Privacy policy

Categories of personal data processed

Personal data included in the categories

Data sources

Data subjects’ obligation to provide data

Storage period

Identification data.

Information that we receive to identify our (potential) clients, their economic beneficiaries, the persons acting for them and their authorisation.

This includes data from copies of personal identity cards and data from commercial register excerpts.

(Potential) clients,

courts and/or authorities,

other Noerr companies and Noerr notary’s offices,

cooperating law firms, tax advisory and/or auditing firms outside the Noerr companies.

The provision of these data is required by law.

If these data are not provided, the identification required by law may not be possible.

We store the data until the retention obligation under anti-money laundering law ends, i.e. for a period of five years after the end of the calendar year in which the business relationship was ended or the information was identified (sec 8(4) German Anti-Money Laundering Act (Geldwäschegesetz – GWG)).

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Contact data.

Information that we receive for contacting and corresponding with our contacts.

These contacts include (potential) clients and the employees, representatives and/or advisors of our clients and their employees, opposing parties in legal proceedings and their employees, representatives and/or advisors of opposing parties in legal proceedings and their employees, witnesses, employees of insurers, experts and their employees, employees of courts and/or authorities, as well as employees of other Noerr companies and Noerr notary’s offices and cooperating law firms, tax advisory and/or auditing firms outside the Noerr companies and the Noerr notary’s offices.

This information includes salutation, title, first name, surname, e-mail address, address, fax number, telephone number and position/function of the individual contact.

(Potential) clients, representatives and/or advisors of our clients,

Opposing parties in legal proceedings, representatives and/or advisors of opposing parties in legal proceedings,

witnesses,

insurers,

experts,

courts and/or authorities,

other Noerr companies and Noerr notary’s offices,

cooperating law firms, tax advisory and/or auditing firms outside the Noerr companies.

The provisions of these data is not required by law or contract.

The provision of the client’s contact data is required for the conclusion of an engagement agreement.

The provision of the contact data of employees of our clients, representative and/or advisors of our clients and their employees, opposing parties in legal proceedings and their employees, representative and/or advisors of opposing parties in legal proceedings and their employees, witnesses, employees of insurers, experts and their employees, employees of courts and/or authorities as well as advisors and/or employees of other Noerr companies or cooperating law firms, tax advisory and/or auditing firms outside the Noerr companies may also be necessary in order to advise and represent our clients.

If these data are not provided, it may not be possible to process the engagement.

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Client data.¹

Information that we receive from our clients, representatives and/or advisors of our clients, opposing parties in legal proceedings, representatives and/or advisors of opposing parties in legal proceedings, witnesses, insurers, experts, courts and/or authorities in order to advise and represent our clients in connection with the engagement.

This in particular includes the content of documents provided to us in connection with the engagement (as far as it relates to identified or identifiable natural persons).

This also includes bank details (IBAN, BIC, bank, account holder) for the disbursement of third-party funds.

Clients, representatives and/or advisors of our clients,

opposing parties in legal proceedings, representatives and/or advisors of opposing parties in legal proceedings,

witnesses,

insurers,

experts,

courts and/or authorities.

The provision of these data is not required by law or contract.

Provision may, however, be necessary to advise and represent our clients.

If these data are not provided, it may not be possible to process the engagement.

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Client data.²

Information that we receive from our clients, representatives and/or advisors of our clients, opposing parties in legal proceedings, representatives and/or advisors of opposing parties in legal proceedings, witnesses, insurers, experts, courts and/or authorities in order to disburse third-party funds in connection with the engagement.

This includes bank details (IBAN, BIC, bank, account holder).

Clients, representatives and/or advisors of our clients,

opposing parties in legal proceedings, representatives and/or advisors of opposing parties in legal proceedings,

witnesses,

insurers,

experts,

courts and/or authorities.

The provision of these data is not required by law or contract.

Provision may, however, be necessary to advise and represent our clients.

If these data are not provided, it may not be possible to disburse third-party funds.

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Client data.³

Data generated in connection with correspondence with our clients, representatives and/or advisors of our clients, opposing parties in legal proceedings, representatives and advisors of opposing parties in legal proceedings, witnesses, insurers, experts, courts and/or authorities, other Noerr companies and Noerr notary’s offices or cooperating law firm, tax advisory and/or auditing firms outside the Noerr companies.

These in particular include the content of oral and written (including electronic) correspondence and protocol data generated for technical reasons in the case of electronic correspondence (as far as it relates to identified or identifiable natural persons).

Clients, representatives and/or advisors of our clients,

opposing parties in legal proceedings, representatives and/or advisors of opposing parties in legal proceedings,

witnesses,

insurers,

experts,

courts and/or authorities,

other Noerr companies and Noerr notary’s offices,

cooperating law firm, tax advisory and/or auditing firms outside the Noerr companies.

The provision of these data is not required by law or contract.

Provision may, however, be necessary to advise and represent our clients.

If these data are not provided, it may not be possible to process the engagement.

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Client data.⁴

Information that we generate in-house to advise and represent our clients as part of the engagement.

This in particular includes client identification numbers, file numbers, contents of notes to file, memoranda, expert opinions, pleadings and other documented results of our advice and representation as part of the engagement (as far as they relate to identified or identifiable natural persons).

Generated in-house.

-

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Billing data.¹

Data that we receive from our clients for billing purposes as part of the engagement.

These in particular also include the VAT identification number.

Clients.

The provision of these data is required by law.

If these data are not provided, proper billing is not possible.

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Billing data.²

Data that we generate in-house for billing purposes as part of the engagement.

These in particular include accounts receivable numbers, invoice numbers, file numbers, content of internal time recording, activity reports, details of any expenses and data relating to payment transactions, in particular date and amounts paid.

Generated in-house.

-

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Purpose of processing the personal data

Categories of personal data processed

Automated decision-making

Legal basis and any legitimate interests

Recipient

Identification of our (potential) clients, their economic beneficiaries, the persons acting for them and their authorisation before or upon establishing the client relationship.

We carry out the identification in coordination with the other Noerr companies and Noerr notary’s offices in order to avoid the renewed identification by other companies of clients already identified.

Identification data.

No automated decision-making takes place.

The legal basis for the identification is compliance with a legal obligation, in particular the German Anti-Money Laundering Act (Geldwäschebekämpfungsgesetzes- GWG) (point (c) of Article 6 paragraph 1 of the General Data Protection Regulation) and a balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is knowing who our contractual partner is.

