The protection of your data is very important to us, which is why we observe the applicable provisions on data protection, in particular those set forth in the GDPR and the national data protection law, while processing your personal data. Below you will find more detailed information on the data processing activities carried out by us:

1. Controller

BG-Graspointner GmbH*
Reinoldstraße 6b
50676 Köln
+49.221.80 14 24-70
office.de@bg-graspointner.com

Since we are not legally required to do so, we have not appointed/designated to the supervisory authority a data protection officer. If you have any questions, you can contact us at the above (email) address. The controller is member of a group of undertakings within the meaning of Art. 4 (19) GDPR. The data listed below are only transferred to other members of the group of undertakings where this is expressly mentioned. The legal basis is our legitimate interest in transferring the data for internal administrative purposes (point (f) of Art. 6 (1) in conjunction with Recital 48 GDPR).

2. Rights of the data subject/Right to object and withdraw consent/Right to lodge a complaint

2.1. You can exercise the following rights against us in respect of the personal data concerning you:

• Right of access (Art. 15 GDPR),
• Right to rectification (Art. 16 GDPR) or erasure (Art 17 GDPR),
• Right to restriction of processing (Art. 18 GDPR),
• Right to data portability (Art. 20 GDPR),
• Right to object to processing (Art. 21 GDPR).

Right to object: Where the processing of your personal data is based on the balancing of interests (point (f) of Art. 6 (1) GDPR: legitimate interests), you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you. When you exercise your right to object, we will ask you to state the reasons why you do not wish your personal data to be processed the way we previously did. We will review the circumstances and will either discontinue the processing, modify the processing or demonstrate to you our compelling legitimate grounds for continuing the processing. We will also continue the processing to the extent necessary for the establishment, exercise or defence of legal claims.

You have the right to object at any time to processing of personal data for direct marketing and data analysis purposes. In this case, we will discontinue the data processing.

Right to withdraw consent: Where you have consented to the processing of your personal data, you can withdraw your consent at any time. The withdrawal of your consent will not affect the lawfulness of processing carried out before the withdrawal.

To exercise the above rights, you have to contact us personally, by phone or in writing:

BG-Graspointner GmbH*
Reinoldstraße 6b
50676 Köln
Germany
+49.221.80 14 24-70
office.de@bg-graspointner.com

Please note that we are only able to provide information if you provide proof of your identity. This is mainly to protect you and prevent the disclosure of your data to unauthorised third parties.

2.2. If you consider that the data processing infringes the applicable data protection regulations or that we violate your rights under the data protection regulations, you also have the right to lodge a complaint with the supervisory authority in the member state of your habitual residence, place of work or place of the alleged infringement.
If you wish to lodge a complaint with the supervisory authority in Austria, please address your complaint to:

The Federal Commissioner for Data Protection and Freedom of Information
Husarenstraße 30
53117 Bonn

3. Information on the processing of your personal data

3.1. When visiting the website merely for information purposes

• Purpose: When using our website for information purposes only (no registration or transmission of other information), we collect those personal data which are transmitted to our server by your browser. This is technically necessary to be able to display to you our website as well as to ensure the stability and security of the website.


• Legal basis: Legitimate interests (point (f) of Art. 6 (1) GDPR)


• The following data are processed: IP address, date and time of request, time zone difference to GMT, content of request (specific page), access status/HTTP status code, data volume transferred, requesting website, browser, operating system as well as interface, language and version of the browser software


• Duration of storage: As long as you use our website.


• Recipients/Categories of recipients: None

3.2. Electronic contact requests via the website

• Purpose: Processing of contact requests sent via email or the website contact form


• Legal basis: Performance of a contract, taking steps prior to entering into a contract (point (b) of Art. 6 (1) GDPR), legitimate interests (point (f) of Art. 6 (1) GDPR)


• The following data are processed: Master data, content of request


• Duration of storage: Until the request is answered. If statutory retention requirements exist, the processing will be limited to the period from answering the request to the end of the retention period.


