Contact

Privacy

To keep you informed

This privacy notice informs you of how we handle your personal data and of your rights under the European General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). Unless otherwise stated below, SupplyX GmbH is responsible for the data processing (hereinafter referred to as "we" or "us").

Our privacy notices consist of two parts. Part A provides general information about data protection at SupplyX GmbH, including details of your rights and how to exercise them. Part B is dedicated to the various groups of affected individuals and explains in detail what data we collect and process about you. In doing so, we address you in your role as:

 

a. Visitors to our website;
b. Newsletter subscribers;
c. Contacts at customers, service providers, suppliers, and business partners;
d. Applicants;
e. Social media visitors;
f. Special notes for customers from Switzerland.

 

A. General Information

1. Our Contact Information

If you have any questions or suggestions regarding this information, or if you wish to assert your rights, please direct your enquiry to:

SupplyX GmbH
Werner-Otto-Str. 1-7
22179 Hamburg
Email: hellonDOpwqAytGL@supplyxnZtkJqyChf.info
Tel: +49 40 537 55 – 0

2. On what basis do we process your data?

The legal term 'personal data' refers to all information relating to an identified or identifiable person. We process personal data in compliance with the applicable data protection regulations, particularly the GDPR and the BDSG. We only process data on the basis of legal permission. We only process personal data with your consent (Art. 6 para. 1 lit. a GDPR), to fulfil a contract to which you are a party, or at your request to take steps prior to entering into a contract (Art. 6 para. 1 lit. b GDPR), to fulfil a legal obligation (Art. 6 para. 1 lit. c GDPR) or if processing is necessary for the protection of our legitimate interests or those of a third party, unless your interests or fundamental rights and freedoms, which require the protection of personal data, override them (Art. 6 para. 1 lit. f GDPR).

If you apply for a position within our company, we will also process your personal data in order to make a decision regarding the establishment of an employment relationship (Section 26(1) of the Federal Data Protection Act and Article 6(1)(b) of the GDPR).

3. Your rights

You have control over your data! As a data subject, you have the right to assert your rights against us. In this context, you have the following rights under applicable data protection laws:

  • You have the right to request information under Art. 15 GDPR and § 34 BDSG, to find out whether and, if so, to what extent, we are processing personal data about you.
  • You have the right to request that we correct your data under Art. 16 GDPR.
  • You have the right to request the deletion of your personal data from us under Art. 17 GDPR and § 35 BDSG.
  • You have the right to request the restriction of the processing of your personal data under Art. 18 GDPR.
  • You have the right to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format, and to transmit this data to another controller (Art. 20 GDPR.
  • If you have given us separate consent for data processing, you can revoke this at any time in accordance with Art. 7 para. 3 GDPR. This does not affect the lawfulness of processing carried out based on consent before it was withdrawn.
  • If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR.

You have the right to object under Art. 21(1) GDPR. 1 GDPR to processing based on the legal basis of Art. 6 para. 1 lit. e or f GDPR, for reasons arising from your particular situation. If we process your personal data for direct marketing purposes, you can object to this processing in accordance with Art. 21(2) and (3) GDPR.

If you exercise your rights under Articles 15 to 22 GDPR, we will process the transmitted personal data in order to implement these rights and provide proof thereof. Data stored for the purpose of providing information and its preparation will only be processed for these purposes and for data protection control purposes. Otherwise, we will restrict processing in accordance with Art. 18 GDPR.

These processing activities are based on the legal basis of Art. 6 para. 1 lit. c GDPR in conjunction with Art. 15 to 22 GDPR and § 34 para. 2 BDSG.

4. Where do we process your data?

In principle, we process your data on European servers with the highest security standards. In providing our services, we are supported by external service providers to whom we send your data. Some data processing may involve the transfer of certain personal data to third countries, i.e., countries where the GDPR is not applicable law. Such a transfer occurs in a permissible manner if the European Commission has determined that an adequate level of data protection is provided in such a third country. This applies to all transfers to countries on this list: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.

