the processing of personal data at any time.

If a data subject wishes to exercise his or her right to withdraw consent, he or she can contact our privacy supervisor or another representative of the data controller at any time.

13. Data protection in applications and application procedures

The data controller collects and processes personal data of applicants for the purpose of handling the application procedure. The processing may take place electronically. This is particularly the case when an applicant provides the desired application documents electronically, for example by email or via the form on the website, to the data controller.

When the data controller enters into an employment contract with the applicant, the provided data for the handling of the employment relationship is stored in accordance with legal regulations. If the data controller does not enter into an employment contract with the applicant, the application documents will be automatically deleted two months after the notification of rejection, provided that deletion does not conflict with other legitimate interests of the data controller. Another legitimate interest in this sense is, for example, an obligation to provide evidence in a procedure under the General Equal Treatment Act.

14. Rules for data protection when using external services

The data controller may integrate components, plug-ins, or services from external parties on this website. These external services may relate to social media, web analytics, online marketing, remarketing, video display, tag management, customer communication, or other functionalities that contribute to the use and improvement of our website.

External services may be used to enable certain functions on our website, to optimize the content of our website, to analyze visitor behavior, to display relevant information or advertisements, or to improve communication with visitors, customers, and business partners.

With each visit to a page on which an external service is integrated, the web browser on the information technology system of the data subject may automatically connect to the relevant external service provider. As part of this technical procedure, the external service provider may receive information about which specific page of our website has been visited by the data subject.

When the data subject is simultaneously logged into an account of the relevant external service provider, this service provider may link the visit to our website to the personal user account of the data subject. This can also occur when the data subject does not actively click on the relevant plug-in, button, or feature. When the data subject does use such a feature, for example by clicking a button, watching a video, using a form, or interacting with a part of the website, this information may also be processed and stored by the external service provider.

The data processed by external services may include, among other things, the IP address, browser data, device data, visited pages, click behavior, the duration of the website visit, the origin of the visitor, and other technical data necessary for the operation of the relevant service. Depending on the external service provider, this data may also be used for analysis, security, personalization, marketing purposes, or improving the service.

As required by law, external services are only used after the data subject has given consent for this. The data subject can withdraw such consent at any time. Additionally, the data subject can limit, refuse, or delete the use of cookies or similar technologies through the settings of the browser used or through the available cookie settings on our website.

If the data subject does not want data to be linked to a personal account with an external service provider, the data subject can often prevent this by logging out of the relevant external service before visiting our website. Please note that certain features of our website may not be fully available when cookies, plug-ins, or external services are disabled.

15. Legal basis for processing

Article 6(1)(a) GDPR serves as the legal basis for our company for processing activities where we request consent for a specific processing purpose.

If the processing of personal data is necessary for the performance of a contract to which the data subject is a party, such as in cases where processing is necessary for the delivery of goods or the provision of another service or consideration, the processing is based on Article 6(1)(b) GDPR. This also applies to processing that is necessary for taking pre-contractual measures, for example, in response to inquiries regarding our products or services.

When our company is subject to a legal obligation for which the processing of personal data is necessary, such as complying with tax obligations, the processing is based on Article 6(1)(c) GDPR.

In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or another natural person. This would be the case, for example, when a visitor to our company is injured and needs to provide their name, age, health insurance details, or other essential information to a doctor, hospital, or other third party. The processing would then take place based on Article 6(1)(d) of the GDPR.

Finally, processing may take place based on Article 6(1)(f) of the GDPR. This legal basis can be used for processing that does not fall under any of the aforementioned legal grounds but is necessary for the protection of the legitimate interests of our company or a third party, unless the interests, fundamental rights, and freedoms of the data subject outweigh them. Such processing is particularly permitted because it is specifically mentioned by the European legislator. In this context, it is assumed that there may be a legitimate interest when the data subject is a customer or relationship of the data controller, as referred to in Recital 47 of the GDPR.

16. Legitimate interests in processing pursued by the data controller or a third party

If the processing of personal data takes place based on Article 6(1)(f) of the GDPR, our legitimate interest consists of carrying out our business activities for the benefit of all our employees and shareholders.

17. Duration of the storage period of personal data

18. Legal or contractual provisions for the provision of personal data; necessity for the conclusion of the agreement; obligation of the data subject to provide personal data; possible consequences of not providing it

We clarify that the provision of personal data is partly legally required, for example under tax regulations, or may arise from contractual provisions, such as data from contracting parties. In certain cases, it may be necessary for the data subject to provide personal data to us when concluding an agreement, which must then be processed by us.

The data subject is required to provide personal data to us when our company enters into an agreement with him or her. Not providing this personal data would result in the agreement with the data subject not being able to be concluded.

Before the data subject provides personal data, he or she can contact our privacy supervisor. Our privacy supervisor explains to the data subject on a case-by-case basis whether the provision of personal data is legally or contractually required, or necessary for the conclusion of an agreement, whether there is an obligation to provide the personal data, and what the possible consequences are of not providing this personal data.

19. Existence of automated decision-making

As a responsible company, we refrain from automated decision-making or profiling.