Datenschutzhinweise für Lieferanten

With the following information, we provide you with an overview of our processing of the personal data of your company's employees and of the rights of data subjects.

Who is responsible for data processing and who can you contact?

The controller is

Rhenus Automotive Services GmbH & Co.KG
Managing directors: Dr. Marcus Ewig, Ulrich Schorb
and all other affiliated companies
(a list of affiliated companies is attached)

You can reach our data protection officer at

Oliver Köhler
Rhenus Assets & Services GmbH & Co. KG
Rhenus-Platz 1
59439 Holzwickede
Datenschutz@de.rhenus.com

What sources and data will we use?

We process personal data that we receive from our suppliers within the scope of our business relationship. We also process - to the extent necessary for the fulfilment of our obligations - personal data that we obtain from publicly accessible sources (for example, trade and association registers, press, Internet) and that is transmitted to us in a permissible manner by other companies of the Rhenus corporate group or other third parties (for example, a credit agency).

Relevant personal data includes personal data (name, address and other contact data) and identification data (for example, identification data). For this purpose, it also includes order data (for example, a payment order), data arising from the fulfilment of our contractual obligations such as turnover data in payment transactions, information regarding your financial situation (for example, creditworthiness data, scoring or rating data), documentation data (for example, extract from the commercial register) and other data comparable with the specified categories.

Why do we process your data (purpose of processing) and on what legal basis do we do so?

We process personal data in accordance with the provisions of the EU General Data Protection Regulation ("GDPR") and the German Federal Data Protection Act (Bundesdatenschutzgesetz, "BDSG")

a. for the performance of contractual obligations (Art. 6 (1)(b) GDPR)
The processing of data is carried out to fulfil our obligations arising from the purchase, work, leasing or rental contract or to carry out pre-contractual measures that are carried out on request.

b. as part of the balancing of interests (Art. 6 (1)(f) GDPR)
To the extent necessary, we process your data beyond the actual fulfilment of the contract to protect the legitimate interests of us or third parties.

Examples:

• Consultation and data exchange with credit agencies (for example, SCHUFA) to determine creditworthiness and default risks in our purchasing processes,
• Assertion of legal claims and defence in legal disputes,
• Ensuring the IT security and operation of the business,
• Prevention and investigation of criminal offences,
• Video surveillance for the protection of the power to enforce building rules, for the collection of evidence upon break-ins (see also § 4 BDSG),
• Measures for building and plant security (for example, access controls),
• Measures to secure the power to enforce building rules,
• Business management measures,
•  Risk management in the Rhenus corporate group.

c. on the basis of your consent (Art. 6 (1)(a) GDPR)
If you have given us consent to process personal data for certain purposes (for example, supplier applications in the supplier portal), such processing is lawful on the basis of your consent. A consent that has been issued may be withdrawn at any time. This also applies to the withdrawal of declarations of consent issued to us before the GDPR came into force, that is prior to 25 May 2018. The withdrawal of a consent shall only take effect for the future and shall not affect the lawfulness of the data processed up to the withdrawal.

d. on the basis of legal requirements (Art. 6 (1)(c) GDPR) or in the public interest (Art. 6 (1)(e) GDPR)
As a company, we are also subject to various legal obligations, i.e. statutory requirements (for example, money laundering law, tax laws). The purposes of the processing include, among other things, checks for creditworthiness, identity checks, fraud and money laundering prevention, compliance with monitoring and reporting obligations under tax law and the assessment and management of risks within the company and the Rhenus corporate group.

Who will receive your data?

Within the company, those departments that need your data to fulfil our contractual and legal obligations, for example purchasing, are given access to it. Service providers and vicarious agents used by us may also receive data for such purposes. These are companies in the categories of IT services, logistics, printing services, telecommunications and debt collection. With regard to the transfer of data to recipients outside our company, it should first be noted that we only pass on necessary personal data in compliance with the applicable data protection regulations. In principle, we may pass on personal data of our suppliers only if this is required by statutory provisions, if the data subject has consented it or if we are otherwise authorised to do so. Under these conditions, recipients of personal data could be the following, for example:

• public entities and institutions (such as tax authorities, criminal prosecution authorities) where there is a legal or administrative obligation,
• other companies in the Rhenus corporate group for risk management based on legal or administrative obligations,
• creditors or insolvency administrators, who make inquiries within the framework of enforcement proceedings,
• chartered accountants,
• service providers that we use within the framework of contract processing relationships.

Other data recipients may be those entities for which you have given us your consent to the transfer of data, or to whom we may transfer personal data on the basis of a balancing of interests.

Will data be transferred to a third country or to an international organisation?

Data transfer to locations in states outside the European Union (so-called "third countries") will take place, as far as

• It is necessary for the implementation of the contractual relationship (for example, the processing of orders),
• it is required by law (for example, tax reporting obligations) or
• You have given us your consent.

Furthermore, a transfer to entities in third countries is foreseen in the following cases:

• If necessary in individual cases, your personal data may be transferred to an IT service provider in the USA or another third country to ensure the IT operation of the company, in compliance with the level of European data protection.
• In individual cases, personal data (for example, identification data) will be transferred with the consent of the data subjects or on the basis of legal regulations to combat money laundering, terrorist financing and other punishable acts, and within the framework of a balancing of interests, in compliance with the level of data protection of the European Union.

How long will your data be stored?

We will process and store your personal data as long as this is necessary for the fulfilment of our contractual and legal duties.

If the data is no longer required for the fulfilment of contractual or legal duties, it will be erased on a regular basis, unless its (temporary) further processing is necessary for the following purposes:

• The fulfilment of retention duties under commercial and tax law, which may arise, for example, from: the German Commercial Code (Handelsgesetzbuch), the German Tax Code (Abgabenordnung) and the German Money Laundering Act (Geldwäschegesetz). As a rule, the time limits for retention and documentation specified therein are two to ten years.
• The preservation of evidence within the framework of the statutory provisions regarding the period of limitations. According to §§ 195 et seq. of the German Civil Code (Bürgerliches Gesetzbuch), such periods of limitation may amount to up to 25 years, whereas the regular period of limitations amounts to 3 years.

What data protection rights do you have?

Every data subject has the right of access under Article 15 GDPR, the right of rectification under Article 16 GDPR, the right of erasure under Article 17 GDPR, the right to the restriction of processing under Article 18 GDPR, the right to object under Article 21 GDPR and the right to data portability under Article 20 GDPR. The restrictions under § 34 and § 35 BDSG apply to the right to access and the right to erasure. In addition, there is right to lodge a complaint with a competent data protection supervisory authority (Article 77 GDPR in conjunction with § 19 BDSG).

Is there a duty for you to provide data?

As part of our contractual relationship, you must provide us with the personal data that is required for the commencement, performance and termination of the contractual relationship and for the fulfilment of the associated contractual obligations, or data that we are legally obligated to collect. As a rule, without such data, we will not be in a position to conclude, carry out or terminate a contract with you.

If you do not provide us with the necessary information and documents, this may conflict with the commencement and implementation of the contractual relationship.

To what extent does automated decision-making exist?

In principle, for the establishment, implementation and termination of the contractual relationship, we do not employ fully automated decision-making pursuant to Article 22 GDPR. If we employ such processes in individual cases, we will inform you separately of this and regarding your rights in this respect, if this is legally prescribed.