Data Protection

Who is responsible for data processing and who can I contact?

The following is responsible for data processing

Sympatec GmbH – System | Partikel | Technik
Am Pulverhaus 1
38678 Clausthal-Zellerfeld
Germany
Phone +49 5323 717 0

Send eMail

You can contact our internal data protection officer at the following address

Sympatec GmbH – System | Partikel | Technik
Data Protection Officer
Am Pulverhaus 1
38678 Clausthal-Zellerfeld
Germany

Send eMail

On what legal basis and for what purposes do we process your data?
We process your personal data in compliance with the provisions of the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz (BDSG)).

a. In order to fulfil contractual obligations or precontractual measures (point (b) of Article 6(1) GDPR)

Personal data are processed in the initiation and fulfilment of contractual obligations, e. g. in processing your orders. The purposes of data processing are aligned with your specific request or the commissioned service; examples include the provision of relevant information, the rendering of analytical, consultancy and training services, the creation of individual quotes, the fulfilment of maintenance contracts and service orders, and the execution of transactions in the context of deliveries and ser-vices. In addition, we capture and process personal data in connection with your requests and orders in the context of a business relationship intended to be longer-term, enabling us to fulfil any potential contractual obligations.

b. Based on your consent (point (a) of Article 6(1) GDPR)

In as far as you have issued us consent to process your personal data for certain purposes, these data are processed legally based on your consent. Once consent has been issued, it may be withdrawn at any time. This also applies for any withdrawal of consent issued to us before the GDPR came into effect on 25/05/2018. The withdrawal of consent applies only for the fu-ture and does not affect the legality of the data processed up until the withdrawal of consent.

c. In the context of the balancing of interests (point (f) of Article 6(1) GDPR)

In as far as necessary, we process your data beyond the actual fulfilment of the contract in order to safeguard legitimate interests held by us and third parties in as far as the interest and basic freedoms of the data subject do not override such processing. In particular, legitimate interest exists before a contract with a financial risk is established, e.g. in the event of non-payment risks or in the event of the assertion of legal claims and defence in the event of legal disputes.

What sources and data do we use?
We process personal data that we have received from our customers or other data subjects in the context of our business relationships. In addition, in as far as is necessary for the provision of contractual services, we process personal data that we have permissibly gained from publicly accessible sources (e. g. registers, the press, and online), or which other companies or other third parties (e. g. commercial credit agencies, and operators of specialist portals) have legitimately transferred to us.

Relevant personal data could be

a. Contact information such as your name, academic title, gender-specific title, address, eMail address, phone num-ber, and fax number;
b. Professional and subject-based information such as your professional responsibilities and role title as well as specialist interests;
c. Communication preferences such as your preferred language, preferred channels of communication (phone, postal, or eMail), consent to marketing communications or use for other purposes and possible objections;
d. Data regarding customer relationship history such as your participation in our seminars, training, trade fair visits, or the use of support services or other interactions;
e. Documentation data such as logs or reports of conversations, consultancy, or services;
f. Order and payment-related, and financial data for processing transactions such as bank details and account numbers;

as well as other data comparable with the stated categories.

Who will receive my data?
Within our company, those offices that require your data for the fulfilment of our contractual and legal obligations receive access to your data. Service providers and agents we use may also receive the data for this purpose if they are qualified as order processors and a corresponding processing contract has been agreed. Corresponding companies fall into categories such as IT services, communications and printing services, and logistics.

Furthermore, it may be that we transfer your personal data – for the performance of our contractual obligations or on the ba-sis of your consent – to our subsidiaries, regional field offices, foreign agencies, distributors and other agencies who work on our behalf. As a result, in following-up an enquiry for instance, it is usual to use our local points of contact or specialists, or to fully transfer the provision of support in order to meet your re-quirements to the best possible extent.

Public bodies (such as supervisory authorities, financial authorities and law enforcement agencies) may also be recipients of personal data in the event of a legal or official obligation.

Is my data transferred to a third country?
Your data is transferred to bodies in states outside the European Union (referred to as third countries) in as far as

a. this is required for the execution of your orders (e.g. for providing deliveries and services abroad)
b. this is legally required, or
c. you have provided us with your consent.

How long is my data stored for?
We process and store your personal data for as long as is necessary for serving the purposes that were stated when the data were collected, or for the fulfilment of our contractual obligations.

If the data are no longer required for the fulfilment of contractual or legal obligations, they will be erased on a regular basis unless their – time-limited – further processing is necessary for the following purposes:

a. the fulfilment of retention obligations under commercial and fiscal law which for example may arise from the German Commercial Code (Handelsgesetzbuch, HGB), the Unions Custom Code (UCC), or the German Tax Code (Abga-benordnung, AO). The retention periods are generally 2 to 10 years.
b. In order to safeguard evidence, the limitation period may be up to 30 years; the regular limitation period pursuant to Sections 195 et seqq., German Civil Code (Bürgerliches Gesetzbuch (BGB)) is 3 years.

What data protection rights am I entitled to?
Each data subject has the right of access (Article 15 GDPR), the right to rectification (Article 16 GDPR), the right to erasure (Article 17 GDPR), the right to restriction of processing (Article 18 GDPR), the right to object (Article 21 GDPR) and the right to data portability (Article 20 GDPR). The restrictions in accordance with Sections 34 and 35 BDSG apply with respect to the right to access and the right to erasure. In addition, you also have the right to submit a complaint to a relevant supervisory authority for data protection (Article 77 GDPR in conjunction with Section 19 BDSG).

You can at any time withdraw any consent you have issued for the processing of personal data. This also applies for the withdrawal of consent declarations that were issued to us before the GDPR came into effect, i.e. before 25/05/2018. Please note that the withdrawal only applies with effect for the future. Processing that took place before withdrawal is not affected by this.

Is there an obligation to provide data?
In the context of our business relationship, you are required to provide personal data that are necessary for the establishment, implementation, and termination of a business relationship, and that are necessary for the fulfilment of the associated contractual obligations, or that we are legally required to capture. Without these data, we will not be able to conclude, execute and terminate a contract with you.

Do we perform profiling or scoring?
We do not use any fully automated decision-making (pursuant to Article 22 GDPR) regarding the establishment and implementation of a business relationship. Furthermore, we do not perform any automated profiling or scoring relating to your personal data.

Information on the right to object in accordance with Article 21 GDPR

a. Case-specific right to object
You have the right to submit an objection at any time to the processing – that takes place based on point (e) of Article 6(1) GDPR (data processing in the public interest) and point (f) of Article 6(1) GDPR (data processing on the basis of a balancing of interests) – of personal data concerning you, for reasons that arise from your particular situation; this also applies for profiling based on this provision as defined by Article 4(4) GDPR.

If you submit an objection, we will not process your per-sonal data unless we are able to prove binding legitimate grounds for such processing that override your interests, rights and freedoms, or the processing serves the establish-ment, exercise or defence of legal claims.

b. Right to object to processing of data for the purposes of direct marketing
In individual cases, we process your personal data in order to undertake direct marketing. You have the right to submit an objection at any time to the processing of personal data concerning you for the purposes of marketing of this type; this also applies for profiling in as far as this is associated with direct marketing.

If you object to processing for the purposes of direct marketing, we will no longer process your personal data for this purpose.

Recipient of an objection
You may submit your objection to the following address in any form with the subject “Objection”, stating your name and your address (and your eMail address if applicable).

Sympatec GmbH – System | Partikel | Technik
Data Protection Officer
Am Pulverhaus 1
38678 Clausthal-Zellerfeld
Germany

Send eMail