1 General

Uhlmann Pac-Systeme GmbH & Co. KG takes the protection of your personal data very seriously. Your personal privacy is of central importance to us. We process your personal data in compliance with the respectively applicable statutory data protection provisions governing the purposes listed below. Personal data, as defined by this data privacy document, are any form of information that establishes a link to your person.

The following informs you about how we handle this data. Our data privacy information is divided into sections to provide a better overview.

Responsible for data processing is the company

Uhlmann Pac-Systeme GmbH & Co. KG
Uhlmannstr. 14 - 18
88471 Laupheim
Germany
Tel.: 07392 / 7 02 - 0
E-mail: info(at)uhlmann.de

Should you have any questions or comments concerning data protection (such as details about your personal data or their updating), you may also contact our external data protection officer.

Mr. Stefan Fischerkeller
Deutsche Datenschutzkanzlei
Richard-Wagner-Str. 2
88094 Oberteuringen
Germany
Tel. +49 7544 / 904 96 91
E-mail: fischerkeller(at)ddsk.de

2 Scope of processing

2.1    Source and origin of acquired data
We process personal data that we have collected directly from you.
Insofar as is necessary for us to render our services, we process personal data received lawfully from other companies or third parties (e.g., credit agencies, mailing list providers). Furthermore, we process personal data that we have gathered, received, or acquired lawfully from publicly available sources (such as telephone directories, commercial, association, civil or land registers, lists of debtors, the press, the Internet, and other media), and are allowed to process.

2.2    Data categories
Relevant personal data categories may include the following in particular:
-    Personal details (name)
-    Contact data (address, e-mail address, telephone number, and comparable data)
-    Purchase records
-    Marketing preferences
-    Activity history (e.g., transmission of e-mails, customer transactions, campaign processes, and similar sets of data)

2.3    Purposes and legal bases for processing data
We process personal data in compliance with the provisions of the General Data Protection Regulation Act (GDPR), the new version of the German Federal Data Protection Act (BDSG-neu), and other applicable data protection regulations (details in the following). The details of what specific data are processed and the manner in which they are used depend primarily on the respective services requested or agreed. Further details and supplemental information on the purposes of data processing can be found in the respective contractual documents, forms, declarations of consent and/or other information provided to you (e.g., in the context of the use of our website or in our terms and conditions).

Purposes for the fulfillment of a contract or of pre-contractual measures (Art. 6 [1b] GDPR)
The processing of personal data takes place for the performance of our contracts with you and the implementation of your orders, as well as for the execution of measures and activities in the context of pre-contractual relationships, e.g. with potential customers. These primarily include contract-related communication with you, corresponding billing and payment transactions relating thereto, the traceability of orders and other agreements, as well as quality control by means of corresponding documentation, goodwill procedures, measures for the control and optimization of business processes, and for the fulfillment of general due diligence obligations, management and control through associated companies, statistical evaluations for corporate management, cost recording and controlling, reporting, internal and external communication, emergency management, billing and tax evaluation of operational services, risk management, assertion of legal claims and defense in the event of legal disputes, safeguarding of IT security (including system and plausibility tests) and general security, safeguarding and exercising domiciliary rights (e.g., through entry controls), safeguarding of the integrity, authenticity and availability of the data, prevention and clarification of criminal offences, as well as controls by supervisory committees or other supervisory bodies (e.g., auditing).

Purposes in the context of a legitimate interest pursued by us or third parties (Art. 6 [1f] GDPR)
Beyond the actual fulfillment of the contract or preliminary contract, if necessary, we may potentially process your data to protect our legitimate interests or those of third parties, particularly for the following purposes:
•    Advertising or marketing and opinion research, provided you have not objected to the use of your data
•    Review and optimization of needs analysis procedures
•    Further development of services and products, as well as existing systems and processes
•    Statistical assessments or market analysis, benchmarking
•    Limited storage of data in the event that deletion is impossible or only possible with disproportionate effort due to the specific type of storage

Purposes in the context of your consent (Art. 6 [1a] GDPR)
Processing of your personal data for specific purposes (e.g., use of your e-mail address for marketing purposes, newsletter distribution) can also take place on the basis of your consent. You can generally revoke this consent at any time. This also applies to revoking declarations of consent issued to us before the GDPR came into effect, i.e., prior to May 25, 2018. You will be informed of the purposes and of the consequences of revoking or withholding consent separately in the corresponding text of the consent. As a general principle, revocations of consent apply only to the future. Instances of processing prior to the revocation are not affected by it and remain legitimate.

Purposes for the fulfillment of statutory requirements (Art. 6 [1c] GDPR) or in the public interest (Art. 6 [1e] GDPR)
In the same manner as anyone involved in business affairs, we are also subject to numerous legal obligations. These primarily encompass statutory requirements (e.g., commercial and tax laws), but may also include supervisory or other official provisions. The purposes of processing may potentially include the fulfillment of control and reporting requirements under tax law, the archiving of data for purposes of data protection and data security, as well as reviewing by tax authorities and other public agencies. In addition, the disclosure of personal data may be necessary in the context of official/judicial measures for purposes of evidence collection, criminal prosecution, or the enforcement of civil claims.

Scope of your obligations to provide us with data
You only need to provide that data required for the establishment and implementation of a business relationship, for a pre-contractual relationship with us, or which we are obliged by law to collect. We are generally unable to conclude or implement the contract without such data. This can also pertain to data required later within the scope of the business relationship. If we request you to submit additional data, you will be informed separately of the voluntary nature of providing this information.
Existence of any automated decision-making processes in individual cases (including profiling)
Automated decision-making processes, including profiling, do not take place.