If such an adequacy decision by the European Commission is not available, the transfer of personal data to a third country only takes place if suitable guarantees exist in accordance with Art. 46 GDPR or if one of the conditions of Art. 49 GDPR is met.

If no adequacy decision is available and nothing else is specified below, we use the EU standard contractual clauses as suitable guarantees for the transfer of personal data from the scope of the GDPR to third countries. You have the option to receive or view these EU standard contractual clauses in copy. Please contact the address provided under Contact for this purpose.

If you consent to the transfer of personal data to third countries, the transfer takes place on the legal basis of Art. 49 para. 1 lit. a GDPR.

5. Who do we disclose your personal data to, and why?

In order to provide our services and operate as a company, we use various external companies to whom we may transmit personal data. If additional specific recipients receive personal data relating to certain groups of data subjects, we will inform you of this in Part B.

Hosting providers: We use certified service providers to host our data who adhere to the highest security standards.

IT service providers and SaaS providers: We utilise the services of various providers who support us as processors, simplifying and optimising our processes.

Advertising and marketing providers: We aim to increase brand awareness, promote demand for our products and enhance customer loyalty with the help of advertising and marketing providers. Campaigns are planned and executed, and their success is measured and analysed. These providers are usually also processors.

Business partners and service providers: During our day-to-day operations, we may share your personal data with our business partners and service providers. This includes freight forwarders, transport companies, warehouse operators, banks and insurance companies, for example.

Affiliated companies: As we are a corporate group, data transfer between companies is possible. Such transfers may occur in the context of the internal provision of IT programmes and systems, for example.

Administration and authorities: To comply with legal regulations, respond to court orders, or other similar official requests, further transfers may take place. This includes transfers to the tax administration and tax consulting/auditing firms.

6. How long do we store your data?

Unless stated otherwise in the following notes, we only store data for as long as is necessary to fulfil the processing purpose or our contractual or legal obligations. Such legal retention obligations may arise from commercial or tax law regulations in particular. From the end of the calendar year in which the data was collected, we will retain personal data contained in our accounting records for ten years, and personal data contained in commercial correspondence and contracts for six years. Furthermore, we will retain data related to verifiable consents and claims for the duration of the statutory limitation periods. Data stored for advertising purposes will be deleted if you object to its use for this purpose.

7. How do we use "cookies" and other tracking technologies?

We use cookies and similar technologies on our website. You can find more information about how we use these technologies in our cookie banner. You can access the banner via the footer of our website. You will also find there a list of other companies that place cookies on our website and process data based on your consent according to Art. 6 para. 1 lit. a GDPR. You will also find a list of the cookies that we place and an explanation of how you can refuse certain types of cookies.

8. How can you contact our data protection officer?

You can contact our data protection officer using the following details:

Herting Oberbeck Datenschutz GmbH
Email: data-protectionnDOpwqAytGL@supplyxnZtkJqyChf.info
Website: www.datenschutzkanzlei.de/

B. Special Part: How and why we process your data

a. Visitors to our website

1) We process pseudonymous information about the device and browser you are using, server log files, your network connection, and your IP address for the following purposes:

  • Ensuring the security, operability and stability of our websites, including defence against attacks.

Legal basis: Legitimate interest under Art. 6 para. 1 lit. f) GDPR in the proper functionality and stability of the website.

  • Sending push notifications and analyzing interaction with push notifications.

Legal basis: Consent under Art. 6 para. 1 lit. a GDPR, which we obtain via a banner on our website and which you can revoke at any time. The unsubscription process is explained in detail at the following link:
https://cleverpush.com/faq.

2) We process information about how you behave on the website. This includes the IP address as well as user IDs, which are partially assigned by third parties, and is done for the following purposes:

  • Measuring reach and analyzing visitor behavior to optimize our websites, increase customer satisfaction, and error analysis;
  • Remarketing to acquire new customers through personalized delivery of our advertising;
  • Incorporation of third-party content.

