Information obligations when collecting data in accordance with Art. 13 and 14 GDPR for processing supplier data

1. Name and contact details of the controller
The controller responsible for data collection is
FIPA GmbH
Freisinger Straße 30
85737 Ismaning / Germany
Phone: +49 89 962489-0
Fax: +49 89 962489-11
E-mail: info@fipa.com
www.fipa.com

Registered office of the company:
Ismaning / Germany

Managing Director:
Rainer Mehrer

Register court Local court:
Munich/Register number HRB 104 684

2. Contact details of the data protection officer
DataCo GmbH
Dachauer Str. 65
80335 Munich
E-mail: datenschutz@dataguard.de

3. Purposes and legal bases of the processing
The collection, processing or use of personal data is carried out to

• Fulfillment of the business purpose such as pre-contractual measures (e.g. for the preparation of offers, processing of inquiries) (Art. 6 para. 1 sentence 1 lit. b GDPR)
• Fulfillment of contractual obligations (order, order processing, payment processing, invoicing), delivery of goods and services (Art. 6 para. 1 sentence 1 lit. b GDPR)
• Maintaining business contacts and informing the business partner about new products and service offers (Art. 6 para. 1 sentence 1 lit. f GDPR)
• Furthermore, there is a legal obligation to process, e.g. due to tax law requirements (Art. 6 para. 1 sentence 1 lit. c GDPR in conjunction with specific legal bases, such as § 147 AO, § 257 HGB).

4. Categories of personal data that are processed
The following personal data is processed:

• Name
• Title
• Name
• Address
• Contact details of contact persons in the company (first name, surname)
• Communication data (telephone number, mobile number, e-mail address, fax number)
• Customer number as well as order and delivery data for the purpose of initiation
• Order and contract data
• Billing and payment data (bank details, Sepa mandate, etc.)

5. Recipients or categories of recipients of the personal data
Your personal data will be passed on to

• Public bodies that receive data due to legal regulations: Tax authorities
• Internal departments involved in the execution of the respective business processes: Management, administration, accounting, controlling, production, design, sales, shipping (logistics), purchasing, technology and IT
• External bodies (contractual partners) insofar as these are necessary for the fulfillment of the contract. External contractors (service providers) in accordance with Art. 28 GDPR for the processing of data on our behalf (e.g. IT service providers, waste disposal companies, Google Analytics)
• Other external bodies: companies belonging to the Group or other external bodies to fulfill the above-mentioned purposes, insofar as the data subject has given their written consent, this is necessary for the fulfillment of the contract or a transfer is permitted due to an overriding legitimate interest (credit institution for supplier payments, tax consultant, customs)

6. Transfer of personal data to a third country
If we transfer personal data to service providers outside the European Economic Area (EEA), the transfer will only take place if the third country has been confirmed by the EU Commission to have an adequate level of data protection (admissibility requirements of Chapter V, Art. 44-50 of the GDPR) or if other appropriate data protection guarantees (e.g. binding internal company data protection regulations or EU standard contractual clauses) are in place.

7. Duration of the storage of personal data
Your data will be stored after collection in accordance with the statutory retention period:

• 10 years: annual financial statements, opening balance sheets, commercial and business books, records, work instructions, organizational documents, invoices and accounting records (HGB, AO, EStG, KStG, GewStG, UStG, AktG, GmbHG, GenG)
• 6 years: Commercial and business letters and other documents (HGB, BGB)
• 30 years: Enforceable titles

After collection, your data will be stored by the controller for as long as this is necessary in accordance with the statutory retention periods described above (for the respective fulfillment of tasks or, if applicable, also with regard to documentation obligations).

8. Rights of data subjects
According to the General Data Protection Regulation, you have the following rights:

• If your personal data is processed, you have the right to obtain information from the controller about the personal data stored about you (Art. 15 GDPR).
• If incorrect personal data is processed, you have the right to rectification (Art. 16 GDPR).
• If the legal requirements are met, you can request the erasure or restriction of processing and object to processing (Art. 17, 18 and 21 GDPR).
• If you have consented to the data processing or a contract for data processing exists and the data processing is carried out using automated procedures, you may have a right to data portability (Art. 20 GDPR).
• You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

9. Right to withdraw consent
If you have consented to the processing by the controller by means of a corresponding declaration, you can revoke your consent at any time for the future. The legality of the data processing carried out on the basis of the consent until the revocation is not affected by this.

10. Obligation to provide the data
You are obliged to provide your data. This obligation arises from the law, e.g. § 14 UstG, § 6 IfSG or contract.
If you do not provide the required data, the contract cannot be concluded with you.

11. Source from which the personal data originates
The personal data originates from the following sources:

The stored data was collected as part of our contractual relationship and for the initiation of contracts and individual orders, or it was created as part of the business relationship and initiation of business. The data is stored in order to fulfill and process the orders placed with us and to comply with documentation and archiving obligations under commercial and tax law. Recording from entries in the ERP system, signatures from e-mails and documents.

12. Automated decision-making including profiling 
No automated decision-making processes pursuant to Art. 22 GDPR or other profiling measures pursuant to Art. 4 No. GDPR are used