The legal basis for the coordination with the other Noerr companies and Noerr notary’s offices is a balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is to fulfil identification obligations as efficiently as possible within the Noerr companies and the Noerr notary’s offices.

Dependent branches of Noerr PartGmbB outside the EU,

Noerr companies,

Noerr notary’s offices.

Comparison with sanctions lists before the client relationship is established.

Contact data.

No automated decision-making takes place.

The legal basis for the conflict check is compliance with a legal obligation (point (c) of Article 6 paragraph 1 of the General Data Protection Regulation).

-

Conflict check to avoid conflicts of interest before establishing the client relationship.

We carry out the conflict check in coordination with the other Noerr companies and Noerr notary’s offices in or to avoid any conflicts of interest within the Noerr companies and Noerr notary’s offices.

Contact data,

clients data.

No automated decision-making takes place.

The legal basis for the conflict check is compliance with a legal obligation (point (c) of Article 6 paragraph 1 of the General Data Protection Regulation) and balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is the avoidance of conflicts of interest.

The legal basis for the coordination with the other Noerr offices and Noerr notary’s offices is a balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is the best-possible avoidance of conflicts of interest within the Noerr companies and the Noerr notary’s offices.

Dependent branches of Noerr PartGmbB outside the EU,

Noerr companies,

Noerr notary’s offices.

Preparation of the client relationship, in particular pre-contractual correspondence for the preparation of offers and costs estimate.

Depending on the engagement, coordination with other Noerr companies and/or law firms, tax advisory and/or auditing firms outside the Noerr companies may be necessary in the individual case. This can for example be the case if an engagement requires advice services of local counsel in other jurisdictions.

Depending on the engagement, coordination may also be required in the individual case with representatives and/or advisors of the client or insurers of the client for the preparation of the engagement.

Contact data,

client data.

No automated decision-making takes place.

If the data subject is our client, the legal basis is taking steps at the request of the data subject prior to entering into a contract (point (b) of Article 6 paragraph 1 of the General Data Protection Regulation).

If the data subject is not our client, the legal basis is a balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is taking steps at the request of our potential client prior to entering into a contract.

Dependent branches of Noerr PartGmbB outside the EU,

Noerr companies,

cooperating law firm, tax advisory and/or auditing firms outside the Noerr companies,

representatives and/or advisors of the client,

insurers.

Advising and representing clients appropriately in connection with engagements, in particular exercising and defending the rights of our clients, including correspondence with our clients, opposing parties in legal proceedings and representatives of opposing parties in legal proceedings, witnesses, insurers, experts and/or service providers, courts and/or authorities.

Depending on the engagement, coordination with other Noerr companies and/or law firms, tax advisory and/or auditing firms outside the Noerr companies may be necessary in the individual case. This can for example be the case if an engagement requires advice services of local counsel in other jurisdictions.

Contact data,

client data.

No automated decision-making takes place.

If the data subject is our client, the legal basis is the performance of a contract, to which the data subject is party (point (b) of Article 6 paragraph 1 of the General Data Protection Regulation).

If the data subject is not our client, the legal basis is a balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is the performance of the contract with our client.

Dependent branches of Noerr PartGmbB outside the EU,

Noerr companies,

Noerr notary’s offices,

cooperating law firms, tax advisory and/or auditing firms outside the Noerr companies,

clients,

representatives and/or advisors of clients,

opposing parties in legal proceedings,

representatives and/or advisors of opposing parties in legal proceedings,

witnesses,

insurers,

experts and/or other service providers,

courts and/or authorities.

Sending of correspondence or other items on behalf of our clients in connection with engagements.

To send correspondence and other items, we communicate the address details of the sender and the recipient to the relevant shipping/courier services provider.

Contact data.

No automated decision-making takes place.

If the data subject is our client, the legal basis is the performance of a contract, to which the data subject is party (point (b) of Article 6 paragraph 1 of the General Data Protection Regulation).

If the data subject is not our client, the legal basis is a balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is the performance of the contract with our client.

Shipping/courier service providers.

Disbursement, receipt or forwarding of third-party funds on behalf of our clients in connection with engagements.

Contact data,

client data.

No automated decision-making takes place.

If the data subject is our client, the legal basis is the performance of a contract, to which the data subject is party (point (b) of Article 6 paragraph 1 of the General Data Protection Regulation).

If the data subject is not our client, the legal basis is a balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is the performance of the contract with our client.

Clients,

representatives and/or advisors of clients,

opposing parties in legal proceedings,

representatives and/or advisors of opposing parties in legal proceedings,

courts and/or authorities,

banks,

IT service providers.

Translations on behalf of our clients in connection with engagements.

Depending on the engagement, coordination with other Noerr companies and Noerr notary’s offices and/or law firms, tax advisory and/or auditing firms outside the Noerr companies and Noerr notary’s offices may be necessary in the individual case. This can for example be the case if a client requires a translation or the legal review of a translation by local counsel in other jurisdictions.

Contact data,

client data.

No automated decision-making takes place.

If the data subject is our client, the legal basis is the performance of a contract, to which the data subject is party (point (b) of Article 6 paragraph 1 of the General Data Protection Regulation).

If the data subject is not our client, the legal basis is a balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is the performance of the contract with our client.

Dependent branches of Noerr PartGmbB outside the EU,

Noerr companies,

Noerr notary’s offices.

Proper internal law firm administration, including the maintenance of reference files and operation of IT systems for administrative purposes.

We carry out internal administration in coordination with the other Noerr companies and Noerr notary’s offices to ensure that internal administration is as efficient as possible.

We use specialist service providers for the operation of our IT that process that data on our behalf.

Contact data,

client data,

billing data.

No automated decision-making takes place.

The legal basis is on the one hand compliance with a legal obligation (point (c) of Article 6 paragraph 1 of the General Data Protection Regulation), in particular compliance with professional ethics obligations for the proper maintenance of reference files.

The legal basis is also a balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is proper internal administration.

The legal basis for the coordination with the other Noerr companies and the Noerr notary’s offices is a balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is ensuring that internal administration within the Noerr companies and Noerr notary’s offices is as efficient as possible.

Dependent branches of Noerr PartGmbB outside the EU,

Noerr companies,

Noerr notary’s offices,

IT service providers.

Proper accounting and invoicing.

Contact data,

billing data.

No automated decision-making takes place.

