Data Processing Principles of FELIX KOCH OFFENBACH

You have come to this page via a link because you want to inform yourself about how we treat (your) personal data. We at FELIX KOCH take the protection of your personal data very seriously. We apply the best possible care to all of your data and strictly adhere to the statutory requirements of the European General Data Protection Regulation (EU-GDPR) as well as to the Federal Data Protection Act (BDSG) of 25 May 2018.

To meet our information duty according to section 13 (collection of personal data from the person concerned), section 14 (if the personal data were not gathered from the person concerned) and section 21 (right of revocation) we would like to present our data protection information in the following.

Parties responsible for the processing of data

The authorized officer within the meaning of GDPR, other data protection acts applicable in the member states of the European Union and other data protection provisions of legal quality is:

FELIX KOCH OFFENBACH Couleur und Karamel GmbH
Business management
Lindenstrasse 70

63071 Offenbach am Main

Telephone: 069-98 54 20 0
E-mail: office@koch-felix.de

You will find further information on our company, details on the persons entitled to represent the company and additional ways to get in contact with us in the legal notices of our website under
https://www.koch-felix.com.

Your trust is fundamental for our business relationship. Therefore, we are at your service at any time to give you information on the processing of your personal data. If you have any questions left unanswered by this privacy statement, or if you wish to receive more detailed information on a certain issue, please address our Data Protection Officer.

Contact details of our Data Protection Officer

Data Protection Officer
c/o FELIX KOCH OFFENBACH Couleur und Karamel GmbH
Lindenstrasse 70

63071 Offenbach am Main

E-mail: dsb@koch-felix.de

The data categories we process about yo

If you are our customer or business partner, we process the following data categories:

  • master and process data required to perform and deliver our services (e. g. name and address, e-mail address, telephone number, contact history, deadlines, contract data)
  • correspondence (e.g. mail or e-mail exchange with you)
  • promotional and sales information (e. g. about how you benefit from cooperating with us)
  • payment information (e. g. bank coordinates, payment history).

If you are a potential customer or partner, we process the following data categories:

  • master data required for the presentation of our portfolio (e.g. name and address, e-mail address, telephone number)
  • correspondence (e.g. mail or e-mail exchange with you)
  • promotional and sales information (e. g. about how you benefit from cooperating with us).

If you are one of our suppliers or service providers or our supplier’s or service provider’s contact partner, we process the following data categories:

  • personal master data (e.g. name and address, e-mail address, telephone number)
  • contract data (e.g. services used, contractual contents, agreed communication, names of contact persons)
  • correspondence (e.g. mail or e-mail exchange with you)
  • payment information (e. g. bank coordinates, payment history).

The purposes, legal bases and duration of processing your personal data

We collect and process your personal data for the purposes set forth in the following:

Winning customers and partners / Meeting contractual obligations with customers and partners

We collect and process personal data to win customers and partners as well as for meeting contractual obligations with our customers and partners. Here, data processing is based on Article 6 paragraph 1 lit. b GDPR allowing data processing (including transfer) for the performance of contractual or pre-contractual services.

Your personal data will only be stored as long as it is required to have knowledge of it for the purposes of the contractual relationship or for the purposes it has been collected for, or if statutory or contractual regulations exist requiring its storage. Statutory storage periods may also result from social legislation and tax law regulations and extend to a period of up to ten years for records and statements relevant under tax law.

Advertising by letter post

For advertising by letter post such as sending brochures, catalogues and similar material we may use addresses of interested persons, established customers and partners; this processing is based on Article 6 paragraph 1 lit. f GDPR. Here, our legitimate interest lies in personal direct advertising. You have the right to object to the use of your data for the purposes of direct advertising at any time.

Newsletter

If you subscribe to our newsletter we need your e-mail address. Additional data will not be collected or may be given voluntarily. The information will only be used for the distribution of the newsletter. We will not pass this information on without your consent.

Therefore, only when you will have given your consent we will process the data entered in the registration form (Article 6 paragraph 1 lit. a GDPR). You may revoke your consent at any time. All you need to do is send an informal e-mail to us, or click on the “unsubscribe” link in the newsletter. The revocation shall not affect the legitimacy of data processing up to the time of your revocation.

