Mandatory information

Mandatory information according to Art. 12 ff. DS-GVO

Contact details of the person responsible (e.g. management)

KURZ Karkassenhandel GmbH
Heinrich-Otto-Str. 19
73240 Wendlingen

Phone: +49 7024/94180
Fax: +49 7024/941820
E-mail: info@reifen-kurz.de

Where do we obtain your personal data from?

Your data is always collected from you. The processing of the personal data provided by you is necessary to fulfil the contractual obligations arising from the contract concluded with us. Due to your obligation to co-operate, it is essential to provide the personal data requested by us, as otherwise we will not be able to fulfil our contractual obligations. Otherwise, accounting and/or tax disadvantages for you can no longer be ruled out.

As part of pre-contractual measures (e.g. master data collection in the prospective customer process), the provision of your personal data is necessary. If you do not provide the requested data, a contract cannot be concluded.

In order to provide our services, it may be necessary to process personal data that we have received from other companies or other third parties, e.g. tax offices, your business partner or similar, in a permissible manner and for the respective purpose.

Furthermore, we may process personal data from publicly accessible sources, e.g. websites, which we use permissibly and only for the respective contractual purpose.

Purposes and legal bases of processing

The personal data you provide will be processed in accordance with the provisions of the European Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG):

Due to legal requirements (pursuant to Art. 6 para. 1 lit. c GDPR) or in the public interest (pursuant to Art. 6 para. 1 lit. e GDPR)

The purposes of data processing result from legal requirements or are in the public interest (e.g. compliance with retention obligations, proof of compliance with the company's notification and information obligations).

For the fulfilment of contractual obligations (pursuant to Art. 6 para. 1 lit. b GDPR)

The purposes of data processing arise on the one hand from the initiation of pre-contractual measures that precede a contractually regulated business relationship and on the other hand to fulfil the obligations arising from the contract concluded with you.

On the basis of consent (pursuant to Art. 6 para. 1 lit. a GDPR)

The purposes of the processing of personal data result from the granting of consent. You can withdraw your consent at any time with effect for the future. Consent given before the GDPR came into force (25 May 2018) can also be withdrawn. Processing that took place before the revocation remains unaffected by the revocation. Example: Sending of a newsletter, release from professional secrecy to pass on the data you have provided to third parties (e.g. banks, insurance companies, shareholders, etc.) at your request.

As part of the balancing of interests (pursuant to Art. 6 para. 1 lit. f GDPR)

The purposes of the processing result from the protection of our legitimate interests. It may be necessary to process the data provided by you beyond the actual fulfilment of the contract. Our legitimate interest may be used to justify the further processing of the data provided by you, provided that your interests or fundamental rights and freedoms do not prevail. Our legitimate interest may be in individual cases: Assertion of legal claims, defence against liability claims, prevention of criminal offences.

Special features for employees and applicants

For the establishment, performance and termination of the employment relationship (pursuant to Section 26 (1) sentence 1 BDSG)

The purposes of data processing arise from the initiation of pre-contractual measures that precede a contractually regulated employment relationship and, on the other hand, to fulfil the obligations arising from the employment contract concluded with you.

For the detection of criminal offences (pursuant to Section 26 (1) sentence 2 BDSG)

Your personal data may be processed to uncover criminal offences if there are factual indications to be documented that give rise to the suspicion that you have committed a criminal offence in the employment relationship, the processing is necessary to uncover the offence and your legitimate interest in excluding the processing does not outweigh this, in particular if the nature and extent of the processing is not disproportionate in view of the reason.

On the basis of consent (pursuant to Section 26 (2) BDSG)

The purposes of the processing of personal data result from the granting of consent. You can withdraw your consent at any time with effect for the future. Consent given before the GDPR came into force (25 May 2018) can also be withdrawn. Processing that took place before the revocation remains unaffected by the revocation. Example: Publication of your image on our website.

Who receives the personal data you provide?

Within our company, access to the personal data provided by you is granted to those departments that require it to fulfil contractual and legal obligations and that are authorised to process this data.

In fulfilment of the contract concluded with you, only those bodies will receive the data provided by you that require it for legal reasons, e.g. tax authorities, social security institutions, competent authorities and courts.

As a professional secrecy holder, we are obliged to observe and implement professional secrecy. Other recipients will only receive the data provided by you at your request if you release us from the obligation of professional secrecy.