The legal basis is on the one hand compliance with a legal obligation (point (c) of Article 6 paragraph 1 of the General Data Protection Regulation), in particular compliance with statutory requirements for proper accounting.

If the data subject is our client, the legal basis for the invoicing is the performance of a contract to which the data subject is party (point (b) of Article 6 paragraph 1 of the General Data Protection Regulation).

If the data subject is not our client, the legal basis for the invoicing is a balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is the performance of the contract with our client.

Payroll and financial accounting service providers.

Proper retention of documents in order to comply with statutory, professional, anti-money laundering, commercial and tax law retention obligations and for evidence purposes for any establishment, exercise or defence of legal claims.

Depending on the type of documents, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Contact data,

client data,

billing data.

No automated decision-making takes place.

The legal basis for retention is to comply with statutory, in particular professional ethics, anti-money laundering, commercial and tax law retention obligations is compliance with a legal obligation (point (c) of Article 6 paragraph 1 of the General Data Protection Regulation).

The legal basis of retention for evidence purposes is a balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is the establishment, exercise or defence of legal claims.

-

Settlement of any existing liability claims and the exercise of any claims against our clients.

Contact data,

client data,

billing data.

No automated decision-making takes place.

Balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is the establishment, exercise and defence or legal claims.

Clients,

representatives and/or advisors of clients,

opposing parties in legal proceedings,

representatives and/or advisors of opposing parties in legal proceedings,

witnesses,

insurers,

courts and/or authorities.

Cooperation with courts and/or authorities in order to fulfil statutory obligations.

Contact data,

client data,

billing data.

No automated decision-making takes place.

Compliance with a legal obligation (point (c) of Article 6 paragraph 1 of the General Data Protection Regulation).

Courts and/or authorities.

Liaison with auditors and tax advisors in order to comply with statutory obligations.

Contact data,

client data,

billing data.

No automated decision-making takes place.

Compliance with a legal obligation (point (c) of Article 6 paragraph 1 of the General Data Protection Regulation).

External auditors,

External tax advisors.

Client relationship management and the alignment of our advisory services with the needs and wishes of our (potential) clients, including making contact to inform our (potential) clients, inviting our (potential) clients to law firm events and maintaining the relationships with our (potential) clients.

We coordinate in this respect with the other Noerr companies in order to ensure that client relationship management within the Noerr companies is as efficient as possible.

For client relationship management we use specialised IT service providers that process data on our behalf.

Contact data.

No automated decision-making takes place.

If the data subject has given their individual consent in this respect, the legal basis for the maintenance of our relationship is the individual consent (point (a) of Article 6 paragraph 1 of the General Data Protection Regulation).

The legal basis is in addition a balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is maintaining the relationships with our (potential) clients and the alignment of our advisory services with the needs and wishes of our (potential) clients.

The legal basis for coordination with the other Noerr companies is a balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interests is ensuring that client relationship management within the Noerr companies is as efficient as possible.

Dependent branches of Noerr PartGmbB outside the EU,

Noerr companies,

IT service providers.

Naming of references for ranking and analyses by press publishers and analysts.

Contact data.

No automated decision-making takes place.

Consent (point (a) or Article 6 paragraph 1 of the General Data Protection Regulation).

Press publishers and market analysts.

Recipient

Recipient’s role

Transfer to third countries and/or to international organisations

Adequacy decision or adequate or suitable assurances for transfers to third countries and/or international organisations

Dependent branches of Noerr PartGmbB outside the EU:

·        Office of Noerr PartGmbB in New York, USA

·        Office of Noerr PartGmbB in London, UK

Part of controller.

USA and UK.

No applicable adequacy decision of the EU within the meaning of Article 45 paragraph 3 of the General Data Protection Regulation exists.

However, the General Data Protection Regulation applies directly to our dependent branches in the USA and UK anyway, so that an appropriate level of data protection exists anyway.

We also guarantee that for transfers to our dependent branches we comply with the obligations under the EU standard contractual clauses in accordance with Article 46 paragraph 5 of the General Data Protection Regulation that were adopted under Article 26 paragraph 4 of the previous Data Protection Directive (Directive 95/46/EC). A copy of the standard contractual clauses can be obtained from our Data Protection Officer (see contact details in Section A).

Noerr companies
in Germany:

·        NOERR Aktiengesellschaft Wirtschaftsprüfungsgesellschaft Steuerberatungsgesellschaft (NOERR AG)

·        Noerr Consulting GmbH & Co. KG

Controller.

Within the EU.

-

Noerr companies
in Spain:

·        Noerr Alicante IP, S.L.

Controller.

Within the EU.

-

Noerr notary’s offices:

·        Notary’s office Berlin (Dr Astrid Frense, Dr Dirk Lentfer, Felix Blobel, Dr Clemens Schönemann)

·        Notary’s office Frankfurt (Dr Thorsten Reinhard, Dr Alexander Jänecke, Dr. Julian Lemor)

Controller.

Within the EU.

-

Cooperating law firms, tax advisory and/or auditing firms outside the Noerr companies, in particular partners of the Lex Mundi network.

Controller.

Depends on engagement; can be within or outside the EU.

We only transfer personal data to third countries and/or to international organisations to the extent that this is necessary perform the contract with our client or to take steps at the request of our client prior to entering in to the contract (point (b) or (c) of Article 49 paragraph 1 of the General Data Protection Regulation) and/or to establish, exercise or defend legal claims (point (e) of Article 49 paragraph 1 of the General Data Protection Regulation).

Clients.

Controller.

Depends on engagement; can be within or outside the EU.

We only transfer personal data to third countries and/or to international organisations to the extent that this is necessary perform the contract with our client or to take steps at the request of our client prior to entering in to the contract (point (b) or (c) of Article 49 paragraph 1 of the General Data Protection Regulation) and/or to establish, exercise or defend legal claims (point (e) of Article 49 paragraph 1 of the General Data Protection Regulation).

Representatives and/or advisors or clients.

Controller.

Depends on engagement; can be within or outside the EU.

We only transfer personal data to third countries and/or to international organisations to the extent that this is necessary perform the contract with our client or to take steps at the request of our client prior to entering in to the contract (point (b) or (c) of Article 49 paragraph 1 of the General Data Protection Regulation) and/or to establish, exercise or defend legal claims (point (e) of Article 49 paragraph 1 of the General Data Protection Regulation).

Insurers.

Controller.

Depends on engagement; can be within or outside the EU.

