Privacy policy

Data protection principles for business partners

Data protection principles for business partners

Dear Sir/Madam,

We take the protection of your personal data very seriously and endeavour to give you comprehensive information about the way in which your personal data is processed. The following data protection information applies to you if you contact us, if contract negotiations take place with us and/or if contractual agreements exist with us and the data of natural persons is processed in connection with these. In particular, the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) serve as the legal basis. Which data is actually processed largely depends on the agreed services. Therefore, not all parts of this information will be relevant to you.

How do we collect your personal data and which data categories do we use?

We essentially collect your data from you.

However, it may also be necessary to process personal data that we receive from other companies, authorities or other third parties, such as credit agencies, tax offices or similar.

Relevant personal data can include: personal data (e.g. first/last name, address and other contact data, date and place of birth and nationality), identification and authentication data (e.g. extracts from the commercial register, identity-card data, specimen signature), data within the scope of our business relationship (e.g. payment data, data on orders), creditworthiness data, data on company structures and ownership as well as other data comparable with the aforementioned categories.

You always have the choice whether to communicate with us by e-mail or post. Communication by e-mail may be unencrypted for technical reasons.

Purposes and legal basis of the processing

In order to fulfil contractual obligations (Art. 6 para. 1 letter b GDPR)

The purposes of the data processing result from the execution of pre-contractual measures, which precede a contractually regulated business relationship and in the fulfilment of the obligations from the concluded contract.

In order to fulfil a legal obligation (Art. 6 para. 1 letter c GDPR)

The purposes of the data processing result in individual cases from statutory requirements. These statutory obligations include, for example, the fulfilment of storage and identification obligations, e.g. as part of the regulations for the prevention of money laundering, tax control and reporting obligations, and the data processing required as a result of enquiries from authorities.

In order to fulfil legitimate interests (Art. 6 para. 1 letter f GDPR)

It may be necessary to process the personal data provided by you beyond the actual fulfilment of the contract. The legitimate interests here are in particular the selection of suitable business partners, assertion of legal claims, defence against liability claims, entry or access controls, billing purposes (e.g. for seminars at Trainmobil), direct marketing purposes (e.g. postal advertising in the form of magazines), clarification of possible compliance violations, prevention of criminal offences and the settlement of damages resulting from the business relationship.
We use the credit rating data of the credit agencies to check creditworthiness. The credit agencies store data that they receive from banks or companies, for example, and this data includes in particular: surname, first name, date of birth, address and information on payment behaviour. Information on the data stored by you can be obtained directly from the credit agencies.

Webinars using Microsoft Teams

If you participate in an online meeting as an external participant, you will receive an access link by e-mail from the host of the webinar. When you register for the online meeting, you will have to enter your login name and, if applicable, your e-mail address. Furthermore, metadata such as date, time, meeting-ID and IP address are processed.

We use the tool "Microsoft Teams" to conduct online webinars. The legal basis for data processing regarding contact persons of our shareholders and concept partners is the legitimate interest according to Art. 6 para. 1 f) GDPR. Our legitimate interest lies in the offering of webinars. If our contact person is a direct contractual partner and a natural person, Art. 6 para. 1 b) GDPR is the legal basis. Recordings of the webinars will not be created in this context.

Microsoft Teams is part of Microsoft Office 365, a software from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.

In principle, ATR does not process data outside the European Union (EU), as we have limited our storage location to data centres in the European Union. However, we cannot exclude that the routing of data takes place via internet servers that are located outside the EU. This may be the case in particular if participants in "Online Meeting" are located in a third country.

However, the data is encrypted during transfer over the Internet and thus protected against unauthorized access by third parties.

Microsoft reserves the right to process customer data for its own legitimate business purposes and to pass it on to Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. We have no control over this data processing by Microsoft. To the extent that Microsoft Teams processes personal data in connection with legitimate business purposes, Microsoft is the independent data controller for those data processing activities and, as such, is responsible for compliance with all applicable data protection laws. If you require information about Microsoft's processing, please refer to the relevant Microsoft statement (https://privacy.microsoft.com/de-de/privacystatement).

