The following information is intended to provide you with an overview of how we process your personal data and your rights under the General Data Protection Regulation (Regulation (EU) 2016/679 - "GDPR"). We request that you also make this privacy policy available to any of your employees who deal with us in business capacity. In principle, this privacy policy applies to personal data of natural persons (e.g. sole traders, shareholders, executive bodies, managing directors, key account managers or other employees of one of our business partners) who are made available to us as business partners within the framework of the respective contractual relationship.
Controller in accordance with Art. 4 VII GDPR is: Konica Minolta Business Solutions Europe GmbH Europaallee 17 30855 Langenhagen Tel.: +49 (0) 800 646 6582 Email: info@konicaminolta.eu (hereinafter: "Konica Minolta", "we" or "us"). If you have any questions concerning data protection, you are welcome to contact our company data protection officer: Dr. Frederike Rehker Konica Minolta Business Solutions Europe GmbH Europaallee 17, 30855 Langenhagen, Germany Telephone: +49 (0)511 7404-0 E-mail: dataprotection(at)konicaminolta.eu
We process personal data that we receive from our business partners in the course of our business relations. In addition, we process personal data that we collect from publicly accessible sources (such as trade and association registers, the press, the Internet) or that is provided to us by third parties (e.g. a credit agency). Relevant personal data are in particular personal details (such as surname, first name, professional address, bank details, invoice address, tax number/USt-Id.) and other contact details (such as telephone number, e-mail address). In addition, this may also include order data (e.g. turnover data, contract data, planned quantities, data on the purchase of goods, customer number), data from the fulfilment of our contractual obligations, information on your financial situation (e.g. creditworthiness data), data on your personal situation (e.g. business interests, profession, industry, marital status) and other data comparable with the categories mentioned. When providing business cards, we use the phone number and/or e-mail address to stay in contact with you regarding the discussed topics and store the data contained on the business card in our customer database. The amount of the data processed about a person varies depending on the position he or she holds with the respective business partner.
We process your personal data in accordance with the GDPR and the Federal Data Protection Act (BDSG). This is because any processing of your personal data by us is always bound to a specific, explicit and legitimate purpose in accordance with the principle of purpose limitation pursuant to Art. 5 (1)(b) GDPR, which was already defined before the processing activity was initiated. Furthermore, the processing of your personal data is always based on a legal basis. Article 6 of the GDPR defines legal bases for the processing of personal data. In the following, you will find an overview of the legal basis on which your personal data may be processed: 3.1 Consent If we obtain your consent for the processing of your personal data, the processing will be carried out on the legal basis of Art. 6 (1)(1)(a) GDPR. The following example serves to clarify this legal basis: You receive advertising from us by electronic mail and/or telephone and have given your prior consent. 3.2 Contract or pre-contractual measure If the processing of your personal data is necessary for the fulfilment of a contract with you or for the implementation of pre-contractual measures taken in response to your request, the legal basis on which our processing is based is Art. 6 (1)(1)(b) GDPR. 3.3 Legal obligation In cases where the processing of your personal data is necessary to comply with a legal obligation to which we are subject, this processing is based on Art. 6 (1)(1)(c) GDPR. 3.4 Public interest In cases where we process your personal data in order to perform a task which is in the public interest or in the exercise of official authority delegated to us, Art. 6 (1)(1)(e) GDPR constitutes the legal basis. 3.5 Legitimate interest If the processing of personal data is necessary to safeguard a legitimate interest of our company or a third party and at the same time the interests, basic rights and fundamental freedoms of the data subject, which require the protection of personal data, do not override our legitimate interest, Art. 6 (1)(1)(f) GDPR serves as the legal basis for the processing. Our legitimate interests in particular:
Under certain circumstances, your personal data may be passed on (apart from your express prior consent) for the purposes mentioned below: 5.1 If it is necessary for the investigation or prosecution of illegal or abusive incidents, personal data will be disclosed to our legal advisors, the law enforcement agencies and, if applicable, to injured third parties. However, this only applies if there are concrete indications of illegal or abusive behavior. Data may also be disclosed if this serves to enforce contractual regulations between us and our business partners. 5.2 We are also legally obliged to provide information to certain public authorities upon request. These are law enforcement agencies, authorities that prosecute administrative offences subject to fines and the tax authorities. 5.3 In the case of centralised or outsourced corporate functions, your data may be passed on to companies affiliated with us for the fulfilment of the above-mentioned purposes. Insofar as these are bodies outside the EU or the EEA, we ensure an appropriate level of data protection, for example by concluding corresponding contracts or certifications of the respective data-receiving body. 5.4 Occasionally, in order to fulfil the purposes described in this Privacy Policy, we may need to rely on contractually affiliated third party companies and external service providers located outside the EU or EEA, such as logistics companies, IT service providers, business advisors and financial institutions. In such cases, information will be shared with these companies or individuals to enable them to continue processing. These external service providers are carefully selected and regularly reviewed by us to ensure that your data is only used for the purposes specified by us and in accordance with applicable data protection laws. Insofar as these are bodies outside the EU or the EEA, we ensure an appropriate level of data protection, for example by concluding corresponding contracts or certifications of the respective data-preserving body. 5.5 In the course of the further development of our business, the structure of our company may change by changing its legal form or by founding, buying or selling subsidiaries, parts of companies or components. In such transactions, customer information will be transferred along with the part of the business being transferred. In any transfer of personal data to third parties to the extent described above, we will ensure that this is done in accordance with this privacy policy and the relevant data protection laws.
