Privacy Notices pursuant to the EU General Data Protection Regulation for Business Partners and their Contacts

The Controller (party responsible) for data processing:

Salzgitter Digital Solutions GmbH
Eisenhüttenstraße 99
38239 Salzgitter, Germany
Phone: +49 5341 / 21-2371

You can contact our Data Protection Officer at the aforementioned address and telephone number, as well as by email:

Phone: +49 5341 / 21-6258
szds.datenschutz@salzgitter-digital.de

As part of informing about our business development and the initiating and conducting of business relations, we process the following data categories of our business partners and their contacts in particular. We obtain this data directly from these partners or from other Salzgitter Group companies or from other parties within the scope permissible (e.g. for the performance of contracts or based on consent granted). Furthermore, data that we have obtained from sources in the public domain (e.g. commercial registers, press, Internet) within the scope permissible is also processed.

Prospective customers

• Personal/contact information (e.g., first name, last name, company, address, (cell) phone number, fax number, email)
• Communication data related to correspondence (emails, letters)

Customers, Suppliers, Service Providers

• Personal/contact information (e.g., first name, last name, company, address, (cell) phone number, fax number, email)
• Contract and billing information (e.g., licensing information, goods or services ordered, billing details)
• Communication data related to correspondence (emails, letters) 

The purpose of our company is to provide data center and IT services, as well as to supply IT products.

Data processing is carried out for these purposes and in compliance with the provisions of the EU General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), and all other applicable laws (e.g., the German Commercial Code (HGB), the German Fiscal Code (AO), etc.).
 

a.    For the performance of a contract or for precontractual measures (Art. 6(1)(b) GDPR)

The primary purpose of processing personal data is to fulfill contracts with our customers, suppliers, and service providers. This also includes the implementation of precontractual measures.

b.    As part of a balancing of interests (Art. 6(1)(f) of the GDPR)

To the extent necessary, we process your data beyond the actual performance of the contract to protect our legitimate interests or those of third parties.

Examples:

• Review and Optimization of Processes for Needs Analysis and Direct Customer Outreach
• Advertising or market and opinion research, provided you have not objected to the use of your data
• Asserting legal claims and defending against legal disputes
• Ensuring IT Security and IT Operations
• Crime Prevention
• Property Security, Theft Prevention (Video)
• Access Control
   

c.    Based on consent (Art. 6(1)(a) of the GDPR)

If you have given us consent to process personal data for specific purposes (e.g., newsletters), the lawfulness of this processing is based on your consent. Consent that has been given may be revoked at any time with future effect. This also applies to the revocation of consent given to us prior to the effective date of the GDPR, i.e., before May 25, 2018. Please note that the revocation takes effect only for the future. Processing that took place prior to the revocation is not affected by this.
 

d.    Due to legal requirements (Art. 6(1)(c) of the GDPR) or in the public interest (Art. 6(1) (e) of the GDPR)

In addition, we are subject to various legal obligations, i.e., statutory requirements, such as tax laws and customs regulations.

Within our company, access to your data is granted to those departments that need it to fulfill our contractual and legal obligations or for the purposes mentioned above. Service providers and agents we engage may also receive data for this purpose.

Eine Datenweitergabe außerhalb des Unternehmens erfolgt nur, wenn gesetzliche Bestimmungen dies erfordern oder Sie eingewilligt haben.

Data will only be disclosed outside the company if required by law or if you have given your consent.

Under these circumstances, the recipients of personal data may include:

• Public agencies and institutions (e.g., tax authorities) when there is a legal or regulatory obligation
• Data processors to whom we transfer personal data in order to carry out our business relationship with you (e.g., support/maintenance of IT systems, data destruction, payment processing, accounting)
• those instances for which you may have given us your consent to transfer your data

Data will only be transferred to countries outside the EU or the EEA (so-called third countries) to the extent that this is necessary for the performance of the contract, required by law, you have given us your consent, or as part of data processing on our behalf. If service providers in third countries are used, an adequate level of data protection is ensured.  

We process and store your personal data for as long as necessary to fulfill the purposes specified in Section 3. Please note that our business relationship is generally long-term in nature.

If the data is no longer necessary for the fulfillment of contractual or legal obligations, it must be deleted on a regular basis, unless its continued processing for a limited period is necessary for the following purposes: 

• Compliance with retention periods under commercial and tax law, e.g., as specified in the German Commercial Code or the German Fiscal Code. The periods specified therein range from 2 to 10 years.
• Preservation of evidence in connection with the statute of limitations (e.g., Sections 195 et seq. of the German Civil Code (BGB))

All persons affected (data subjects) have the right to information pursuant to Art. 15 GDPR , the right to rectification pursuant to Art. 16 GDPR, the right to erasure pursuant to Art. 17 GDPR, the right to restriction on the processing pursuant to Art. 18 GDPR, the right to objection based on Art. 21 GDPR and the right to data portability pursuant to Art. 20 GDPR. The restrictions under Sections 34 and 35 of the German Federal Data Protection Act apply to the right to information and the right to erasure. Moreover, there is a right to lodge a complaint with the competent data protection supervisory authority (Art. 77 GDPR in conjunction with Section 19 of the German Federal Data Protection Act).

You can revoke any consent granted for the processing of personal data at any time. This also applies to the revocation of declarations of consent that we were granted before the GDPR took effect, i.e. before May 25, 2018. Please note that any revocation applies just to the future. Processing that took place before the revocation remains unaffected.

Within the scope of our business relationship, you must provide personal data required for the initiation and conducting of a business relationship and compliance with the associated contractual obligations, or data which we are required to collect under the law.

No use is made of automatic decision-making or profiling.

1.   Case-by-case right to object
You have the right to object at any time for reasons arising from your particular situation against the processing of your personal data that is carried out based on Art. 6 (1 e) GDPR (data processing in the public interest) and Art. 6 (1 f) GDPR (data processing on the basis of balancing of interests). If you lodge an objection, we will no longer process your personal data unless we can provide proof of compelling legitimate grounds for processing that override your interests, rights and freedoms, or if the processing serves the purpose of the establishment, exercise or defense of legal claims.

2.   Right to object against the processing of data for advertising purposes
In certain cases, we process your personal data for direct marketing purposes. You have the right to object at any time to the processing of your personal data for such marketing purposes.

If you object to the processing for direct marketing purposes, we will no longer process your personal data for those purposes. You may submit your objection informally by email or by phone to the responsible entity.