We only transfer personal data to third countries and/or to international organisations to the extent that this is necessary perform the contract with our client or to take steps at the request of our client prior to entering in to the contract (point (b) or (c) of Article 49 paragraph 1 of the General Data Protection Regulation) and/or to establish, exercise or defend legal claims (point (e) of Article 49 paragraph 1 of the General Data Protection Regulation).

Opposing parties in legal proceedings,

representatives and/or advisors of opposing parties in legal proceedings.

Controller.

Depends on engagement; can be within or outside the EU.

We only transfer personal data to third countries and/or to international organisations to the extent that this is necessary perform the contract with our client or to take steps at the request of our client prior to entering in to the contract (point (b) or (c) of Article 49 paragraph 1 of the General Data Protection Regulation) and/or to establish, exercise or defend legal claims (point (e) of Article 49 paragraph 1 of the General Data Protection Regulation).

Witnesses.

Controller.

Depends on engagement; can be within or outside the EU.

We only transfer personal data to third countries and/or to international organisations to the extent that this is necessary perform the contract with our client or to take steps at the request of our client prior to entering in to the contract (point (b) or (c) of Article 49 paragraph 1 of the General Data Protection Regulation) and/or to establish, exercise or defend legal claims (point (e) of Article 49 paragraph 1 of the General Data Protection Regulation).

Experts and/or other service providers.

Controller or processor.

Depends on engagement; can be within or outside the EU.

We only transfer personal data to third countries and/or to international organisations to the extent that this is necessary perform the contract with our client or to take steps at the request of our client prior to entering in to the contract (point (b) or (c) of Article 49 paragraph 1 of the General Data Protection Regulation) and/or to establish, exercise or defend legal claims (point (e) of Article 49 paragraph 1 of the General Data Protection Regulation).

Courts and/or authorities.

Controller.

Depends on engagement; can be within or outside the EU.

We only transfer personal data to third countries and/or to international organisations to the extent that this is necessary perform the contract with our client or to take steps at the request of our client prior to entering in to the contract (point (b) or (c) of Article 49 paragraph 1 of the General Data Protection Regulation) and/or to establish, exercise or defend legal claims (point (e) of Article 49 paragraph 1 of the General Data Protection Regulation).

External auditors.

Controller.

Within the EU.

-

External tax advisors

Controller.

Within the EU.

-

Shipping/courier service providers.

Controller.

Depends on engagement; can be within or outside the EU.

We only transfer personal data to third countries and/or to international organisations to the extent that this is necessary perform the contract with our client or to take steps at the request of our client prior to entering in to the contract (point (b) or (c) of Article 49 paragraph 1 of the General Data Protection Regulation) and/or to establish, exercise or defend legal claims (point (e) of Article 49 paragraph 1 of the General Data Protection Regulation).

Press publishers and market analysts.

Controller.

Depending on the location of the relevant press publisher or market analyst either within or outside the EU.

We only transfer personal data to third countries to the extent that the data subject has given their express consent to the proposed data transfer (point (a) of Article 49 paragraph 1 of the General Data Protection Regulation).

IT service providers.

Processor.

Within the EU.

-

Banks.

Controller.

Within the EU.

-

Payroll and financial accounting service providers.

Processor.

Within the EU.

-

Categories of personal data processed

Personal data included in the categories

Data sources

Data subjects’ obligation to provide data

Storage period

Master data.

Name, data of birth, nationality, place of birth, country of birth, marital status.

Applicants or recruitment agencies instructed to act on behalf of applicants.

Provision of the data is not required by law or contract. The data subject is not obliged to provide the data.

However, if the data are not provided, it may not be possible to conduct the application process and, if applicable, to hire an applicant.

If an applicant is hired, the data will be entered in the personnel file. Information on the storage duration is provided in the information on the processing of the personal data of our employees.

If an applicant participates in our talent management programme, the data are stored after completion of the application process for the duration of participation in the talent management programme.

Otherwise the data will be stored for evidence purposes for the possible establishment, exercise and defence of legal claims for a period of six months after completion of the application process.

Contact data.

Private address, e-mail address telephone number.

Applicants or recruitment agencies instructed to act on behalf of applicants.

The provision of the data is not required by law or contract. The data subject is not obliged to provide the data.

However, if the data are not provided, it may not be possible to conduct the application process and, if applicable, to hire an applicant.

If an applicant is hired, the data will be entered in the personnel file. Information on the storage duration is provided in the information on the processing of the personal data of our employees.

If an applicant participates in our talent management programme, the data are stored after completion of the application process for the duration of participation in the talent management programme.

Otherwise the data will be stored for evidence purposes for the possible establishment, exercise and defence of legal claims for a period of six months after completion of the application process.

Application data.¹

Content of application documents, in particular photograph, CV and certificates/references,

content of the written (including electronic) correspondence relating to the application.

Applicants or recruitment agencies instructed to act on behalf of applicants.

The provision of the data is not required by law or contract. The data subject is not obliged to provide the data.

However, if the data are not provided, it may not be possible to conduct the application process and, if applicable, to hire an applicant.

If an applicant is hired, the data will be entered in the personnel file. Information on the storage duration is provided in the information on the processing of the personal data of our employees.

If an applicant participates in our talent management programme, the data are stored after completion of the application process for the duration of participation in the talent management programme.

Otherwise the data will be stored for evidence purposes for the possible establishment, exercise and defence of legal claims for a period of six months after completion of the application process.

Application data.²

Content of evaluation notes, perceptions from interviews, feedback and evaluations.

Generated in-house.

-

If an applicant is hired, the data will be entered in the personnel file. Information on the storage duration is provided in the information on the processing of the personal data of our employees.

If an applicant participates in our talent management programme, the data are stored after completion of the application process for the duration of participation in the talent management programme.

Otherwise the data will be stored for evidence purposes for the possible establishment, exercise and defence of legal claims for a period of six months after completion of the application process.

Purpose of processing the personal data

Categories of personal data processed

Automated decision-making

Legal basis and any legitimate interests

Recipient

Conducting the application process, in particular reviewing applications, contacting the applicant and conducting interviews to evaluate and select suitable applicants.

Master data,

contact data,

application data.

No automated decision-making takes place.

Decision on the establishment of an employment relationship (Article 88 paragraph 1 of the General Data Protection Act, sec. 26(1) of the German Federal Data Protection Act).

Taking steps prior to entering into a contract (point (b) of Article 6 paragraph 1 of the General Data Protection Regulation).

