In the context of our professional activities, S-Quad Handels- und Beteiligungs GmbH and, where applicable, the independent partner cooperating with us advising you (hereinafter „we“, „us“ or „our“) processes – as the controller within the meaning of Article 4(7) of the General Data Protection Regulation (Regulation (EU) 2016/679; hereinafter „GDPR“) – your personal data and the personal data of your employees and/or members of corporate bodies (hereinafter „you“ or „your“). This privacy notice informs you of the details of the processing of your personal data. Personal data is all information which relates to an identified or identifiable person, such as his/her name, date of birth, address etc. (hereinafter „data“).
NOTE: If we provide our professional services to legal entities, we kindly ask our contract and business partners to bring this privacy notice to the attention of the natural persons concerned (in particular employees and members of corporate bodies).
A. Data processing in connection with our service
1) For what purposes do we process your data and on which legal basis?
We process your data for the following purposes and on the following legal bases:
a. Contractual performance
We process the data of our contract partners for the purpose of the performance of a contract, i.e. contractually agreed services. Such processing is lawful on the basis of Article 6(1)(b) GDPR (performance of a contract). If this data is not provided to us in full or at all, we may not be able to meet all of our contractual obligations or to conclude the contract in the first place.
b. Compliance with legal obligations
Furthermore, we process personal data in order to comply with the legal obligations to which we are subject (e.g. retention periods, anti-money laundering legislation). Such processing is lawful on the basis of Article 6(1)(c) GDPR (compliance with a legal obligation). Also in this regard, we may not be able to meet all of our contractual obligations or conclude the contract in the first place, if data are not provided in full or at all.
c. Management and database of contract partners
Furthermore, we process your data for administration and business management purposes (e.g. bookkeeping, cost accounting, maintaining a database of contract partners). Such processing is conducted on the basis of our legitimate interest in running our business properly and efficiently and in managing and optimizing the selection of our contract partners (suppliers, tradesmen, etc.) and thus is lawful on the basis of Article 6(1)(f) GDPR.
d. Partner management and marketing
Lastly, we process the personal data of current, former and potential contract partners and their employees for the purposes of partner management and marketing. Such processing is conducted on the grounds of our legitimate interest in maintaining and developing existing and former partner contacts and in acquiring new partners and thus is lawful on the basis of Article 6(1)(f) GDPR.
2) Who receives your data?
Your data will be disclosed by us only if there is a valid legal basis for such disclosure and provided it does not violate our duty of confidentiality. In any case, we only disclose your data to the extent necessary for each specific purpose, or as required under the relevant legal provision, in line with any legitimate interest or, in the case of consent, as specified by you.
Where necessary, your data will be disclosed in particular to the following recipients:
Tax consultants or auditors
Banks Insurance undertakings
Service providers (e.g. IT, travel companies, chauffeur services, hotels)
Furthermore, we sometimes use service providers (data processors) for data processing (in particular for technical support). These processors have agreed to maintain the confidentiality of your data, are carefully selected by us, and are bound by our instructions.
3) How long will your personal data be retained?
In principle, we retain your data until the contractual relationship is fulfilled or has ended. Furthermore, we are subject to multiple retention obligations, in accordance with which data are also required to be retained beyond the term of the contract, as stipulated for instance on the basis of retention periods provided under tax law.
Moreover, we retain your data beyond the term of the contractual relationship as part of our database of contract partners and for the purposes of partner management. We delete your data if you object to such data processing or if there has been no contact with you for business purposes over a period of two years.
B. Data processing in connection with our website
1) Provision of the website and creation of log files
a. Description and scope of data processing
Each time our internet site is accessed, our system collects automated data and information from the computer system accessing our site. The following data may be collected:
• Information on the type of browser and the version being used
• Language and version of the browser software
• Operating system and interface used
• The user’s IP address
• Date and time of access and time zone
• Volume of data transmitted
• Websites from which the user’s system accesses our website
• Websites accessed by the user’s system via our website
• Access status / HTTP status code
The data are likewise stored in our system’s log files.
b. Legal basis for data processing The temporary storage of data and log files is lawful under Article 6(1)(f) GDPR.
C. Your rights in connection with the processing of your data
The General Data Protection Regulation (Regulation (EU) 2016/679) grants you as a data subject certain rights to which we wish to draw your attention in the following. Please note that these rights are complementary, which means that you can for instance either request that your data be rectified/completed or that it be erased.
Revocation of consent
Where we process your personal data with your consent, you have the right to revoke your consent at any time. However, this does not affect the lawfulness of the processing of data conducted up until the time of revocation.
Right of access
You have the right to obtain information on the origin, categories, storage duration, recipients, and purpose of the data relating to you processed by us, as well as information on the nature of the processing.
Right to rectification and erasure
In the event we process data relating to you that are incorrect or incomplete, you have the right to request that the data be rectified or completed. Further, you have the right to request the erasure of data processed unlawfully.
Right to restrict processing
If it is unclear whether the processed data relating to you are incorrect or incomplete or whether they are being or have been unlawfully processed, you have the right to request the restriction of the processing of your data until such time as this issue is clarified.
Right to object
You have the right to object to the processing of your data even if the data relating to you are correct and complete and even if they are being processed lawfully by us. However, you may only do so in situations in which you provide special justification.
Right to data portability
You have a right to obtain data relating to you that have been processed by us, which we received from you, in a machine-readable format determined by us or you may instruct us to transfer the data directly to a third party of your choosing provided, however, that we make this possible for the recipient from a technical perspective and that the transfer of data is not hindered or impeded due to it being an unreasonable burden and providing no other confidentiality obligations or considerations on the part of us or third parties stand in the way of such transfer.
Right to lodge a complaint
Lastly, you have a right to lodge a complaint with the Data Protection Agency if you are of the view that the processing of the personal data relating to you breaches the provisions of the General Data Protection Regulation (Regulation (EU) 2016/679).
To whom can you turn to enforce your rights as a data subject?
To assert the aforementioned rights, please write (via letter or email) to the contact specified below.
Mr. Armin Sommerauer