Mandatory Data Protection Information

In our role as data controller, we, TORWEGGE GmbH & Co. KG, Oldermanns Hof 6, 33719, Bielefeld, Germany, +49 521 93417-0, info@torwegge.de, have drawn up this document to inform you about which of your data we process and how. If you have any questions regarding data protection, please contact our Data Protection Officer at datenschutz@torwegge.de.

This mandatory data protection information fulfils our duty to provide information in accordance with Articles 12-14 of the GDPR.

Information on data protection and processing

This document explains which personal data (i.e. any data that identify or can be used to identify you as a natural person (hereinafter: the “data subject”)) we collect during your visit to our website and how we use them. These include, but are not limited to:

• Master customer data used to perform the contract/service, name, address, email address, data in connection with payment processing, correspondence (e.g. written or email correspondence with you), marketing and sales data (e.g. in order to provide information by post on new products and services you may be interested in, or by email, with your consent)
• Data from initial contact, such as name, telephone number, and email address
• Supplier data, such as name, telephone number, and email address
• Employee data, such as name, address, bank details, and religion,
  personnel number, social security number, log data from use of our IT systems, plus other and special categories of personal data
• Applicant data, such as name, address, email address, marital status, and religion
• Data obtained through video surveillance

Right to lodge a complaint

If you believe that the processing of your personal data violates the General Data Protection Regulation, you have the right to lodge a complaint with your supervisory authority for data protection, the North Rhine-Westphalia State Representative for Data Protection and Freedom of Information, https://www.ldi.nrw.de/, or with any other supervisory authority for data protection matters.

Purposes of processing

Data concerning customers/prospective customers

Purpose of processing
We process data that we obtain while conducting business with you. We obtain these data directly from you, either from enquiries made as a potential customer or in order to initiate contact, or during the awarding or performance of a contract (see “Information on data protection and processing”).

Legal basis: The collection and processing of these data is necessary for the performance of the contract in accordance with Article 6(1) (b) of the GDPR. The use of these data for direct marketing purposes is covered by Article 6(1) (f) of the GDPR. We have a legitimate interest in using direct marketing techniques to make you aware of special offers. We will not share these data with third parties unless required to do so by law, e.g. submission to the Tax Office in order to comply with taxation law. These data will be deleted as soon as they have served their processing purpose/once the respective legal retention periods have expired. Examples of such retention periods include: 10 years for accounting documents relating to tax and trade; 6 years for business letters; 3 years for records on suppliers, type, quantity, earnings and expenditure.

You have the right to object at any time to the use of your data for direct marketing purposes. Furthermore, you have the right to obtain information on the data we have saved concerning you and, if said data are incorrect or have been saved without authorisation, to request their rectification or erasure. You also have the right to lodge a complaint with a supervisory authority (see “Right to lodge a complaint”).

Data retention periods
Once we have completed the service in accordance with our contractual duties, your personal data shall be saved: - for 10 years for the purposes of a guarantee required by law - for 2 years for the purpose of fulfilling the terms of the warranty - for 6 years for the purpose of completing subsequent orders (required either at the time the contract is concluded or at a later date) and - 10 years for tax purposes.

Erasure of data
Your personal data will be erased once the aforementioned retention periods have expired, at the latest.

Suppliers

Purpose of processing
We process data that we obtain while conducting business with you. We obtain these data directly from you during the awarding or performance of a contract (see “Information on data protection and processing”).

Legal basis: The collection and processing of these data is necessary for the performance of the contract in accordance with Article 6(1) (b) of the GDPR. We will not share these data with third parties unless required to do so by law, e.g. submission to the Tax Office in order to comply with taxation law. These data will be deleted as soon as they have served their processing purpose/once the respective legal retention periods have expired. Examples of such retention periods include: 10 years for accounting documents relating to tax and trade; 6 years for business letters; 3 years for records on suppliers, type, quantity, earnings and expenditure.

You have the right to obtain information on the data we have saved concerning you and, if they are incorrect or have been saved without authorisation, to obtain their rectification or erasure. You also have the right to lodge a complaint with a supervisory authority (see “Right to lodge a complaint”).

Employee data

See special template to be issued to employees.

Newsletter (not currently in use)

Purpose of processing
If you want to receive the newsletter through our website, we will require your email address. We use a double opt-in procedure for subscriptions to our newsletter: once you have subscribed, you will receive an email; you must click the link in this email to confirm your subscription. This procedure prevents unauthorised persons from subscribing to the newsletter using your email address. When you subscribe to the newsletter, logging will take place (the time of and IP address used for the subscription and confirmation will be saved). This enables us to demonstrate that our subscription process complies with legal requirements.

You can withdraw your consent at any time to save your email address (plus your first name and surname (optional information) if provided so that we can address you personally) and for it to be used to send you the newsletter and conduct the associated measures of success. An unsubscribe link is provided at the end of every newsletter. To enable us to prove that your consent was given at an earlier stage before being withdrawn, we may need to save these data for up to two (2) years before erasing them.

Legal basis for delivery of the newsletter and the associated measure of success: This action is performed based on consent provided by the recipient in accordance with Article 6(1) (a) of the GDPR, Article 7 of the GDPR in conjunction with Section 7, 2(3) of the German Act Against Unfair Competition (UWG), or based on the legal permission established in Section 7(3) of the UWG. Further legal basis: Article 6(1) (f): Our legitimate interest in measuring the success of the newsletter lies in determining the reading habits of our users based on how many times the newsletter is opened, when it is opened, and which links are clicked on so that we can create and send you useful content based on your interests.                              

