Data Privacy Information for Suppliers and Services Providers of Agrobs GmbH

This document provides you with information on how we process your personal data and what rights you have.
 

1. Who is responsible for data processing?

Agrobs GmbH
represented by
Florian Berger, Simon Berger in Angerbreite 27, 82541 Degerndorf, Germany
email: info@agrobs.de
Tel: +49 (0) 8171-9084-0

Our data protection officer can be reached at the address provided in the Legal Notice or by
email: datenschutz@agrobs.de
 

2. Purposes and legal basis for processing

Your personal data is processed in accordance with the provisions of the General Data Protection Regulation (GDPR), the Federal Data Protection Act (FDPA) and other relevant data protection provisions.
 

2.1 Consent (Article 6 (1) (a) GDPR)

If you have given us your express consent for the processing of your data in certain cases, that consent is the legal basis for the processing referred to therein. You may withdraw consent at any time with future effect.

2.2 Execution of pre-contractual measures and fulfilment of contractual obligations (Article 6 (1) (b) GDPR)

We process your personal data in order to carry out measures and activities as part of pre-contractual relations, in particular for contract negotiations. In addition, your personal data is processed to conclude our contracts with you, especially as part of our order processing and the utilisation of your services.
 

2.3 Fulfilment of legal obligations (Article 6 (1) (c) GDPR)

We process your personal data insofar as this is legally necessary for the fulfilment of retention obligations under commercial and tax law or otherwise on the basis of legal norms. (e.g. in accordance with the German Money Laundering Act).
 

2.4 Safeguarding the legitimate interests of us or of a third party (Article 6 (1) (f) GDPR)

We may also process your personal data on the basis of a weighing of interests for the safeguarding of legitimate interests of us or of a third party. This is carried out for the following purposes:

• For comparison with European and international anti-terror lists, if this exceeds the legal obligations
• For the further development of services and products as well as existing systems and processes
• For the obtaining of information and exchange of information with credit agencies, if this exceeds our economic risk
• For the disclosure of personal data as part of due diligence (code of obligations), e.g. in the case of company sales
• For the enhancement of our data through the research and use of publicly accessible data
• For statistical evaluations or market analyses
• For benchmarking
• For internal and external investigations or security checks
• For the assurance and performance of our building security through corresponding measures (e.g. video surveillance)
• For the enforcement of our rights and defence against unjustified claims in the event of a legal dispute with you

3. Categories of personal data that are processed by us

The following categories of data are processed:

• Personal data (e.g. name, nationality, profession/industry)
• Contact data (e.g. home address, email address, telephone number)
• Bank details (e.g. account number)
• Tax information (e.g. VAT ID number)
• Information on your financial situation (e.g. credit rating information)
• Supplier history
• Registry data and other data from public sources (e.g. the internet, media and press as well as commercial, association, civil, debtors and land registers)

4. Who receives your data?

We transfer your personal data to departments within our company that require this data for the fulfilment of contractual and legal obligations or for the implementation of our legitimate interests.

The following departments may also receive your data:

• Order processing companies (Article 28 GDPR) and service providers that we use for supporting activities, e.g. in the departments of IT services, logistics and printing services, archiving, document processing, data destruction, purchasing/procurement, media technology, tax auditing and accounting, courier services
• Public bodies and institutions in the event of a legal or official obligation, according to which we are obligated to disclose
• Bodies and institutions due to our legitimate interest or the legitimate interest of third parties for the purposes named in 3.4 (e.g. authorities, credit agencies, debt collectors, lawyers, courts, appraisers)

5. Transfer of your data to a recipient in a third country or to an international organisation

Data shall not be transferred to entities in countries outside the European Union (EU) or the European Economic Area (EEA) (“third countries”) or to an international organisation.
 

6. How long do we store your data?

Insofar as it is required, we process your personal data for the duration of our contractual relationship with you.

Furthermore, we are subject to various retention and documentation obligations arising from the legal framework conditions. The periods specified there for retention or documentation are up to ten years beyond the end of the contract.

