Data protection information from the German Factoring Association
(please note that this is only an English translation from the original and hence binding German text, provided for your convenience)
The protection of your data is important to us. With the following data protection information we would like to inform you about the processing of your data and inform you about your rights in this regard.
I. Name and address of the person responsible
The person responsible within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is:
….
II. General information on data processing
1. Scope of processing of personal data
We generally only process personal data of our users on our website insofar as this is necessary to provide a functional website as well as our content and services. When you contact us or have contractual relationships with us, we only process the data insofar as this is necessary in each case.
Generally, personal data is only processed if and to the extent that processing of the data is permitted by statutory provisions or on the basis of consent.
Generally, we do not pass data on to third parties. In particular, the data is not passed on for advertising purposes. In addition, we do not use any personal data for advertising purposes, we do not create user profiles or do profiling.
2. Legal basis for the processing of personal data
Insofar as we obtain the consent of the data subject for the processing of personal data, Article 6 (1) a of the EU General Data Protection Regulation (GDPR) serves as the legal basis. When processing personal data that is required to fulfill a contract to which the data subject is a party, Art. 6 Para. 1 b GDPR serves as the legal basis. This also applies to processing operations that are required to carry out pre-contractual measures.
Insofar as the processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 Para. 1 c GDPR serves as the legal basis.
In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 Para. 1 d GDPR serves as the legal basis.
If processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the person concerned do not outweigh the first-mentioned interest, Art. 6 Paragraph 1 f GDPR serves as the legal basis for the processing.
3. Data deletion and storage duration
The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Storage can also take place if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which the person responsible is subject. The data will also be blocked or deleted if a storage period prescribed by the aforementioned laws and rules expires, unless there is a need for further storage of the data for the conclusion or fulfillment of a contract.
III. Making the website available and creation of log files
1. Description and scope of data processing
Every time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer. The following data is collected: information about the browser type and version used, the user's operating system, the user's IP address (anonymized), the date and time of access.
The IP address of the user is anonymized so that no personal affiliation can be established. The data is also stored in the log files of our system. This data is not stored together with other personal data of the user.
2. Legal basis for data processing
The legal basis for the temporary storage of the data and the log files is Art. 6 Para. 1 f GDPR.
3. Purpose of data processing
The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's computer. To do this, the user's IP address must be saved for the duration of the session. The storage in log files takes place in order to ensure the functionality of the website. In addition, we use the data to optimize the website and to ensure the security of our information technology systems. Our legitimate interest in data processing in accordance with Art. 6 Paragraph 1 f GDPR lies in these purposes.
An evaluation of the data for marketing purposes does not take place in this context.
4. Duration of storage
The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. In the case of the collection of data for accessing the website, this is the case when the respective session has ended. If the data is stored in log files, this is the case after seven days at the latest.
Storage beyond this is possible. In this case, the IP addresses of the users are deleted or alienated so that they can no longer be assigned to the accessing client.
5. Matomo analysis service
We use the analysis service Matomo (formerly PIWIK), which uses cookies. These are text files that are stored on your computer and that make it possible to analyze the use of our website. For this purpose, the usage information obtained by the cookie is transmitted to us and stored so that usage behavior can be evaluated (collection and analysis of statistical data).
Your IP address will be anonymized immediately; this means that you remain anonymous as a user. We use the service to receive information about user behavior on our website and thus to be able to improve it. The information generated by the cookie about your use of this website will not be passed on to third parties and will be deleted after 6 weeks at the latest.
We only use Matomo with your consent (Art. 6 Para. 1 lit. a GDPR) in the cookie banner.
Further information on the Matomo terms of use and the data protection regulations can be found at: https://matomo.org/privac
You have the option of deactivating Matomo at any time, even after you have given your consent (opt-out).
Please click here: Deactivate Matomo
6. Opposition and removal option
The collection of the data for the provision of the website and the storage of the data in log files is essential for the operation of the website. There is consequently no possibility of objection on the part of the user.
IV. Use of cookies
1. Description and scope of data processing
Our website uses cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the user's computer system. When a user calls up a website, a cookie can be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be clearly identified when the website is called up again.
Some elements of our website require that the calling browser can also be identified after changing pages. Only the following data is stored and transmitted in the cookies: log-in information, information about the use of Javascript, the ID of the cookie.
2. Legal basis for data processing
The legal basis for the processing of personal data using technically necessary cookies is Art. 6 Para. 1 lit. f GDPR.
3. Purpose of data processing
The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For this it is necessary that the browser is recognized even after changing pages. Our legitimate interest in the processing of personal data in accordance with Art. 6 Para. 1 lit. f GDPR lies in these purposes. The user data collected by technically necessary cookies are not used to create user profiles or tracking.
4. Duration of storage, possibility of objection and removal
Cookies are stored on the user's computer and transmitted from there to our site. As a user, you therefore have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your Internet browser. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it is possible that not all functions of the website can be used to their full extent.