Who receives the personal data provided by you?

Within our company, the areas that need the data provided by you to fulfil their contractual or legal obligations or to fulfil their legitimate interests are given access to it. As part of the contractual relationship, we also commission contract processors or service providers who may have access to your personal data. Compliance with data protection regulations is contractually ensured.The data may also be transferred to companies within the ATR group of companies in order to fulfil contractual obligations.

How long will the data be kept?

Personal data will be kept for as long as is necessary to fulfil the above-mentioned purposes or until you have effectively objected to the processing within the meaning of Art. 21 GDPR. In particular, the statutory storage obligations from the German Commercial Code (HGB) and the Fiscal Code (AO), which provide for storage for up to twelve years, are relevant here.

Are you obliged to provide the data?

As part of our business relationship, you must provide us with the personal data necessary to establish, conduct and terminate a business relationship and to perform the duties associated therewith, which we are required to collect by law or have the right to do so in our legitimate interests. Without this data, we will usually not be able to enter into a business relationship with you.

Is data transferred to a third country?

If we transfer personal data to recipients outside the European Economic Area (EEA), this transfer will only take place if the third country has been confirmed by the EU Commission as having an adequate level of data protection, if an adequate level of data protection has been agreed with the data recipient (e.g. by means of EU standard contract clauses) or if we have received your consent to do so.

Which rights do you have?

You have the right, upon request and free of charge, to receive information about your personal data stored by us. In addition, you have a right to the correction and deletion of this personal data, a right to data transferability and a right to restriction of processing in accordance with the statutory provisions. If we process your personal data on the basis of your consent, you have the right to at any time revoke this consent with effect for the future. If data is collected on the basis of Art. 6 para. 1 page 1 letter e (data processing for the fulfilment of official tasks or the protection of the public interest) or letter f (data processing for the safeguarding of legitimate interests), the data subject shall have the right to object to the processing at any time for reasons arising from their particular situation. We will then no longer process the personal data unless there are verifiable compelling legitimate grounds for processing which outweigh the interests, rights and freedoms of the data subject, or the processing serves the assertion, exercise or defence of legal claims. In such cases, please contact us in writing or by e-mail at the following address: datenschutz@atr.de.

Any data subject has the right to complain to a supervisory authority if they consider that the processing of data concerning them is in breach of data protection provisions. The right to complain can in particular be exercised before a supervisory authority in the Member State where the data subject is staying or where the alleged infringement took place. The competent supervisory authority in Baden-Württemberg is the following:

The State Commissioner for Data Protection and Freedom of Information
Postfach 10 29 32
70025 Stuttgart
Germany
Phone: +49 711/61 55 41 – 0
E-mail: poststelle@lfdi.bwl.de

Responsible body

The responsible body is the company with which you are initiating or conducting a business relationship.

Contact details of the Data Protection Officer

E-mail: office@datenschutz-sued.de
Postal address:
datenschutz süd GmbH
Wörthstraße 15
97082 Würzburg
Germany

Data protection principles for trade fair events

The following data protection principles inform you about the collection, processing and use of personal data by the responsible party in the context of a trade fair event.

Responsible party within the meaning of Art. 4 No. 7 GDPR

ATR International AG
Auto-Teile-Ring GmbH
ATR SERVICE GmbH
ATR Digitisation GmbH

Marie-Curie-Strasse 3
73770 Denkendorf
Germany

Phone: + 49 711 918979-0
E-mail: datenschutz@atr.de
Website: www.atr.de

Purposes of data processing/legal basis: 

Contract initiation

We process your personal data in the context of trade fair events for the purpose of initiating or maintaining contractual relationships. The legal basis for data processing in this regard is Art. 6 (1) b) GDPR.

Sending of information material

In addition to discussions at trade fair stands, we will send you information material by post or e-mail at your request so that you can obtain further comprehensive information about ATR's services after the trade fair.  The legal basis for sending the information material is your consent in accordance with Art. 6 Para. 1 a) DSGVO, which you give us when providing us with your contact details.