• Recipients/Categories of recipients: Members of our group of undertakings

3.3. Cookies/Web analytics service

• Purpose: Improvement of services offered, web presence and direct marketing


• Legal basis: Legitimate interest, in particular in maintaining the functionality of the website and improving its own services for the benefit of users (point (f) of Art. 6 (1) GDPR)


• The following data are processed: IP address


• Duration of storage: 14 months


• Recipients/Categories of recipients: Google Analytics, members of our group of undertakings

3.4. Customer management, accounting, logistics and bookkeeping

• Purpose: Processing of personal data as part of business relationships with customers and suppliers in the context of the manufacture of products produced by our company and the provision of services, including systematic recording of all business operations relating to income and expenses


• Legal basis: Performance of a contract, taking steps prior to entering into a contract (point (b) of Art. 6 (1) GDPR), for processing (in particular storage) after compliance with the contractual obligations: legitimate interests, in particular establishment, exercise and defence of legal claims (point (f) of Art. 6 (1) GDPR), explicit consent (point (a) of Art. 9 (2) GDPR)


• Duration of storage: Until termination of the business relationship or until expiry of the guarantee, warranty, limitation and statutory retention periods applicable to the customer (in particular BAO – Austrian Federal Fiscal Code); in addition, until resolution of any legal disputes for which the data is required as evidence


• Recipients/Categories of recipients: Revenue office, courts and public authorities, suppliers, debt collection agencies, banks entrusted with the payment to the data subject or a third party, legal representatives, public accountants, payroll accountants, members of our group of undertakings

The provision of your personal data is required for the performance of the contract and/or to take steps prior to entering into the contract. Without these data, we cannot conclude a contract with you.


3.5. Customer support and marketing for own purposes

• Purpose: Processing of our own or purchased data of customers and prospective customers to initiate business contact concerning our own products or services as well as to implement advertising campaigns and to send newsletters; customer relationship management, in particular information of customers/interested parties about requested and related products and services.


• Legal basis: For newsletter: consent (point (a) of Art. 6 (1) GDPR), for existing customers and during the initial phase: legitimate interests, (point (f) of Art. 6 (1) GDPR), in particular direct marketing (Recital 47 GDPR)


• The following data are processed for sending the newsletter via our website: Master data


• Duration of storage: The data are retained until the end of the third year following the last contact with the customer, unless longer contractual or statutory retention periods exist.


• Recipients/Categories of recipients: CleverReach GmbH & Co. KG (processor), members of our group of undertakings

3.6. Applicant management

• Purpose: Use and keeping on file of personal data provided by applicants, provided that these data were provided by the data subject


• Legal basis: When keeping the personal data on file: consent (point (a) of Art. 6 (1) GDPR), when transferring sensitive data within the meaning of Art. 9 GDPR to us (e.g. religious confession, social insurance number): explicit consent (point (a) of Art. 9 (2) GDPR), after receipt of applicant data (initial phase): taking steps prior to entering into a contract (point (b) of Art. 6 (1)


• Duration of storage: Applicant data will be deleted immediately after filling the advertised position or after expiry of deadline for asserting claims according to the Austrian Equal Treatment Act, unless consent to keeping the application on file for future reference is available. Speculative applications will be kept on file according to their purpose until withdrawal of consent by the data subject.


• Recipients/Categories of recipients: Applicant data will not be passed on to third parties.

4. Information on data transfer to third countries or international organisations

The data processed by us will only be transferred to the following members of our group of undertakings (Art. 4 (19) GDPR):

• BG-Graspointner Inc., 642 De Courcelle, Suite 206, Montréal (QC), H4C 3C5, Canada


• OOO Gidro BG, b143180, Moskovskaya oblast, Zvenigorod, Proektiruemiy proezd, vladenie 11, stroenie 4, kabinet 24, Russia


• BG-Graspointner USA Inc., 134 Boynton Ave, Plattsburgh, NY 12901, USA


• Watersys AG, Industriering 17, 3250 Lyss, Schweiz

In the case of Canada, this transfer takes place on the basis of an adequacy decision (Art. 45 (3) GDPR) and in other cases on the basis of standard data protection clauses (point (c) of Art. 46 (2) GDPR) adopted by the European Commission in accordance with the examination procedure referred to in Art. 93 (2) GDPR.


* valid from 1^st of September 2019