Privacy

In this privacy notice, we inform you about how we handle your personal data and about your rights under the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The data controller is (unless otherwise stated below) SupplyX GmbH (hereinafter referred to as “we” or “us”).

Our privacy notice consists of two parts. In Part A, you will find general information on data protection at SupplyX GmbH and learn, amongst other things, what rights you have and where you can exercise them. Part B focuses on the various data subject groups and explains in detail what data we collect and process about you. In doing so, we address you in your role as:

a. visitors to our website;
b. newsletter subscribers;
c. contact person at customers, service providers, suppliers and business partners;
d. job applicants;
e. social media visitors;
f. Special information for customers in Switzerland.

1. Our Contact Information

If you have any questions or suggestions regarding this information, or if you wish to exercise your rights, please direct your enquiry to:

SupplyX GmbH
Werner-Otto-Str. 1-7
22179 Hamburg
Email: hellonDOpwqAytGL@supplyxnZtkJqyChf.info
Tel: +49 40 537 55 – 0

2. On what basis do we process your data?

The data protection term “personal data” refers to any information relating to an identified or identifiable natural person. We process personal data in compliance with the relevant data protection regulations, in particular the GDPR and the BDSG. We only process data on the basis of a legal authorisation. We process personal data only with your consent (Article 6(1)(a) of the GDPR), to fulfil a contract to which you are a party, or in response to your request to take pre-contractual measures (Article 6(1)(b) of the GDPR), to comply with a legal obligation (Article 6(1)(c) of the GDPR) or where processing is necessary to safeguard our legitimate interests or the legitimate interests of a third party, provided that your interests or fundamental rights and freedoms, which require the protection of personal data, do not override those interests (Article 6(1)(f) of the GDPR).

If you apply for a vacancy within our company, we also process your personal data for the purpose of deciding whether to enter into an employment relationship (Section 26(1), first sentence, of the German Federal Data Protection Act (BDSG) and Article 6(1)(b) of the GDPR).

3. Your rights

You have control over your data! As a data subject, you have the right to assert your rights against us. In this context, you have the following rights under applicable data protection laws: You are in control of your data! As a data subject, you therefore have the right to exercise your data subject rights vis-à-vis us. Within the framework of the data protection laws applicable to you, you have the following rights:

• In accordance with Article 15 of the GDPR and Section 34 of the BDSG, you have the right to request information as to whether, and if so to what extent, we process personal data relating to you.
• You have the right, in accordance with Article 16 of the GDPR, to request that we rectify your data.
• You have the right, in accordance with Article 17 of the GDPR and Section 35 of the BDSG, to request that we erase your personal data.
• You have the right, in accordance with Article 18 of the GDPR, to have the processing of your personal data restricted.
• You have the right, in accordance with Article 20 of the GDPR, to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and to transmit this data to another controller.
• If you have given us separate consent to the processing of your data, you may withdraw this consent at any time in accordance with Article 7(3) of the GDPR. Such withdrawal does not affect the lawfulness of the processing carried out on the basis of your consent prior to the withdrawal.
• If you consider that the processing of your personal data infringes the provisions of the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Article 77 of the GDPR.

In accordance with Article 21(1) of the GDPR, you have the right to object to processing based on the legal grounds set out in Article 6(1)(e) or (f) of the GDPR on grounds relating to your particular situation. Where we process personal data relating to you for the purposes of direct marketing, you may object to such processing in accordance with Article 21(2) and (3) of the GDPR.

If you exercise your rights under Articles 15 to 22 of the GDPR, we will process the personal data provided for the purpose of implementing these rights and to be able to provide evidence thereof. We will process data stored for the purpose of providing information and preparing such information solely for this purpose and for data protection monitoring purposes, and will otherwise restrict processing in accordance with Article 18 of the GDPR.

This processing is based on the legal basis of Article 6(1)(c) of the GDPR in conjunction with Articles 15 to 22 of the GDPR and Section 34(2) of the BDSG.

4. Where do we process your data?

As a general rule, we process your data on European servers meeting the highest security standards. In providing our services, we are supported by external service providers to whom we send your data. Some data processing operations may involve the transfer of certain personal data to third countries, i.e. countries where the GDPR is not applicable. Such a transfer is permitted if the European Commission has determined that an adequate level of data protection is provided in that third country. This applies to all transfers to countries on this list: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.

Where no such adequacy decision has been adopted by the European Commission, personal data may only be transferred to a third country if suitable safeguards are in place in accordance with Article 46 of the GDPR or if one of the conditions set out in Article 49 of the GDPR is met.

Where no adequacy decision exists and unless otherwise stated below, we use the EU Standard Data Protection Clauses as suitable safeguards for the transfer of personal data from the scope of the GDPR to third countries. You have the option to receive a copy of these EU Standard Data Protection Clauses or to view them. Please contact us at the address provided under “Contact” for this purpose.

If you consent to the transfer of personal data to third countries, the transfer takes place on the legal basis of Article 49(1)(a) of the GDPR.

5. To whom and why do we disclose your personal data?

In order to provide our services and operate commercially as a business, we use various external companies to whom we transfer personal data in some cases. Where specific recipients receive personal data from certain categories of data subjects, we will inform you of this in Part B.

• Hosting providers: We engage service providers to host our data, who adhere to the highest security standards.
• IT service providers and SaaS providers: We utilise the services of various service providers who support us as data processors and simplify and optimise our processes.
• Advertising and marketing providers: With the help of advertising and marketing providers, we aim to increase our brand awareness, promote demand for our products and enhance customer loyalty. To this end, we plan and run campaigns, and measure and analyse their success. These providers are generally also data processors.
• Business partners and service providers: As part of our day-to-day operations, we may transfer your personal data to our business partners and service providers. These include, for example, freight forwarders and transport companies, warehouse operators, banks and insurance companies.
• Affiliated companies: We are part of a group of companies, which means that data may be transferred between companies within this group. Such transfers may take place, for example, in connection with the intra-group provision of IT programmes and systems.
• Public authorities: Further transfers may take place to comply with legal requirements or to respond to court orders or other similar requests from public authorities.

6. How long do we retain your data?

Unless otherwise stated in the following information, we retain the data only for as long as is necessary to fulfil the purpose of processing or to meet our contractual or legal obligations. Such statutory retention obligations may arise, in particular, from commercial or tax law provisions. From the end of the calendar year in which the data was collected, we will retain personal data contained in our accounting records for eight or ten years, and personal data contained in commercial correspondence and contracts for six years. Furthermore, we will retain data relating to consents for which proof is required, as well as to claims for payment, for the duration of the statutory limitation periods. We will delete data stored for marketing purposes if you object to its processing for this purpose.

7. How do we use "cookies" and other tracking technologies?

We use cookies and similar technologies on our website. We have provided further information on how we use these technologies in our cookie banner. The banner can be accessed via the footer of our website. There you will also find a list of other companies that place cookies on our website and process data on the basis of your consent pursuant to Article 6(1)(a) of the GDPR, a list of cookies that we place, and an explanation of how you can opt out of certain types of cookies.

8. How can you contact our Data Protection Officer?

You can contact our data protection officer using the following details:

Herting Oberbeck Datenschutz GmbH
Email: data-protectionnDOpwqAytGL@supplyxnZtkJqyChf.info
Website: www.datenschutzkanzlei.de/