 

The details entered in the subscription form remain with us until you request their erasure, revoke your consent to their retention, or the purpose for keeping the data has ceased to exist (e.g. when the distribution of the newsletter will be stopped). Mandatory legal provisions – in particular retention times – remain unaffected.

Getting in touch

When you get in touch with us (e. g. by e-mail, business card, business correspondence, contact form on our website, telephone, or via social media) the information collected or provided will be processed to handle your enquiry and for follow-up issues according to Article 6 paragraph 1 lit. b GDPR. Your details may be stored in a customer relationship management system (“CRM system”) or in a comparable system used for managing enquiries.

We will delete any enquiries made by interested persons when they are not needed any more. Enquiries made by customers and partners will be stored for documentary purposes in your customer or partner profile as long as this information is needed for the purposes of the contractual relationship, or statutory or contractual regulations exist requiring their storage. As a matter of principle, we will check the data with regard to the requirement of further processing towards the end of each calendar year. Furthermore, the statutory obligations for keeping records shall apply.

If you are our supplier, service provider, organiser or otherwise our business partner or if you are our contact partner at a supplier, service provider, organiser or other business partner we will keep your information on the grounds of our commercial interest, e. g. with a view to get in touch with you at a later time. We will principally keep this predominantly company-related data permanently.

E-mails

All e-mails that we will send to you (e. g. confirmations, bills, queries) can include your address data, telephone number(s), and company information. They will not include any of your payment information such as credit card numbers or bank account details.

Performances under a contract with suppliers, service providers, organisers, or other business partners

We process the data of our suppliers, service providers, organisers or other business partners in accordance with Article 6 paragraph 1 lit. b GDPR in order to provide our contractual or pre-contractual services to them. The data processed in this context, the type, scope and purpose and the necessity to process it is governed by the relevant contractual relationship.

The data will be deleted when it will no longer be needed for meeting contractual or statutory diligence duties as well as dealing with possible warranty and comparable obligations. The necessity of data retention is reviewed every three years. In all other respects, statutory retention obligations shall apply which result among other things from social legislation and tax law regulations and extend to a period of ten years for records and statements relevant under tax law.

Applicant data

We collect and process data of applicants for employment for the purpose of carrying out recruitment procedures insofar as this is required for the decision-making on establishing an employment with us. Here, the legal basis is Article 88 GDPR in connection with section 26 paragraph 1 in connection with paragraph 8 sentence 2 German Federal Data Protection Act (BDSG).

When it comes to an employment we can continue to process the candidates’ personal data which we have already received in accordance with section 26 paragraph 1 BDSG for employment-related purposes.

We will keep the data of rejected applicants for up to 6 months after receipt of the rejection in text form following Article 6 paragraph 1 lit. f GDPR to defend possible legal claims raised under the recruitment procedure. Here, our legitimate interest is to satisfy a potential burden of proof in a proceeding under the German General Equal Treatment Act (AGG). Any data retention going beyond these purposes requires the explicit consent of the candidate.

Protection of vital interests

In rare cases the processing of your data could become necessary to protect interests which are essential for your life or for the life of another natural person.  This would typically be the case if you were injured while visiting us, and your name, age, health insurance information or other vital information would have to be given to a physician, hospital or other third party. The processing would then be based on Article 6 paragraph 1 lit. d GDPR.

Other purposes

If necessary, we process your data beyond the actual performance of the contract or preliminary contract, if this is necessary to protect legitimate interests pursued by us or third parties. In this case the processing follows Article 6 paragraph 1 lit. f GDPR. Our legitimate interests or the legitimate interests of third parties are of commercial nature (efficient fulfilment of tasks, sales, avoidance of legal risks) such as

  • supporting our sales structures in providing advice and service;
  • further development of services and add-on products;
  • preventing and resolving of criminal offences unless to fulfil legal requirements exclusively;
  • asserting legal claims and defending disputes which are not directly attributable to the contractual relationship;
  • restricted retention of data if erasure is not possible given the special type of retention or if a disproportionately high effort is required;
  • maintaining and continuance of certifications under private law and of official nature;
  • warranting of IT security and operational availability.

To the extent permitted by the specific purpose we process your data in pseudonymised or anonymised form.