IT service providers.

Forwarding of the application documents to Noerr notary’s offices or Noerr companies if the applicant expressly requested this in his/her application letter.

Master data,

contact data,

application data.

No automated decision-making takes place.

Taking steps prior to entering into a contract (point (b) of Article 6 paragraph 1 of the General Data Protection Regulation).

Dependent branches of Noerr PartGmbB outside the EU,

Noerr companies,

Noerr notary’s offices,

IT service providers.

Storage for evidence purposes for the possible establishment, exercise or defence of legal claims.

Master data,

contact data,

application data.

No automated decision-making takes place.

Balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is the establishment, exercise or defence of legal claims.

IT service providers.

Establishment, exercise or defence of legal claims, including liaison with external lawyers.

Master data,

contact data,

application data.

No automated decision-making takes place.

Balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interests is the establishment, exercise or defence of legal claims.

Courts and/or authorities,

external lawyers.

Recipient

Recipient’s role

Transfer to third countries and/or to international organisations

Adequacy decision or adequate or suitable assurances for transfers to third countries and/or international organisations

Dependent branches of Noerr PartGmbB outside the EU:

·        Office of Noerr PartGmbB in New York, USA

·        Office of Noerr PartGmbB in London, UK

Part of controller.

USA, UK.

No applicable adequacy decision of the EU within the meaning of Article 45 paragraph 3 of the General Data Protection Regulation exists.

However, the General Data Protection Regulation applies directly to our dependent branches in the USA and UK anyway, so that an appropriate level of data protection exists anyway.

We also guarantee that for transfers to our dependent branches we comply with the obligations under the EU standard contractual clauses in accordance with Article 46 paragraph 5 of the General Data Protection Regulation that were adopted under Article 26 paragraph 4 of the previous Data Protection Directive (Directive 95/46/EC). A copy of the standard contractual clauses can be obtained from our Data Protection Officer (see contact details in Section A).

Noerr companies
in Germany:

·        NOERR Aktiengesellschaft Wirtschaftsprüfungsgesellschaft Steuerberatungsgesellschaft (NOERR AG)

·        Noerr Consulting GmbH & Co. KG

Controller.

Within the EU..

-

Noerr companies
in Spain:

·        Noerr Alicante IP, S.L.

Controller.

Within the EU.

-

Noerr notary’s offices:

·        Notary’s office Berlin (Dr Astrid Frense, Dr Dirk Lentfer, Felix Blobel, Dr Clemens Schönemann)

·        Notary’s office Frankfurt (Dr Thorsten Reinhard, Dr Alexander Jänecke, Dr. Julian Lemor)

Controller.

Within the EU.

-

IT service providers.

Processor.

Germany.

-

Courts and/or authorities.

Controller.

Depending on the location of the relevant court and/or the relevant authority, within or outside the EU.

We only transfer personal data to third countries and/or to international organisations to establish, exercise or defend legal claims (point (e) of Article 49 paragraph 1 of the General Data Protection Regulation).

External lawyers.

Controller.

Depending on the location of the relevant lawyer, within or outside the EU.

We only transfer personal data to third countries and/or to international organisations to establish, exercise or defend legal claims (point (e) of Article 49 paragraph 1 of the General Data Protection Regulation).

Categories of personal data processed

Personal data included in the categories

Data sources

Data subjects’ obligation to provide data

Storage period

Master data.

Name, date of birth, nationality, place of birth, country of birth, marital status.

Participants in the talent management programme/careers events, subscribers to Noerr Careers Events News.

The provision of the data is not required by law or contract. The data subject is not obliged to provide the data.

However, if the name is not provided, it is not possible to participate in the talent management programme.

We store the data of participants in careers events until the end of the relevant careers event.

The data of participants in our talent management programme are stored for the duration of participation in our talent management programme.

We store the data of subscribers to Noerr Careers Events News until consent is withdrawn.

We store these data for evidence purposes for the establishment, exercise or defence of possible legal claims and in addition for a transitional period of three years from the end of the year in which the participant has deregistered and in the case of any legal dispute until such have been concluded.

Contact data.

Private address, e-mail address, telephone number.

Participants in the talent management programme/careers events, subscribers to Noerr Careers Events News.

The provision of the data is not required by law or contract. The data subject is not obliged to provide the data.

However, unless at least a contact possibility is provided, it is not possible to participate in the talent management programme.

We store the data of participants in careers events until the end of the relevant careers event.

The data of participants in our talent management programme are stored for the duration of participation in our talent management programme.

We store the data of subscribers to Noerr Careers Events News until consent has been withdrawn.

We store these data for evidence purposes for the establishment, exercise or defence of possible legal claims and in addition for a transitional period of three years from the end of the year in which the participant has deregistered and in the case of any legal dispute until such have been concluded.

Contact history.

Information on reason/medium of current and past contact with Noerr (trade, fair, event, job exchange etc.).

Applicants (in covering letter or in online application),

generated in-house (e.g. trade fair).

-

We store the data of participants in careers events until the end of the relevant careers event.

The data of participants in our talent management programme are stored for the duration of participation in our talent management programme.

Application data.¹

Content of application documents, in particular photo, CV and certificates/references,

content of the written (including electronic) correspondence relating to the application.

Participants in the talent management programme/careers events.

The provision of the data is not required by law or contract. The data subject is not obliged to provide the data.

If the data are not provided, they cannot be taken into account for the selection of suitable talents.

We store the data of participants in careers events until the end of the relevant careers event.

The data of participants in our talent management programme are stored for the duration of participation in our talent management programme.

Application data.²

Content of evaluation notes, perceptions from interviews, feedback and evaluations.

Generated in-house.

-

We store the data of participants in careers events until the end of the relevant careers event.

The data of participants in our talent management programme are stored for the duration of participation in our talent management programme.

Talent data.¹

Information on interests, professional qualifications, professional experience and other information that participants provide for talent management.

Content of written (including electronic) correspondence relating to participation in the talent management programme.

Participants in the talent management programme/careers events.

The provision of the data is not required by law or contract. The data subject is not obliged to provide the data.

If the data are not provided, they cannot be taken into account for the selection of suitable talents.

We store the data of participants in careers events until the end of the relevant careers event.

The data of participants in our talent management programme are stored for the duration of participation in our talent management programme.

Talent data.²

Content of evaluation notes, perceptions from interviews, feedback and evaluations., which we generate in-house to select suitable talents.