Photographs 

In the course of a trade fair, photographs (individual and/or group photos) may be taken of you. If we do not take these photos ourselves, they will be provided to us by the respective photographer of the trade fair. We will use the photographs for internal documentation purposes and, if necessary, publish them on our website www.atr.de and on our social media channels (Facebook, LinkedIn, Xing, Google (YouTube) und Twitter) to illustrate our trade fairs. 

If you actively make yourself available for a photograph, we will consider this as your consent to the processing of the photographs for the aforementioned purposes. Accordingly, the processing of the photographs is based on Art. 6 (1) a) GDPR.

If photographs merely reflect the overall events at a trade fair and you as a person are relegated to the background, we process the photographs for the aforementioned purposes on the basis of our legitimate interest in documenting the trade fair in accordance with Art. 6 (1) f) GDPR. 

Who receives the personal data you provide?

Within our company, the areas that receive access to the data you have provided are those that need it to fulfil contractual or legal obligations or to fulfil legitimate interests. If we publish your personal data (photographs) on our website www.atr.de or on our Social Media Channels, these can be accessed by third parties who have Internet access. Within the framework of contractual relationships, we also commission processors or service providers who may have access to your personal data. Compliance with data protection regulations is contractually ensured in this regard.

The data may also be transferred to companies within the ATR group of companies in order to fulfil contractual obligations.

In relation to Social Media the data recipients may also be located in third countries where the level of data protection may be lower than in the EU or the EEA area. This also applies to the storage of data by Facebook, LinkedIn, Google (YouTube) , Xing and Twitter themselves. Suitable guarantees with/by the social media platforms Facebook, LinkedIn, Google (YouTube) , Xing and Twitter do not currently exist. For cases where we are jointly responsible for processing with the social media platform, you can find the main contents of the joint processing of your data here:

https://www.facebook.com/legal/terms/page_controller_addendum. The posts under the pictures including the comments are available on Facebook for an unlimited period of time. Information on this can be found here: https://www.facebook.com/help/568137493302217. You can delete the comments and posts independently at any time. 
You can find more information on Xing’s data processing here: 
https://privacy.xing.com/en/privacy-policy
You can find more information on LinkedIn's data processing here: 
https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy. 
You can find more information on Twitter's data processing here: 
https://twitter.com/de/privacy
You can find more information on Google’s (YouTube) data processing here: 
https://policies.google.com/privacy?hl=en-US

Please note that when photos are published on the Internet, there is always a risk that they will be disseminated without our intervention and can therefore no longer be deleted. This applies accordingly to photos published on the internet which can be found and retrieved by internet search engines in Germany and abroad.

Please also note that in the case of group photos with several people, a revocation may remain without effect under certain circumstances, provided that a large number of people are depicted in a neutral manner and the individual is clearly not the focus of the portrait.

How long will the data be stored?

The personal data will be stored for as long as is necessary to fulfil the above-mentioned purposes or until you have effectively objected to the processing within the meaning of Art. 21 GDPR or have revoked your consent in accordance with Art. 7 Para. 3 GDPR. In this context, the statutory retention obligations from the German Commercial Code (HGB) and the German Fiscal Code (AO), which provide for retention for up to twelve years, are particularly relevant. Please note that when photos are published on the Internet, there is always a risk that they will be disseminated without our intervention and can therefore no longer be deleted. This applies accordingly to photos published on the Internet that can be located and retrieved by Internet search engines in Germany and abroad.

Are you obliged to provide the data?

As part of our business relationship, you must provide us with the personal data necessary to establish, conduct and terminate a business relationship and to perform the duties associated therewith, which we are required to collect by law or have the right to do so in our legitimate interests. Without this data, we will usually not be able to enter into a business relationship with you.

Is data transferred to a third country?

If we transfer personal data to recipients outside the European Economic Area (EEA), this transfer will only take place if the third country has been confirmed by the EU Commission as having an adequate level of data protection, if an adequate level of data protection has been agreed with the data recipient (e.g. by means of EU standard contractual clauses) or if we have received your consent to do so.

Which rights do you have?

