Which data are processed for which purposes and on which legal basis?
a) The following data may be collected and processed in certain cases:
Name, address, e-mail address, telephone number, fax number, date of birth, bank details, identification and contract content data, figures, tax number, GLN, place of birth, nationality, legitimation data (e.g. ID card data) and authentication data (e.g. signature sample), names and contact details of contact persons within the company, order data (e.g. payment order), data from the fulfillment of the contractual obligation (e.g. contacts, orders, sales data in payment transactions, contract numbers), product data, advertising and sales data, documentation data (e.g. in the case of persons interested in renting or leasing), and registry data.
We also process personal data which we have legitimately acquired from the public domain and are permitted to process.
b) We use these data for the following purposes:
aa) For the performance of (pre-)contractual obligations pursuant to Art. 6 para. 1 lit. b) GDPR
Before conclusion of contract We use these personal data partly as decision criteria for an intended contract conclusion. Before concluding the contract, we carry out credit checks in some cases. For this purpose, we transfer personal data to a credit agency, such as Creditreform (Verband der Vereine Creditreform e.V., Hellersbergstraße 12, 41460 Neuss) and/or Schufa (SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden). Besides name, address and date of birth, these data may also include bank details. Based on this information, we then receive a credit rating. This assessment may be based on payment behavior as well as statistical values.
After conclusion of contract We use the personal data;
for the purpose of contract fulfillment;
for billing purposes;
for managing claims/liabilities;
for implementing electronic payments;
for settling payment obligations;
for executing contractually agreed deliveries;
for managing complaints and claims;
for managing warranties;
in connection with product monitoring;
in connection with product liability;
in connection with comprehensive customer service and customer loyalty measures;
in the interests of comprehensive supplier management and supplier evaluation;
in the interests of quality management;
in order to meet requirements under tax and commercial law.
Should a third party take out a guarantee or provide collateral in our favor, we also process this party’s data. This is done in order to assess the value of the collateral as well as its administration and, if applicable, recovery.
bb) For the weighing up of interests pursuant to Art. 6 para. 1 lit. f) GDPR
For the protection of our legitimate interests or those of third parties, we also process personal data for
exchanging data with credit rating agencies;
advertising, insofar as permission for the use of data has not been withdrawn;
asserting legal claims and defending interests in the case of legal disputes;
steering the business and developing services and products;
providing an analogue and digital gastronomy guide for HORECA, leasing and rental customers;
providing an analogue and digital buying guide for retail, wholesale and beverage market customers.
cc) Due to consent provided pursuant to Art. 6 para. 1 lit. a), 9 para. 2 lit. a) in conjunction with Art. 7 GDPR
The processing of personal data may also be based on consent received.
Who receives your data?
a) Within our company, the persons receiving access to your data are those who need such data to fulfill our contractual and legal obligations. The service providers and vicarious agents we use may also receive data for these purposes. These companies are in the categories IT services, billing, logistics, suppliers, credit institutions, printing services, telecommunications, debt collection, (legal) advice and consulting, as well as sales, marketing and address research.
Under these conditions, the recipients of personal data may include:
auditors, consultants
lawyers
collection agencies
advertising agencies
warehouses, delivery partners/forwarders, dispensing technicians, and other suppliers and service providers
in the case of leasing and rental agreements, the property owner and property managers
banks
public bodies and institutions in the case of a legal and/or official obligation
other data recipients may include entities for which consent was given to transfer data
b) If applicable, we will disclose customer and sales data to certain industrial partners (manufacturers/distributors of the products we offer) on a regular basis or on request, as to which of our customers bought which of their products and in which quantity. Customer master data (name and address of the sales outlet, company/name and, if applicable, contact data of the operator, GLN, sales tax identification number and, if applicable, reference to a sales structure), as well as sales data (type and quantity of products of the respective industrial partner delivered to the sales outlet within the respective period). This is done on the one hand in order to coordinate field service visits between ourselves and the industrial partner (if the customer is also a customer of the industrial partner), or to mediate contact between contacts and industrial partners of possible interest, and to collect, invoice and process any agreements between the industrial partner and us or the customer in connection with the purchase of products or the evaluation of the profitability of the business relationship. On the other hand, this is done in the interests of the industrial partners to improve marketing, as well as for distribution analysis, sales control, decisions on marketing/sales activities or customer support, for the preparation of availability information for end users, plausibility checks of total sales reports, market research, and possibly for checking and billing of conditions with us etc. In the case of customers belonging to organizations, data may also be transmitted to the respective head offices.
