Data Protection

Privacy Notice – Information on the Processing of Personal Data

1. Who is responsible for processing your personal data and whom can you contact?

You can contact our Data Protection Officer:

Mr Bernhard Brands
Brands Consulting
Auf dem Hahn 11
56412 Niederbach, Germany
Tel.: +49 6485 957976-1
Email: info@brands-consulting.eu

2. What sources and categories of data do we use?

We process personal data that we receive from our suppliers in the course of our business relationship.

We may also process personal data that we lawfully obtain from publicly accessible sources, such as commercial registers, registers of associations, the press and the Internet, as well as personal data lawfully provided to us by other companies within the SFB GROUP or by other third parties, such as credit reference agencies.

We process such data only to the extent necessary to fulfil our contractual and legal obligations.

The categories of personal data relevant to our processing include personal and contact details, such as your name, address and other contact information, as well as identification and verification data, such as information contained in identity documents.

This may also include transaction and order data, such as payment orders; data arising from the performance of our contractual obligations, including transaction data relating to payment activities; information concerning your financial circumstances, such as creditworthiness, scoring and rating data; documentation data, such as extracts from commercial registers; and other data comparable to the categories described above.

3. For what purposes do we process your personal data, and on what legal basis?

We process personal data in accordance with the provisions of the EU General Data Protection Regulation (“GDPR”) and the German Federal Data Protection Act (“BDSG”).

a. Processing for the performance of contractual obligations

Article 6(1)(b) GDPR

We process personal data where this is necessary to enter into, perform or terminate purchase, works, leasing or rental agreements, or to take steps at your request prior to entering into a contract.

b. Processing based on a balancing of legitimate interests

Article 6(1)(f) GDPR

Where necessary, we process your personal data beyond what is required for the performance of a contract in order to safeguard our legitimate interests or those of third parties.

This may include, in particular:

• consulting credit reference agencies, such as SCHUFA, and exchanging data with them in order to assess creditworthiness and the risk of default in our procurement processes;
• asserting and enforcing legal claims and defending against legal disputes;
• ensuring the security and proper operation of our IT systems;
• preventing and investigating criminal offences;
• using video surveillance to safeguard our rights of access and control over our premises and to collect evidence in the event of break-ins, in accordance with Section 4 BDSG;
• implementing measures to ensure the security of buildings and facilities, including access controls;
• implementing measures to safeguard our rights of access and control over our premises;
• supporting the management and administration of our business; and
• managing risks within our company.

Wohnen für Menschen mit Behinderung gGmbH
Ludwig-Erhard-Straße 11
51503 Rösrath, Germany
Managing Director: Tobias Aretz

c. Processing based on your consent

Article 6(1)(a) GDPR

Where you have given us your consent to process personal data for specific purposes, such as applications by suppliers via the supplier portal, the processing is based on your consent and is therefore lawful on that basis.

You may withdraw your consent at any time. This also applies to consents granted to us before the GDPR became applicable on 25 May 2018.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal. It takes effect only for the future.

d. Processing to comply with legal obligations or in the public interest

Article 6(1)(c) and Article 6(1)(e) GDPR

As a company, we are subject to various statutory and regulatory obligations, including requirements arising from the German Money Laundering Act and tax legislation.

The purposes for which we process personal data on this basis include, among other things, creditworthiness assessments, identity verification, the prevention of fraud and money laundering, compliance with tax-related control and reporting obligations, and the assessment and management of risks within the company.

4. Who receives your personal data?

Within our company, access to your personal data is granted only to those departments and employees who require it in order to fulfil our contractual and legal obligations, such as our Procurement Department.

We may also engage service providers and other processors to perform services on our behalf. Such service providers may operate in areas including IT services, logistics, printing services, telecommunications and debt collection.

Where personal data is disclosed to recipients outside our company, we ensure that only the personal data required for the relevant purpose is disclosed and that all applicable data protection requirements are observed.