Pursuant to Art. 15 para. 1 GDPR, you have the right to request information free of charge on the personal data stored by ATR about you.

In addition, you have a right to correction (Art. 16 GDPR), deletion (Art. 17 GDPR) and restriction of the processing (Art. 18 GDPR) of your personal data if the legal requirements are met.

If the data processing is based on Art. 6 para. 1 e) or f) GDPR, you have the right to object according to Art. 21 GDPR. If you object to the data processing, this will not take place in the future, unless the data controller can prove compelling reasons worthy of protection for the further processing which outweigh the interest of the data subject in objecting.

If you have provided the processed data yourself, you have the right to data transfer in accordance with Art. 20 GDPR.

If the data processing is based on consent pursuant to Art. 6 para. 1 a) or Art. 9 para. 2 a) GDPR, you may revoke the consent at any time with effect for the future without affecting the legality of the previous processing.

Please contact the data protection officer in writing or by e-mail in the aforementioned cases, for open questions or in the event of complaints.
In addition, you have the right to complain to a data protection supervisory authority. The data protection supervisory authority of the federal state in which you live or in which the data controller is based is responsible.

The competent supervisory authority in Baden-Württemberg is as follows: 

The State Commissioner for Data Protection and Freedom of Information
Postfach 10 29 32
70025 Stuttgart
Germany
Phone: +49 711/61 55 41 – 0
E-mail: poststelle@lfdi.bwl.de

Responsible body

The responsible body is the company with which you are initiating or conducting a business relationship.

Contact details of the Data Protection Officer

E-mail: office@datenschutz-sued.de
Postal address:
datenschutz süd GmbH
Wörthstraße 15
97082 Würzburg
Germany

Data protection principles for our social media pages

When you visit our social media pages, it may be necessary to process relevant data. We would therefore like to inform you below, in accordance with Art. 13 of the General Data Protection Regulation (GDPR), about the handling of your data and your rights resulting from this.

Responsibility

We, ATR International AG, Marie-Curie-Straße 3, 73770 Denkendorf, operate the following social media pages:

• Facebook: https://www.facebook.com/autoteilering/
• Instagram: https://www.instagram.com/campderchamps/
• Instagram:  https://www.instagram.com/expertentrophy/
• LinkedIn: https://www.linkedin.com/company/atr-international-ag/

Our contact details: Tel. + 49 (0) 711 91 89 79-0 and e-mail: info@atr.de 

In addition to us, the respective operator of the social media platform is also responsible for the processing of your personal data. Insofar as we can influence and parameterise the data processing, we work within the scope of the possibilities available to us to ensure that the operator of the social media platform handles the data in accordance with the GDPR. In this context, please also refer to the privacy policy of the respective social media platform. However, the operator will inform you about the data processing in its own privacy policy. 

Within the scope of platform use, your personal data is usually also processed by the platform operator on servers in third countries.

Data processing by us
The data you enter on our social media pages, such as user names, comments, videos, pictures, likes, public messages, etc. are published by the social media platform and are not processed by us for any other purpose at any time. We only reserve the right to delete content if this should be necessary. Where appropriate, we share your content on our site if this is a function of the social media platform and communicate with you via the social media platform. 

If you send us an enquiry on the social media platform, we may also refer you to other more secure communication channels that guarantee confidentiality, depending on the content. For example, you have the option of sending us your enquiries at any time to the address given in the imprint or to info@atr.de. The choice of the appropriate communication channel is your own responsibility here. 

The legal basis for processing your data is our legitimate interest according to Art. 6 (1) f GDPR. The data processing is carried out in the legitimate interest of conducting public relations for our company and being able to communicate with you.

Some social media platforms create statistics based on usage data and contain information about your interaction with our social media site. We cannot influence the implementation and provision of these statistics, nor can we prevent them. However, we do not make use of optional statistics from the social media platform. 

We process this information in accordance with Art. 6 (1) f GDPR in the legitimate interest of validating the use of our social media pages and improving our content in a target group-oriented manner.

If you wish to object to certain data processing over which we have control, please contact us using the contact details provided in the imprint.