Information on the next (development) steps of the talent.

Generated in-house.

-

We store the data of participants in careers events until the end of the relevant careers event.

The data of participants in our talent management programme are stored for the duration of participation in our talent management programme.

Consent data.

Data for the provision, evidence and withdrawal of consent.

These include date and time and content of the consent (e.g. registration for newsletter), data and time registration notification is sent using closed-loop opt-in procedure and IP address of the end device used for confirmation, data and time of any withdrawal of consent (e.g. deregistration from newsletters).

Participants in the talent management programme,

subscribers to Noerr Careers Events News.

The provision of the data is not required by law or contract or for conclusion of a contract. There is no obligation to provide the data.

If the data are not provided, we cannot provides services (e.g. newsletters) which require consent.

We store the data relating to the relevant consent until consent has been withdrawn.

We store these data for evidence purposes for the establishment, exercise or defence of possible legal claims and in addition for a transitional period of three years from the end of the year in which the participant has deregistered and in the case of any legal dispute until such have been concluded.

Purpose of processing the personal data

Categories of personal data processed

Automated decision-making

Legal basis and any legitimate interests

Recipient

Organisation and execution of careers events, in particular the select of suitable participants based on the application and talent data requested in the pre-registration

Master data,

contact data,

application data,

talent data.

No automated decision-making takes place.

Balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is the execution of careers events.

Dependent branches of Noerr PartGmbB outside the EU,

Noerr companies,

Noerr notary’s offices,

IT service providers.

Implementation of the talent management programme, in particular the select of suitable talents for open positions and sending information on open positions and/or individual information. relating to the participant’s professional interests and objectives.

Master data,

contact data,

talent data,

consent data.

No automated decision-making takes place.

Consent (point (a) of Article 6 paragraph 1 of the General Data Protection Regulation).

IT service providers.

Referral of the talents to the corresponding Noerr Notary’s offices or Noerr companies if the talent has expressly requested this when making contact.

Master data,

contact data,

contact history,

application data,

talent data.

No automated decision-making takes place.

Consent (point (a) of Article 6 paragraph 1 of the General Data Protection Regulation).

Dependent branches of Noerr PartGmbB outside the EU,

Noerr companies,

Noerr notary’s offices,

IT service providers.

Analysis of the effectiveness of contact channels.

Contact history.

No automated decision-making takes place.

Balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is the analysis of the effectiveness of contact channels.

-

Sending Noerr Careers Events News to subscribers by e-mail.

Master data,

contact data,

consent data.

No automated decision-making takes place.

Consent (point (a) of Article 6 paragraph 1 of the General Data Protection Regulation).

IT service providers.

Storage for evidence purposes for the establishment, exercise or defence of possible legal claims.

Master data,

contact data,

consent data.

No automated decision-making takes place.

Balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is the establishment, exercise or defence of legal claims.

IT service providers.

Establishment, exercise or defence of legal claims, including liaison with external lawyers.

Master data,

contact data,

consent data.

No automated decision-making takes place.

Balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interests is the establishment, exercise or defence of legal claims.

Courts and/or authorities,

external lawyers.

Recipient

Recipient’s role

Transfer to third countries and/or to international organisations

Adequacy decision or adequate or suitable assurances for transfers to third countries and/or international organisations

Dependent branches of Noerr PartGmbB outside the EU:

·        Office of Noerr PartGmbB in New York, USA

·        Office of Noerr PartGmbB in London, UK

Part of controller.

USA, UK.

No applicable adequacy decision of the EU within the meaning of Article 45 paragraph 3 of the General Data Protection Regulation exists.

However, the General Data Protection Regulation applies directly to our dependent branches in the USA and UK anyway, so that an appropriate level of data protection exists anyway.

We also guarantee that for transfers to our dependent branches we comply with the obligations under the EU standard contractual clauses in accordance with Article 46 paragraph 5 of the General Data Protection Regulation that were adopted under Article 26 paragraph 4 of the previous Data Protection Directive (Directive 95/46/EC). A copy of the standard contractual clauses can be obtained from our Data Protection Officer (see contact details in Section A).

Noerr companies
in Germany:

·        NOERR Aktiengesellschaft Wirtschaftsprüfungsgesellschaft Steuerberatungsgesellschaft (NOERR AG)

·        Noerr Consulting GmbH & Co. KG

Controller.

Within the EU.

-

Noerr companies
in Spain:

·        Noerr Alicante IP, S.L.

Controller.

Within the EU.

-

Noerr notary’s offices:

·        Notary’s office Berlin (Dr Astrid Frense, Dr Dirk Lentfer, Felix Blobel, Dr Clemens Schönemann)

·        Notary’s office Frankfurt (Dr Thorsten Reinhard, Dr Alexander Jänecke, Dr. Julian Lemor)

Controller.

Within the EU.

-

IT service providers.

Processor.

Within the EU.

-

Courts and/or authorities.

Controller.

Depending on the location of the relevant court and/or the relevant authority, within or outside the EU.

We only transfer personal data to third countries and/or to international organisations to establish, exercise or defend legal claims (point (e) of Article 49 paragraph 1 of the General Data Protection Regulation).

external lawyers.

Controller.

Depending on the location of the relevant lawyer, within or outside the EU.

We only transfer personal data to third countries and/or to international organisations to establish, exercise or defend legal claims (point (e) of Article 49 paragraph 1 of the General Data Protection Regulation).

Categories of personal data processed

Personal data included in the categories

Data sources

Data subjects’ obligation to provide data

Storage period

Master data.

Company name, industry of our suppliers.

Suppliers.

Provision of the data is not required by law or contract. The data subject is not obliged to provide the data.

However, if the data are not provided, the conclusion of performance of a contract may not be possible.

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Contact data.

Name, position and company contact data (address, e-mail address, telephone number, fax number) of contact person at our suppliers.

Suppliers.

Provision of the data is not required by law or contract. The data subject is not obliged to provide the data.

However, if the data are not provided, the conclusion of performance of a contract may not be possible.

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Bank account data.

Account holder, bank, IBAN, BIC of our suppliers.

Suppliers.

Provision of the data is not required by law or contract. The data subject is not obliged to provide the data.

However, if the data are not provided, the conclusion of performance of a contract may not be possible.

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Communication data.¹

Content of business communication of our suppliers to us, in particular by post, e-mail, fax.

Suppliers.