For the transmission of data, we sometimes use GEDAT Getränkedaten GmbH ("Gedat") as an external processor. We also transfer the above mentioned customer master data to this company for the creation of a verified, unambiguous and up-to-date address data set for sales outlets as the basis for the above mentioned data processing. The legal basis is Art. 6 para. 1 lit. b) and lit. f) GDPR.
The transmitted data are processed by the industrial partners and Gedat at their own responsibility, possibly additionally and with further data available to them or in the public domain about the company and distribution structures. In some cases, these companies use external processors. The addresses of Gedat, the industrial partners and their data protection officers are available at www.gfgh-industriepartner.de.
Are data transferred to third countries?
Personal data are not transferred to countries outside the European Union and Switzerland.
How long will the data be stored?
Unless retention periods are prescribed by law, existing data are deleted after the contract has ended. In the case of legal retention periods, archiving may last up to 10 years. Thereafter, the data are finally deleted, as far as this is technically feasible. In the meantime, the data are blocked so that access is no longer readily possible. The blocking phase begins at the end of the year following expiry of the contract.
The retention period may also be based on statutory limitation periods, for example according to Sections 195 et seq. German Civil Code (BGB). Thereafter, the retention period is usually three years (to the end of the year), and in some cases may be up to 30 years.
What rights do data subjects have?
Data subjects have the following rights vis-à-vis us and others, insofar as data were transferred to industrial partners, Gedat and/or other partner companies:
acc. to Art. 7 para. 3 GDPR, consent provided can be withdrawn at any time. As a result, data processing based on this consent cannot be continued in the future;
acc. to Art. 15 GDPR, information about the processed personal data can be requested. In particular, information can be provided about the processing purposes, the categories of personal data, the categories of recipients to whom the data was and will be disclosed, and the planned retention period. The existence of a right to rectification, deletion, limitation of processing or opposition, the existence of a right of appeal, the origin of your data, if not collected by us, and the existence of automated decision-making including profiling and, possibly, meaningful information on the details can be requested.
acc. to Art. 16 GDPR, immediate rectification of incorrect or completion of incomplete personal data can be requested.
acc. to Art. 17 GDPR, deletion of stored personal data may be requested unless processing is necessary to exercise the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims.
acc. to Art. 18 GDPR, restrictions on the processing of personal data may be requested if the accuracy of the data is disputed, the processing is unlawful but deletion has been refused and the data are no longer needed, but you need these data to assert, exercise or defend legal claims, or an objection to the processing has been filed pursuant to Art. 21 GDPR.
acc. to Art. 20 GDPR, you may request that the personal data you provided are contained in a structured, commonly used and machine-readable format or that such data are transferred to another controller.
acc. to Art. 77 GDPR, you can lodge a complaint with a supervisory authority. As a rule, such complaints are lodged with the supervisory authority of the usual place of residence or work or our company headquarters. The relevant authority in Bavaria is: Bayerische Landesamt für Datenschutzaufsicht, Promenade 27, 91522 Ansbach.
Which rights are there when processing is necessary for the purposes of legitimate interests?
If the personal data are processed on the basis of a legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR, you have the right under Art. 21 GDPR to file an objection against the processing of the personal data if there are grounds arising from a particular situation or special circumstances.
If an objection is filed, the personal data will no longer be processed unless it is possible to prove compelling legitimate grounds for processing that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
The objection must be addressed to us (see person responsible above). Insofar as processing is undertaken by the industrial partners, Gedat and/or partner companies, the objection must be addressed to them.
Is there an obligation to provide data?
Within the scope of the business relationship, only those personal data must be provided which are necessary for the establishment, execution and termination of the business relationship or which must be collected by law. It should be noted that we will not enter into the agreement if these data are not provided.
The provision of all further data is voluntary.
Is there any automated decision-making?
We do not use automated decision-making pursuant to Art. 22 GDPR for the establishment and implementation of the business relationship.
Can personal data be used for other purposes?
Personal data are processed for the purpose for which they were collected. If permitted by law, the data will also be used for other purposes. If further uses are already known at the time the contract is concluded, these are stated in the contract. Should we wish to process the data for further purposes at a later point, we will provide the necessary information, and in particular the information on the purpose pursuant to Art. 13 para. 2 GDPR, prior to further processing.