Storage period
We delete your personal data when they are no longer required for the aforementioned processing purposes and no legal retention obligations prevent deletion.

Data processing by the operator of the social media platform

The operator of the social media platform uses web tracking methods. The web tracking can also take place regardless of whether you are logged in or registered with the social media platform.

We would therefore like to point out that it cannot be ruled out that the provider of the social media platform uses your profile and behavioural data to evaluate for example your habits, personal relationships, preferences, etc. In this respect, we have no influence on the processing of your data by the provider of the social media platform, so that the use of the social media platform is at your own responsibility.

You can find more information on data processing by the provider of the social media platform, configuration options for protecting your privacy as well as further objection options and, if available and concluded, the agreement pursuant to Art. 26 GDPR in the provider's privacy policy:

• Twitter: https://www.twitter.com/privacy
• Facebook: https://www.facebook.com/about/privacy/update

For more information on the joint responsibility agreement pursuant to Art. 26 (2) sentence 2 GDPR, please visit: https://www.facebook.com/legal/terms/page_controller_addendum

• XING: https://privacy.xing.com/
• LinkedIn: https://www.linkedin.com/static?key=privacy_policy and https://legal.linkedin.com/pages-joint-controller-addendum
• Instagram: https://www.instagram.com/legal/privacy/ and https://www.facebook.com/legal/terms/page_controller_addendum

Transfer to third countries

Your use of the platform may result in the processing of your data in a third country (located outside the European Economic Area) by the platform operator. In some countries, there is a risk that authorities may access the data for security and monitoring purposes without you being informed or having the right to appeal. For more information on the processing of your data in a third country over which ATR has no control, please refer to the privacy policy of the social media platforms. 

Your rights as a user

As a website user, you have the possibility to assert the following rights against us as well as against the provider of the social media platform if the prerequisites are met:

Right of access (Art. 15 GDPR): 
You have the right to request confirmation as to whether personal data concerning you is being processed; if this is the case, you have the right to be informed about this personal data and to the information listed in detail in Article 15 GDPR.

Right to rectification and erasure (Art. 16 and 17 GDPR):
You have the right to request without delay the correction of any inaccurate personal data concerning you and, where applicable, the completion of any incomplete personal data. 

You also have the right to request that personal data concerning you be deleted without delay if one of the reasons listed in detail in Article 17 GDPR applies, e.g. if the data is no longer required for the purposes pursued.

Right to restriction of processing (Art. 18 GDPR):
You have the right to request the restriction of processing if one of the conditions listed in Art. 18 GDPR applies, for example if you have objected to the processing, for the duration of any review.

Right to data portability (Art. 20 GDPR): 
In certain cases, which are detailed in Art. 20 GDPR, you have the right to receive the personal data concerning you in a structured, common and machine-readable format or to request the transfer of this data to a third party.

Right to object (Art. 21 GDPR): 
If data is processed on the basis of our legitimate interest pursuant to Art. 6 (1) f DSGVO, you have the right to object to the processing at any time for reasons arising from your particular situation. We will then no longer process the personal data unless there are demonstrably compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

If the data is processed on the basis of legitimate interest for the purpose of direct marketing, you have your own right to object, which you may exercise at any time without giving reasons and the exercise of which will result in the termination of the processing for the purpose of direct marketing. 

Right of appeal to a supervisory authority
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you are of the opinion that the processing of data concerning you violates data protection provisions. The right of complaint may in particular be asserted before a supervisory authority in the member state of your place of residence, your place of work or the place of the alleged infringement.

Providing your data
Unless otherwise stated in the previous chapters, the provision of personal data is not required by law or contract or necessary for the conclusion of a contract. You are not obliged to provide the personal data if no other information has been provided previously. Failure to provide your personal data may mean that we are unable to respond to your contact request.

Contact details of our data protection officer

Our external data protection officer will be happy to provide you with information on the subject of data protection under the following contact details:

datenschutz süd GmbH

Wörthstraße 15

97082 Würzburg

E-mail: office@datenschutz-sued.de

If you contact our data protection officer, please also state the responsible office named in the imprint.