Finally, the storage period is also assessed according to the legal limitation periods which, according to Sections 195 et seq. of the German Civil Code (BGB), are usually three years, but in certain cases can be up to thirty years.
 

7. To what extent does automated individual decision-making occur (including profiling)?

We use no purely automated decision-making processes in accordance with Article 22 GDPR. If we use these processes in individual cases, we shall inform you of this separately.
 

8. Scope of your obligations to provide us with your data

You need only to provide the data that is necessary for the establishment and execution of a contractual relationship with us, which we are legally obligated to collect or which we are entitled to collect for the safeguarding of legitimate interests. You are not obligated to provide personal data. Without the provision, however, the execution of the contract would not be possible in a proper manner, which could ultimately result in the refusal to conclude or the termination of a contract. If we request additional data from you, you will be informed separately that the information is voluntary.
 

9. Data subject rights

You have the right to the following:

• To request your personal data that we have processed, in accordance with Article 15 GDPR. In particular, you may request information on the purposes of processing, the category of personal data, the categories of recipients where your data was or is disclosed, the planned storage duration, the existence of a right of rectification, deletion, and restriction of processing or objection, the existence of a right to appeal, the origin of your data, insofar as these were not collected by us, and on the existence of an automated decision-making process including profiling and, if applicable, meaningful information on their details.
• In accordance with Article 16 GDPR, to request the immediate rectification and completion of incorrect or incomplete personal data stored by us.
• In accordance with Article 17 GDPR, to request the deletion of your personal data stored by us, insofar as the processing is necessary for the exercise of the right to freedom of expression and information, for the fulfilment of a legal obligation, for reasons of public interest or for the assertion, exercise or defence of legal claims.
• In accordance with Article 18 GDPR, to request the restriction of the processing of your personal data, insofar as the accuracy of the data is contested by you, the processing is unlawful, but you decline its deletion and we no longer require the data, you however require this for the assertion, exercise or defence of legal claims or you have objected to the processing in accordance with Article 21 GDPR.
• In accordance with Article 20 GDPR, to request the receipt of your personal data, which you have provided us, in structured, commonly-used and machine-readable format and to transmit this data to another data controller:
• In accordance with Article 7 (3) GDPR, to withdraw your consent at any time. The consequence of this is that we may no longer continue the data processing based on this consent for the future.

If you wish to assert one of these rights, please contact us or our data protection officer.
 

Information on your right to object in accordance with Article 21 GDPR

You have the right to object to the processing of your personal data which is carried out on the basis of Article 6 (1) (f) GDPR (data processing for the safeguarding of legitimate interests) or Article 6 (1) (e) GDPR (data processing for the performance of a task carried out in the public interest).

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves for the assertion, exercise or defence of legal claims.

Information on your right to withdraw in accordance with Article 7 (3) GDPR

Insofar as we carry out the processing of your personal data for certain purposes based on your consent, in accordance with Article 7 (3) GDPR you have the right to withdraw your consent at any time. After receipt of your withdrawal we will stop the processing of your data for the purposes for which you gave us your consent. The lawfulness of the processing prior to receipt of your revocation remains unaffected.

Please note that the withdrawal shall take effect for the future. Processing carried out before the withdrawal shall remain unaffected.

Objection to processing for direct marketing purposes

In the case of data processing for direct marketing, you have the right to object to the processing of your personal data for the purpose of such marketing at any time, as well as for profiling, insofar as it is connected to said direct marketing

If you object to the processing for direct marketing, your personal data will no longer be processed for these purposes.

Objection can be made without formalities and should be sent to:
datenschutz@agrobs.de

10. Your right to appeal to the competent supervisory authority

You are entitled to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data infringes the GDPR (Article 77 GDPR). The competent supervisory authority for us is:

The Bavarian State Office for Data Protection, Promenade 18, 91522 Ansbach. Tel: +49 (0) 981 180093-0, email: poststelle@lda.bayern.de

As of August 2023