The legal basis for logging these data is provided by Article 6(1) (f) of the GDPR. Our legitimate interest lies in the fact that we use a secure and user-friendly newsletter system that is useful for sending our newsletters and protects the personal data of the newsletter subscribers. It also enables us to provide proof of consent.

You have the right to obtain information on the data we have saved concerning you and, if they are incorrect or have been saved without authorisation, to obtain their rectification or erasure. You also have the right to lodge a complaint with a supervisory authority (see “Right to lodge a complaint”).

Applicants

Purpose of processing
Applications submitted online (not currently in use), via email or by post: If you apply to us in response to an advertised vacancy, we will collect personal data such as your first name, surname, address, telephone number, email address, attachments (cover letter, CV, certificates, photo) from you and save them for the duration of the selection process.

Online application (not currently in use)

Your data will be used exclusively by authorised Human Resources/Management staff and for the purposes of processing your application during the selection process. Your personal data will not be shared with third parties.

If the specific position for which you have applied is no longer available but your profile indicates that you may be suitable for a future vacancy or a role at one of our partners or subsidiaries, we will contact you to obtain your express consent before saving your personal data for a longer period of time or passing them on, unless you have already agreed to your data being saved or shared for this purpose in your application.

If you send us a speculative application using our general contact email address, the content of your application email may be seen by personnel who are not authorised to view it. We employ a rule whereby application documents are left unopened and forwarded immediately to our Human Resources department, after which the original email is deleted. If you wish to avoid this happening, please contact us by telephone prior to submitting your speculative application so that we can provide you with the contact details for the correct member of staff.

The legal basis for this action is provided by Article 6(1) (b) of the GDPR: taking appropriate steps prior to entering into a contract.

Unless you hear otherwise from us, we will erase these data six (6) months after the conclusion of the application process, or destroy them in the case of applications submitted by post. Due to the long application and selection periods for apprenticeship positions, in Germany we save data on apprenticeship applicants for up to 18 months.

Under certain legal conditions, you have the following rights: the right to obtain information on the data we have saved concerning you; rectification, erasure, restriction of, or objection to, the processing of your data, and data portability. Furthermore, as a matter of course, you can also request that we erase or destroy all your application documents by sending an email at any time to: personal(at)torwegge.de.

Facebook fan page

Please click here to view our Privacy Policy on our website.

Data collection on our server

Please click here to view our Privacy Policy on our website.

Video surveillance (not currently in use)

If you have any questions, please contact our Data Protection Officer at datenschutz(at)torwegge.de.

Intent to process data in third countries

If there exists intent to process personal data in a third country, it is particularly important to produce statements regarding the existence or absence of an adequacy decision by the Commission. If no such adequacy decision has been issued, the provider of the website must approximately describe the appropriate and suitable guarantees (especially those of a technical and organisational nature) they plan to implement for the transmission of the data. The website provider must provide the data subject with an opportunity to obtain a copy of these declarations of guarantee. For more details, please consult Article 13(1) (f) of the GDPR. The type of processing relationship with a third country described above shall be deemed to exist particularly if the headquarters of the selected service provider are located in a third country, said service provider collects the data or saves and can access the data collected via our website on its own servers, or said service provider uses third-party servers via which it can access the usage data.

Categories of recipient

When providing our services to customers in specialist areas, we use special service providers who are legally obliged to maintain secrecy and data protection whenever it is not possible to guarantee that said service providers will not be able to access personal data.

These categories of recipient are:

• Processors (Article 28, EU GDPR) we have commissioned, particularly in the fields of IT services, tax, logistics and print services, who process your data on our behalf and according to our instructions.
• Public bodies and institutions (finance authorities) in circumstances where we are subject to duties imposed by law or the authorities.
• Other entities to whom you have consented for us to transmit your data.

We will never share your personal data with authorities unless we are required to do so in order to comply with overriding legal requirements.

Advertising and your right to object

We also collect your surname, first name and address for advertising purposes (sending out offers and information on additional services). You can object to the processing of your data for advertising purposes at any time without providing your reasons for doing so. To do this, please contact: datenschutz@torwegge.com

Objection to data retention

By processing your data for the purpose of completing subsequent orders (required either at the time the contract is concluded or at a later date) for six (6) years, we are pursuing legitimate commercial interests as permitted by data protection laws. You can object to the processing of your data for this purpose at any time by contacting: datenschutz(at)torwegge.de

Duty to provide correct information

Generally speaking, we will not be able to conclude a contract with you if you do not provide us with correct information.

Rights of the data subject

In accordance with Article 15 of the GDPR, you have the right to obtain information regarding the personal data we have saved concerning you, including information on any data recipients and the envisaged period for which the data will be retained. If any of the personal data we process concerning you are incorrect, you have the right to rectification in accordance with Article 16 of the GDPR. Under certain legal conditions, you have the right to obtain the erasure of your data or the restriction of their processing, or to object to said processing (Articles 17, 18 and 21, GDPR).

If you want us to erase your data but we are still under a legal obligation to retain them, access to said data shall be restricted (blocked). The same shall apply if you issue an objection under similar circumstances. You can exercise your right to data portability, providing this is technically feasible for us and the recipient alike.

If you have any questions regarding your rights as a data subject, please contact our Data Protection Officer at datenschutz(at)torwegge.de.

Updates and alterations to this mandatory information

We reserve the right to amend the contents of this mandatory information at any time. Such amendments are usually performed in conjunction with ongoing development efforts or modifications required under law. You can view the latest version of this mandatory information on our website by clicking on the relevant link, which is provided in emails, quotations, order confirmations, invoices, etc. This mandatory information was last updated on: 12 February 2019

For more information on how we handle personal data, please refer to our Privacy Policy