Provision of the data is not required by law or contract. The data subject is not obliged to provide the data.

However, if the data are not provided, the conclusion of performance of a contract may not be possible.

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Communication data.²

Connect of our business communication to our suppliers, in particular by post, e-mail, fax.

Generated in-house.

-

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Communication data.³

Circumstances of business communication with our suppliers, in particular parties involved, date/time and duration.

Generated in-house.

-

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Contract data.¹

Information that we receive from our suppliers to take steps prior to entering into a contract and/or to perform contracts with our suppliers.

Suppliers.

Provision of the data is not required by law or contract. The data subject is not obliged to provide the data.

However, if the data are not provided, the conclusion of performance of a contract may not be possible.

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Contract data.²

Data from written (including electronic) contract documents that we receive from our suppliers.

Suppliers.

Provision of the data is not required by law or contract. The data subject is not obliged to provide the data.

However, if the data are not provided, the conclusion of performance of a contract may not be possible.

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Contract data.³

Information that we may receive from third parties to take steps prior to entering into a contract and/or for the performance of contracts with our suppliers.

Third parties.

-

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Contract data.⁴

Data from written (including electronic) contract documents that we prepare.

Generated in-house.

-

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Invoice data.

Data from invoices and payment reminders that we receive from our suppliers, in particular data, invoice items and invoice amounts.

Suppliers.

Provision of the data is not required by law or contract. The data subject is not obliged to provide the data.

However, if the data are not provided, billing may not be possible.

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Payment data.

Data relating to payment transactions, in particular date and payment amounts.

Generated in-house.

-

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Minutes data.

Data from minutes relating to the business content of appointments and meetings with our suppliers that we prepare to maintain the business relationship.

Generated in-house.

-

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Analysis data.¹

Data from analyses of the business structure of the companies of our suppliers that we prepare for the strategic alignment of our business relationships.

Generated in-house.

-

We store these data until the purposes of processing these data specified below have been achieved.

Analysis data.²

Date we receive from our suppliers from analyses of the companies of our suppliers that we prepare for the strategic alignment of our business relationships.

Suppliers.

Provision of the data is not required by law or contract. The data subject is not obliged to provide the data.

If the data are not provided, we cannot take the data into account for the strategic alignment of our business relationships with our suppliers.

We store these data until the purposes of processing these data specified below have been achieved.

Survey data.

Responses to our surveys on the voluntary assessment of the business from the supplier’s perspective.

Suppliers.

Provision of the data is not required by law or contract. The data subject is not obliged to provide the data.

If the data are not provided, we cannot take any survey results of this supplier into account. This does not otherwise have any effect on the business relationship.

We store these data until the purposes of processing these data specified below have been achieved.

Purpose of processing the personal data

Categories of personal data processed

Automated decision-making

Legal basis and any legitimate interests

Recipient

Taking steps prior to entering into a contract, including pre-contractual communication.

Master data,

contact data,

communication data,

contract data.

No automated decision-making takes place.

If the data subject is our (potential) supplier, the legal basis is taking steps at the request of the data subject prior to entering into a contract (point (b) of Article 6 paragraph 1 of the General Data Protection Regulation).

If the data subject is not our (potential) supplier, the legal basis is a balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is taking steps at the request of our (potential) supplier prior to entering into a contract.

Shipping/courier service providers.

Performance of contracts with our suppliers, including contractual communication, exchange of services and payment processing.

Master data,

contact data

bank account data,

communication data,

contract data,

invoice data,

payment data.

No automated decision-making takes place.

If the data subject is our supplier, the legal basis is the performance of a contract, to which the data subject is party (point (b) of Article 6 paragraph 1 of the General Data Protection Regulation).

If the data subject is not our supplier, the legal basis is a balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is the performance of the contract with our supplier.

Shipping/courier service providers,

IT service providers.

Proper accounting and storage to comply with contractual and statutory, in particular commercial law and tax law retention obligations.

Master data,

identification data,

contact data,

bank account data,

communication data,

contract data,

invoice data,

payment data.

No automated decision-making takes place.

Compliance with a legal obligation (point (c) of Article 6 paragraph 1 of the General Data Protection Regulation), in particular compliance with statutory requirements for proper accounting and statutory, in particular professional ethics, commercial and tax law retention obligations.

If the data subject is our supplier, the legal basis is also the performance of a contract, to which the data subject is party (point (b) of Article 6 paragraph 1 of the General Data Protection Regulation).

If the data subject is not our supplier, the legal basis is also a balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is the performance of the contract with our supplier .

Accounting service providers,

archiving service providers.

Storage for evidence purposes for the establishment, exercise or defence of possible legal claims.

Master data,

contact data,

bank account data,

communication data,

contract data,

minutes data,

invoice data,

payment data.

No automated decision-making takes place.

Balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interests is the establishment, exercise or defence of legal claims.

Archiving service providers.

Establishment, exercise or defence of legal claims, including liaison with external lawyers.

Master data,

contact data,

bank account data,

communication data,

contract data,

invoice data,

payment data.

No automated decision-making takes place.

Balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interests is the establishment, exercise or defence of legal claims.

Courts and/or authorities,

external lawyers.

Liaison with external tax advisors and/or auditors to comply with statutory obligations.

Master data,

contact data,

bank account data,

communication data,

contract data,

invoice data,

payment data.

No automated decision-making takes place.

Compliance with a legal obligation (point (c) of Article 6 paragraph 1 of the General Data Protection Regulation).

External tax advisors,

external auditors.

Cooperation with courts and/or authorities to comply with statutory obligations.

Master data,

contact data,

bank account data,

communication data,

contract data,

invoice data,

payment data.

No automated decision-making takes place.

Compliance with a legal obligation (point (c) of Article 6 paragraph 1 of the General Data Protection Regulation).

Courts and/or authorities.

Business relationship management, making contact to inform our suppliers and to maintain relationships with our suppliers.

Master data,

contact data,

communication data,

contract data,

minutes data,

analysis data,

survey data.

No automated decision-making takes place.

The legal basis for business relationship management is generally a balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is the maintenance and strategic alignment of the relationships with our suppliers.

The legal basis for making contact to inform our suppliers can, depending on the circumstances of each individual case, in particular the way in which contact is made, either consent (point (a) of Article 6 paragraph 1 of the General Data Protection Regulation) or a balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is information our suppliers.