We process and store your personal data as long as this is necessary for the fulfilment of the above-mentioned purposes and legal obligations: We generally retain master and contact data for an unlimited period of time or until the final termination of the respective business relationship. We delete transaction-related information (e.g. relating to a specific order transaction or contractual relationship) after the end of the respective transaction with a period of three years after the end of the respective calendar year, unless this is subject to statutory retention obligations (e.g. the six or ten-year retention period pursuant to Section 257 of the German Commercial Code); in such a case, the data concerned is blocked for any further processing.
As a data subject, you have the following rights: Right of access (Art. 15 GDPR): You have the right to be informed at any time of the categories of personal data processed, the purposes of processing, any recipients or categories of recipients of your personal data and the planned storage period. Right of rectification (Art. 16 GDPR): You have the right to request the rectification or completion of personal data concerning you that is incorrect or incomplete. Right to erasure („right to be forgotten“) (Art. 17 GDPR): You have the right to request the immediate erasure of your personal data. In particular, we are obliged as the responsible party to delete your data in the following cases:
Please be aware that the right to erasure is subject to a limitation in the following cases, so that a deletion is excluded:
Right of restriction of processing (Art. 18 GDPR): You also have the right to request that the processing of your personal data be restricted; in such a case, your personal data will be excluded from any processing. This right applies if:
Right of data portability (Art. 20 GDPR): You have the right to receive the personal data concerning you that you have provided to us as a controller in a structured, common and machine readable format and to transfer it to another controller. Furthermore, you also have the right to request that your personal data be transferred from us to another controller, insofar as this is technically feasible. The requirements for the applicability of data portability are:
Right to object (Art. 21 GDPR): You have the right at any time to object to the processing of your personal data on grounds arising from your particular situation. This also applies to profiling. The requirement for this is that the processing is based on a legitimate interest on our part (Art. 6 (1)(1)(f) GDPR) or the public interest (Art. 6 (1)(1)(e) GDPR). Furthermore, you may also at any time object to the processing of your personal data for the purposes of direct marketing or profiling linked to such direct marketing. Should you object to the processing of your personal data based on a legitimate interest, we will check in each individual case whether we can show grounds worthy of protection that override your interests and rights and freedoms. In the event that there are no reasons worthy of protection on our part or your interests as well as rights and freedoms override our own, your personal data will no longer be processed. An exception is made if your personal data is still used for the establishment, exercise or defense of legal claims. If you object to the processing of your personal data for the purposes of direct marketing or profiling, insofar as this is linked to such direct marketing, your personal data will no longer be processed for these purposes. Right to lodge a complaint with the supervisory authority (Art. 77 GDPR): Right to lodge a complaint with the supervisory authority (Art. 77 DPA): You also have the right to lodge a complaint with a supervisory authority at any time, in particular with a supervisory authority in the Member State of your residence, place of work or place of suspected infringement, if you consider that the processing of personal data concerning you is in breach of the data protection regulations. The address of the supervisory authority responsible for our company is: Barbara Thiel Die Landesbeauftragte für den Datenschutz Niedersachsen Prinzenstraße 5 30159 Hanover Germany Telephone: 0511-120 4500 Fax: 0511-120 4599 poststelle@lfd.niedersachsen.de Right of withdrawal (Art. 7 GDPR): If you have given us consent to process your personal data, you can withdraw this consent at any time without giving reasons and in an informal manner. Withdrawal of consent does not affect the lawfulness of the processing that has taken place on the basis of the consent up to the point of withdrawal.