2.4    Consequences of withholding data
In the context of the business relationship, you must provide that personal data needed to justify, implement, and conclude the legal business, needed to fulfill the associated contractual obligations, or which we are legally obliged to collect. We are unable to conduct legal business with you without this data.

2.5    Data recipients within the EU
Your data are shared within our company with those internal parties or organizational units that need them to fulfill our contractual and statutory obligations, or in the context of the handling and implementation of our legitimate interests. These include, for example, system administrators, and the marketing, sales, and services departments.

Your data are shared with external parties exclusively:
•    In connection with contract execution
•    For purposes of the fulfilment of statutory requirements under which we are obliged to disclose, report, or share data, or when sharing data is in the public interest (cf. Section 2.3); if external service providers process data on our account as contracted processors or function-holders (e.g., computer centers, support/maintenance of EDP/IT applications, archiving, document processing, call center services, compliance services, controlling, data validation or plausibility checks, data destruction, purchasing/procurement, customer management, letter shops, marketing, media technology, research, risk controlling, billing, telephone services, website management, audit services, credit institutions, printing services or companies for data disposal, courier services, logistics)
•    On the basis of our legitimate interests or the legitimate interests of third parties for purposes within the scope of the specified purposes (e.g., with authorities, credit agencies, debt collection agencies, attorneys, courts, external experts, subsidiary companies, and committees and supervisory bodies)
•    When you have given us your consent to the transmission of your data to third parties

We will not share your data with third parties under any other circumstances. If we hire service providers in the context of contracted processing, your data are subject to the same security standards there as with us. In other cases, the recipients are only permitted to use the data for the purposes for which they were shared.

2.6    Data recipients outside the EU
Data are shared with subsidiary companies of the responsible party in countries outside the European Union (EU) or the European Economic Area (EEA) (referred to as third countries).

Further sharing of personal data with parties in countries outside the European Union (EU) or the European Economic Area (EEA) only takes place when we make use of services to execute our work. Personal data are only shared when the provisions of Art. 44 ff GDPR are met and provided that suitable guarantees for the transfer of personal data are given.

2.7    Storage periods
We process and store your data for the duration of our business relationship. This also includes the initiation of a contract (pre-contractual legal relationship) and the execution of a contract.

In addition, we are subject to various obligations of retention and documentation such as those under the German Commercial Code (HGB) and the German Fiscal Code (AO). The periods of retention or documentation specified therein amount to up to ten years to the end of the calendar year beyond the end of the business relationship or pre-contractual legal relationship.

Furthermore, special statutory provisions may require a longer period of retention, such as the retention of evidence within the scope of statutory limitation requirements. While the regular statutory limitation period under §§195 ff of the German Civil Code (BGB) amounts to three years, limitation periods of up to 30 years may be applicable.

If the data are no longer needed for the fulfillment of contractual or statutory obligations and rights, they are normally deleted unless temporary continued processing of them is required for the fulfillment of the purposes on the basis of an overriding legitimate interest. An overriding legitimate interest of this type also exists, for example, if deletion is impossible or only possible with disproportionate effort due to the type of storage, and processing for other purposes has been made impossible by means of appropriate technical and organizational measures.

2.8    Your rights
Subject to specific requirements, you can assert your data protection rights against us:
•    You thus have the right to obtain information from us on your stored data in compliance with the provisions of Art. 15 GDPR (potentially with restrictions pursuant to § 34 BDSG-neu).
•    At your request, we will correct the data stored on you in accordance with Art. 16 GDPR if it is incorrect or incomplete.
•    If you wish, we will delete your data in accordance with the provisions of Art. 17 GDPR provided that other legal provisions (e.g., statutory retention periods or restrictions pursuant to § 35 BDSG-neu), or an overriding interest on our part (e.g., for the defense of our rights and claims) do not exclude this.
•    With due regard to the provisions of Art. 18 GDPR, you can request that we restrict the processing of your data.
•    Under the provisions of Art. 20 GDPR, you also have the right to receive your data in a structured, conventional, and machine-readable format, or have them sent to a third party.
•    In addition, you have the right at all times to revoke with future effect any consent given to us for the processing of personal data (cf. Section 2.3).
•    You also have a right to complain to a data protection supervisory authority (Art. 77 GDPR). However, we recommend that you always first address any complaints to our data protection officer. The following data protection regulatory authority is responsible:

State representative for Data Protection and Freedom of Information
Königstr. 10a
70173 Stuttgart
Germany

Your applications to exercise your rights should preferably be sent in writing (letter or e-mail) to the above address or directly to our data protection officer.

Particular reference to your right to object under Art. 21 GDPR

Based on Art. 6 [1f] GDPR (data processing on the basis of a balancing of interests) or Art. 6 [1e] GDPR (data processing in the public interest), you have the right to object to the processing of your data if there are reasons to do so ensuing from your particular situation.

The same applies to profiling based on those provisions as defined by Art. 4 [4] GDPR. If you object, we will no longer process your personal data unless we provide evidence of compelling reasons for processing that outweigh your interests, rights, and freedoms, or if the processing serves the purpose of the assertion, exercise, or defense of legal claims.

Where appropriate, we may also process your personal data to conduct direct advertising. If you do not wish to receive any advertising, you have the right to object to this at any time. This also applies to profiling, insofar as it is related to such direct advertising. We will respect this objection in the future. Your data will no longer be used by us for direct advertising purposes if you object to processing for these purposes.

Objection can be made without observing any formal requirements and should preferably be sent to:
Uhlmann Pac-Systeme GmbH & Co. KG
Uhlmannstr. 14 - 18
88471 Laupheim
Germany
E-mail: info(at)uhlmann.de