V. Registration and use of the created account
1. Description and scope of data processing
On our website we only offer employees of our member companies the opportunity to register by providing personal data. By registering or subsequent registrations, the user can access content that we make available to our members, such as event information and association newsletters. When registering, data is entered in an input mask and transmitted to us and saved. A transfer of data to third parties does not take place. The following data is collected during the registration process:
Surname, first name, email address, name of the member company, telephone number, user name
When the account is subsequently used (log in), only the user name (and a password that only the user knows) will be processed. At the time of registration and when the account is subsequently used, the following data is also stored: Date and time of registration
2. Legal basis for data processing
Members are entitled to register as part of their membership. The legal basis for the processing of the data is therefore Art. 6 Paragraph 1b GDPR, in addition Art. 6 Paragraph 1f GDPR.
3. Purpose of data processing
A registration of the user is required to access certain content and services on our website. By registering or subsequent registrations, the user can access content that we make available to our members, such as event information and association newsletters.
4. Duration of storage
The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. This is the case for the data collected during the registration process if the registration on our website is canceled or changed. The data that is also collected during registration or the subsequent log-in, such as the date and time of registration, is automatically deleted after 23 days.
5. Opposition and removal option
As a user, you have the option at any time to cancel the registration or to have the data stored about you changed. Simply send a corresponding email to kontakt@factoring.de
or call us at 030-20654654. If the membership expires, the accounts will be automatically deleted by us.
VI. Contact by email, post, fax or phone or by handing over a business card
1. Description and scope of data processing
The German Factoring Association can be contacted in writing using the email address provided, by post or fax or by handing over a business card. In these cases, the personal data transmitted will be processed. If you contact us by telephone, the telephone number as well as the date and time of the call and any other contact details are saved. In this context, the data will not be passed on to third parties. The data will only be used to process the conversation. When a business card is presented, the contact details are also stored in our system for further contact maintenance.
2. Legal basis for data processing
The legal basis for the processing of the data transmitted in the course of sending an e-mail, by post, by fax, when making a phone call or by handing over a business card is Art. 6 Para. 1 f GDPR. If the aim of establishing contact is to conclude a contract, the additional legal basis for processing is Art. 6 Para. 1 b GDPR.
3. Purpose of data processing
If you contact us, the data processing is used to process the contact and, if necessary, any subsequent communication or contact maintenance that may result from it.
4. Duration of storage
The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. This is the case when the respective conversation with the user has ended. The conversation ends when it can be inferred from the circumstances that the matter in question has been finally clarified and no further communication is desired.
5. Opposition and removal option
It is possible at any time to revoke any consent that may have been given to the processing of personal data. If the user contacts us by email, post, fax, telephone or by handing over a business card, they can object to the storage of his personal data at any time. In such a case, the conversation cannot be continued. To do this, send a corresponding email to kontakt@factoring.de or call us at 030-20654654. In this case, all personal data that was stored in the course of contacting us will be deleted.
VII. Contractual Relationship
1. Description and scope of data processing
If you have a contractual relationship with us, e.g. as a service provider, we process the data required to fulfill the contract. These are, for example, name, title, company, contact details and any other data required to fulfill the contract. In principle, your data will not be passed on to third parties, but in exceptional cases this may be necessary to fulfill the contract, for example in the case of postal traffic for sending letters.
2. Legal basis for data processing
In this case, the legal basis is Article 6, Paragraph 1b. GDPR
3. Purpose of data processing
The purpose of data processing is to fulfill the contract.
4. Duration of storage
The data will be stored for as long as is necessary to fulfill the contract. If the contractual relationship has expired, the personal data will also be deleted, whereby we have to observe statutory retention periods, so that some documents can only be deleted after the statutory periods have expired.
VIII. Rights of the data subject
If your personal data is processed, you are affected within the meaning of the GDPR and you have the following rights vis-à-vis the person responsible:
1. Right to information
You can request confirmation from us as to whether personal data relating to you is being processed by us. If this is the case, you can request information from us about the following information:
(1) the purposes for which the personal data are processed;
(2) the categories of personal data that are processed;
(3) the recipients or the categories of recipients to whom the personal data relating to you have been disclosed or are still being disclosed;
(4) the planned duration of the storage of your personal data or, if specific information is not available, criteria for determining the duration of storage;
(5) the existence of a right to correct or delete your personal data, a right to restrict processing by the person responsible or a right to object to this processing;
(6) the right to lodge a complaint with a supervisory authority;
(7) all available information about the origin of the data if the personal data are not collected from the data subject;
(8) The existence of automated decision-making including profiling in accordance with Art. 22 Paragraphs 1 and 4 GDPR and - at least in these cases - meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.
You have the right to request information about whether your personal data is being transmitted to a third country or to an international organization. In this context, you can request to be informed about the appropriate guarantees in accordance with Art. 46 GDPR in connection with the transmission.