Legal basis: Consent under Art. 6 para. 1 lit. a) GDPR, which we obtain via the consent banner on our website and which you can revoke or adjust at any time via the footer of the website.

b. Newsletter subscribers

We process name, contact details, and possibly other data that you provide to us when signing up for our newsletter for the following purposes:

  • Registration for and sending of personalized promotional mailings with information and updates about us, our services, and current developments in the world of logistics and procurement for the purpose of sales promotion and acquisition of new customers.

Legal basis: The legal basis for data processing in connection with our newsletter is your consent according to Art. 6 para. 1 lit. a) GDPR, which you can revoke at any time by contacting the above-mentioned contact details or using the unsubscribe link in our newsletter.

c. Contact persons at customers, service providers, suppliers, and business partners

We process data that you provide to us about yourself and the company you work for, such as your name, email address, and phone number for the following purposes:

  • Fulfillment of the contract with the company you work for (this includes contract management, documentation of ongoing collaboration, billing, and communication).

Legal basis: Legitimate interest under Art. 6 para. 1 lit. f) GDPR in the fulfillment of the contract between the company you work for and us.

d. Applicants

1) Data that you provide to us during your application or that a recruitment agency transmits to us about you. This includes information about your resume, your previous career, and other data that we process for the following purposes:

  • Determining whether employment is possible;
  • Initiating an employment relationship.

Legal basis: Initiation of a contract according to Art. 6 para. 1 lit. b) GDPR and § 26 para. 1 S. 1 BDSG.

  • Fulfillment of legal retention obligations or defense against legal claims.

Legal basis: Compliance with legal obligations under Art. 6 para. 1 lit. c) GDPR.

  • Inclusion in our talent pool for later re-contact if no employment relationship is established for the time being.

Legal basis: Consent under Art. 6 para. 1 lit. a) GDPR, which you can revoke at any time by contacting the above-mentioned contact details.

If we are unable to offer you employment, we will retain the application documents you submitted for up to six months after a possible rejection for the purpose of answering questions related to your application and rejection. This does not apply if legal provisions oppose deletion, if further retention is necessary for the purpose of providing evidence, or if you have expressly consented to longer retention.

e. Social media visitors

1) Responsibility of social media providers

If you visit our social media page (LinkedIn), where we present our company, certain information about you as a visitor is processed.

Further information on data processing by LinkedIn can be found in the privacy policy of LinkedIn Ireland Unlimited Company.

2) Joint responsibility of social media providers and SupplyX GmbH (joint controllers)

LinkedIn as a social media provider collects and processes event data and sends us anonymized statistics and data for our pages, which help us gain insights into the various activities that visitors perform on our page (so-called “page insights”). These page insights are created based on certain information about individuals who have visited our page(s).

Further information on data processing by LinkedIn and us:

  • Joint Controller Agreement with LinkedIn Ireland Unlimited Company
  • Data subject rights can be asserted via this contact form at LinkedIn. You can contact LinkedIn's data protection officer via this link.
  • LinkedIn and SupplyX GmbH have agreed that the Irish Data Protection Commission is the competent supervisory authority that oversees the processing of page insights. You can submit your complaint to the Irish Data Protection Commission (see data protection.ie) or to another supervisory authority.

3) Responsibility of SupplyX GmbH

We process information that you provide to us via our social media channels on the respective social media platform. This information may include the name used, contact information, or a message to us.

Legal basis: Legitimate interest under Art. 6 para. 1 lit. f) GDPR in communication with interested parties and followers.

f. Special notes for customers from Switzerland

If you are a data subject within the scope of the Swiss Federal Data Protection Act, the information under this point also applies.

The legal references made in this privacy information are directed at data subjects in Switzerland according to the comparable provisions of the Federal Data Protection Act. This particularly concerns the applicable rights of data subjects under Arts. 25-29, 32 DPA.

Data processing may take place in the following countries outside of Switzerland:

  • Germany
  • Other EU and EEA countries
  • USA

We guarantee an adequate level of data protection. This is ensured by:

  • A recognized adequate level of data protection according to Art. 16 para. 1 DPA for the recipient country;
  • Standard data protection clauses that the FADP has previously approved, issued, or recognized, particularly the standard contractual clauses of the European Commission;
  • An international treaty that regulates an adequate level of data protection.