As a general rule, we disclose personal data relating to our suppliers only where this is required by law, where the data subject has given consent, or where we are otherwise legally authorised to do so.

Depending on the applicable circumstances, recipients may include:

• public authorities and institutions, such as tax authorities and law enforcement authorities, where disclosure is required by law or by an official order;
• other companies within the SFB GROUP for the purpose of risk management where required by statutory or regulatory obligations;
• creditors or insolvency administrators making enquiries in connection with enforcement proceedings; and
• service providers engaged by us under data processing agreements.

Other recipients may include entities to which you have expressly consented to the disclosure of your personal data, or entities to which we are permitted to disclose personal data following a balancing of legitimate interests.

5. Is your personal data transferred to a third country or an international organisation?

Personal data may be transferred to recipients in countries outside the European Union (“third countries”) where:

• the transfer is necessary for the performance of the contractual relationship, for example for the processing of orders;
• the transfer is required by law, for example to comply with tax reporting obligations; or
• you have given your consent to the transfer.

In addition, personal data may be transferred to recipients in third countries in the following circumstances:

• Where necessary in individual cases, your personal data may be transferred to an IT service provider located in the United States or another third country in order to ensure the operation of our IT systems, subject to maintaining an appropriate level of data protection consistent with European data protection standards.
• In individual cases, personal data, such as identification data, may be transferred where you have given your consent, where required or permitted by law in connection with the prevention of money laundering, terrorist financing or other criminal offences, or where such transfer is justified following a balancing of legitimate interests. Any such transfer will be carried out in accordance with the applicable European data protection requirements.

6. How long do we retain your personal data?

We process and retain your personal data for as long as necessary to fulfil our contractual and statutory obligations.

Once the data is no longer required for these purposes, it will generally be deleted unless continued, temporary retention or processing is required for one of the following purposes:

• compliance with statutory retention obligations under commercial and tax law, including obligations arising under the German Commercial Code (HGB), the German Fiscal Code (AO) and the German Money Laundering Act (GwG). The applicable retention and documentation periods generally range from two to ten years; and
• preserving evidence within the applicable statutory limitation periods. Pursuant to Sections 195 et seq. of the German Civil Code (BGB), limitation periods may extend to 30 years, although the standard limitation period is three years.

7. What data protection rights do you have?

As a data subject, you have the following rights:

• Right of access pursuant to Article 15 GDPR;
• Right to rectification pursuant to Article 16 GDPR;
• Right to erasure pursuant to Article 17 GDPR;
• Right to restriction of processing pursuant to Article 18 GDPR;
• Right to object pursuant to Article 21 GDPR; and
• Right to data portability pursuant to Article 20 GDPR.

The right of access and the right to erasure are subject to the limitations set out in Sections 34 and 35 BDSG.

You also have the right to lodge a complaint with a competent data protection supervisory authority pursuant to Article 77 GDPR in conjunction with Section 19 BDSG.

8. Are you required to provide your personal data?

As part of our contractual relationship, you are required to provide those personal data that are necessary to establish, perform and terminate the contractual relationship and to fulfil the contractual obligations associated with it, or whose collection is required by law.

Without this data, we will generally be unable to enter into, perform or terminate a contractual relationship with you.

If you do not provide the information and documentation required for these purposes, this may prevent us from establishing or performing the contractual relationship.

9. To what extent is automated decision-making used?

As a general rule, we do not use fully automated decision-making within the meaning of Article 22 GDPR for the establishment, performance or termination of the contractual relationship.

If we use such procedures in individual cases, we will inform you separately about the use of such procedures and about your associated rights, insofar as we are required to do so by law.

10. Does profiling take place?

We may process your personal data in part by automated means for the purpose of assessing certain personal aspects relating to you (“profiling”).

We use profiling, for example, in the following context:

• We are required by law to take measures to combat money laundering, terrorist financing and offences that may endanger assets. In this context, data may also be analysed and evaluated using automated processes.