As part of our service provision, we commission processors who contribute to the fulfilment of contractual obligations, e.g. computer centre service providers, IT partners, document shredders, etc. We contractually oblige these processors to maintain professional secrecy and to comply with the provisions of the GDPR and the BDSG.

Will the data you provide be transferred to third countries or international organisations?

The data provided by you will not be transferred to a third country or an international organisation under any circumstances. If, in individual cases, you wish the data you have provided to be transferred to a third country or an international organisation, we will only do so with your written consent and release you from the obligation of professional secrecy.

Does automated decision-making, including profiling, take place?

No fully automated decision-making (including profiling) pursuant to Art. 22 GDPR is used to process the data provided by you.

Duration of processing (criteria for erasure)

The data provided by you will be processed for as long as it is necessary to fulfil the contractually agreed purpose, in principle as long as the contractual relationship with you exists. After termination of the contractual relationship, the data provided by you will be processed to comply with statutory retention obligations or on the basis of our legitimate interests. Once the statutory retention periods have expired and/or our legitimate interests no longer apply, the data you have provided will be deleted.

Expected periods of our retention obligations and our legitimate interests:

• Fulfilment of retention periods under commercial, tax and professional law. The retention and documentation periods specified there are two to ten years.
• Preservation of evidence within the framework of the statute of limitations. According to Sections 195 et seq. of the German Civil Code (BGB), these limitation periods can be up to 30 years, whereby the regular limitation period is three years.

Special features of application procedures

If you apply to us, we will only use the information you provide. In addition to the above-mentioned legal bases, this is done to carry out pre-contractual measures in accordance with Art. 6 para. 1 lit. b) GDPR and to decide on the establishment of an employment relationship in accordance with § 26 para. 1 sentence 1 BDSG.

As part of the application process, only those persons who are involved in the application process within our company will have access to your data. If your application leads to the establishment of an employment relationship, your personal data will continue to be processed for the purpose of implementing the employment relationship.

If your application does not lead to the establishment of an employment relationship, your personal data will be processed after the end of the application process on the basis of legitimate interests, e.g. for the assertion of or defence against claims for damages, and deleted after our legitimate interests cease to apply and after the expiry of statutory retention periods. This is usually the case three months after a rejection, unless you have given us your consent to store your data for longer.

Information about your rights

• Right to Information pursuant to Art. 15 GDPR:‍
  • data about you is stored and the purpose for which it is stored.

• Right to Correction pursuant to Art. 16 GDPR:‍
  • You have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

• Right to Erasure ("right to be forgotten") pursuant to Art. 17 GDPR:
  • You have the right to demand from the controller that your data be deleted immediately. The controller is obliged to delete personal data immediately if one of the following reasons applies:
    
    1. The purposes for which the personal data were collected no longer apply
    2. You withdraw your consent to the processing. There is no other legal basis for the processing.
    3. You object to the processing. There is no other legal basis for the processing.
    4. The personal data was processed unlawfully.
    5. The deletion of personal data is necessary to fulfil a legal obligation under Union law or the law of the Member States to which the controller is subject.
    6. The personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

• Right to Restriction of processing pursuant to Art. 18 GDPR &. § 35 BDSG:
  • You have the right to request the restriction of processing if one of the following conditions is met:
    
    1. You dispute the accuracy of the personal data.
    2. The processing is unlawful, but you oppose the erasure.
    3. Personal data are no longer required for the purposes of the processing; however, you need the data for the establishment, exercise or defence of legal claims.
    4. You have lodged an objection to the processing pursuant to Art. 21 (1) GDPR. As long as it has not yet been determined whether the legitimate reasons of the controller outweigh your reasons, processing will be restricted.

• Right to Data portability pursuant to Art. 20 GDPR:
  • You have the right to receive the data provided by you from the controller in a structured, commonly used and machine-readable format. We must not prevent the data from being forwarded to another controller.

• Right of objection pursuant to Art. 21 GDPR:
  • To do so, please contact the controller (see above).

• Right of appeal with the supervisory authority pursuant to Art. 13 para. 2 lit. d, 77 GDPR in conjunction with § 19 BDSG:
  • If you believe that the processing of your data violates the GDPR, you have the right to lodge a complaint with the supervisory authority. To do so, please contact the competent supervisory authority

• Withdrawal of consent pursuant to Art. 7 para. 3D GDPR:
  • If the processing is based on your consent in accordance with Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a (processing of special categories of personal data), you are entitled at any time to revoke the purpose of the processing. Withdraw consentwithout affecting the lawfulness of processing based on consent before its withdrawal.