Data protection information for customers and other data subjects in accordance with the GDPR
Thank you for visiting our website and for your interest in our services. The protection of your personal data during processing throughout the entire business process is an important concern for us.
With the following information, we would like to give you, as a customer or as a person interested in our products/services, an overview of the processing of your personal data by us and your rights under data protection law. Which data is processed in detail and how it is used depends largely on the desired or agreed services. Therefore, not all parts of this information will apply to you.
1. who is responsible for the data collection on this website?
Responsible for the data processing through this website is the
Aranju UG
Camberger Straße 4
D-61389 Schmitten
You can reach those responsible at
Aranju UG
Camberger Straße 4
D-61389 Schmitten
As well as by e-mail
datenschutz@aranju.de
and telephone
+49 6081 4542561
2 What sources and data do we use?
We process personal data that we receive from our customers or other data subjects as part of our business relationship. In addition, we process - insofar as this is necessary for our business relationship - personal data that we legitimately obtain from publicly accessible sources (e.g. debtor directories, land registers, commercial and association registers, press, internet) or that is legitimately transmitted to us by other third parties (e.g. a credit reference agency).
Relevant personal data of you and, if applicable, your employees are personal details (name, address and other contact details, date and place of birth and nationality), identification data (e.g. ID card data) and authentication data (e.g. specimen signature). In addition, this may also include order data (e.g. payment order), data from the fulfillment of our contractual obligations (e.g. turnover data in payment transactions), information about your financial situation (e.g. creditworthiness data, scoring/rating data, origin of assets), advertising and sales data (including advertising scores), documentation data (e.g. minutes from meetings) and other data comparable to the categories mentioned.
3 What do we process your data for (purpose of processing) and on what legal basis?
We process personal data in accordance with the provisions of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
3.1 For the fulfillment of contractual obligations (Art. 6 para. 1 b GDPR)
The processing of data takes place for the provision and execution of orders and commissions as part of the execution of our contracts with our customers or for the implementation of pre-contractual measures that take place on request. The purposes of data processing are primarily based on the specific contract. Further details on the data processing purposes can be found in the relevant contract documents and terms and conditions.
3.2 As part of the balancing of interests (Art. 6 para. 1 f GDPR)
If necessary, we process your data beyond the actual fulfillment of the contract to protect our legitimate interests or those of third parties. Examples of this are:
- Consultation of and data exchange with credit agencies (e.g. SCHUFA) to determine creditworthiness or default risks in our business default risks in our business
- Examination and optimization of procedures for needs analysis for the purpose of direct customer contact,
- Advertising or market and opinion research insofar as you have not objected to the use of your data,
- Assertion of legal claims and defense in legal disputes,
- Ensuring the IT security and IT operation of the company,
- Prevention and investigation of criminal offenses,
- Video surveillance to safeguard domiciliary rights, to collect evidence in the event of burglaries (cf. also § 4 BDSG),
- measures for building and plant security (e.g. access controls),
- measures to safeguard domiciliary rights,
- measures for business management and further development of services and products,
- risk management.
3.3 Based on your consent (Art. 6 para. 1 a GDPR)
If you have given us your consent to process personal data for specific purposes (e.g. disclosure of data, evaluation of payment transaction data for marketing purposes, photographs in the context of events, newsletter dispatch), the lawfulness of this processing is based on your consent. Any consent given can be revoked at any time. This also applies to the revocation of declarations of consent that were given to us before the GDPR came into force, i.e. before May 25, 2018. The withdrawal of consent is only effective for the future and does not affect the legality of the data processed until the withdrawal.
3.4 Due to legal requirements (Art. 6 para. 1 c GDPR) or in the public interest (Art. 6 para. 1 e GDPR)
As a company, we are also subject to various legal obligations, i.e. legal requirements (e.g. Money Laundering Act, tax laws and regulatory requirements). The purposes of processing include credit checks, identity and age checks, fraud and money laundering prevention, the fulfillment of control and reporting obligations under tax law and the assessment and management of risks within the company.