-

Recipient

Recipient’s role

Transfer to third countries and/or to international organisations

Adequacy decision or adequate or suitable assurances for transfers to third countries and/or international organisations

External lawyers.

Controller.

Depending on the location of the relevant external lawyer, within or outside the EU.

We only transfer personal data to third countries and/or to international organisations to the extent that this is necessary to establish, exercise or defend legal claims (point (e) of Article 49 paragraph 1 of the General Data Protection Regulation).

External auditors.

Controller.

Within the EU.

-

External tax advisors.

Controller.

Within the EU.

-

Courts and/or authorities.

Controller.

Depending on the location of the relevant court and/or the relevant authority, within or outside the EU.

We only transfer personal data to third countries and/or to international organisations to establish, exercise or defend legal claims (point (e) of Article 49 paragraph 1 of the General Data Protection Regulation).

Shipping/courier service providers

Controller.

Within the EU.

-

IT service providers

Processor.

Within the EU.

-

Accounting service providers

Processor.

Within the EU.

-

Archiving service provider

Processor.

Within the EU.

-

Categories of personal data processed

Personal data included in the categories

Data sources

Data subjects’ obligation to provide data

Storage period

Master data.

Name, position, company, industry.

Visitors.

Provision of the data is not required by law or contract. The data subject is not obliged to provide the data.

However, if the data are not provides, a visit may not be possible.

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Contact data.

Address, e-mail address, telephone number, fax number.

Visitors.

Provision of the data is not required by law or contract. The data subject is not obliged to provide the data.

However, if the data are not provides, a visit may not be possible.

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Registration data.¹

Expected time, duration and purpose of visit, buildings or parts of buildings to be visited, arrival and departure.

Visitors.

Provision of the data is not required by law or contract. The data subject is not obliged to provide the data.

However, if the data are not provides, a visit may not be possible.

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Registration data.²

Expected time, duration and purpose of visit, buildings or parts of buildings to be visited, arrival and departure.

Generated in-house.

-

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Additional data.

Optional information on the visitor’s special catering requirements or other technical or organisational arrangements for the visit, such as barrier-free facilities.

Visitors.

Provision of the data is not required by law or contract. The data subject is not obliged to provide the data.

If the data are not provided, the visitor’s special requirements cannot be taken into account.

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Visit data.

Actual time and duration of visit, information on buildings or parts of buildings visited.

Generated in-house.

-

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Communication data.¹

Content of communication with visitors regarding the planning and organisation of visits, in particular via post, e-mail, telephone, fax.

Visitors.

Provision of the data is not required by law or contract. The data subject is not obliged to provide the data.

However, if the data are not provides, a visit may not be possible.

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Communication data.²

Content of communication with visitors regarding the planning and organisation of visits, in particular via post, e-mail, telephone, fax.

Generated in-house.

-

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Communication data.³

Circumstances of business communication with visitors, in particular those involved, time and duration.

Generated in-house.

-

We store these data until the purposes of processing these data specified below have been achieved.

We also store the data if other statutory, in particular commercial or tax law document retention obligations exist. Depending on the document type, document retention requirements under commercial or tax law can be between six and ten years (sec. 147 German Tax Code (Abgabenordnung – AO), sec. § 257 German Commercial Code (Handelsgesetzbuch – HGB)).

Door camera data.

Footage from cameras in door intercoms.

Generated in-house.

-

These data are not stored beyond the communication process.

Purpose of processing the personal data

Categories of personal data processed

Automated decision-making

Legal basis and any legitimate interests

Recipient

Identification of our visitors and documentation of visits in order to maintain the safety of our buildings, facilities and employees, to ensure the safety of our visitors, to protect our property or the property of our suppliers.

This includes checking access authorisation and comparing the master and visit data specified during the visit with any master and registration data specified during any advance registration.

To identify visitors at entrances to our buildings and/or parts of buildings, we also use real-time video transmission in door intercom systems with video function. The transmission only takes place immediately and shortly after the doorbell has been activated. A video recording does not take place. We expressly refer to the video function in connection with the door intercom system (typically by means of pictograms on the door intercom system).

Master data,

contact data,

registration data,

visit data,

door camera data.

No automated decision-making takes place.

Balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is maintaining the safety of our buildings, facilities and employees, ensuring the safety of our visitors and protecting our property or the property of our suppliers. Our legitimate interest is also ensuring that appropriate data security measures in accordance with Article 32 of the General Data Protection Regulation have been implemented. 

-

Planning and organisation of the details of the visit.

For this purpose, we may carry out advance registration of visitors prior to the visit.

In addition, we take into account any optional information from visitors regarding special catering requirements or other technical or organisational arrangements for the visit, such as barrier-free facilities.

Master data,

contact data,

registration data,

visit data,

additional data,

communication data.

No automated decision-making takes place.

Balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest is the planning and organisation of the details of the visit taking the special wishes and needs of the visitor into account.

-

Storage for evidence purposes for the possible establishment, exercise or defence of legal claims.

Master data,

contact data,

registration data,

visit data,

additional data,

communication data.

No automated decision-making takes place.

Balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest the establishment, exercise or defence of legal claims.

-

Establishment, exercise or defence of legal claims.

Master data,

contact data,

registration data,

visit data,

additional data,

communication data.

No automated decision-making takes place.

Balancing of interests (point (f) of Article 6 paragraph 1 of the General Data Protection Regulation). Our legitimate interest the establishment, exercise or defence of legal claims.

Courts and/or authorities,

external lawyers.

Cooperation with courts and/or authorities to comply with statutory obligations.

Master data,

visit data.

No automated decision-making takes place.

Compliance with a legal obligation (point (c) of Article 6 paragraph 1 of the General Data Protection Regulation).

Courts and/or authorities.

Recipient

Recipient’s role

Transfer to third countries and/or to international organisations

Adequacy decision or adequate or suitable assurances for transfers to third countries and/or international organisations

External lawyers.

Controller.

Depending on the location of the relevant external lawyer, within or outside the EU.

We only transfer personal data to third countries and/or to international organisations to the extent that this is necessary to establish, exercise or defend legal claims (point (e) of Article 49 paragraph 1 of the General Data Protection Regulation).

Courts and/or authorities.

Controller.

Depending on the location of the relevant court and/or the relevant authority, within or outside the EU.

We only transfer personal data to third countries and/or to international organisations to the extent that this is necessary to establish, exercise or defend legal claims (point (e) of Article 49 paragraph 1 of the General Data Protection Regulation).