2. Right to correction and / or completion
You have the right to correct and / or complete us if the processed personal data concerning you is incorrect or incomplete
3. Right to restriction of processing
Under the following conditions, you can request that the processing of your personal data be restricted:
(1) if you dispute the accuracy of the personal data concerning you for a period that enables us to check the accuracy of the personal data;
(2) the processing is unlawful and you refuse to delete the personal data and instead request that the use of the personal data be restricted;
(3) We no longer need the personal data for processing purposes, but you need them to assert, exercise or defend legal claims, or
(4) if you have lodged an objection to the processing in accordance with Art. 21 Paragraph 1 GDPR and it has not yet been determined whether the legitimate reasons of the person responsible outweigh your reasons.
If the processing of your personal data has been restricted, this data - apart from its storage - may only be used with your consent or to assert, exercise or defend legal claims or to protect the rights of another natural or legal person or for reasons of important public interest processed by the Union or a Member State. If the processing restriction has been restricted according to the above conditions, you will be informed by the person responsible before the restriction is lifted.
4. Right to cancellation
a) Obligation to delete
You can request that we delete the personal data relating to you immediately, and we are obliged to delete this data immediately if one of the following reasons applies:
(1) The personal data relating to you are no longer necessary for the purposes for which they were collected or otherwise processed.
(2) You revoke your consent on which the processing was based in accordance with Art. 6 Paragraph 1 a or Art. 9 Paragraph 2 a GDPR, and there is no other legal basis for the processing.
(3) You object to the processing in accordance with Art. 21 Paragraph 1 GDPR and there are no overriding legitimate reasons for the processing, or you object to the processing in accordance with Art. 21 Paragraph 2 GDPR.
(4) The personal data concerning you have been processed unlawfully.
(5) The deletion of your personal data is necessary to fulfill a legal obligation under Union law or the law of the member states to which the person responsible is subject.
(6) The personal data relating to you were collected in relation to the information society services offered in accordance with Art. 8 Paragraph 1 GDPR.
b) The right to deletion does not exist if processing is necessary
(1) to exercise the right to freedom of expression and information;
(2) To fulfill a legal obligation that requires processing under the law of the Union or of the member states to which we are subject, or to perform a task that is in the public interest or in the exercise of official authority that has been transferred to the person responsible ;
(3) for reasons of public interest in the area of public health in accordance with Art. 9 Paragraph 2 h and i and Art. 9 Paragraph 3 GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes in accordance with Art. 89 Para. 1 GDPR, insofar as the right mentioned under section a) is likely to make the realization of the objectives of this processing impossible or seriously impair it, or
(5) for the establishment, exercise or defense of legal claims.
5. Right to data portability
You have the right to receive the personal data concerning you that you have provided to us in a structured, common and machine-readable format. You also have the right to transfer this data to another person responsible without hindrance from us, to whom the personal data was provided, provided that
(1) the processing is based on consent in accordance with Art. 6 Paragraph 1 a GDPR or Art. 9 Paragraph 2 a GDPR or on a contract in accordance with Art. 6 Paragraph 1 b GDPR and
(2) the processing is carried out using automated procedures.
In exercising this right, you also have the right to have the personal data relating to you transmitted directly from us to another person responsible, insofar as this is technically feasible. This must not impair the freedoms and rights of other people.
The right to data portability does not apply to the processing of personal data that is necessary for the performance of a task that is in the public interest or takes place in the exercise of official authority that has been transferred to the person responsible.
6. Right to object
You have the right, for reasons that arise from your particular situation, to object at any time to the processing of your personal data, which is based on Art. 6 Para. 1 e or f GDPR (this also applies to a profiling based on these provisions, which we do not carry out).
We will then no longer process the personal data relating to you unless we can demonstrate compelling legitimate reasons for the processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
In connection with the use of information society services - regardless of Directive 2002/58 / EC - you have the option of exercising your right of objection by means of automated procedures in which technical specifications are used.
7. Right to revoke the declaration of consent under data protection law
You have the right to revoke a data protection declaration of consent given by you at any time. Revoking your consent does not affect the legality of the processing carried out on the basis of your consent up to the point of revocation.
8. Automated decision in individual cases including profiling
We do not use your data for profiling purposes.
9. Provision of data
In principle, you are neither legally nor contractually obliged to provide us with personal data. For a voluntary registration on our website reserved for members, corresponding data is required, otherwise registration for the member's area cannot be made. The processing of personal data is also necessary to carry out a contractual relationship.
10. Right to complain to a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your place of residence, your place of work or the place of the alleged infringement, if you are of the opinion that the processing of your personal data is against violates the GDPR.
The supervisory authority to which the complaint was lodged informs the complainant about the status and the results of the complaint, including the possibility of a judicial remedy in accordance with Art. 78 GDPR.
(Copyright notice: the text is partially taken from the sample data protection declaration by Professor Dr. Thomas Hoeren from the University of Münster)
Status: May 2018