In addition, we are subject to different statutory obligations and legal requirements (e. g. Civil Code (BGB), Commercial Code (HGB), generally accepted accounting principles (GoB), tax laws of the Federal Republic of Germany). The purposes of processing include fraud prevention, compliance with the monitoring and reporting obligations under tax law as well as risk evaluation and control. Furthermore, the disclosure of personal data may become necessary in connection with authoritative/judicial measures for the purposes of evidence taking, public prosecution or enforcement of civil claims. In these matters the processing follows Article 6 paragraph 1 lit. c GDPR.

The sources we get your personal data from

We exclusively process data which is freely available (e. g. on the Internet) or which we receive while doing business with you. We receive this data directly from you or from another person involved in issuing an order.

The recipients to whom your data is disclosed

In our company only those employees who are responsible for processing personal data relevant to the respective task or who need such data to fulfil our contractual and statutory obligations or to safeguard our interests are granted access to this data.

Apart from that we make use of service and supplier companies in the context of data processing (e. g. for IT maintenance) to fulfil our contractual and statutory obligations.

In addition, we can transfer your personal data to other recipients outside the company insofar as this is required to fulfil our contractual and statutory obligations (e. g. authorities or tax consultant).

Data transfer to a third party

Your personal data will only be disclosed to a third party if this is necessary to perform the contract entered into with you. Here, the transfer is based on Article 6 paragraph 1 lit. b GDPR allowing data processing for the performance of a contract or pre-contractual measures.

The transfer of your data to a third country without appropriate safeguards is based on Article 49 paragraph 1 lit. b GDPR which allows the transfer for the performance of a contract.

Any other transfer of data will only be made if you explicitly consented to the transfer or if we are statutorily or officially obliged to do so.

Your data will not be transferred to third parties for advertising purposes.

Your obligation to provide your data

In connection with our business relationship you need to provide only the personal data which is necessary to establish, perform and terminate the business or which we are legally obliged to collect. Without this data we will usually have to decline to enter into contract with you, or to perform the order, or cannot continue to fulfil a contract in place and, in that case, have to terminate it.

Automated decision-making and profiling

There is no automated decision-making, and we will not create any profile from your personal data.

Your rights regarding the processing of your personal data

Revocation of your consent to data processing

Many data processing jobs can only be performed with your explicit consent. You may revoke your consent at any time. All you need to do is send an informal e-mail to our Data Protection Officer. The revocation shall not affect the legitimacy of data processing up to the time of your revocation.

Communication of your data

You have the right to receive information about your personal data processed by us as well as to demand a copy of this data. Elements of this information are: purposes of processing, data categories, its recipients or categories of recipients as well as, if possible, the intended data retention period or criteria for the determination of this period. If we receive a request to disclose information which is not made in written form, we kindly ask for your understanding that we may then request from you to prove that you are the person who you claim to be.

Rectification, erasure, restriction

In addition, you are entitled to request rectification if the data is incorrect or erasure if its retention is prohibited. If, for various reasons, the erasure of data is not possible you have the right to request that the processing of your data is restricted or blocked.

Right to object

Insofar as the processing of data follows Article 6 paragraph 1 lit. f GDPR (balancing of interests) you have the right pursuant to Article 21 paragraphs 1 and 2 GDPR to lodge an objection against the processing of this data at any time. We will then refrain from processing this personal data unless we can demonstrate compelling legitimate grounds which override your legitimate interests. Or, if the processing is required to assert, exercise or defend legal claims.

Right to data portability

You have the right to have data, that we process automatically with your consent or in the fulfilment of a contract, transferred to you or a third party in a common, machine-readable form. If you wish to have the data transferred directly to another controller, we will only do so if this is technically feasible.

To exercise your rights please contact our Data Protection Officer who is bound to secrecy regarding your request insofar as the processing of your data is concerned.

Right to lodge a complaint with the competent supervisory authority

Without prejudice to any other administrative or judicial remedy, you, as the affected person, have the right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR if you are of the opinion that the processing of personal data pertaining to you violates any GDPR.

The competent supervisory authority in data protection matters is the state data protection commissioner of Hessen who will inform you about the progress and outcome of the complaint including the possibility to seek judicial remedy pursuant to Article 78 GDPR.

Timeliness and alteration of this information

This privacy statement shall apply as of June 2018.

Menü