4 Who receives my data?
Within the company, those departments that need your data to fulfill our contractual and legal obligations will have access to it. Service providers and vicarious agents employed by us may also receive data for these purposes if they maintain confidentiality and integrity in particular. These are companies in the categories of IT services, logistics, printing services, telecommunications, debt collection, consulting as well as sales and marketing.
With regard to the transfer of data to recipients outside our company, it should first be noted that we only pass on necessary personal data in compliance with the applicable data protection regulations. We may only pass on information about you if this is required by law, if you have given your consent or if we are authorized to provide information. Under these conditions, recipients of personal data may be, for example:
- public bodies and institutions (e.g. tax authorities, criminal prosecution authorities, family courts, land registries) in the event of a legal or official obligation,
- credit and financial services institutions or comparable institutions to which we transfer personal data in the course of the business relationship (e.g. banks, credit agencies).e.g. banks, credit agencies),
- creditors or insolvency administrators who make inquiries in the context of enforcement proceedings,
- auditors,
- service providers that we use in the context of order processing relationships.
5. is data transferred to a third country or to an international organization?
No.
6.how long will my data be stored?
We process and store your personal data and that of your employees for as long as is necessary for the fulfillment of our contractual and legal obligations.
If the data is no longer required for the fulfillment of contractual or legal obligations, it is regularly deleted, unless its - temporary - further processing is necessary for the following purposes:
- fulfillment of commercial and tax retention obligations,
- German Commercial Code (HGB), German Fiscal Code (AO), German Money Laundering Act (GwG). The retention and documentation periods specified there are generally two to ten years.
- Preservation of evidence within the framework of the statutory limitation periods. According to §§ 195 ff. of the German Civil Code (BGB), these limitation periods can be up to 30 years, whereby the regular limitation period is 3 years.
7 What data protection rights do I have?
Every data subject has the right of access under Article 15 GDPR, the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, the right to restriction of processing under Article 18 GDPR, the right to object under Article 21 GDPR and the right to data portability under Article 20 GDPR.
The restrictions under Sections 34 and 35 BDSG-new apply to the right of access and the right to erasure. In addition, you have the right to lodge a complaint with a competent data protection supervisory authority (Article 77 GDPR in conjunction with Section 19 BDSG).
You can withdraw your consent to the processing of personal data at any time. This also applies to the revocation of declarations of consent given to us before the GDPR came into force, i.e. before May 25, 2018. Please note that the revocation is only effective for the future. Processing that took place before the withdrawal is not affected.
8. is there an obligation for me to provide data?
As part of our business relationship, you must provide the personal data that is necessary for the establishment, execution and termination of a business relationship and for the fulfillment of the associated contractual obligations or that we are legally obliged to collect. Without this data, we will generally not be able to conclude, execute and terminate a contract with you.
9.to what extent is there automated decision-making?
In principle, we do not use fully automated decision-making in accordance with Article 22 GDPR to establish, implement and terminate the business relationship. Should we use these procedures in individual cases (e.g. to improve our products and services), we will inform you separately about this and about your rights in this regard, insofar as this is required by law.
10. does profiling take place?
We process your data partially automatically with the aim of evaluating certain personal aspects (profiling). For example, we use profiling in the following cases:
- We use evaluation tools to inform and advise you about products and services in a targeted manner. These enable needs-based communication and advertising, including market and opinion research.
- We use scoring to assess your creditworthiness. This involves calculating the probability that a customer will meet their payment obligations in accordance with the contract. Scoring is based on a mathematically and statistically recognized and proven procedure. The calculated score values help us to make decisions when concluding product contracts and are included in ongoing risk management.
11.information about your right to object in accordance with Article 21 GDPR
11.1 Individual right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(e) GDPR (data processing in the public interest) and Article 6(1)(f) GDPR (data processing on the basis of a balancing of interests); this also applies to profiling based on this provision within the meaning of Article 4 no. 4 GDPR. 4 GDPR.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms. This includes, in particular, if the processing is necessary for the establishment, exercise or defense of legal claims.
11.2 Recipient of an objection
The objection can be made informally with the subject "Objection" stating your name, address and date of birth and should be addressed to:
Aranju UG
Camberger Straße 4
D-61389 Schmitten
+49 6081 4542561
datenschutz@aranju.de
