Privacy notice for business partners

The controller responsible for the processing of your personal data is generally the company of the Craemer Group with which the company or organization for which you work has, or is initiating, a business relationship.

The contact details of the company responsible for you can be found in the relevant contract, offer, order or other business documents, or in the communication conducted with you or your company.

Where another controller or joint controllership applies to individual processing activities, you will be informed of this separately.

You can contact the Data Protection Officer of the Craemer Group at:

Data Protection Officer of the Craemer Group
Brocker Strasse 1, 33442 Herzebrock-Clarholz, Germany

Phone: +49 5245 43-0
Email: datenschutzbeauftragter@craemer.com

In the context of the business relationship, we process the following personal data:

• Name and business contact details,
• Company, function and position,
• Communication content, e.g. emails and business correspondence,
• Contract, offer, order and billing data,
• Where business partners are self-employed, payment and invoice information, where applicable,
• Information about the course of the business relationship.

We generally receive your personal data directly from you or in the context of the business relationship with the company or organisation for which you work.

Where we do not collect your personal data directly from you, it may in particular originate from your employer or our respective business partner, from other contacts within your company or organisation, and from publicly accessible sources.

We process personal data of our business partners and their contact persons in particular for the following purposes:

• Initiating and performing contractual relationships, where the data subject is a contracting party (Art. 6(1)(b) GDPR),
• Communication, organisation and management of the business relationship with contact persons of our customers, suppliers and other business partners on the basis of our legitimate interest in proper and efficient business operations (Art. 6(1)(f) GDPR),
• Customer relationship management, CRM and, where applicable, marketing measures on the basis of the applicable legal basis, in particular Art. 6(1)(f) GDPR or consent given pursuant to Art. 6(1)(a) GDPR,
• Compliance with legal obligations (Art. 6(1)(c) GDPR),
• Safeguarding further legitimate interests, in particular to ensure IT and information security, to prevent misuse and fraud, and to establish, exercise or defend legal claims (Art. 6(1)(f) GDPR).

Personal data is generally stored only for as long as this is necessary for the performance of the business relationship and for the purposes set out above.

After termination of a business relationship, the data will be deleted or blocked unless statutory retention obligations or other legitimate grounds for further storage apply.

Longer retention may be required in particular to comply with commercial and tax law retention obligations or to establish, exercise or defend legal claims.

Within the Craemer Group, only those persons and departments that need the personal data to perform their tasks will have access to it.

Where necessary, personal data may also be transferred to external service providers, in particular IT, hosting, support or other administrative service providers. Where these providers act as processors, the processing is carried out on the basis of a corresponding agreement pursuant to Art. 28 GDPR.

In addition, personal data may be transferred to authorities, courts or other public bodies where there is a legal obligation to do so or where the transfer is necessary to safeguard legitimate interests.

Where, in the context of processing, personal data is transferred to recipients in countries outside the European Union or the European Economic Area, or processed there, this will only take place in compliance with the statutory requirements of Art. 44 et seq. GDPR.

A transfer may occur, for example, in connection with the use of IT, cloud, CRM or other service providers. Where no adequacy decision of the European Commission exists for the relevant third country, the transfer will be based on appropriate safeguards, such as the standard contractual clauses adopted by the European Commission.

Subject to the statutory requirements, you have the following rights:

• Right of access pursuant to Art. 15 GDPR,
• Right to rectification pursuant to Art. 16 GDPR,
• Right to erasure pursuant to Art. 17 GDPR,
• Right to restriction of processing pursuant to Art. 18 GDPR,
• Right to data portability pursuant to Art. 20 GDPR,
• Right to object pursuant to Art. 21 GDPR,
• Right to withdraw consent given at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.

Where we process your personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation.

Where personal data is processed for direct marketing purposes, you have the right to object to processing for this purpose at any time. After an objection, your personal data will no longer be processed for direct marketing purposes.

The provision of certain personal data may be necessary for initiating or performing a business relationship or due to statutory requirements.

Without the required data, a business relationship may not be initiated or performed, or may only be initiated or performed to a limited extent.

Decision-making based solely on automated processing within the meaning of Art. 22 GDPR does generally not take place in the context of the processing described.