Privacy Policy for Suppliers and Business Partners

We are pleased that you are interested in us and that you are contacting us, or have contacted us, as a supplier or business partner. Below, we would like to provide you with information on the processing of your personal data in connection with contacting us within the supplier and business partner relationship.

Protecting your personal data is important to us. Personal data is information relating to the personal or factual circumstances of an identified or identifiable natural person. This includes, for example, your legal name, address, telephone number and date of birth, as well as any other data that can be linked to an identifiable person.

Our data protection practices comply with statutory provisions, in particular the German Federal Data Protection Act (BDSG) and the EU General Data Protection Regulation (GDPR). The following data protection information serves to fulfil the information obligations arising from the GDPR. These can be found, for example, in Art. 13 and Art. 14 et seq. GDPR.

Who is responsible for data processing?

The controller within the meaning of Art. 4 No. 7 GDPR is the party who, alone or jointly with others, determines the purposes and means of the processing of personal data.

With regard to our supplier and business partner relationship, the controller is:

Paul Wiegand GmbH
Eschengrund 5, D-36124 Eichenzell-Kerzell

Email: info@paulwiegand.de
Phone: +49 (0) 6659-9862-0
Fax: +49 (0) 6659-9862-150

You can find further information about our company, details of the persons authorised to represent it, and additional contact options in the legal notice on our website:

www.paulwiegand.de/impressum

Which of your data do we process, and for what purposes?

When you contact us, we collect the following data:

  • Your data that we have received from you in the context of contract initiation or processing (e.g., the designation of your legal representatives, company name, commercial register number, VAT ID number, business number, address),
  • Your contact details for contact persons within the company (first name, last name),
  • Your communication data (telephone number, mobile number, email address, fax number),
  • Your supplier number as well as your order and delivery data for the purpose of initiation,
  • Your order and contract data,
  • Your billing and payment data (bank details, SEPA mandate, etc.),
  • All information necessary for your consultation and/or the execution of your request within the framework of the supplier or business partner relationship.

This data is collected:

  • To be able to identify you as our supplier/business partner,
  • To correspond with you and/or otherwise contact you,
  • To be able to support you responsibly and successfully,
  • To fulfill the business purpose such as pre-contractual measures, e.g., for the preparation of offers, processing of inquiries (Art. 6 Para. 1 Sentence 1 lit. b GDPR),
  • To fulfill contractual obligations (order, contract, payment processing, invoicing) to deliver goods and services (Art. 6 Para. 1 Sentence 1 lit. b GDPR),
  • To maintain business contacts and to inform the business partner about new products and service offerings (Art. 6 Para. 1 Sentence 1 lit. f GDPR),
  • For processing based on legal obligations, e.g., with regard to tax law requirements (Art. 6 Para. 1 Sentence 1 lit. c GDPR in conjunction with specific legal bases, such as Section 147 AO, Section 257 HGB),
  • To be able to process and enforce any liability claims on our part against you,
  • To be able to pursue any (payment) claims on your part against us.

What is the legal basis for this?

Data processing is carried out,

  • To fulfill (pre-)contractual obligations (Art. 6 Para. 1 lit. b GDPR):
  • The processing of your data is carried out for contract execution. The data is processed in particular during business initiation and during the execution of contracts with you.
  • To fulfill legal obligations (Art. 6 Para. 1 lit. c GDPR):
  • Processing of your data is necessary for the purpose of fulfilling various legal obligations, e.g., from the Commercial Code or the Fiscal Code.
  • To protect legitimate interests (Art. 6 Para. 1 lit. f GDPR):
  • Based on a balancing of interests, data processing beyond the actual fulfillment of the contract may take place to protect legitimate interests of us or third parties. Data processing to protect legitimate interests takes place, for example, in the following cases:
    • Measures for business management and further development of services,
    • In the context of legal prosecution.

How long will the data be stored?

Your data is stored and collected both digitally (in our administration software / document management system) and in paper form.

The personal data collected by us within the framework of the supplier/business partner relationship will be stored or retained until the expiry of the statutory retention obligation and then deleted or destroyed. This only applies differently if we are obligated to longer storage/retention due to other legal provisions (e.g., the Fiscal Code [AO], the Money Laundering Act [GwG], etc.) (Art. 6 Para. 1 Sentence 1 lit. c GDPR).

After the retention period has ended, we will have your paper documents collected and subsequently destroyed by a certified company in sealed containers, while maintaining all confidentiality.

To which recipients will the data be disclosed?

A transmission of your personal data to third parties for purposes other than those listed below does not generally take place. Data is only passed on to the extent necessary for the proper execution of the contractual relationship with you (Art. 6 Para. 1 Sentence 1 lit. b GDPR). This includes in particular the transmission to our house bank, in the case of any claims against you to our lawyer, any authorities and customers. Transmission also takes place based on legal provisions to public authorities (tax authorities), based on contract fulfillment, where necessary, to external entities (contractual partners), for processing data on our behalf in accordance with Art. 28 GDPR to external contractors (e.g., IT service providers, disposal companies) as well as based on our overriding legitimate interests to other external entities (e.g., credit institutions for supplier payments, tax advisors, customs). The transmitted data may only be used by the third party for the stated purposes.

No further transmission of your personal data to third parties takes place.

Those employees of our company who come into contact with your data are subject to a strict obligation of confidentiality and secrecy, the observance of which we constantly monitor. Other persons with whom we cooperate and who come or could come into contact with your data have also been or will be contractually bound by us to confidentiality and secrecy and are – as they have also been or will be expressly informed – liable to prosecution in the event of a breach.

Where is the data processed?

The data is processed exclusively on the internal servers of the controller.

Should we transfer personal data to service providers outside the European Economic Area (EEA), the transfer will only take place if the third country has been confirmed by the EU Commission to have an adequate level of data protection (admissibility requirements of Chapter V, Art. 44-50 of the GDPR) or if other appropriate data protection guarantees (e.g., binding corporate rules or EU standard contractual clauses) are in place.

Your rights as a “data subject”

You have the right to information (Art. 15 GDPR) about the personal data we process about you. In the case of an information request that is not made in writing, we ask for your understanding that we may then request evidence from you proving that you are the person you claim to be.

Furthermore, you have the right to rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR) or restriction (Art. 18 GDPR) of processing, insofar as you are legally entitled to do so.

Furthermore, you have the right to object (Art. 21 GDPR) to processing within the scope of the statutory provisions. The same applies to the right to data portability (Art. 20 GDPR).

Our Data Protection Officer

We have appointed a Data Protection Officer in our company pursuant to Art. 37 GDPR. You can contact them using the following details:

Paul Wiegand GmbH
– Data Protection Officer –
Eschengrund 5, D-36124 Eichenzell-Kerzell
Email: datenschutz@paulwiegand.de

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data.

Changes to this Privacy Notice

We revise this Privacy Notice when changes in processing activities or other circumstances make this necessary. The current version can always be found on this website.

Last updated: 2021-09-16